做完链路负载均衡，一条静态路由内网专线不通了
- 0关注
- 0收藏，47浏览
问题描述：
#
version 7.1.064, Release 8860P1210
#
sysname Firewall-1000
#
clock protocol none
#
context Admin id 1
#
irf mac-address persistent timer
irf auto-update enable
undo irf link-delay
irf member 1 priority 1
#
ip pool aa 10.6.0.100 10.6.0.200
ip pool aa gateway 10.6.0.1
#
dialer-group 1 rule ip permit
#
dns server 8.8.8.8
dns server 114.114.114.114
#
lldp global enable
#
password-recovery enable
#
vlan 1
#
object-group ip address jyw
0 network subnet 10.0.0.0 255.0.0.0
#
object-group ip address zhuanhuan
0 network host address 10.2.4.106
#
nqa template icmp pppoe
destination ip 8.8.8.8
#
nqa template icmp zx
destination ip 115.236.75.53
#
interface Dialer0
mtu 1492
ppp chap password cipher $c$3$XxSXNKm2ywIZXgnzAyYIfjcapCSKEtC88w==
ppp chap user 057194275540
ppp ipcp dns admit-any
ppp ipcp dns request
ppp pap local-user 057194275540 password cipher $c$3$+aWswYQHPVzTcHErkjqSDRAxu7E+w8Ne+A==
dialer bundle enable
dialer-group 1
dialer timer idle 0
dialer timer autodial 5
ip address ppp-negotiate
tcp mss 1400
nat outbound
#
interface Virtual-Template1
ppp authentication-mode chap domain system
remote address pool aa
ip address 10.6.0.1 255.255.255.0
dns server 114.114.114.114
#
interface NULL0
#
interface GigabitEthernet1/0/0
port link-mode route
ip address 115.236.75.54 255.255.255.252
session log enable ipv4 inbound
session log enable ipv4 outbound
nat outbound
gateway 115.236.75.53
#
interface GigabitEthernet1/0/1
port link-mode route
ip address 192.168.88.253 255.255.255.0
ipv6 address 2402:4B80:FFFF:1008:1:45:0:1/96
undo ipv6 nd ra halt
#
interface GigabitEthernet1/0/2
port link-mode route
session log enable ipv4 inbound
session log enable ipv4 outbound
nat outbound
pppoe-client dial-bundle-number 0
#
interface GigabitEthernet1/0/3
port link-mode route
#
interface GigabitEthernet1/0/4
port link-mode route
#
interface GigabitEthernet1/0/5
port link-mode route
ip address 192.168.100.1 255.255.255.0
#
interface GigabitEthernet1/0/6
port link-mode route
#
interface GigabitEthernet1/0/7
port link-mode route
#
interface GigabitEthernet1/0/8
port link-mode route
#
interface GigabitEthernet1/0/9
port link-mode route
#
interface GigabitEthernet1/0/10
port link-mode route
shutdown
#
interface GigabitEthernet1/0/11
port link-mode route
#
interface GigabitEthernet1/0/12
port link-mode route
#
interface GigabitEthernet1/0/13
port link-mode route
#
interface GigabitEthernet1/0/14
port link-mode route
#
interface GigabitEthernet1/0/15
port link-mode route
#
interface GigabitEthernet1/0/16
port link-mode route
combo enable fiber
#
interface GigabitEthernet1/0/17
port link-mode route
combo enable fiber
#
interface GigabitEthernet1/0/18
port link-mode route
combo enable fiber
#
interface GigabitEthernet1/0/19
port link-mode route
combo enable fiber
#
interface GigabitEthernet1/0/20
port link-mode route
#
interface GigabitEthernet1/0/21
port link-mode route
#
interface GigabitEthernet1/0/22
port link-mode route
#
interface GigabitEthernet1/0/23
port link-mode route
#
interface GigabitEthernet1/0/24
port link-mode route
#
interface GigabitEthernet1/0/25
port link-mode route
#
interface M-GigabitEthernet1/0/0
ip address 192.168.0.1 255.255.255.0
#
interface Ten-GigabitEthernet1/0/26
port link-mode route
#
interface Ten-GigabitEthernet1/0/27
port link-mode route
ip address 10.2.4.106 255.255.255.252
ip last-hop hold
ipv6 address 2402:4B80:FFFF:1008:0:45:0:1/96
undo ipv6 nd ra halt
gateway 10.2.4.105
#
security-zone name Local
#
security-zone name Trust
import interface GigabitEthernet1/0/1
#
security-zone name DMZ
#
security-zone name Untrust
import interface Dialer0
import interface GigabitEthernet1/0/0
import interface GigabitEthernet1/0/2
import interface Ten-GigabitEthernet1/0/27
#
security-zone name Management
import interface GigabitEthernet1/0/5
import interface M-GigabitEthernet1/0/0
import interface Virtual-Template1
#
scheduler logfile size 16
#
line class console
authentication-mode scheme
user-role network-admin
#
line class vty
user-role network-admin
user-role network-operator
#
line con 0
user-role network-admin
#
line vty 0 63
authentication-mode scheme
user-role network-admin
user-role network-operator
#
ip route-static 0.0.0.0 0 Dialer0
ip route-static 10.0.0.0 8 10.2.4.105
ip route-static 192.168.0.0 23 192.168.88.254
ip route-static 192.168.2.0 23 192.168.88.254
ip route-static 192.168.4.0 23 192.168.88.254
ip route-static 192.168.6.0 23 192.168.88.254
ip route-static 192.168.8.0 24 192.168.88.254
ip route-static 192.168.10.252 32 192.168.88.254
ip route-static 192.168.10.253 32 192.168.88.254
ip route-static 192.168.12.0 23 192.168.88.254
ip route-static 192.168.96.0 22 192.168.88.254
ip route-static 192.168.224.0 21 192.168.88.254
ipv6 route-static :: 0 2402:4B80:FFFF:1008:0:45:FFFF:FFFE
ipv6 route-static 2402:4B80:1008:45:: 64 2402:4B80:FFFF:1008:1:45:FFFF:FFFE
#
undo info-center enable
info-center loghost 127.0.0.1 port 3301 format default
info-center source CFGLOG loghost level informational
#
ssh server enable
#
acl basic 2000
rule 0 permit
#
radius scheme aa
primary authentication 139.196.46.207
primary accounting 139.196.46.207
key authentication cipher $c$3$OzS/gUBr+K73/CSvL0+LgR3FVmqowOPryRwzHdiJ
key accounting cipher $c$3$OHFywh37NknaLK7Et+fx+rwS9hS0+cUHjqbJkhiQ
retry 5
timer response-timeout 8
user-name-format without-domain
#
domain system
authentication ppp local radius-scheme aa
authorization ppp local radius-scheme aa
accounting ppp local radius-scheme aa
#
domain default enable system
#
role name level-0
description Predefined level-0 role
#
role name level-1
description Predefined level-1 role
#
role name level-2
description Predefined level-2 role
#
role name level-3
description Predefined level-3 role
#
role name level-4
description Predefined level-4 role
#
role name level-5
description Predefined level-5 role
#
role name level-6
description Predefined level-6 role
#
role name level-7
description Predefined level-7 role
#
role name level-8
description Predefined level-8 role
#
role name level-9
description Predefined level-9 role
#
role name level-10
description Predefined level-10 role
#
role name level-11
description Predefined level-11 role
#
role name level-12
description Predefined level-12 role
#
role name level-13
description Predefined level-13 role
#
role name level-14
description Predefined level-14 role
#
user-group system
#
local-user admin class manage
password hash $h$6$sEJvh100jJXbpXbO$92xlOhh4Cz0hFcczsw/PYW9cWpmkjvsj/9ytemIC5131zhXLtXk2A6/4SexbUBI7TNafyD9Xx/HESSnDd1cwwQ==
service-type ssh terminal https
authorization-attribute user-role level-3
authorization-attribute user-role network-admin
authorization-attribute user-role network-operator
password-control length 8
undo password-control complexity user-name check
#
local-user system class manage
password hash $h$6$329G4OkZLt4afOY5$wYz8UeIxIRGQc4yh96+UatXE/V1goX9DohDOkT3A6oXY+7HN5Ug1p6hqFbDqSWe5xnp4KWyboatIg86WkqQGRw==
service-type ssh https
authorization-attribute user-role level-3
authorization-attribute user-role network-admin
authorization-attribute user-role network-operator
#
session statistics enable
session log bytes-active 1
session log flow-begin
#
l2tp-group 1 mode lns
allow l2tp virtual-template 1
undo tunnel authentication
tunnel name LNS
#
nat global-policy
rule name GlobalPolicyRule_20
source-zone Trust
destination-zone Untrust
destination-ip jyw
action snat object-group zhuanhuan
counting enable
#
l2tp enable
#
ip https enable
#
blacklist ip 115.206.241.20
blacklist destination-ip 115.206.241.20
#
inspect logging parameter-profile av_logging_default_parameter
#
inspect logging parameter-profile ips_logging_default_parameter
#
inspect logging parameter-profile url_logging_default_parameter
#
inspect email parameter-profile mailsetting_default_parameter
undo authentication enable
#
loadbalance link-group pppoe
transparent enable
probe pppoe
success-criteria at-least 1
link 链路2
success-criteria at-least 1
#
loadbalance link-group zx
transparent enable
probe zx
success-criteria at-least 1
link 链路1
success-criteria at-least 1
#
loadbalance class 1 type link-generic match-any
#
loadbalance action ##defaultactionforllbipv4##%%autocreatedbyweb%% type link-generic
link-group pppoe
#
loadbalance action ob$action$#for#1 type link-generic
link-group zx
fallback-action continue
#
loadbalance policy ##defaultpolicyforllbipv4##%%autocreatedbyweb%% type link-generic
class 1 action ob$action$#for#1
default-class action ##defaultactionforllbipv4##%%autocreatedbyweb%%
#
virtual-server ##defaultvsforllbipv4##%%autocreatedbyweb%% type link-ip
virtual ip address 0.0.0.0 0
lb-policy ##defaultpolicyforllbipv4##%%autocreatedbyweb%%
bandwidth busy-protection enable
bandwidth interface statistics enable
service enable
#
loadbalance isp file flash:/lbispinfo_v1.5.tp
#
loadbalance link 链路1
router ip 115.236.75.53
max-bandwidth 2000000 kbps
max-bandwidth inbound 2000000 kbps
max-bandwidth outbound 2000000 kbps
success-criteria at-least 1
#
loadbalance link 链路2
router interface Dialer0
max-bandwidth 10000000 kbps
max-bandwidth inbound 10000000 kbps
max-bandwidth outbound 1000000 kbps
success-criteria at-least 1
#
security-policy ip
rule 0 name Any_Any_0_IPv4
action pass
counting enable
rule 21 name in-out
action pass
rule 23 name Trust-to-Unrust
action pass
source-zone Trust
destination-zone Untrust
rule 24 name Local-to-Untrust
action pass
source-zone Local
destination-zone Untrust
#
security-policy ipv6
rule 0 name ipv6
action pass
counting enable
#
ips logging parameter-profile ips_logging_default_parameter
#
anti-virus logging parameter-profile av_logging_default_parameter
#
cloud-management server domain opstunnel-seccloud.h3c.com
防火墙配置如上，做了出接口链路负载均衡（G1/0/0和G1/0/2）,静态路由走的内网专线在业务端ping网管都不通了（ten-G1/0/27）
你这套是F1000 V7 R8860P1210，LLB 链路负载均衡全局虚服务
virtual ip 0.0.0.0 0，所有目的 IP 的流量全部交给 LLB 策略处理，优先级高于普通静态路由。 内网专线网段10.0.0.0/8匹配到默认 LLB 策略，不再走你写的静态路由ip route-static 10.0.0.0 8 10.2.4.105（Ten-G1/0/27 专线），直接丢去两条公网链路做负载均衡，所以专线不通。
重点：
virtual-server ##defaultvsforllbipv4##%%autocreatedbyweb%% type link-ip
virtual ip address 0.0.0.0 0
lb-policy ##defaultpolicyforllbipv4##%%autocreatedbyweb%%
service enable
0.0.0.0/0 的 LLB 虚服务，会拦截所有 IPv4 流量，优先 LLB 调度，不再查路由表，这是 H3C V7 LLB 出方向负载均衡最经典踩坑点。
补充：
transparent enable只是链路组内关闭 NAT，不是让 LLB 放过内网专线网段，不解决路由优先问题。
方案（推荐，不改动现有 LLB）
新增一条 LLB class，匹配专线目的网段 10.0.0.0/8，动作配置 fallback-action continue 含义：匹配到 10.0.0.0/8 → 不做 LLB 调度，交给防火墙正常路由表转发，走你原来的专线静态路由。
参考配置
# 1. 新建ACL匹配专线网段
acl number 3000
rule permit ip destination 10.0.0.0 0.255.255.255
quit
# 2. 新建LLB class，引用ACL
loadbalance class 2 type link-generic match-any
if-match acl 3000
quit
# 3. 新建action，continue（放过，走路由）
loadbalance action skip_zhuanxian type link-generic
fallback-action continue
quit
# 4. 在LLB策略里，把这个class放在最前面（优先匹配）
loadbalance policy ##defaultpolicyforllbipv4##%%autocreatedbyweb%% type link-generic
class 2 action skip_zhuanxian
class 1 action ob$action$#for#1
default-class action ##defaultactionforllbipv4##%%autocreatedbyweb%%
quit
顺序很关键：class2（专线）写在 class1 前面，优先匹配；匹配上就 continue，不做 LLB 调度，交给路由表转发。
验证命令
# 查看LLB策略表
display loadbalance policy
# 看匹配计数，ping专线后看class2计数上涨
display loadbalance class
# 确认路由表10.0.0.0/8路由存在
display ip routing-table 10.0.0.0
备选方案（不推荐，改 LLB 模式）
删掉这个 virtual ip 0.0.0.0 0 的全局 LLB 虚服务，改成源 NAT + 策略路由方式做外网负载均衡，不再用 LLB 全局 0.0.0.0 虚服务；缺点是 Web 链路负载均衡面板的带宽统计、就近性、健康检测就不能用了。
额外风险检查
- 安全域：你的专线接口 Ten-G1/0/27 被划入
Untrust，内网 Trust 访问专线 10 段，安全策略要放行；你现在有一条rule 23 name Trust-to-Unrust action pass，策略层面是放行的，策略没问题。 - 回程：专线对端回程路由是否指向 10.2.4.106，这个也要确认。
- NAT：访问专线 10 段不要做 SNAT，你现有 nat global-policy 里目的 ip jyw（10.0.0.0/8）是 snat 到 zhuanhuan（10.2.4.106），这个是专线 SNAT，看业务是否需要；如果不需要，这条 global nat rule 要删掉，否则 10 段访问会被转换。
nat global-policy
rule name GlobalPolicyRule_20
source-zone Trust
destination-zone Untrust
destination-ip jyw
action snat object-group zhuanhuan
注意：如果专线内是同网段互通，这个 SNAT 会造成异常，按需保留 / 删除。
1. 检查路由是否生效
执行 display ip routing-table 确认该静态路由是否还在路由表中，下一跳和出接口是否正确。若路由消失，检查负载均衡策略是否误删或覆盖了该路由。
2. 检查出接口状态
执行 display interface brief 查看专线接口物理和协议状态是否 Up。若接口 Down，负载均衡可能将流量切走，需检查链路探测配置。
3. 检查负载均衡策略
执行 display loadbalance link-group 和 display loadbalance policy 查看是否将专线链路加入组并配置了健康检查。若健康检查失败（如探测失败），链路会被判定不可用，流量不再走该专线。
4. 检查NAT和策略路由
执行 display nat session 和 display ip policy-setup 确认是否有策略路由或NAT规则与负载均衡冲突，导致专线流量被错误引导。
5. 抓包验证
在专线接口执行 debugging ip packet 或镜像抓包，确认流量是否到达该接口。若未到达，问题在路由或负载均衡选路；若到达但无返回，检查对端路由或NAT。
建议优先检查负载均衡健康检查配置，这是最常见的故障点。
暂无评论
编辑答案
亲~登录后才可以操作哦!
确定你的邮箱还未认证，请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
- 1. 您举报的内容是什么？（请在邮件中列出您举报的内容和链接地址）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
- 3. 是哪家企业？（营业执照，单位登记证明等证件）
- 4. 您与该企业的关系是？（您是企业法人或被授权人，需提供企业委托授权书）
抄袭了我的内容
×
原文链接或出处
诽谤我
×
- 1. 您举报的内容以及侵犯了您什么权益？（请在邮件中列出您举报的内容、链接地址，并给出简短的说明）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
对根叔社区有害的内容
×
不规范转载
×
举报说明
暂无评论