防火墙旁路部署经典使用案例

1、下面两台电脑模拟两个部门的vlan
2、最终效果是两个部门不能互通，但都能上网ping通8.8.8.8，两个部门都能绕行旁挂防火墙
3、全网跑ospf 区域0
4、两个vpn实例对应两个部门的vlan，路由表相互隔离，互不影响

R1配置 ：

dis current-configuration

interface GigabitEthernet0/0/0
ip address 10.1.200.2 255.255.255.252

interface LoopBack0
ip address 8.8.8.8 255.255.255.255

ospf 1 router-id 8.8.8.8
default-route-advertise always
import-route direct
area 0.0.0.0
network 10.1.200.2 0.0.0.0

lsw1配置

dis current-configuration

vlan batch 10 20 31 to 34 200

dhcp enable

ip vpn-instance pr
ipv4-family
route-distinguisher 65001:2

ip vpn-instance rd
ipv4-family
route-distinguisher 65001:1

interface Vlanif10
ip binding vpn-instance rd
ip address 192.168.10.254 255.255.255.0
dhcp select interface

interface Vlanif20
ip binding vpn-instance pr
ip address 192.168.20.254 255.255.255.0
dhcp select interface

interface Vlanif31
ip binding vpn-instance rd
ip address 100.1.31.1 255.255.255.252

interface Vlanif32
ip binding vpn-instance pr
ip address 100.1.32.1 255.255.255.252

interface Vlanif33
ip address 100.1.33.1 255.255.255.252

interface Vlanif34
ip address 100.1.34.1 255.255.255.252

interface Vlanif200
ip address 10.1.200.1 255.255.255.252

interface MEth0/0/1

interface Eth-Trunk1
port link-type trunk
port trunk allow-pass vlan 31 to 34
mode lacp-static

interface GigabitEthernet0/0/1
eth-trunk 1

interface GigabitEthernet0/0/2
eth-trunk 1

interface GigabitEthernet0/0/3
port link-type access
port default vlan 10

interface GigabitEthernet0/0/4
port link-type access
port default vlan 200

interface GigabitEthernet0/0/5
port link-type access
port default vlan 20

ospf 1 router-id 3.3.3.3
area 0.0.0.0
network 10.1.200.1 0.0.0.0
network 100.1.34.1 0.0.0.0
network 100.1.33.1 0.0.0.0

ospf 2 router-id 1.1.1.1 vpn-instance rd
area 0.0.0.0
network 100.1.31.1 0.0.0.0
network 192.168.10.0 0.0.0.255

ospf 3 router-id 2.2.2.2 vpn-instance pr
area 0.0.0.0
network 100.1.32.1 0.0.0.0
network 192.168.20.0 0.0.0.255

防火墙配置

dis current-configuration

vlan batch 31 to 34

ip vpn-instance pr
ipv4-family
route-distinguisher 65002:2

ip vpn-instance rd
ipv4-family
route-distinguisher 65002:1

interface Vlanif31
ip binding vpn-instance rd
ip address 100.1.31.2 255.255.255.252

interface Vlanif32
ip binding vpn-instance pr
ip address 100.1.32.2 255.255.255.252

interface Vlanif33
ip binding vpn-instance rd
ip address 100.1.33.2 255.255.255.252

interface Vlanif34
ip binding vpn-instance pr
ip address 100.1.34.2 255.255.255.252

interface Eth-Trunk1
portswitch
port link-type trunk
port trunk allow-pass vlan 31 to 34
mode lacp-static

interface GigabitEthernet1/0/0
undo shutdown
eth-trunk 1

interface GigabitEthernet1/0/1
undo shutdown
eth-trunk 1

firewall zone local
set priority 100

firewall zone trust
set priority 85
add interface Vlanif31
add interface Vlanif32

firewall zone untrust
set priority 5
add interface Vlanif33
add interface Vlanif34

ospf 1 router-id 6.6.6.6 vpn-instance rd
area 0.0.0.0
network 100.1.31.2 0.0.0.0
network 100.1.33.2 0.0.0.0

ospf 2 router-id 7.7.7.7 vpn-instance pr
area 0.0.0.0
network 100.1.32.2 0.0.0.0
network 100.1.34.2 0.0.0.0

security-policy
rule name ospf
source-zone local
source-zone trust
source-zone untrust
destination-zone local
destination-zone trust
destination-zone untrust
service ospf
action permit

rule name rd
source-zone trust
destination-zone untrust
source-address 192.168.10.0 mask 255.255.255.0
action permit

rule name pr
source-zone trust
destination-zone untrust
source-address 192.168.20.0 mask 255.255.255.0
action permit