华为设备配置策略路由引流到旁挂防火墙

1. 配置各接口IP地址和路由
   [LSW1]vlan batch 10 20 30 40
   [LSW1-GigabitEthernet0/0/2]port link-type trunk
   [LSW1-GigabitEthernet0/0/2]port trunk allow-pass vlan 10
   [LSW1-GigabitEthernet0/0/2]port trunk pvid vlan 10
   [LSW1-GigabitEthernet0/0/1]port link-type trunk
   [LSW1-GigabitEthernet0/0/1]port trunk pvid vlan 20
   [LSW1-GigabitEthernet0/0/1]port trunk allow-pass vlan 20
   [LSW1-GigabitEthernet0/0/3]port link-type trunk
   [LSW1-GigabitEthernet0/0/3]port trunk pvid vlan 30
   [LSW1-GigabitEthernet0/0/3]port trunk allow-pass vlan 30
   [LSW1-GigabitEthernet0/0/4]port link-type trunk
   [LSW1-GigabitEthernet0/0/4]port trunk allow-pass vlan 40
   [LSW1-GigabitEthernet0/0/4]port trunk pvid vlan 40
   [LSW1-Vlanif10]ip add 10.1.1.1 24
   [LSW1-Vlanif20]ip add 10.1.2.1 24
   [LSW1-Vlanif30]ip add 10.1.3.1 24
   [LSW1-Vlanif40]ip add 10.1.4.1 24
   [LSW2]vlan batch 10
   [LSW2-GigabitEthernet0/0/1]port link-type trunk
   [LSW2-GigabitEthernet0/0/1]port trunk allow-pass vlan 10
   [LSW2-GigabitEthernet0/0/1]port trunk pvid vlan 10
   [LSW2-GigabitEthernet0/0/2]port link-type access
   [LSW2-GigabitEthernet0/0/2]port default vlan 10
   [LSW2-GigabitEthernet0/0/3]port link-type access
   [LSW2-GigabitEthernet0/0/3]port default vlan 10
   [LSW2-Vlanif10]ip add 10.1.1.2 24
   
   

[FW1-GigabitEthernet1/0/1]ip add 10.1.3.3 24
[FW1-GigabitEthernet1/0/0]ip add 10.1.4.3 24
[AR1-GigabitEthernet0/0/0]ip add 10.1.2.4 24
2. 配置路由
[FW1]security-policy
[FW1-policy-security]rule name ttou
[FW1-policy-security-rule-ttou]source-zone trust
[FW1-policy-security-rule-ttou]source-address 10.1.1.0 24
[FW1-policy-security-rule-ttou]destination-zone untrust
[FW1-policy-security-rule-ttou]destination-address any
[FW1-policy-security-rule-ttou]action permit
[FW1-policy-security]rule name utot
[FW1-policy-security-rule-utot]destination-zone trust
[FW1-policy-security-rule-utot]destination-address 10.1.1.0 24
[FW1-policy-security-rule-utot]source-zone untrust
[FW1-policy-security-rule-utot]source-address any
[FW1-policy-security-rule-utot]action permit
[FW1]ospf 10
[FW1-ospf-10]area 0
[FW1-ospf-10-area-0.0.0.0]network 10.1.4.0 0.0.0.255
[FW1]ospf 20
[FW1-ospf-20]area 0
[FW1-ospf-20-area-0.0.0.0]network 10.1.3.0 0.0.0.255
[LSW1]ospf 10
[LSW1-ospf-10]area 0
[LSW1-ospf-10-area-0.0.0.0]network 10.1.1.0 0.0.0.255
[LSW1-ospf-10-area-0.0.0.0]network 10.1.4.0 0.0.0.255
[LSW1]ospf 20
[LSW1-ospf-20]area 0
[LSW1-ospf-20-area-0.0.0.0]network 10.1.2.0 0.0.0.255
[LSW1-ospf-20-area-0.0.0.0]network 10.1.3.0 0.0.0.255
3. 配置策略路由，将所有外网进入内网的流量重定向到防火墙进行安全检测
[LSW1]traffic classifier a1
[LSW1-classifier-a1]if-match any
[LSW1]traffic behavior b1
[LSW1-behavior-b1]redirect ip-nexthop 10.1.3.3
[LSW1]traffic policy c1
[LSW1-trafficpolicy-c1]classifier a1 behavior b1
[LSW1-GigabitEthernet0/0/1]traffic-policy c1 inbound
4. 验证配置