SecPath_F100 二层通信

0x0. 需求防火墙二层通信，设备处于同一VLAN 

0x1.简单处理方法记录一下

1）PC_3 配置IP地址 192.168.5.5 /24

2）S5820v2 接口配置

[sw-GigabitEthernet1/0/1]dis this 

# 

interface GigabitEthernet1/0/1 

 port link-mode bridge 

 port link-type trunk 

 undo port trunk permit vlan 1 

 port trunk permit vlan 10 

 combo enable fiber

 # 

return 

   S5820v2 vlan 配置

[sw-Vlan-interface10]dis this 

#

 interface Vlan-interface10 

 ip address 192.168.5.254 255.255.255.0 

# 

return

3）防火墙配置

(a) 接口配置 gig1/0/23  gig1/0/1

#

 interface GigabitEthernet1/0/23 

 port link-mode bridge 

 port access vlan 10 

 combo enable copper 

# 

return 

------------------------------------------

# 

interface GigabitEthernet1/0/1 

 port link-mode bridge 

 port link-type trunk 

 port trunk permit vlan 1 10 

 combo enable copper 

# 

return 

------------------------------------------

(b) vlan 配置IP地址

[H3C-Vlan-interface10]dis this 

# 

interface Vlan-interface10 

 ip address 192.168.5.1 255.255.255.0 

#

 return 

（c）创建安全域 AP

[H3C]security-zone name ap 

[H3C-security-zone-ap]dis this 

# 

security-zone name ap 

 import interface Vlan-interface10 

 import interface GigabitEthernet1/0/1 vlan 10 

# 

return 

（d）创建安全策略

参考 https://zhiliao.h3c.com/Theme/details/136909

[H3C]security-policy ip 

[H3C-security-policy-ip]dis this 

# 

security-policy ip 

 rule 0 name ap-local 

 action pass 

 source-zone ap 

 destination-zone local 

 rule 5 name local-ap 

 action pass 

 source-zone local

 destination-zone ap 

# 

return