华为USG6000V多ISP接入Internet（基于ISP目的地址的多出口）

一、组网需求

1、如图所示，某企业在网络边界处部署了NGFW作为安全网关，并分别从运营商ISP1和ISP2处购买了宽带上网服务，实现内部网络接入Internet的需求。
具体需求如下：
研发部门和市场部门中的PC可以通过运营商ISP1和ISP2访问Internet，要求去往特定目的地址的流量必须经由相应的运营商来转发。

当一条链路出现故障时，流量可以被及时切换到另一条链路上，避免业务中断。

2、网络拓扑

3、配置思路

配置接口的地址，并将接口加入相应的安全区域。在配置接口GigabitEthernet 1/0/0和GigabitEthernet 1/0/2的地址时，分别指定默认网关为1.1.1.254和2.2.2.254。
配置多条静态路由，使去往特定目的地址的流量经由相应的运营商来转发。
配置安全策略，允许内部网络中的PC访问Internet。
配置NAT策略，提供源地址转换功能。
在运营商ISP1和ISP2网络的设备上配置回程路由，该配置由运营商完成。

规划内部网络中PC的地址，并将内部网络中PC的网关设置为10.3.0.254

二、操作步骤

1、配置防火墙接口IP地址

system-view
[USG6000V1]interface GigabitEthernet 1/0/1
[USG6000V1-GigabitEthernet1/0/1]ip address 10.3.0.254 24
[USG6000V1-GigabitEthernet1/0/1]service-manage ping permit
[USG6000V1-GigabitEthernet1/0/1]q
[USG6000V1]interface GigabitEthernet 1/0/0
[USG6000V1-GigabitEthernet1/0/0]ip address 202.1.1.1 24
[USG6000V1-GigabitEthernet1/0/0]service-manage ping permit
[USG6000V1-GigabitEthernet1/0/0]q
[USG6000V1]interface GigabitEthernet 1/0/2
[USG6000V1-GigabitEthernet1/0/2]ip address 202.1.2.1 24
[USG6000V1-GigabitEthernet1/0/2]service-manage ping permit
[USG6000V1-GigabitEthernet1/0/2]q

2、加入对应安全区域

[USG6000V1]firewall zone trust
[USG6000V1-zone-trust]add interface GigabitEthernet 1/0/1
[USG6000V1-zone-trust]q[USG6000V1]firewall zone name ISP1
[USG6000V1-zone-ISP1]set priority 10
[USG6000V1-zone-ISP1]add interface GigabitEthernet 1/0/0
[USG6000V1-zone-ISP1]q[USG6000V1]firewall zone name ISP2
[USG6000V1-zone-ISP2]set priority 15
[USG6000V1-zone-ISP2]add interface GigabitEthernet 1/0/2
[USG6000V1-zone-ISP2]q

3、配置静态路由

[USG6000V1]ip route-static 0.0.0.0 0.0.0.0 202.1.1.254
[USG6000V1]ip route-static 0.0.0.0 0.0.0.0 202.1.2.254

4、配置安全策略，允许内部网络PC访问Internet

[USG6000V1]security-policy
[USG6000V1-policy-security]rule name trus_ISP1
[USG6000V1-policy-security-rule-trus_ISP1]source-zone trust
[USG6000V1-policy-security-rule-trus_ISP1]destination-zone ISP1
[USG6000V1-policy-security-rule-trus_ISP1]source-address 10.3.0.0 24
[USG6000V1-policy-security-rule-trus_ISP1]action permit
[USG6000V1-policy-security-rule-trus_ISP1]q[USG6000V1]security-policy
[USG6000V1-policy-security]rule name trust_ISP2
[USG6000V1-policy-security-rule-trust_ISP2]source-zone trust
[USG6000V1-policy-security-rule-trust_ISP2]destination-zone ISP2
[USG6000V1-policy-security-rule-trust_ISP2]source-address 10.3.0.0 24
[USG6000V1-policy-security-rule-trust_ISP2]action permit
[USG6000V1-policy-security-rule-trust_ISP2]q

5、配置NAT地址池

[USG6000V1]nat address-group address1
[USG6000V1-address-group-address1]section 202.1.1.10 202.1.1.12
[USG6000V1-address-group-address1]mode pat
[USG6000V1-address-group-address1]q[USG6000V1]nat address-group address2
[USG6000V1-address-group-address2]section 202.1.2.10 202.1.2.12
[USG6000V1-address-group-address2]mode pat
[USG6000V1-address-group-address2]q

6、配置NAT策略

[USG6000V1]nat-policy
[USG6000V1-policy-nat]rule name nat_isp1
[USG6000V1-policy-nat-rule-nat_isp1]source-zone trust
[USG6000V1-policy-nat-rule-nat_isp1]destination-zone ISP1
[USG6000V1-policy-nat-rule-nat_isp1]source-address 10.3.0.0 24
[USG6000V1-policy-nat-rule-nat_isp1]action nat address-group address1
[USG6000V1-policy-nat-rule-nat_isp1]q[USG6000V1]nat-policy
[USG6000V1-policy-nat]rule name nat_ips2
[USG6000V1-policy-nat-rule-nat_ips2]source-zone trust
[USG6000V1-policy-nat-rule-nat_ips2]destination-zone ISP2
[USG6000V1-policy-nat-rule-nat_ips2]source-address 10.3.0.0 24
[USG6000V1-policy-nat-rule-nat_ips2]action nat address-group address2
[USG6000V1-policy-nat-rule-nat_ips2]q

7、ISP配置接口IP

system-view
[Huawei]sysname ISP1
[ISP1]interface GigabitEthernet 0/0/0
[ISP1-GigabitEthernet0/0/0]ip address 202.1.1.254 24
[ISP1-GigabitEthernet0/0/0]qsystem-view
[Huawei]sysname ISP2
[ISP2]interface GigabitEthernet 0/0/0
[ISP2-GigabitEthernet0/0/0]ip address 202.1.2.254 24
[ISP2-GigabitEthernet0/0/0]q

8、ISP配置路由

[ISP1]ip route-static 10.3.0.0 24 202.1.1.1
[ISP2]ip route-static 10.3.0.0 24 202.1.2.1

9、内网PC测试ping，查看防火墙nat会话

[USG6000V1]display firewall session tableCurrent Total Sessions : 10icmp VPN: public --> public 10.3.0.1:33768[202.1.2.10:2049] --> 202.1.2.254:2
048icmp VPN: public --> public 10.3.0.1:36328[202.1.1.10:2058] --> 202.1.1.254:2
048icmp VPN: public --> public 10.3.0.1:36840[202.1.1.10:2060] --> 202.1.1.254:2
048icmp VPN: public --> public 10.3.0.1:35048[202.1.1.10:2053] --> 202.1.1.254:2
048