组网说明:
本案例采用H3C HCL模拟器的F1060来模拟F1060防火墙二层链路聚合的典型组网配置。FW1与FW2采用双物理链路并使用二层链路聚合实现互联,VLAN10的网关在FW1上。要求两台PC能够相互PING通。
1、按照网络拓扑图正确配置IP地址
2、FW1与FW2采用二层链路聚合互联
FW2:
<H3C>sys
System View: return to User View with Ctrl+Z.
[H3C]sysname FW2
[FW2]acl basic 2001
[FW2-acl-ipv4-basic-2001]rule 0 permit source any
[FW2-acl-ipv4-basic-2001]quit
[FW2]
[FW2]zone-pair security source trust destination untrust
[FW2-zone-pair-security-Trust-Untrust]packet-filter 2001
[FW2-zone-pair-security-Trust-Untrust]quit
[FW2]
[FW2]zone-pair security source untrust destination trust
[FW2-zone-pair-security-Untrust-Trust]packet-filter 2001
[FW2-zone-pair-security-Untrust-Trust]quit
[FW2]
[FW2]zone-pair security source trust destination local
[FW2-zone-pair-security-Trust-Local]packet-filter 2001
[FW2-zone-pair-security-Trust-Local]quit
[FW2]
[FW2]zone-pair security source local destination trust
[FW2-zone-pair-security-Local-Trust]packet-filter 2001
[FW2-zone-pair-security-Local-Trust]quit
[FW2]
[FW2]zone-pair security source untrust destination local
[FW2-zone-pair-security-Untrust-Local]packet-filter 2001
[FW2-zone-pair-security-Untrust-Local]quit
[FW2]
[FW2]zone-pair security source local destination untrust
[FW2-zone-pair-security-Local-Untrust]packet-filter 2001
[FW2-zone-pair-security-Local-Untrust]quit
[FW2]vlan 10
[FW2-vlan10]quit
[FW2]int gi 1/0/2
[FW2-GigabitEthernet1/0/2]port link-mode bridge
[FW2-GigabitEthernet1/0/2]port link-type access
[FW2-GigabitEthernet1/0/2]port access vlan 10
[FW2-GigabitEthernet1/0/2]quit
[FW2]security-zone name Trust
[FW2-security-zone-Trust]import interface GigabitEthernet 1/0/2 vlan 10
[FW2-security-zone-Trust]quit
FW2 二层链路聚合关键配置点:
[FW2]int Bridge-Aggregation 1
[FW2-Bridge-Aggregation1]quit
[FW2]int range gi 1/0/3 to gi 1/0/4
[FW2-if-range]port link-mode bridge
[FW2-if-range]port link-aggregation group 1
[FW2-if-range]quit
[FW2]int Bridge-Aggregation 1
[FW2-Bridge-Aggregation1]port link-type trunk
[FW2-Bridge-Aggregation1]undo port trunk permit vlan 1
[FW2-Bridge-Aggregation1]port trunk permit vlan 10
[FW2-Bridge-Aggregation1]quit
[FW2]security-zone name Untrust
[FW2-security-zone-Untrust]import interface GigabitEthernet 1/0/3 vlan 10
[FW2-security-zone-Untrust]import interface GigabitEthernet 1/0/4 vlan 10
[FW2-security-zone-Untrust]import interface Bridge-Aggregation 1 vlan 10
[FW2-security-zone-Untrust]quit
FW1:
<H3C>sys
System View: return to User View with Ctrl+Z.
[H3C]sysname FW1
[FW1]vlan 10
[FW1-vlan10]quit
[FW1]int gi 1/0/2
[FW1-GigabitEthernet1/0/2]port link-mode bridge
[FW1-GigabitEthernet1/0/2]port link-type access
[FW1-GigabitEthernet1/0/2]port access vlan 10
[FW1-GigabitEthernet1/0/2]quit
[FW1]int vlan 10
[FW1-Vlan-interface10]ip address 192.168.10.1 24
[FW1-Vlan-interface10]quit
[FW1]acl basic 2001
[FW1-acl-ipv4-basic-2001]rule 0 permit source any
[FW1-acl-ipv4-basic-2001]quit
[FW1]
[FW1]zone-pair security source trust destination untrust
[FW1-zone-pair-security-Trust-Untrust]packet-filter 2001
[FW1-zone-pair-security-Trust-Untrust]quit
[FW1]
[FW1]zone-pair security source untrust destination trust
[FW1-zone-pair-security-Untrust-Trust]packet-filter 2001
[FW1-zone-pair-security-Untrust-Trust]quit
[FW1]
[FW1]zone-pair security source trust destination local
[FW1-zone-pair-security-Trust-Local]packet-filter 2001
[FW1-zone-pair-security-Trust-Local]quit
[FW1]
[FW1]zone-pair security source local destination trust
[FW1-zone-pair-security-Local-Trust]packet-filter 2001
[FW1-zone-pair-security-Local-Trust]quit
[FW1]
[FW1]zone-pair security source untrust destination local
[FW1-zone-pair-security-Untrust-Local]packet-filter 2001
[FW1-zone-pair-security-Untrust-Local]quit
[FW1]
[FW1]zone-pair security source local destination untrust
[FW1-zone-pair-security-Local-Untrust]packet-filter 2001
[FW1-zone-pair-security-Local-Untrust]quit
[FW1]security-zone name Trust
[FW1-security-zone-Trust]import interface GigabitEthernet 1/0/2 vlan 10
[FW1-security-zone-Trust]quit
FW1二层链路聚合关键配置点:
[FW1]int Bridge-Aggregation 1
[FW1-Bridge-Aggregation1]quit
[FW1] int range gi 1/0/3 to gi 1/0/4
[FW1-if-range]port link-mode bridge
[FW1-if-range]port link-aggregation group 1
[FW1-if-range]quit
[FW1]int Bridge-Aggregation 1
[FW1-Bridge-Aggregation1]port link-type trunk
[FW1-Bridge-Aggregation1]undo port trunk permit vlan 1
[FW1-Bridge-Aggregation1]port trunk permit vlan 10
[FW1-Bridge-Aggregation1]quit
[FW1]security-zone name Untrust
[FW1-security-zone-Untrust]import interface GigabitEthernet 1/0/3 vlan 10
[FW1-security-zone-Untrust]import interface GigabitEthernet 1/0/4 vlan 10
[FW1-security-zone-Untrust]import interface Bridge-Aggregation 1
[FW1-security-zone-Untrust]import interface Bridge-Aggregation 1 vlan 10
[FW1-security-zone-Untrust]import interface vlan 10
[FW1-security-zone-Untrust]quit
测试:
所有PC都填写IP地址:
PC之间可以相互PING通:
查看FW1的链路聚合显示信息:
查看FW2的链路聚合显示信息:
至此,F1060二层链路聚合典型组网配置案例已完成!
该案例暂时没有网友评论
✖
案例意见反馈
亲~登录后才可以操作哦!
确定你的邮箱还未认证,请认证邮箱或绑定手机后进行当前操作