华为防火墙智能选路：策略路由

华为防火墙智能选路：策略路由

fw_2022.01.08.22时03分00秒.txt

#
interface GigabitEthernet0/0/0
 undo shutdown
 ip binding vpn-instance default
 ip address 10.12.7.7 255.255.0.0
 service-manage http permit
 service-manage https permit
 service-manage ping permit
#
interface GigabitEthernet1/0/1
 undo shutdown
 ip address 202.100.2.254 255.255.255.0
 service-manage ping permit
#
interface GigabitEthernet1/0/2
 undo shutdown
 ip address 202.100.1.254 255.255.255.0
 service-manage ping permit
#                                         
interface GigabitEthernet1/0/3
 undo shutdown
 ip address 10.1.1.254 255.255.255.0
 service-manage ping permit
#
interface GigabitEthernet1/0/4
 undo shutdown
 ip address 10.1.2.254 255.255.255.0
 service-manage ping permit
#
#
firewall zone local
 set priority 100
#
firewall zone trust
 set priority 85
 add interface GigabitEthernet0/0/0
 add interface GigabitEthernet1/0/3
 add interface GigabitEthernet1/0/4
#
firewall zone untrust                     
 set priority 5
#
firewall zone dmz
 set priority 50
#
firewall zone name isp1 id 4
 set priority 10
 add interface GigabitEthernet1/0/2
#
firewall zone name isp2 id 5
 set priority 20
 add interface GigabitEthernet1/0/1
#

#
security-policy
 rule name trust-isp1
  source-zone trust
  destination-zone isp1
  action permit
 rule name trust-isp2                     
  source-zone trust
  destination-zone isp2
  action permit

#
#
policy-based-route
 rule name trust-isp1 1
  ingress-interface GigabitEthernet1/0/3
  action pbr next-hop 202.100.1.1
 rule name trust-isp2 2
  ingress-interface GigabitEthernet1/0/4
  action pbr next-hop 202.100.2.1

#
nat-policy
 rule name trust-isp1
  source-zone trust
  destination-zone isp1
  action source-nat easy-ip
 rule name trust-isp2
  source-zone trust
  destination-zone isp2                   
  action source-nat easy-ip

#

测试：

查看路径：

抓包验证：PC1 ping PC3, 在PC3上抓包

抓包验证：PC2 ping PC3, 在PC3上抓包

display firewall session table verbose