两条运营商线学生走一条老师走一条？华为策略路由按网段分线
本文整理自华为官方发布的典型配置案例，命令与步骤均按原始文档呈现，供现场实施参考。
单位同时接了两条运营商线路时，最常见的需求就是按人群分流：一组电脑只许走一条线，另一组走另一条线，互不干扰，出问题也好界定。华为防火墙的策略路由（PBR）就是干这个的——不按路由表查，而是按你定的规则直接指定出接口和下一跳。官方案例是一个双 ISP 接入的场景：学生网络的 PC 只允许通过教育网访问 Internet，教师网络的 PC 只允许通过运营商网络访问 Internet。下面照着案例把配置走一遍。
本例中 GE0/0/1、GE0/0/3、GE0/0/4、GE0/0/7 分别对应案例图里的 interface1、interface3、interface4、interface7。
第一步，配置接口 IP 地址和安全区域。内网两个网段 10.3.0.0/24（学生）和 10.3.1.0/24（教师）都放进 trust 区域，教育网出口 GE0/0/7 放 untrust，运营商出口 GE0/0/1 单独建一个 untrust1 区域放进去——同一个区域装两条不同运营商的线，后面安全策略就没法区分了，这是这个案例里很关键的细节。
<HUAWEI> system-view
[HUAWEI] sysname DeviceA
[DeviceA] interface ge 0/0/1
[DeviceA-GE0/0/1] ip address 1.1.1.1 255.255.255.0
[DeviceA-GE0/0/1] quit
[DeviceA] interface ge 0/0/3
[DeviceA-GE0/0/3] ip address 10.3.0.1 255.255.255.0
[DeviceA-GE0/0/3] quit
[DeviceA] interface ge 0/0/4
[DeviceA-GE0/0/4] ip address 10.3.1.1 255.255.255.0
[DeviceA-GE0/0/4] quit
[DeviceA] interface ge 0/0/7
[DeviceA-GE0/0/7] ip address 2.2.2.2 255.255.255.0
[DeviceA-GE0/0/7] quit
[DeviceA] firewall zone trust
[DeviceA-zone-trust] add interface ge 0/0/3
[DeviceA-zone-trust] add interface ge 0/0/4
[DeviceA-zone-trust] quit
[DeviceA] firewall zone untrust
[DeviceA-zone-untrust] add interface ge 0/0/7
[DeviceA-zone-untrust] quit
[DeviceA] firewall zone name untrust1
[DeviceA-zone-untrust1] set priority 10
[DeviceA-zone-untrust1] add interface ge 0/0/1
[DeviceA-zone-untrust1] quit
第二步，配置策略路由。两条规则各自匹配入接口加源网段，动作直接指明出接口和下一跳。
[DeviceA] policy-based-route
[DeviceA-policy-pbr] rule name policy_route_1
[DeviceA-policy-pbr-rule-policy_route_1] ingress-interface ge 0/0/3
[DeviceA-policy-pbr-rule-policy_route_1] source-address 10.3.0.0 24
[DeviceA-policy-pbr-rule-policy_route_1] action pbr egress-interface ge 0/0/7 next-hop 2.2.2.254
[DeviceA-policy-pbr-rule-policy_route_1] quit
[DeviceA-policy-pbr] rule name policy_route_2
[DeviceA-policy-pbr-rule-policy_route_2] ingress-interface ge 0/0/4
[DeviceA-policy-pbr-rule-policy_route_2] source-address 10.3.1.0 24
[DeviceA-policy-pbr-rule-policy_route_2] action pbr egress-interface ge 0/0/1 next-hop 1.1.1.254
[DeviceA-policy-pbr-rule-policy_route_2] quit
[DeviceA-policy-pbr] quit
第三步，配置安全策略。两组用户分别放行到各自的出口区域，跨区域的流量就不至于串线。
[DeviceA] security-policy
[DeviceA-policy-security] rule name policy_sec_1
[DeviceA-policy-security-rule-policy_sec_1] source-zone trust
[DeviceA-policy-security-rule-policy_sec_1] destination-zone untrust
[DeviceA-policy-security-rule-policy_sec_1] source-address 10.3.0.0 24
[DeviceA-policy-security-rule-policy_sec_1] action permit
[DeviceA-policy-security-rule-policy_sec_1] quit
[DeviceA-policy-security] rule name policy_sec_2
[DeviceA-policy-security-rule-policy_sec_2] source-zone trust
[DeviceA-policy-security-rule-policy_sec_2] destination-zone untrust1
[DeviceA-policy-security-rule-policy_sec_2] source-address 10.3.1.0 24
[DeviceA-policy-security-rule-policy_sec_2] action permit
[DeviceA-policy-security-rule-policy_sec_2] quit
[DeviceA-policy-security] quit
第四步，配置 NAT 策略。两条线各建一个地址池，各自只对去往本线方向的流量做转换，回程流量才能从原路返回。
[DeviceA] nat address-group address_1
[DeviceA-address-group-address_1] section 0 2.2.2.10 2.2.2.15
[DeviceA-address-group-address_1] quit
[DeviceA] nat-policy
[DeviceA-policy-nat] rule name policy_nat_1
[DeviceA-policy-nat-rule-policy_nat_1] source-zone trust
[DeviceA-policy-nat-rule-policy_nat_1] destination-zone untrust
[DeviceA-policy-nat-rule-policy_nat_1] source-address 10.3.0.0 24
[DeviceA-policy-nat-rule-policy_nat_1] action source-nat address-group address_1
[DeviceA-policy-nat-rule-policy_nat_1] quit
[DeviceA-policy-nat] quit
[DeviceA] nat address-group address_2
[DeviceA-address-group-address_2] section 0 1.1.1.10 1.1.1.15
[DeviceA-address-group-address_2] quit
[DeviceA] nat-policy
[DeviceA-policy-nat] rule name policy_nat_2
[DeviceA-policy-nat-rule-policy_nat_2] source-zone trust
[DeviceA-policy-nat-rule-policy_nat_2] destination-zone untrust1
[DeviceA-policy-nat-rule-policy_nat_2] source-address 10.3.1.0 24
[DeviceA-policy-nat-rule-policy_nat_2] action source-nat address-group address_2
[DeviceA-policy-nat-rule-policy_nat_2] quit
[DeviceA-policy-nat] quit
配置完成后怎么验证？官方给出的检查方法很直接：执行 display firewall session table verbose source inside 10.3.0.0 查看学生网络的流量出接口应为 GE0/0/7，执行 display firewall session table verbose source inside 10.3.1.0 查看教师网络的流量出接口应为 GE0/0/4。会话表里出接口对了，分流就成功了。
双线场景里最怕的就是流量乱走、回程丢包，策略路由加分区安全策略这套组合拳能把边界划得清清楚楚。欢迎搜索关注贵州诚鑫致达科技，获取更多企业双出口组网方案。
企业存储选型参考｜贵州诚鑫致达
做中小企业全能主力存储，群晖机型参考：DS1823xs+ · DS2422+ · DS923+。需要选型建议或上门评估，搜「诚鑫致达」即可找到我们。
服务区域｜贵州诚鑫致达
贵州群晖NAS、贵阳存储、数据备份、信创云盘或 IT 集成服务，可联系贵州诚鑫致达科技，服务范围覆盖贵州全省各市州。重庆企业 NAS 存储、服务器运维与容灾备份方案。