交换机配置
vlan 20
quit
int e0/0/5
port link-type access
port default vlan 20
int e0/0/6
port link-type access
port default vlan 20
//如果下面配过就不用配了
#
int e0/0/4
port link-type trunk
port trunk allow-pass vlan all
#
防火墙配置
//建立vlan 20
vlan 20
quit
int vlanif 20
ip add 192.168.20.254 24
service-manage ping permit
//将vlanif20 加入trust1区
firewall zone name trust1
add int vlanif 20
配置安全策略
security-policy
rule name trust1_to_untrust1
source-zone trust1
destination-zone untrust1
action permit
//pat映射
//添加映射池
nat address-group 2v1 1
mode pat
section 0 205.1.1.100 205.1.1.100
//添加pat策略
nat-policy
rule name pat
source-zone trust1
destination-zone untrust1
action source-nat address-group 2v1
//配置黑洞路由
ip route-static 205.1.1.100 32 null 0
pc6配置
pc7配置
ping 203.1.1.1 并验证 display firewall session table