ensp usg6000v 不能往外ping（基本连通配置二层接口）

 

 

防火墙配置

interface Vlanif3
 ip address 30.1.1.10 255.255.255.0
 service-manage ping permit
#
interface Vlanif20
 ip address 20.1.1.10 255.255.255.0
 service-manage ping permit
#
#
interface GigabitEthernet1/0/0
 portswitch
 undo shutdown
 port link-type access
 port default vlan 20
#
interface GigabitEthernet1/0/2
 portswitch
 undo shutdown
 port link-type trunk
 port trunk allow-pass vlan 3

#
firewall zone trust
 set priority 85
 add interface GigabitEthernet0/0/0
 add interface Vlanif20
 add interface Vlanif3
           
#
security-policy
 rule name p1
  source-zone local
  destination-zone trust
  service icmp
  action permit

交换机配置

#
interface Vlanif1
#
interface Vlanif3
 ip address 30.1.1.1 255.255.255.0
#
interface Vlanif20
 ip address 20.1.1.1 255.255.255.0
#
interface MEth0/0/1
#
interface Ethernet0/0/1
 port link-type access
 port default vlan 20
#
interface Ethernet0/0/2
 port link-type trunk
 port trunk allow-pass vlan 3
#

#

验证

从交换机ping 防火墙

<SW>ping 20.1.1.10
  PING 20.1.1.10: 56  data bytes, press CTRL_C to break
    Reply from 20.1.1.10: bytes=56 Sequence=1 ttl=255 time=30 ms
    Reply from 20.1.1.10: bytes=56 Sequence=2 ttl=255 time=30 ms
    Reply from 20.1.1.10: bytes=56 Sequence=3 ttl=255 time=30 ms
    Reply from 20.1.1.10: bytes=56 Sequence=4 ttl=255 time=10 ms
    Reply from 20.1.1.10: bytes=56 Sequence=5 ttl=255 time=30 ms

  --- 20.1.1.10 ping statistics ---
    5 packet(s) transmitted
    5 packet(s) received
    0.00% packet loss
    round-trip min/avg/max = 10/26/30 ms

<SW>ping 30.1.1.10
  PING 30.1.1.10: 56  data bytes, press CTRL_C to break
    Reply from 30.1.1.10: bytes=56 Sequence=1 ttl=255 time=50 ms
    Reply from 30.1.1.10: bytes=56 Sequence=2 ttl=255 time=40 ms
    Reply from 30.1.1.10: bytes=56 Sequence=3 ttl=255 time=50 ms
    Reply from 30.1.1.10: bytes=56 Sequence=4 ttl=255 time=20 ms
    Reply from 30.1.1.10: bytes=56 Sequence=5 ttl=255 time=30 ms

  --- 30.1.1.10 ping statistics ---
    5 packet(s) transmitted
    5 packet(s) received
    0.00% packet loss
    round-trip min/avg/max = 20/38/50 ms

从防火墙ping交换机

[USG6000V1] ping 20.1.1.1
  PING 20.1.1.1: 56  data bytes, press CTRL_C to break
    Reply from 20.1.1.1: bytes=56 Sequence=1 ttl=255 time=3 ms
    Reply from 20.1.1.1: bytes=56 Sequence=2 ttl=255 time=21 ms
    Reply from 20.1.1.1: bytes=56 Sequence=3 ttl=255 time=17 ms
    Reply from 20.1.1.1: bytes=56 Sequence=4 ttl=255 time=14 ms
    Reply from 20.1.1.1: bytes=56 Sequence=5 ttl=255 time=9 ms

  --- 20.1.1.1 ping statistics ---
    5 packet(s) transmitted
    5 packet(s) received
    0.00% packet loss
    round-trip min/avg/max = 3/12/21 ms

[USG6000V1]ping 30.1.1.1
  PING 30.1.1.1: 56  data bytes, press CTRL_C to break
    Reply from 30.1.1.1: bytes=56 Sequence=1 ttl=255 time=20 ms
    Reply from 30.1.1.1: bytes=56 Sequence=2 ttl=255 time=21 ms
    Reply from 30.1.1.1: bytes=56 Sequence=3 ttl=255 time=15 ms
    Reply from 30.1.1.1: bytes=56 Sequence=4 ttl=255 time=11 ms
    Reply from 30.1.1.1: bytes=56 Sequence=5 ttl=255 time=6 ms

  --- 30.1.1.1 ping statistics ---
    5 packet(s) transmitted
    5 packet(s) received
    0.00% packet loss
    round-trip min/avg/max = 6/14/21 ms