三层交换机与防火墙对接上网

三层交换机与防火墙对接上网1、应用场景如下图，交换机Switch和防火墙对接，使用户PC1和PC2可以实现上网功能。交换机是三层交换机，可以完成跨网段数据转发。2、配置思路交换机作为用户的网关，实现三层转发。同时作为DHCP效劳器，为用户分配IP地址。防火墙通过NAT转换，使用户可以访问外网。(这里使用的是USG防火墙)三层交换机与防火墙对接上网交换机的配置步骤〔共4步〕第一步：配置连接用户的接口和对应的VLANIF接口。<Switch>system-view[Switch]vlanbatch23[Switch]interfacegigabitethernet0/0/2[Switch-GigabitEthernet0/0/2]portlink-typeaccess[Switch-GigabitEthernet0/0/2]portdefaultvlan2[Switch-GigabitEthernet0/0/2]quit[Switch]interfacegigabitethernet0/0/3[Switch-GigabitEthernet0/0/3]portlink-typeaccess[Switch-GigabitEthernet0/0/3]portdefaultvlan3[Switch-GigabitEthernet0/0/3]quit[Switch]interfacevlanif2[Switch-Vlanif2]ipaddress192.168.1.124[Switch-Vlanif2]quit[Switch]interfaceVlanif3[Switch-Vlanif3]ipaddress192.168.2.124[Switch-Vlanif3]quit三层交换机与防火墙对接上网交换机的配置步骤〔共4步〕第二步：配置连接防火墙的接口和对应的VLANIF接口。[Switch]vlanbatch100[Switch]interfacegigabitethernet0/0/1[Switch-GigabitEthernet0/0/1]portlink-typeaccess[Switch-GigabitEthernet0/0/1]portdefaultvlan100[Switch-GigabitEthernet0/0/1]quit[Switch]interfacevlanif100[Switch-Vlanif100]ipaddress192.168.100.224[Switch-Vlanif100]quit第三步：配置缺省路由。[Switch]三层交换机与防火墙对接上网交换机的配置步骤〔共4步〕第四步：配置DHCP效劳器。[Switch]dhcpenable[Switch]interfacevlanif2[Switch-Vlanif2]dhcpselectinterface

[Switch-Vlanif2]dhcpserverdns-list114.114.114.114223.5.5.5[Switch-Vlanif2]quit[Switch]interfacevlanif3[Switch-Vlanif3]dhcpselectinterface

[Switch-Vlanif3]dhcpserverdns-list114.114.114.114223.5.5.5[Switch-Vlanif3]quit三层交换机与防火墙对接上网防火墙的配置步骤〔共5步〕第一步：配置连接交换机的接口对应的IP地址。<USG>system-view[USG]interfacegigabitethernet0/0/1[USG-GigabitEthernet0/0/1][USG-GigabitEthernet0/0/1]quit第二步：配置连接公网的接口对应的IP地址。[USG]interfacegigabitethernet0/0/2[USG-GigabitEthernet0/0/2][USG-GigabitEthernet0/0/2]quit第三步：配置缺省路由和回程路由。[USG][USG]三层交换机与防火墙对接上网防火墙的配置步骤〔共5步〕第四步：配置域并开启域间策略。[[USG]firewallzonetrust[USG-zone-trust]addinterfacegigabitethernet0/0/1[USG-zone-trust]quit[USG]firewallzoneuntrust[USG-zone-untrust]addinterfacegigabitethernet0/0/2[USG-zone-untrust]quit[USG]firewallpacket-filterdefaultpermitall三层交换机与防火墙对接上网防火墙的配置步骤〔共5步〕第五步：配置NAT功能。[USG]nataddress-group1200.0.0.2200.0.0.2[USG]nat-policyinterzonetrustuntrustoutbound[USG-nat-policy-interzone-trust-untrust-outbound]policy1[USG-nat-policy-interzone-trust-untrust-outbound-1][USG-nat-policy-interzone-trust-untrust-outbound-1]actionsource-nat[USG-nat-policy-interzone-trust-untrust-outbound-1]address-group