6.4 防火墙全局智能选路

1.防火墙配置ip-link健康检测（防火墙独有）

1）配置ip-link
ip-link check enable                      
ip-link name isp01                        
 destination 88.8.1.1 interface GigabitEthernet1/0/1 mode icmp
ip-link name isp02                        
 destination 99.9.1.1 interface GigabitEthernet1/0/2 mode icmp

2）ip-link绑定默认路由
ip route-static 0.0.0.0 0.0.0.0 GigabitEthernet1/0/1 88.8.1.1 track ip-link isp01

ip route-static 0.0.0.0 0.0.0.0 GigabitEthernet1/0/2 99.9.1.1 track ip-link isp02

2.防火墙healthcheck健康检测（防火墙独有）

1）配置healthcheck
healthcheck enable                        
healthcheck name isp01    
source-ip 88.8.1.2                
  destination 88.8.3.1 interface GigabitEthernet1/0/1  next-hop 88.8.1.1 protocol icmp
 destination 99.9.3.1 interface GigabitEthernet1/0/1  next-hop 88.8.1.1 protocol icmp

healthcheck name isp02  
source-ip 99.9.1.2                  
  destination 88.8.3.1 interface GigabitEthernet1/0/2  next-hop 99.9.1.1 protocol icmp
 destination 99.9.3.1 interface GigabitEthernet1/0/2  next-hop 99.9.1.1 protocol icmp

3.基于运营商选路（基于目的方式选路）

1）配置过程

2）查看配置文件

Web-ui （导入ISP地址库）
 isp name isp01 set filename isp01.csv 		linkif-group 63
 isp name isp02 set filename isp02.csv 		linkif-group 62

# 运营商ISP01  ------网络子网isp01.csv
# 运营商ISP02  ------网络子网isp02.csv
<FW01>dir
Directory of hda1:/isp/
  Idx  Attr     Size(Byte)  Date        Time       FileName 
    0  -rw-         11,697  Jul 31 2025 23:49:04   isp02.csv
    1  -rw-         29,607  Jul 31 2025 23:48:43   isp01.csv

#一个链路接口组 – 关联多个链路接口
#一个链路接口中 – 可以关联多个物理接
link-interface 0 name isp01
 interface GigabitEthernet1/0/1 next-hop 88.8.1.1
 healthcheck isp01
 isp isp01 route enable                   
#
link-interface 1 name isp02
 interface GigabitEthernet1/0/2 next-hop 99.9.1.1
 healthcheck isp02
 isp isp02 route enable

4.DNS透明代理

1）FW1配置DNS代理
dns-transparent-policy
 rule name tpdns
  source-address 192.168.1.0 mask 255.255.255.0
  source-address 192.168.2.0 mask 255.255.255.0
  action tpdns
 dns transparent-proxy enable
 dns server bind interface GigabitEthernet1/0/1 preferred 88.8.2.1
 dns server bind interface GigabitEthernet1/0/2 preferred 99.9.2.1

5.基于数据源的选路 -策略路由方式 (优于查找路由表转发)

policy-based-route
 rule name vlan10
source-zone trust
 ingress-interface GigabitEthernet1/0/0
 source-address 192.168.1.0 24
#结合ip-link做检测
  track ip-link isp01
  action pbr next-hop 88.8.1.1

rule name vlan20
source-zone trust
source-address 192.168.2.0 24
ingress-interface GigabitEthernet1/0/0
#结合ip-link做检测
track ip-link isp02
action pbr next-hop 99.9.1.1

6.全局智能选路-链路带宽

7.全局智能选路-链路质量

8.全局智能选路-链路权重

9.全局智能选路-链路优先级

10.全局智能选路-会话保持