交換機VRF，防火牆旁掛

2.2.1  組網需求

Host A、Host B和Host C通過接入交換機Switch、路由器Router與Internet通信。出於安全考慮，需要在路由器Router上部署SecBlade插卡Device起安全防護作用，應用需求如下：

·     Switch將Host A、Host B和Host C分別劃分在VLAN 10、VLAN 20和VLAN 30，透傳Host與Internet之間的流量。

·     Router與Host、Internet和Device三層對接，下行口和Route-Aggregation1.100劃分在VPN host，上行口和Route-Aggregation1.200劃分在VPN internet，查靜態路由表轉發Host與Internet之間的流量。

·     Device與Router三層對接，查靜態路由表轉發Host與Internet之間的流量。

圖2-2 三層直路部署SecBlade插卡（劃分VRF）組網圖

‌

2.2.2  配置步驟

1. 配置Switch

# 創建VLAN 10、VLAN 20和VLAN 30，將GigabitEthernet1/0/1、GigabitEthernet1/0/2和GigabitEthernet1/0/3分別加入VLAN 10、VLAN 20和VLAN 30。

<Switch> system-view

[Switch] vlan 10

[Switch-vlan10] port gigabitethernet 1/0/1

[Switch-vlan10] quit

[Switch] vlan 20

[Switch-vlan20] port gigabitethernet 1/0/2

[Switch-vlan20] quit

[Switch] vlan 30

[Switch-vlan30] port gigabitethernet 1/0/3

[Switch-vlan30] quit

# 將GigabitEthernet1/0/4的鏈路類型配置為Trunk，並允許VLAN 10、VLAN 20和VLAN 30的報文通過。

[Switch] interface gigabitethernet 1/0/4

[Switch-GigabitEthernet1/0/4] port link-type trunk

[Switch-GigabitEthernet1/0/4] port trunk permit vlan 10 20 30

[Switch-GigabitEthernet1/0/4] quit

2. 配置Router

# 創建VPN實例host與internet。

[Router] ip vpn-instance host

[Router-vpn-instance-host] quit

[Router] ip vpn-instance internet

[Router-vpn-instance-internet] quit

# 創建三層聚合接口1。

[Router] interface route-aggregation 1

[Router-Route-Aggregation1] quit

# 創建三層聚合子接口Route-Aggregation1.100和Route-Aggregation1.200，開啟Dot1q終結功能，分別終結VLAN 100和VLAN 200，綁定VPN實例並配置接口IP。

[Router] interface route-aggregation 1.100

[Router-Route-Aggregation1.100] vlan-type dot1q vid 100

[Router-Route-Aggregation1.100] ip binding vpn-instance host

[Router-Route-Aggregation1.100] ip address 10.1.1.1 30

[Router-Route-Aggregation1.100] quit

[Router] interface route-aggregation 1.200

[Router-Route-Aggregation1.200] vlan-type dot1q vid 200

[Router-Route-Aggregation1.200] ip binding vpn-instance internet

[Router-Route-Aggregation1.200] ip address 10.1.1.6 30

[Router-Route-Aggregation1.200] quit

# 將FortyGigE2/0/1和FortyGigE2/0/2加入到聚合組1中。

[Router] interface range fortygige 2/0/1 fortygige 2/0/2

[Router-if-range] port link-aggregation group 1

[Router-if-range] quit

# 創建三層子接口GigabitEthernet1/0/1.10、GigabitEthernet1/0/1.20和GigabitEthernet1/0/1.30，開啟Dot1q終結功能，分別終結VLAN 10、VLAN 20和VLAN 30，綁定VPN實例並配置接口IP。

[Router] interface gigabitethernet 1/0/1.10

[Router-GigabitEthernet1/0/1.10] vlan-type dot1q vid 10

[Router-GigabitEthernet1/0/1.10] ip binding vpn-instance host

[Router-GigabitEthernet1/0/1.10] ip address 192.168.10.1 24

[Router-GigabitEthernet1/0/1.10] quit

[Router] interface gigabitethernet 1/0/1.20

[Router-GigabitEthernet1/0/1.20] vlan-type dot1q vid 20

[Router-GigabitEthernet1/0/1.20] ip binding vpn-instance host

[Router-GigabitEthernet1/0/1.20] ip address 192.168.20.1 24

[Router-GigabitEthernet1/0/1.20] quit

[Router] interface gigabitethernet 1/0/1.30

[Router-GigabitEthernet1/0/1.30] vlan-type dot1q vid 30

[Router-GigabitEthernet1/0/1.30] ip binding vpn-instance host

[Router-GigabitEthernet1/0/1.30] ip address 192.168.30.1 24

[Router-GigabitEthernet1/0/1.30] quit

# 配置GigabitEthernet1/0/2接口IP，綁定VPN實例。

[Router] interface gigabitethernet 1/0/2

[Router-GigabitEthernet1/0/2] ip binding vpn-instance internet

[Router-GigabitEthernet1/0/2] ip address 20.1.1.1 24

[Router-GigabitEthernet1/0/2] quit

# 配置靜態路由指導上下行流量轉發。

[Router] ip route-static vpn-instance host 20.1.1.0 24 vpn-instance host 10.1.1.2

[Router] ip route-static vpn-instance internet 192.168.10.0 24 vpn-instance internet 10.1.1.5

[Router] ip route-static vpn-instance internet 192.168.20.0 24 vpn-instance internet 10.1.1.5

[Router] ip route-static vpn-instance internet 192.168.30.0 24 vpn-instance internet 10.1.1.5

3. 配置Device

# 創建三層聚合接口1。

<Device> system-view

[Device] interface route-aggregation 1

[Device-Route-Aggregation1] quit

# 創建三層聚合子接口Route-Aggregation1.100和Route-Aggregation1.200，開啟Dot1q終結功能，分別終結VLAN 100和VLAN 200，並配置接口IP。

[Device] interface route-aggregation 1.100

[Device-Route-Aggregation1.100] vlan-type dot1q vid 100

[Device-Route-Aggregation1.100] ip address 10.1.1.2 30

[Device-Route-Aggregation1.100] quit

[Device] interface route-aggregation 1.200

[Device-Route-Aggregation1.200] vlan-type dot1q vid 200

[Device-Route-Aggregation1.200] ip address 10.1.1.5 30

[Device-Route-Aggregation1.200] quit

# 將FortyGigE1/0/1和FortyGigE1/0/2加入到聚合組1中。

[Device] interface range fortygige 1/0/1 fortygige 1/0/2

[Device-if-range] port link-aggregation group 1

[Device-if-range] quit

# 將Route-Aggregation1.100和Route-Aggregation1.200分別加入安全域Trust和Untrust中。

[Device] security-zone name trust

[Device-security-zone-Trust] import interface route-aggregation 1.100

[Device-security-zone-Trust] quit

[Device] security-zone name untrust

[Device-security-zone-Untrust] import interface route-aggregation 1.200

[Device-security-zone-Untrust] quit

# 配置安全策略允許域間報文通過。

[Device] security-policy ip

[Device-security-policy-ip] rule name trust-untrust

[Device-security-policy-ip-0-trust-untrust] action pass

[Device-security-policy-ip-0-trust-untrust] source-zone trust

[Device-security-policy-ip-0-trust-untrust] destination-zone untrust

[Device-security-policy-ip-0-trust-untrust] quit

[Device-security-policy-ip] rule name untrust-trust

[Device-security-policy-ip-1-untrust-trust] action pass

[Device-security-policy-ip-1-untrust-trust] source-zone untrust

[Device-security-policy-ip-1-untrust-trust] destination-zone trust

[Device-security-policy-ip-1-untrust-trust] quit

[Device-security-policy-ip] quit

# 配置靜態路由指導上下行流量轉發。

[Device] ip route-static 192.168.10.0 24 10.1.1.1

[Device] ip route-static 192.168.20.0 24 10.1.1.1

[Device] ip route-static 192.168.30.0 24 10.1.1.1

[Device] ip route-static 20.1.1.0 24 10.1.1.6

2.2.3  驗證配置

# Host A上ping測試Internet的連通性，可以ping通Internet地址20.1.1.1。

C:\>ping 20.1.1.1

Pinging 20.1.1.1 with 32 bytes of data:

Reply from 20.1.1.1: bytes=32 time=3ms TTL=254

Reply from 20.1.1.1: bytes=32 time=2ms TTL=254

Reply from 20.1.1.1: bytes=32 time=1ms TTL=254

Reply from 20.1.1.1: bytes=32 time=2ms TTL=254

Ping statistics for 20.1.1.1:

    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

    Minimum = 1ms, Maximum = 3ms, Average = 2ms

# Host B上ping測試Internet的連通性，可以ping通Internet地址20.1.1.1。

C:\>ping 20.1.1.1

Pinging 20.1.1.1 with 32 bytes of data:

Reply from 20.1.1.1: bytes=32 time=3ms TTL=254

Reply from 20.1.1.1: bytes=32 time=2ms TTL=254

Reply from 20.1.1.1: bytes=32 time=1ms TTL=254

Reply from 20.1.1.1: bytes=32 time=2ms TTL=254

Ping statistics for 20.1.1.1:

    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

    Minimum = 1ms, Maximum = 3ms, Average = 2ms

# Host C上ping測試Internet的連通性，可以ping通Internet地址20.1.1.1。

C:\>ping 20.1.1.1

Pinging 20.1.1.1 with 32 bytes of data:

Reply from 20.1.1.1: bytes=32 time=3ms TTL=254

Reply from 20.1.1.1: bytes=32 time=2ms TTL=254

Reply from 20.1.1.1: bytes=32 time=1ms TTL=254

Reply from 20.1.1.1: bytes=32 time=2ms TTL=254

Ping statistics for 20.1.1.1:

    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

    Minimum = 1ms, Maximum = 3ms, Average = 2ms

# 在Device上檢查會話表，存在Host與20.1.1.1的會話表。

[Device] display session table ipv4

Slot 1:

Initiator:

  Source      IP/port: 192.168.10.15/12005

  Destination IP/port: 20.1.1.1/2048

  DS-Lite tunnel peer: -

  VPN instance/VLAN ID/Inline ID: -/-/-

  Protocol: ICMP(1)

  Inbound interface: Route-Aggregation1.100

  Source security zone: Trust

Initiator:

  Source      IP/port: 192.168.20.15/12005

  Destination IP/port: 20.1.1.1/2048

  DS-Lite tunnel peer: -

  VPN instance/VLAN ID/Inline ID: -/-/-

  Protocol: ICMP(1)

  Inbound interface: Route-Aggregation1.100

  Source security zone: Trust

Initiator:

  Source      IP/port: 192.168.30.15/12005

  Destination IP/port: 20.1.1.1/2048

  DS-Lite tunnel peer: -

  VPN instance/VLAN ID/Inline ID: -/-/-

  Protocol: ICMP(1)

  Inbound interface: Route-Aggregation1.100

  Source security zone: Trust