一 虚拟防火墙作用虚拟防火墙是将一台物理硬件防火墙逻辑切分成多台独立防火墙，每台防火墙功能和物理防火墙功能和性质一样二 虚拟防火墙规划与部署2.1 物理防火墙物理连接拓扑2.2 物理防火墙逻辑连接拓扑核心交换机不同业务通过不同的VRF进行隔离，然后不同业务通过不同的虚拟防火墙互联，实现不同业务的隔离2.3 地址规划1.物理防火墙默认根墙名称Admin，冗余接口Reth1.11默认为根防火墙Admin独立子接口；2.Reth1.1500为根防火墙和各虚拟防火墙的共享接口，用于根防火墙和其他各虚拟防火墙互联地址；3.每个虚拟防火墙独立子接口（Reth1.1501-Reth1.1506）和核心交换机互联；4.核心交换机通过划分不同的VRF与不同的VRF互联，同时核心交换机不同的VRF与核心业务VRF一一对应；三 设备配置3.1 两台物理防火墙堆叠+冗余口和冗余组配置sysname FW#irf domain 1irf mac-address persistent timerirf auto-update enableundo irf link-delayirf member 1 priority 30irf member 2 priority 20#irf-port 1/1port group interface Ten-GigabitEthernet1/2/6port group interface Ten-GigabitEthernet1/2/7#irf-port 2/2port group interface Ten-GigabitEthernet2/2/6port group interface Ten-GigabitEthernet2/2/7#track 1 interface Ten-GigabitEthernet1/2/0 physical#track 2 interface Ten-GigabitEthernet1/2/1 physical#track 3 interface Ten-GigabitEthernet1/2/2 physical#track 4 interface Ten-GigabitEthernet1/2/3 physical#track 5 interface Ten-GigabitEthernet2/2/0 physical#track 6 interface Ten-GigabitEthernet2/2/1 physical#track 7 interface Ten-GigabitEthernet2/2/2 physical#track 8 interface Ten-GigabitEthernet2/2/3 physical#interface Reth1member interface Route-Aggregation1 priority 200member interface Route-Aggregation2 priority 100#redundancy group 1member interface Reth1node 1 bind slot 1 priority 255 track 1 interface Ten-GigabitEthernet1/2/0 track 2 interface Ten-GigabitEthernet1/2/1 track 3 interface Ten-GigabitEthernet1/2/2 track 4 interface Ten-GigabitEthernet1/2/3node 2 bind slot 2 track 5 interface Ten-GigabitEthernet2/2/0 track 6 interface Ten-GigabitEthernet2/2/1 track 7 interface Ten-GigabitEthernet2/2/2 track 8 interface Ten-GigabitEthernet2/2/3#