三層交換機與防火墻對接上網(wǎng)

三層交換機與防火墻對接上網(wǎng)1、應(yīng)用場景如下圖，交換機Switch和防火墻對接，使用戶PC1和PC2可以實現(xiàn)上網(wǎng)功能。交換機是三層交換機，可以完成跨網(wǎng)段數(shù)據(jù)轉(zhuǎn)發(fā)。2、配置思路交換機作為用戶的網(wǎng)關(guān)，實現(xiàn)三層轉(zhuǎn)發(fā)。同時作為DHCP效勞器，為用戶分配IP地址。防火墻通過NAT轉(zhuǎn)換，使用戶可以訪問外網(wǎng)。(這里使用的是USG防火墻)三層交換機與防火墻對接上網(wǎng)交換機的配置步驟〔共4步〕第一步：配置連接用戶的接口和對應(yīng)的VLANIF接口。<Switch>system-view[Switch]vlanbatch23[Switch]interfacegigabitethernet0/0/2[Switch-GigabitEthernet0/0/2]portlink-typeaccess[Switch-GigabitEthernet0/0/2]portdefaultvlan2[Switch-GigabitEthernet0/0/2]quit[Switch]interfacegigabitethernet0/0/3[Switch-GigabitEthernet0/0/3]portlink-typeaccess[Switch-GigabitEthernet0/0/3]portdefaultvlan3[Switch-GigabitEthernet0/0/3]quit[Switch]interfacevlanif2[Switch-Vlanif2]ipaddress192.168.1.124[Switch-Vlanif2]quit[Switch]interfaceVlanif3[Switch-Vlanif3]ipaddress192.168.2.124[Switch-Vlanif3]quit三層交換機與防火墻對接上網(wǎng)交換機的配置步驟〔共4步〕第二步：配置連接防火墻的接口和對應(yīng)的VLANIF接口。[Switch]vlanbatch100[Switch]interfacegigabitethernet0/0/1[Switch-GigabitEthernet0/0/1]portlink-typeaccess[Switch-GigabitEthernet0/0/1]portdefaultvlan100[Switch-GigabitEthernet0/0/1]quit[Switch]interfacevlanif100[Switch-Vlanif100]ipaddress192.168.100.224[Switch-Vlanif100]quit第三步：配置缺省路由。[Switch]三層交換機與防火墻對接上網(wǎng)交換機的配置步驟〔共4步〕第四步：配置DHCP效勞器。[Switch]dhcpenable[Switch]interfacevlanif2[Switch-Vlanif2]dhcpselectinterface

[Switch-Vlanif2]dhcpserverdns-list114.114.114.114223.5.5.5[Switch-Vlanif2]quit[Switch]interfacevlanif3[Switch-Vlanif3]dhcpselectinterface

[Switch-Vlanif3]dhcpserverdns-list114.114.114.114223.5.5.5[Switch-Vlanif3]quit三層交換機與防火墻對接上網(wǎng)防火墻的配置步驟〔共5步〕第一步：配置連接交換機的接口對應(yīng)的IP地址。<USG>system-view[USG]interfacegigabitethernet0/0/1[USG-GigabitEthernet0/0/1][USG-GigabitEthernet0/0/1]quit第二步：配置連接公網(wǎng)的接口對應(yīng)的IP地址。[USG]interfacegigabitethernet0/0/2[USG-GigabitEthernet0/0/2][USG-GigabitEthernet0/0/2]quit第三步：配置缺省路由和回程路由。[USG][USG]三層交換機與防火墻對接上網(wǎng)防火墻的配置步驟〔共5步〕第四步：配置域并開啟域間策略。[[USG]firewallzonetrust[USG-zone-trust]addinterfacegigabitethernet0/0/1[USG-zone-trust]quit[USG]firewallzoneuntrust[USG-zone-untrust]addinterfacegigabitethernet0/0/2[USG-zone-untrust]quit[USG]firewallpacket-filterdefaultpermitall三層交換機與防火墻對接上網(wǎng)防火墻的配置步驟〔共5步〕第五步：配置NAT功能。[USG]nataddress-group1200.0.0.2200.0.0.2[USG]nat-policyinterzonetrustuntrustoutbound[USG-nat-policy-interzone-trust-untrust-outbound]policy1[USG-nat-policy-interzone-trust-untrust-outbound-1][USG-nat-policy-interzone-trust-untrust-outbound-1]actionsource-nat[USG-nat-policy-interzone-trust-untrust-outbound-1]address-group