防火墙旁挂 过数据

可以旁挂，要做VRF引流，确保来回路径一致，HCL模拟器的防火墙堆叠不支持冗余组，只好做三层聚合口。

内网主机192.168.1.1/24上114效果：

<H3C>ping 114.114.114.114 Ping 114.114.114.114 (114.114.114.114): 56 data bytes, press CTRL_C to break Request time out 56 bytes from 114.114.114.114: icmp_seq=1 ttl=251 time=4.000 ms 56 bytes from 114.114.114.114: icmp_seq=2 ttl=251 time=4.000 ms 56 bytes from 114.114.114.114: icmp_seq=3 ttl=251 time=4.000 ms 56 bytes from 114.114.114.114: icmp_seq=4 ttl=251 time=3.000 ms --- Ping statistics for 114.114.114.114 --- 5 packet(s) transmitted, 4 packet(s) received, 20.0% packet loss round-trip min/avg/max/std-dev = 3.000/3.750/4.000/0.433 ms

内部主机192.168.1.1/24对公网nat server开启telnet服务，公网设备可以telnet访问内网。

<H3C>telnet 100.1.1.1 Trying 100.1.1.1 ... Press CTRL+K to abort Connected to 100.1.1.1 ... ****************************************************************************** * Copyright (c) 2004-2017 New H3C Technologies Co., Ltd. All rights reserved.* * Without the owner's prior written consent, * * no decompiling or reverse-engineering shall be allowed. * ****************************************************************************** login: h3c Password: <H3C>dis ip int br <H3C>dis ip int brief *down: administratively down (s): spoofing (l): loopback Interface Physical Protocol IP Address Description GE0/0 up up 192.168.1.1 --