用ENSP模拟二层交换机和三层交换机分别与防火墙对接上网配置过程(2)

用ENSP模拟二层交换机和三层交换机分别与防火墙对接上网配置过程

2.配置思路

3.配置过程

3.1交换机的配置步骤

第一步：配置连接用户的接口和对应的VLANIF接口

[HXSW]vlan batch 10 20
Info: This operation may take a few seconds. Please wait for a moment...done.
[HXSW]interface GigabitEthernet 0/0/1
[HXSW-GigabitEthernet0/0/1]port link-type access
[HXSW-GigabitEthernet0/0/1]port default vlan 10
[HXSW-GigabitEthernet0/0/1]quit
[HXSW]interface GigabitEthernet 0/0/2
[HXSW-GigabitEthernet0/0/2]port link-type access
[HXSW-GigabitEthernet0/0/2]port default vlan 10
[HXSW-GigabitEthernet0/0/2]quit
 
[HXSW]interface GigabitEthernet 0/0/3
[HXSW-GigabitEthernet0/0/3]port link-type access
[HXSW-GigabitEthernet0/0/3]port default vlan 20
[HXSW-GigabitEthernet0/0/3]quit
[HXSW]int GigabitEthernet 0/0/4
[HXSW-GigabitEthernet0/0/4]port link-type access
[HXSW-GigabitEthernet0/0/4]port default vlan 20
[HXSW-GigabitEthernet0/0/4]quit
[HXSW]int vlanif10
[HXSW-Vlanif10]ip address 192.168.10.1 24
[HXSW-Vlanif10]quit
[HXSW]int vlanif20
[HXSW-Vlanif20]ip address 192.168.20.1 24
[HXSW-Vlanif20]quit
[HXSW]

第二步：配置连接防火墙的接口和对应的VLANIF接口

[HXSW]vlan 100
[HXSW-vlan100]quit
[HXSW]interface GigabitEthernet 0/0/24
[HXSW-GigabitEthernet0/0/24]port link-type access
[HXSW-GigabitEthernet0/0/24]port default vlan 100
[HXSW-GigabitEthernet0/0/24]quit
[HXSW]interface vlanif100
[HXSW-Vlanif100]ip address 10.10.250.2 24
[HXSW-Vlanif100]quit
[HXSW]

第三步：配置dhcp服务

[HXSW]dhcp enable
Info: The operation may take a few seconds. Please wait for a moment.done.
[HXSW]interface vlanif10
[HXSW-Vlanif10]dhcp select interface 
[HXSW-Vlanif10]dhcp server dns-list 114.114.114.114 8.8.8.8
[HXSW-Vlanif10]quit
[HXSW]interface vlanif20
[HXSW-Vlanif20]dhcp select interface 
[HXSW-Vlanif20]dhcp server dns-list 114.114.114.114 8.8.8.8
[HXSW-Vlanif20]quit
[HXSW]

第四步：配置缺省路由

[HXSW]ip route-static 0.0.0.0 0.0.0.0 10.10.250.1
[HXSW]

3.2防火墙配置步骤

第一步：配置连接交换机的接口对应的IP地址

[USG6000]interface GigabitEthernet 1/0/3
[USG6000-GigabitEthernet1/0/3]ip address 10.10.250.1 24
[USG6000-GigabitEthernet1/0/3]quit
[USG6000]

第二步：配置连接公网接口的IP地址

[USG6000]int GigabitEthernet 1/0/1
[USG6000-GigabitEthernet1/0/1]ip address 1.1.1.1 24
[USG6000-GigabitEthernet1/0/1]quit
[USG6000]

第三步：配置缺省路由和回程路由

[USG6000]ip route-static 0.0.0.0 0.0.0.0 1.1.1.254
[USG6000]ip route-static 192.168.0.0 255.255.0.0 10.10.250.2
[USG6000

第四步：将接口加入安全区域

[USG6000]firewall zone trust
[USG6000-zone-trust]add interface GigabitEthernet 1/0/3
[USG6000-zone-trust]quit
[USG6000]firewall zone untrust
[USG6000-zone-untrust]add interface GigabitEthernet 1/0/1
[USG6000-zone-untrust]quit
[USG6000]

第五步：配置安全策略

[USG6000]security-policy 
[USG6000-policy-security]rule name trust-to-untrust
[USG6000-policy-security-rule-trust-to-untrust]source-address 192.168.10.0 mask 255.255.255.0
[USG6000-policy-security-rule-trust-to-untrust]source-address 192.168.20.0 mask 255.255.255.0
[USG6000-policy-security-rule-trust-to-untrust]source-zone trust
[USG6000-policy-security-rule-trust-to-untrust]destination-zone untrust
[USG6000-policy-security-rule-trust-to-untrust]action permit
[USG6000-policy-security-rule-trust-to-untrust]quit
[USG6000-policy-security]quit
[USG6000]

第六步：配置NAT功能

[USG6000]nat-policy 
[USG6000-policy-nat]rule name mynat
[USG6000-policy-nat-rule-mynat]source-address 192.168.10.0 mask 255.255.255.0
[USG6000-policy-nat-rule-mynat]source-address 192.168.20.0 mask 255.255.255.0
[USG6000-policy-nat-rule-mynat]source-zone trust
[USG6000-policy-nat-rule-mynat]egress-interface GigabitEthernet 1/0/1
[USG6000-policy-nat-rule-mynat]action source easy-ip
[USG6000-policy-nat-rule-mynat]quit
[USG6000-policy-nat]quit
[USG6000]

4.测试结果

不同VLAN主机获得IP地址