SecPath防火墙DHCP功能的典型配置

SecPath防火墙DHCP功能的典型配置

                                                 

 

一、 组网需求：

验证SecPath防火墙的DHCP Server和DHCP Relay的功能。

二、 组网图

 

   SecPath100F：版本为SECPATH100F-VRP340-E1605。

三、 配置步骤

1.     DHCP_Server的主要配置

#

 sysname DHCP_Server

#

 firewall packet-filter enable

 firewall packet-filter default permit

dhcp server ip-pool 2                        //配置dhcp地址池2

 network 192.168.1.0 mask 255.255.255.0

 gateway-list 192.168.1.254

 dns-list 202.106.0.20

#

dhcp server ip-pool 10                      //配置dhcp地址池10

 network 192.168.10.0 mask 255.255.255.0

 gateway-list 192.168.10.254

 dns-list 202.106.0.20

#

interface Ethernet0/0

 ip address 172.16.1.1 255.255.255.0

#

firewall zone trust

 add interface Ethernet0/0

 set priority 85

 ip route-static 192.168.0.0 255.255.0.0 172.16.1.2      //配置去往内网的路由

#

 

2.        DHCP_Relay的主要配置

#

 sysname DHCP_Relay

#

 firewall packet-filter enable

 firewall packet-filter default permit

#

interface Ethernet1/0

 ip address 172.16.1.2 255.255.255.0

interface Ethernet1/2.2                        //创建子接口

 ip address 192.168.1.254 255.255.255.0

 ip relay address 172.16.1.1                   //配置dhcp relay的地址

 dhcp select relay                           //启用dhcp relay功能

 vlan-type dot1q vid 2                       //封装成VLAN2

#

interface Ethernet1/2.10                      //创建子接口

 ip address 192.168.10.254 255.255.255.0

 ip relay address 172.16.1.1                  //配置dhcp relay的地址

 dhcp select relay                          //启用dhcp relay功能

 vlan-type dot1q vid 10                     //封装成VLAN10

#

firewall zone trust

 add interface Ethernet1/2

 add interface Ethernet1/2.2

 add interface Ethernet1/2.10

 set priority 85

#

firewall zone untrust

 add interface Ethernet1/0

 set priority 5

#

 ip route-static 0.0.0.0 0.0.0.0 172.16.1.1      //配置默认路由

#

 

3.        S3526E交换机的主要配置

#

 sysname S3536E

#

vlan 1

#

vlan 2                                        //创建VLAN2

#

vlan 10                                       //创建VLAN10

#

interface Ethernet0/18

 port access vlan 2                      //把端口加入到VLAN2

#

interface Ethernet0/20

 port access vlan 10                     //把端口加入到VLAN10

#

interface Ethernet0/24

 port link-type trunk                    //把端口设置为Trunk

 port trunk permit vlan 1 to 2 10

#

 

四、 配置关键点

见注释。