一、组网需求
1、如图所示，某企业在网络边界处部署了NGFW作为安全网关，并分别从运营商ISP1和ISP2处购买了宽带上网服务，实现内部网络接入Internet的需求。
具体需求如下：
研发部门和市场部门中的PC可以通过运营商ISP1和ISP2访问Internet，要求去往特定目的地址的流量必须经由相应的运营商来转发。
当一条链路出现故障时，流量可以被及时切换到另一条链路上，避免业务中断。
2、网络拓扑
3、配置思路
配置接口的地址，并将接口加入相应的安全区域。在配置接口GigabitEthernet 1/0/0和GigabitEthernet 1/0/2的地址时，分别指定默认网关为1.1.1.254和2.2.2.254。
配置多条静态路由，使去往特定目的地址的流量经由相应的运营商来转发。
配置安全策略，允许内部网络中的PC访问Internet。
配置NAT策略，提供源地址转换功能。
在运营商ISP1和ISP2网络的设备上配置回程路由，该配置由运营商完成。
规划内部网络中PC的地址，并将内部网络中PC的网关设置为10.3.0.254
二、操作步骤
1、配置防火墙接口IP地址
<USG6000V1>system-view [USG6000V1]interface GigabitEthernet 1/0/1[USG6000V1-GigabitEthernet1/0/1]ip address 10.3.0.254 24[USG6000V1-GigabitEthernet1/0/1]service-manage ping permit [USG6000V1-GigabitEthernet1/0/1]q[USG6000V1]interface GigabitEthernet 1/0/0[USG6000V1-GigabitEthernet1/0/0]ip address 202.1.1.1 24[USG6000V1-GigabitEthernet1/0/0]service-manage ping permit [USG6000V1-GigabitEthernet1/0/0]q[USG6000V1]interface GigabitEthernet 1/0/2[USG6000V1-GigabitEthernet1/0/2]ip address 202.1.2.1 24[USG6000V1-GigabitEthernet1/0/2]service-manage ping permit [USG6000V1-GigabitEthernet1/0/2]q
2、加入对应安全区域
[USG6000V1]firewall zone trust [USG6000V1-zone-trust]add interface GigabitEthernet 1/0/1[USG6000V1-zone-trust]q[USG6000V1]firewall zone name ISP1[USG6000V1-zone-ISP1]set priority 10[USG6000V1-zone-ISP1]add interface GigabitEthernet 1/0/0[USG6000V1-zone-ISP1]q[USG6000V1]firewall zone name ISP2[USG6000V1-zone-ISP2]set priority 15[USG6000V1-zone-ISP2]add interface GigabitEthernet 1/0/2[USG6000V1-zone-ISP2]q
3、配置静态路由
[USG6000V1]ip route-static 0.0.0.0 0.0.0.0 202.1.1.254[USG6000V1]ip route-static 0.0.0.0 0.0.0.0 202.1.2.254
4、配置安全策略，允许内部网络PC访问Internet
[USG6000V1]security-policy [USG6000V1-policy-security]rule name trus_ISP1[USG6000V1-policy-security-rule-trus_ISP1]source-zone trust [USG6000V1-policy-security-rule-trus_ISP1]destination-zone ISP1[USG6000V1-policy-security-rule-trus_ISP1]source-address 10.3.0.0 24[USG6000V1-policy-security-rule-trus_ISP1]action permit [USG6000V1-policy-security-rule-trus_ISP1]q[USG6000V1]security-policy [USG6000V1-policy-security]rule name trust_ISP2[USG6000V1-policy-security-rule-trust_ISP2]source-zone trust [USG6000V1-policy-security-rule-trust_ISP2]destination-zone ISP2[USG6000V1-policy-security-rule-trust_ISP2]source-address 10.3.0.0 24[USG6000V1-policy-security-rule-trust_ISP2]action permit [USG6000V1-policy-security-rule-trust_ISP2]q
5、配置NAT地址池
[USG6000V1]nat address-group address1[USG6000V1-address-group-address1]section 202.1.1.10 202.1.1.12[USG6000V1-address-group-address1]mode pat[USG6000V1-address-group-address1]q[USG6000V1]nat address-group address2[USG6000V1-address-group-address2]section 202.1.2.10 202.1.2.12 [USG6000V1-address-group-address2]mode pat [USG6000V1-address-group-address2]q
6、配置NAT策略
[USG6000V1]nat-policy [USG6000V1-policy-nat]rule name nat_isp1[USG6000V1-policy-nat-rule-nat_isp1]source-zone trust [USG6000V1-policy-nat-rule-nat_isp1]destination-zone ISP1[USG6000V1-policy-nat-rule-nat_isp1]source-address 10.3.0.0 24[USG6000V1-policy-nat-rule-nat_isp1]action nat address-group address1 [USG6000V1-policy-nat-rule-nat_isp1]q[USG6000V1]nat-policy [USG6000V1-policy-nat]rule name nat_ips2[USG6000V1-policy-nat-rule-nat_ips2]source-zone trust [USG6000V1-policy-nat-rule-nat_ips2]destination-zone ISP2[USG6000V1-policy-nat-rule-nat_ips2]source-address 10.3.0.0 24[USG6000V1-policy-nat-rule-nat_ips2]action nat address-group address2[USG6000V1-policy-nat-rule-nat_ips2]q
7、ISP配置接口IP
<Huawei>system-view[Huawei]sysname ISP1[ISP1]interface GigabitEthernet 0/0/0[ISP1-GigabitEthernet0/0/0]ip address 202.1.1.254 24[ISP1-GigabitEthernet0/0/0]q<Huawei>system-view [Huawei]sysname ISP2[ISP2]interface GigabitEthernet 0/0/0[ISP2-GigabitEthernet0/0/0]ip address 202.1.2.254 24[ISP2-GigabitEthernet0/0/0]q
8、ISP配置路由
[ISP1]ip route-static 10.3.0.0 24 202.1.1.1[ISP2]ip route-static 10.3.0.0 24 202.1.2.1
9、内网PC测试ping，查看防火墙nat会话
[USG6000V1]display firewall session tableCurrent Total Sessions : 10icmp VPN: public --> public 10.3.0.1:33768[202.1.2.10:2049] --> 202.1.2.254:2048icmp VPN: public --> public 10.3.0.1:36328[202.1.1.10:2058] --> 202.1.1.254:2048icmp VPN: public --> public 10.3.0.1:36840[202.1.1.10:2060] --> 202.1.1.254:2048icmp VPN: public --> public 10.3.0.1:35048[202.1.1.10:2053] --> 202.1.1.254:2048
