二層交換機(jī)與防火墻對(duì)接上網(wǎng)配置示例
組網(wǎng)圖形
圖1?二層交換機(jī)與防火墻對(duì)接上網(wǎng)組網(wǎng)圖
二層交換機(jī)簡(jiǎn)介
二層交換機(jī)指的是僅能夠進(jìn)行二層轉(zhuǎn)發(fā)，不能進(jìn)行三層轉(zhuǎn)發(fā)的交換機(jī)。也就是說(shuō)僅支持二層特性，不支持路由等三層特性的交換機(jī)。
二層交換機(jī)一般部署在接入層，不能作為用戶的網(wǎng)關(guān)。
配置注意事項(xiàng)
本舉例中的交換機(jī)配置適用于S系列交換機(jī)所有產(chǎn)品的所有版本。
本舉例中的防火墻配置以USG6650 V500R001C60為例，其他防火墻的配置方法請(qǐng)參見對(duì)應(yīng)的文檔指南。
組網(wǎng)需求
如圖1所示，某公司擁有多個(gè)部門且位于不同網(wǎng)段，各部門均有訪問(wèn)Internet的需求?，F(xiàn)要求用戶通過(guò)二層交換機(jī)和防火墻訪問(wèn)外部網(wǎng)絡(luò)，且要求防火墻作為用戶的網(wǎng)關(guān)。
配置思路
采用如下思路進(jìn)行配置：
-
配置交換機(jī)基于接口劃分VLAN，實(shí)現(xiàn)二層轉(zhuǎn)發(fā)。
-
配置防火墻作為用戶的網(wǎng)關(guān)，通過(guò)子接口或VLANIF接口實(shí)現(xiàn)跨網(wǎng)段的三層轉(zhuǎn)發(fā)。
-
配置防火墻作為DHCP服務(wù)器，為用戶PC分配IP地址。
-
開啟防火墻域間安全策略，使不同域的報(bào)文可以相互轉(zhuǎn)發(fā)。
-
配置防火墻PAT功能，使內(nèi)網(wǎng)用戶可以訪問(wèn)外部網(wǎng)絡(luò)。
操作步驟
- 配置交換機(jī)
# 配置下行連接用戶的接口。
<HUAWEI> system-view [HUAWEI] sysname Switch [Switch] vlan batch 2 3 [Switch] interface gigabitethernet 0/0/2 [Switch-GigabitEthernet0/0/2] port link-type access //配置接口接入類型為access [Switch-GigabitEthernet0/0/2] port default vlan 2 //配置接口加入VLAN 2 [Switch-GigabitEthernet0/0/2] quit [Switch] interface gigabitethernet 0/0/3 [Switch-GigabitEthernet0/0/3] port link-type access [Switch-GigabitEthernet0/0/3] port default vlan 3 [Switch-GigabitEthernet0/0/3] quit# 配置上行連接防火墻的接口。
[Switch] interface gigabitethernet 0/0/1 [Switch-GigabitEthernet0/0/1] port link-type trunk [Switch-GigabitEthernet0/0/1] port trunk allow-pass vlan 2 3 //配置接口以trunk方式透?jìng)鱒LAN 2和VLAN 3 [Switch-GigabitEthernet0/0/1] quit - 配置防火墻
防火墻的配置有兩種方式，配置子接口或者配置VLANIF接口，兩種方式選擇其一即可。
-
配置防火墻通過(guò)子接口終結(jié)VLAN，實(shí)現(xiàn)跨網(wǎng)段的三層轉(zhuǎn)發(fā)。
# 配置終結(jié)子接口。
<USG6600> system-view [USG6600] interface gigabitethernet 1/0/1.1 [USG6600-GigabitEthernet1/0/1.1] vlan-type dot1q 2 [USG6600-GigabitEthernet1/0/1.1] ip address 192.168.1.1 24 [USG6600-GigabitEthernet1/0/1.1] quit [USG6600] interface gigabitethernet 1/0/1.2 [USG6600-GigabitEthernet1/0/1.2] vlan-type dot1q 3 [USG6600-GigabitEthernet1/0/1.2] ip address 192.168.2.1 24 [USG6600-GigabitEthernet1/0/1.2] quit# 配置DHCP功能，為內(nèi)網(wǎng)用戶分配IP地址并指定DNS服務(wù)器地址。
[USG6600] dhcp enable [USG6600] interface gigabitethernet 1/0/1.1 [USG6600-GigabitEthernet1/0/1.1] dhcp select interface //開啟接口采用接口地址池的DHCP Server功能 [USG6600-GigabitEthernet1/0/1.1] dhcp server dns-list 114.114.114.114 223.5.5.5 //配置的DNS-List 114.114.114.114是公用的DNS服務(wù)器地址，是不區(qū)分運(yùn)營(yíng)商的。在實(shí)際應(yīng)用中，請(qǐng)根據(jù)運(yùn)營(yíng)商分配的DNS進(jìn)行配置 [USG6600-GigabitEthernet1/0/1.1] quit [USG6600] interface gigabitethernet 1/0/1.2 [USG6600-GigabitEthernet1/0/1.2] dhcp select interface [USG6600-GigabitEthernet1/0/1.2] dhcp server dns-list 114.114.114.114 223.5.5.5 [USG6600-GigabitEthernet1/0/1.2] quit# 配置公網(wǎng)接口的IP地址和靜態(tài)路由。
[USG6600] interface gigabitethernet 1/0/2 [USG6600-GigabitEthernet1/0/2] ip address 203.0.113.2 255.255.255.0 //配置連接公網(wǎng)的接口GE0/0/2的IP地址203.0.113.2 [USG6600-GigabitEthernet1/0/2] quit [USG6600] ip route-static 0.0.0.0 0.0.0.0 203.0.113.1 //配置靜態(tài)缺省路由的下一跳指向公網(wǎng)提供的IP地址203.0.113.1# 配置安全區(qū)域。
# 配置安全策略，允許域間互訪。[USG6600] firewall zone trust //配置trust域 [USG6600-zone-trust] add interface gigabitethernet 1/0/1 [USG6600-zone-trust] add interface gigabitethernet 1/0/1.1 [USG6600-zone-trust] add interface gigabitethernet 1/0/1.2 [USG6600-zone-trust] quit [USG6600] firewall zone untrust //配置untrust域 [USG6600-zone-untrust] add interface gigabitethernet 1/0/2 [USG6600-zone-untrust] quit
# 配置PAT地址池，開啟允許端口地址轉(zhuǎn)換。[USG6600] security-policy [USG6600-policy-security] rule name policy1 [USG6600-policy-security-rule-policy1] source-zone trust [USG6600-policy-security-rule-policy1] destination-zone untrust [USG6600-policy-security-rule-policy1] source-address 192.168.0.0 mask 255.255.0.0 [USG6600-policy-security-rule-policy1] action permit [USG6600-policy-security-rule-policy1] quit [USG6600-policy-security] quit
# 配置源PAT策略，實(shí)現(xiàn)私網(wǎng)指定網(wǎng)段訪問(wèn)公網(wǎng)時(shí)自動(dòng)進(jìn)行源地址轉(zhuǎn)換。[USG6600] nat address-group addressgroup1 [USG6600-address-group-addressgroup1] mode pat [USG6600-address-group-addressgroup1] route enable [USG6600-address-group-addressgroup1] section 0 203.0.113.2 203.0.113.2 //轉(zhuǎn)換的公網(wǎng)IP地址 [USG6600-address-group-addressgroup1] quit[USG6600] nat-policy [USG6600-policy-nat] rule name policy_nat1 [USG6600-policy-nat-rule-policy_nat1] source-zone trust [USG6600-policy-nat-rule-policy_nat1] destination-zone untrust [USG6600-policy-nat-rule-policy_nat1] source-address 192.168.0.0 mask 255.255.0.0 //允許進(jìn)行PAT轉(zhuǎn)換的源IP地址 [USG6600-policy-nat-rule-policy_nat1] action nat address-group addressgroup1 [USG6600-policy-nat-rule-policy_nat1] quit [USG6600-policy-nat] quit [USG6600] quit -
配置防火墻通過(guò)配置VLANIF接口，實(shí)現(xiàn)跨網(wǎng)段的三層轉(zhuǎn)發(fā)。
# 配置VLANIF接口。
<USG6600> system-view [USG6600] vlan batch 2 3 [USG6600] interface gigabitethernet 1/0/1 [USG6600-GigabitEthernet1/0/1] portswitch //將以太網(wǎng)接口從三層模式切換到二層模式。如果接口已經(jīng)是二層模式，跳過(guò)該步驟 [USG6600-GigabitEthernet1/0/1] port link-type hybrid [USG6600-GigabitEthernet1/0/1] port hybrid tagged vlan 2 to 3 [USG6600-GigabitEthernet1/0/1] quit [USG6600] interface vlanif 2 [USG6600-Vlanif2] ip address 192.168.1.1 24 //配置VLANIF2的IP地址作為PC1的網(wǎng)關(guān) [USG6600-Vlanif2] quit [USG6600] interface vlanif 3 [USG6600-Vlanif3] ip address 192.168.2.1 24 //配置VLANIF3的IP地址作為PC2的網(wǎng)關(guān) [USG6600-Vlanif3] quit# 配置DHCP功能。
[USG6600] dhcp enable [USG6600] interface vlanif 2 [USG6600-Vlanif2] dhcp select interface [USG6600-Vlanif2] dhcp server dns-list 114.114.114.114 223.5.5.5 //配置的DNS-List 114.114.114.114是公用的DNS服務(wù)器地址，是不區(qū)分運(yùn)營(yíng)商的。在實(shí)際應(yīng)用中，請(qǐng)根據(jù)運(yùn)營(yíng)商分配的DNS進(jìn)行配置 [USG6600-Vlanif2] quit [USG6600] interface vlanif 3 [USG6600-Vlanif3] dhcp select interface [USG6600-Vlanif3] dhcp server dns-list 114.114.114.114 223.5.5.5 [USG6600-Vlanif3] quit# 配置公網(wǎng)接口的IP地址和靜態(tài)路由。
[USG6600] interface gigabitethernet 1/0/2 [USG6600-GigabitEthernet1/0/2] ip address 203.0.113.2 255.255.255.0 [USG6600-GigabitEthernet1/0/2] quit [USG6600] ip route-static 0.0.0.0 0.0.0.0 203.0.113.1 //配置靜態(tài)缺省路由的下一跳指向公網(wǎng)提供的IP地址203.0.113.1# 配置安全區(qū)域。
# 配置安全策略，允許域間互訪。[USG6600] firewall zone trust [USG6600-zone-trust] add interface gigabitethernet 1/0/1 [USG6600-zone-trust] add interface vlanif 2 [USG6600-zone-trust] add interface vlanif 3 [USG6600-zone-trust] quit [USG6600] firewall zone untrust [USG6600-zone-untrust] add interface gigabitethernet 1/0/2 [USG6600-zone-untrust] quit
# 配置PAT地址池，開啟允許端口地址轉(zhuǎn)換。[USG6600] security-policy [USG6600-policy-security] rule name policy1 [USG6600-policy-security-rule-policy1] source-zone trust [USG6600-policy-security-rule-policy1] destination-zone untrust [USG6600-policy-security-rule-policy1] source-address 192.168.0.0 mask 255.255.0.0 [USG6600-policy-security-rule-policy1] action permit [USG6600-policy-security-rule-policy1] quit [USG6600-policy-security] quit
# 配置源PAT策略，實(shí)現(xiàn)私網(wǎng)指定網(wǎng)段訪問(wèn)公網(wǎng)時(shí)自動(dòng)進(jìn)行源地址轉(zhuǎn)換。[USG6600] nat address-group addressgroup1 [USG6600-address-group-addressgroup1] mode pat [USG6600-address-group-addressgroup1] route enable [USG6600-address-group-addressgroup1] section 0 203.0.113.2 203.0.113.2 //轉(zhuǎn)換的公網(wǎng)IP地址 [USG6600-address-group-addressgroup1] quit[USG6600] nat-policy [USG6600-policy-nat] rule name policy_nat1 [USG6600-policy-nat-rule-policy_nat1] source-zone trust [USG6600-policy-nat-rule-policy_nat1] destination-zone untrust [USG6600-policy-nat-rule-policy_nat1] source-address 192.168.0.0 mask 255.255.0.0 //允許進(jìn)行PAT轉(zhuǎn)換的源IP地址 [USG6600-policy-nat-rule-policy_nat1] action nat address-group addressgroup1 [USG6600-policy-nat-rule-policy_nat1] quit [USG6600-policy-nat] quit [USG6600] quit
-
- 檢查配置結(jié)果
配置PC1的IP地址為192.168.1.2/24，網(wǎng)關(guān)為192.168.1.1；PC2的IP地址為192.168.2.2/24，網(wǎng)關(guān)為192.168.2.1。
配置外網(wǎng)PC的IP地址為203.0.113.1/24，網(wǎng)關(guān)為203.0.113.2。文章來(lái)源：http://www.zghlxwxcb.cn/news/detail-763359.html
配置完成后，PC1和PC2都可以Ping通外網(wǎng)的IP 203.0.113.1/24，PC1和PC2都可以訪問(wèn)Internet。文章來(lái)源地址http://www.zghlxwxcb.cn/news/detail-763359.html
配置文件
Switch的配置文件
#
sysname Switch
#
vlan batch 2 to 3
#
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 2 to 3
#
interface GigabitEthernet0/0/2
port link-type access
port default vlan 2
#
interface GigabitEthernet0/0/3
port link-type access
port default vlan 3
#
return
USG的配置文件（防火墻通過(guò)子接口進(jìn)行三層轉(zhuǎn)發(fā)的配置文件）
#
interface GigabitEthernet1/0/1
#
interface GigabitEthernet1/0/1.1
vlan-type dot1q 2
ip address 192.168.1.1 255.255.255.0
dhcp select interface
dhcp server dns-list 114.114.114.114 223.5.5.5
#
interface GigabitEthernet1/0/1.2
vlan-type dot1q 3
ip address 192.168.2.1 255.255.255.0
dhcp select interface
dhcp server dns-list 114.114.114.114 223.5.5.5
#
interface GigabitEthernet1/0/2
ip address 203.0.113.2 255.255.255.0
#
firewall zone trust
set priority 85
add interface GigabitEthernet1/0/1
add interface GigabitEthernet1/0/1.1
add interface GigabitEthernet1/0/1.2
#
firewall zone untrust
set priority 5
add interface GigabitEthernet1/0/2
#
ip route-static 0.0.0.0 0.0.0.0 203.0.113.1
#
nat address-group addressgroup1 0
mode pat route enable section 0 203.0.113.2 203.0.113.2
#
security-policy
rule name policy1
source-zone trust
destination-zone untrust
source-address 192.168.0.0 mask 255.255.0.0
action permit
#
nat-policy
rule name policy_nat1
source-zone trust
destination-zone untrust
source-address 192.168.0.0 mask 255.255.0.0
action nat address-group addressgroup1
#
return
USG的配置文件（防火墻通過(guò)VLANIF接口進(jìn)行三層轉(zhuǎn)發(fā)的配置文件）
#
vlan batch 2 to 3
#
interface Vlanif2
ip address 192.168.1.1 255.255.255.0
dhcp server dns-list 114.114.114.114 223.5.5.5
#
interface Vlanif3
ip address 192.168.2.1 255.255.255.0
dhcp select interface
dhcp server dns-list 114.114.114.114 223.5.5.5
#
interface GigabitEthernet1/0/1
portswitch
port hybrid tagged vlan 2 to 3
#
interface GigabitEthernet1/0/2
ip address 203.0.113.2 255.255.255.0
#
firewall zone trust
set priority 85
add interface GigabitEthernet1/0/1
add interface Vlanif2
add interface Vlanif3
#
firewall zone untrust
set priority 5
add interface GigabitEthernet1/0/2
#jja
ip route-static 0.0.0.0 0.0.0.0 203.0.113.1
#
nat address-group addressgroup1 0
mode pat
route enable
section 0 203.0.113.2 203.0.113.2
#
security-policy
rule name policy1
source-zone trust
destination-zone untrust
source-address 192.168.0.0 mask 255.255.0.0
action permit
#
nat-policy
rule name policy_nat1
source-zone trust
destination-zone untrust
source-address 192.168.0.0 mask 255.255.0.0
action nat address-group addressgroup1
#
return到了這里，關(guān)于華為二層交換機(jī)與防火墻配置實(shí)例的文章就介紹完了。如果您還想了解更多內(nèi)容，請(qǐng)?jiān)谟疑辖撬阉鱐OY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！
