A区域:核心交换机Vlan10,20,30,40,50,60
B区域:核心交换机Vlan10,20,30,40,50,60
华三防火墙透明模式部署在 A区域和B区域核心交换机之间管控内网,
两边Vlan10 是设备管理Vlan,华三怎么透传所有Vlan呢?
我的配置:
[FW]vlan 10 //设备管理Vlan(核心上有网关
[FW-vlan10]quit
[FW]interface Vlan-interface 10
[FW-Vlan-interface10]ip address 172.16.10.3 24
[FW-Vlan-interface10]quit
[FW]interface GigabitEthernet 1/0/0
[FW-GigabitEthernet1/0/0]description ##untrust##
[FW-GigabitEthernet1/0/0]port link-mode bridge
[FW-GigabitEthernet1/0/0]port access vlan 10
[FW-GigabitEthernet1/0/0]quit
[FW]interface GigabitEthernet 1/0/1
[FW-GigabitEthernet1/0/1]description ##trust##
[FW-GigabitEthernet1/0/1]port link-mode bridge
[FW-GigabitEthernet1/0/1]port access vlan 10
[FW-GigabitEthernet1/0/1]quit
[FW]security-zone name Trust
[FW-security-zone-Trust]import interface GigabitEthernet 1/0/1 vlan 10
[FW-security-zone-Trust]quit
[FW]security-zone name Untrust
[FW-security-zone-Untrust]import interface GigabitEthernet 1/0/0 vlan 10
[FW-security-zone-Untrust]quit
[FW]security-zone name Management
[FW-security-zone-Management]import interface Vlan-interface 10
[FW-security-zone-Management]quit
[FW]security-policy ip
[FW-security-policy-ip]rule name all-open
[FW-security-policy-ip-0-all-open]action pass
[FW-security-policy-ip-0-all-open]quit
[FW-security-policy-ip]quit
(0)
最佳答案
防火墙透明模式透传vlan的话 ,接口配置trunk透传vlan,同时接口及vlan需要加入到安全域 放通相应安全策略就可以了
(0)
那交换机那边也要 把接口access改成trunk才行吧?
是的
vlan 10 20 30 40 50 60
[FW]interface GigabitEthernet 1/0/0
[FW-GigabitEthernet1/0/0]description ##untrust##
[FW-GigabitEthernet1/0/0]port link-mode bridge
[FW-GigabitEthernet1/0/0]port link trunk
[FW-GigabitEthernet1/0/0]port trunk pe vl al
[FW-GigabitEthernet1/0/0]quit
[FW]interface GigabitEthernet 1/0/1
[FW-GigabitEthernet1/0/1]description ##trust##
[FW-GigabitEthernet1/0/1]port link-mode bridge
[FW-GigabitEthernet1/0/1]port link trunk
[FW-GigabitEthernet1/0/1]port trunk pe vl al
这样复制进去就行了
其他的就是安全策略放通untrust 到trust trust 到untrust
(0)
亲~登录后才可以操作哦!
确定你的邮箱还未认证,请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
抄袭了我的内容
×
原文链接或出处
诽谤我
×
对根叔社区有害的内容
×
不规范转载
×
举报说明
是的