組網(wǎng)需求

如圖3-323所示，某公司擁有多個(gè)部門且位于不同網(wǎng)段，各部門均有訪問(wèn)Inte.NET的需求。現(xiàn)要求用戶通過(guò)三層交換機(jī)和防火墻訪問(wèn)外部網(wǎng)絡(luò)，且要求三層交換機(jī)作為用戶的網(wǎng)關(guān)。

圖3-323 三層交換機(jī)與防火墻對(duì)接上網(wǎng)組網(wǎng)圖

配置思路

采用如下思路進(jìn)行配置：

1. 配置交換機(jī)作為用戶的網(wǎng)關(guān)，通過(guò)VLANIF接口，實(shí)現(xiàn)跨網(wǎng)段用戶互訪。
2. 配置交換機(jī)作為DHCP服務(wù)器，為用戶分配IP地址。
3. 開啟防火墻域間安全策略，使不同域的報(bào)文可以相互轉(zhuǎn)發(fā)。
4. 配置防火墻PAT轉(zhuǎn)換功能，使用戶可以訪問(wèn)外部網(wǎng)絡(luò)。

操作步驟

1. 配置交換機(jī)
2. # 配置連接用戶的接口和對(duì)應(yīng)的VLANIF接口。

<HUAWEI> system-view
[HUAWEI] sysname Switch
[Switch] vlan batch 2 3
[Switch] interface gigabitethernet 0/0/2
[Switch-GigabitEthernet0/0/2] port link-type access   //配置接口接入類型為access
[Switch-GigabitEthernet0/0/2] port default vlan 2   //配置接口加入VLAN 2
[Switch-GigabitEthernet0/0/2] quit
[Switch] interface gigabitethernet 0/0/3
[Switch-GigabitEthernet0/0/3] port link-type access
[Switch-GigabitEthernet0/0/3] port default vlan 3   
[Switch-GigabitEthernet0/0/3] quit
[Switch] interface vlanif 2
[Switch-Vlanif2] ip address 192.168.1.1 24
[Switch-Vlanif2] quit
[Switch] interface vlanif 3
[Switch-Vlanif3] ip address 192.168.2.1 24
[Switch-Vlanif3] quit

# 配置連接防火墻的接口和對(duì)應(yīng)的VLANIF接口。

[Switch] vlan batch 100
[Switch] interface gigabitethernet 0/0/1
[Switch-GigabitEthernet0/0/1] port link-type access
[Switch-GigabitEthernet0/0/1] port default vlan 100   
[Switch-GigabitEthernet0/0/1] quit
[Switch] interface vlanif 100
[Switch-Vlanif100] ip address 192.168.100.2 24
[Switch-Vlanif100] quit

# 配置缺省路由。

[Switch] ip route-static 0.0.0.0 0.0.0.0 192.168.100.1   //缺省路由的下一跳是防火墻接口的IP地址192.168.100.1

# 配置DHCP服務(wù)器。

[Switch] dhcp enable   
[Switch] interface vlanif 2
[Switch-Vlanif2] dhcp select interface   //DHCP使用接口地址池的方式為用戶分配IP地址
[Switch-Vlanif2] dhcp server DNS-list 114.114.114.114 223.5.5.5   //配置的DNS-List 114.114.114.114是公用的DNS服務(wù)器地址，是不區(qū)分運(yùn)營(yíng)商的。在實(shí)際應(yīng)用中，請(qǐng)根據(jù)運(yùn)營(yíng)商分配的DNS進(jìn)行配置
[Switch-Vlanif2] quit
[Switch] interface vlanif 3
[Switch-Vlanif3] dhcp select interface
[Switch-Vlanif3] dhcp server dns-list 114.114.114.114 223.5.5.5
[Switch-Vlanif3] quit

配置防火墻

# 配置連接交換機(jī)的接口對(duì)應(yīng)的IP地址。

<USG6600> system-view
[USG6600] interface gigabitethernet 1/0/1
[USG6600-GigabitEthernet1/0/1] ip address 192.168.100.1 255.255.255.0   
[USG6600-GigabitEthernet1/0/1] quit

# 配置連接公網(wǎng)的接口對(duì)應(yīng)的IP地址。

[USG6600] interface gigabitethernet 1/0/2
[USG6600-GigabitEthernet1/0/2] ip address 200.0.0.2 255.255.255.0   //配置連接公網(wǎng)接口的IP地址和公網(wǎng)的IP地址在同一網(wǎng)段
[USG6600-GigabitEthernet1/0/2] quit

# 配置缺省路由和回程路由。

[USG6600] ip route-static 0.0.0.0 0.0.0.0 200.0.0.1   //配置靜態(tài)缺省路由的下一跳指向公網(wǎng)提供的IP地址200.0.0.1
[USG6600] ip route-static 192.168.0.0 255.255.0.0 192.168.100.2   //配置回程路由的下一跳就指向交換機(jī)上行接口的IP地址192.168.100.

# 配置安全策略。

[USG6600] firewall zone tRust   //配置trust域
[USG6600-zone-trust] add interface gigabitethernet 1/0/1
[USG6600-zone-trust] quit
[USG6600] firewall zone untrust   //配置untrust域
[USG6600-zone-untrust] add interface gigabitethernet 1/0/2
[USG6600-zone-untrust] quit

# 配置安全策略，允許域間互訪。

[USG6600] security-policy
[USG6600-policy-security] rule name policy1
[USG6600-policy-security-rule-policy1] source-zone trust
[USG6600-policy-security-rule-policy1] destination-zone untrust
[USG6600-policy-security-rule-policy1] source-address 192.168.0.0 mask 255.255.0.0
[USG6600-policy-security-rule-policy1] action permit
[USG6600-policy-security-rule-policy1] quit
[USG6600-policy-security] quit

配置PAT地址池，開啟允許端口地址轉(zhuǎn)換。

[USG6600] nat address-group addressgroup1    
[USG6600-address-group-addressgroup1] mode pat
[USG6600-address-group-addressgroup1] route enable
[USG6600-address-group-addressgroup1] section 0 200.0.0.2 200.0.0.2    //轉(zhuǎn)換的公網(wǎng)IP地址
[USG6600-address-group-addressgroup1] quit

配置源PAT策略，實(shí)現(xiàn)私網(wǎng)指定網(wǎng)段訪問(wèn)公網(wǎng)時(shí)自動(dòng)進(jìn)行源地址轉(zhuǎn)換。

[USG6600] nat-policy    
[USG6600-policy-nat] rule name policy_nat1
[USG6600-policy-nat-rule-policy_nat1] source-zone trust
[USG6600-policy-nat-rule-policy_nat1] destination-zone untrust
[USG6600-policy-nat-rule-policy_nat1] source-address 192.168.0.0 mask 255.255.0.0   //允許進(jìn)行PAT轉(zhuǎn)換的源IP地址
[USG6600-policy-nat-rule-policy_nat1] action nat address-group addressgroup1
[USG6600-policy-nat-rule-policy_nat1] quit
[USG6600-policy-nat] quit
[USG6600] quit

到此 配置就完成了