Vlan间通信-防火墙
原创
©著作权归作者所有:来自51CTO博客作者mht8423的原创作品,请联系作者获取转载授权,否则将追究法律责任
Vlan间通信-防火墙
实验环境:一台防火墙来实现单臂路由,两台两层交换机,两台路由器做pc机
配置防火墙:
[r]inter eth0/0.10
[r-Ethernet0/0.10]vlan-type dot1q vid 10
[r-Ethernet0/0.10]ip address 192.168.10.254 24
[r]inter eth0/0.20
[r-Ethernet0/0.20]vlan-type dot1q vid 20
[r-Ethernet0/0.20]ip address 192.168.20.254 24
加区域:
[r]firewall zone trust
[r-zone-trust]add interface eth0/0.10
[r-zone-trust]add interface eth0/0.20
取消隔离:
[r]undo insulate
配置sw1:
[sw1]inter e1/0/2
[sw1-Ethernet1/0/2]
[sw1-Ethernet1/0/2]
[sw1-Ethernet1/0/2]
[sw1-Ethernet1/0/2]port link-type trunk
[sw1-Ethernet1/0/2]port trunk permit vlan all
Please wait........................................... Done.
[sw1-Ethernet1/0/2]inter e1/0/1
[sw1-Ethernet1/0/1]port link-type trunk
[sw1-Ethernet1/0/1]port trunk permit vlan all
Please wait........................................... Done.
[sw1-Ethernet1/0/1]
划分vlan:
[sw1]vlan 10
[sw1-vlan10]port e1/0/10
[sw1-vlan10]vlan 20
[sw1-vlan20]port e1/0/20
配置sw2:
[sw2]inter e1/0/1
[sw2-Ethernet1/0/1]port link-type trunk
[sw2-Ethernet1/0/1]port trunk permit vlan all
Please wait........................................... Done.
[sw2-Ethernet1/0/1]quit
[sw2]vlan 10
[sw2-vlan10]port e1/0/10
[sw2-vlan10]vlan 20
[sw2-vlan20]port e1/0/20
用路由器1做pc机10.100:
[r1]inter e0
[r1-Ethernet0]ip address 192.168.10.100 24
[r1]ip route 0.0.0.0 0 192.168.10.254
[r1]ping 192.168.10.254
PING 192.168.10.254: 56 data bytes, press CTRL_C to break
Reply from 192.168.10.254: bytes=56 Sequence=0 ttl=255 time = 5 ms
Reply from 192.168.10.254: bytes=56 Sequence=1 ttl=255 time = 3 ms
Reply from 192.168.10.254: bytes=56 Sequence=2 ttl=255 time = 3 ms
Reply from 192.168.10.254: bytes=56 Sequence=3 ttl=255 time = 3 ms
Reply from 192.168.10.254: bytes=56 Sequence=4 ttl=255 time = 3 ms
用路由器2做pc机20.100
[r2]inter e0
[r2-Ethernet0]
[r2-Ethernet0]
[r2-Ethernet0]ip address 192.168.20.100 24
[r2-Ethernet0]
%01:12:39: Line protocol ip on the interface Ethernet0 is UP
[r2-Ethernet0]quit
[r2]ip route 0 0 192.168.20.254
Bad IP address
[r2]ip route 0.0.0.0 0 192.168.20.254
测试:
[r2]ping 192.168.10.254
Pinging 192.168.10.254 with 32 bytes of data:
Reply from 192.168.10.254: bytes=32 time=2ms TTL=255
Reply from 192.168.10.254: bytes=32 time=5ms TTL=255
Reply from 192.168.10.254: bytes=32 time=5ms TTL=255
Reply from 192.168.10.254: bytes=32 time=3ms TTL=255
Ping statistics for 192.168.10.254:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 2ms, Maximum = 5ms, Average = 3ms
[r2]ping 192.168.10.100
Pinging 192.168.10.100 with 32 bytes of data:
Reply from 192.168.10.100: bytes=32 time=5ms TTL=63
Reply from 192.168.10.100: bytes=32 time=3ms TTL=63
Reply from 192.168.10.100: bytes=32 time=2ms TTL=63
Reply from 192.168.10.100: bytes=32 time=3ms TTL=63
Ping statistics for 192.168.10.100:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 2ms, Maximum = 5ms, Average = 3ms
[r2]tracert 192.168.10.100
Tracing route to 192.168.10.100 over a maximum of 30 hops
1 2 ms 1 ms 1 ms 192.168.20.254
2 2 ms 2 ms 3 ms 192.168.10.100
上一篇:自反acl配置
下一篇:Vlan间通信-三层交换机
![](https://ucenter.51cto.com/images/noavatar_middle.gif)
提问和评论都可以,用心的回复会被更多人看到
评论
发布评论
相关文章
-
Linux防火墙
Linux防火墙
Linux运维 iptables firewall firewalld -
防火墙配置与Vlan
一、整体介绍 防火墙指的是一个由软件和硬件设备组合而成、在内部网和外部网之间、专用网与公共网之间的界面上构造的保护屏障.是一种获取安全性方法的形象说法,它是一种计算机硬件和软件的结合,使Internet与Intranet之间建立起一个安全网关(Security Gateway),从而保护内部网免受非法用户的侵入,防火
防火墙配置与Vlan Linux防火墙 NAT和filter Internet NAT