CLI方式：三层直路部署典型配置

使用版本

本举例是在F1090的R8660P33版本上进行配置和验证的。

组网需求

如下图所示，Host A、Host B和Server通过Switch、Device与Internet通信，应用需求如下：

图-1 Device三层直路部署组网图

‌

配置步骤

配置Device

  1. 配置接口IP

# 配置接口GigabitEthernet1/0/1和GigabitEthernet1/0/2的IP地址。

<Device> system-view

[Device] interface gigabitethernet 1/0/1

[Device-GigabitEthernet1/0/1] ip address 20.1.1.1 24

[Device-GigabitEthernet1/0/1] quit

[Device] interface gigabitethernet 1/0/2

[Device-GigabitEthernet1/0/2] ip address 10.1.1.1 24

[Device-GigabitEthernet1/0/2] quit

  1. 配置静态路由

# 配置默认路由指导上行流量转发（此处下一跳以20.1.1.3为例，请以实际情况为准）。

[Device] ip route-static 0.0.0.0 0 20.1.1.3

  1. 配置接口加入安全域

# 将GigabitEthernet1/0/1和GigabitEthernet1/0/2分别加入安全域Untrust和Trust中。

[Device] security-zone name untrust

[Device-security-zone-Untrust] import interface gigabitethernet 1/0/1

[Device-security-zone-Untrust] quit

[Device] security-zone name trust

[Device-security-zone-Trust] import interface gigabitethernet 1/0/2

[Device-security-zone-Trust] quit

  1. 配置DHCP服务

# 配置DHCP地址池1，用来为10.1.1.0/24网段内的客户端分配IP地址和网络配置参数。

[Device] dhcp server ip-pool 1

[Device-dhcp-pool-1] network 10.1.1.0 24

[Device-dhcp-pool-1] gateway-list 10.1.1.1

[Device-dhcp-pool-1] dns-list 20.1.1.15

[Device-dhcp-pool-1] forbidden-ip 10.1.1.2

[Device-dhcp-pool-1] quit

# 开启DHCP服务。

[Device] dhcp enable

  1. 配置NAT服务

# 配置地址组0，包含外网地址20.1.1.2。

[Device] nat address-group 0

[Device-address-group-0] address 20.1.1.2 20.1.1.2

[Device-address-group-0] quit

# 配置全局NAT规则1，允许使用地址组0中的地址对匹配的报文进行源地址转换。

[Device] nat global-policy

[Device-nat-global-policy] rule name 1

[Device-nat-global-policy-rule-1] source-zone trust

[Device-nat-global-policy-rule-1] destination-zone untrust

[Device-nat-global-policy-rule-1] source-ip subnet 10.1.1.0 24

[Device-nat-global-policy-rule-1] action snat address-group 0

[Device-nat-global-policy-rule-1] quit

# 配置全局NAT规则2，允许外网主机访问20.1.1.2的21端口时进行目的地址转换，并转换为内网FTP服务器的21端口。

[Device-nat-global-policy] rule name 2

[Device-nat-global-policy-rule-2] source-zone untrust

[Device-nat-global-policy-rule-2] destination-ip host 20.1.1.2

[Device-nat-global-policy-rule-2] service ftp

[Device-nat-global-policy-rule-2] action dnat ip-address 10.1.1.2 local-port 21

[Device-nat-global-policy-rule-2] quit

[Device-nat-global-policy] quit

  1. 配置安全策略

# 配置安全策略dhcpin允许用户发送的DHCP协议报文通过。

[Device] security-policy ip

[Device-security-policy-ip] rule name dhcpin

[Device-security-policy-ip-0-dhcpin] action pass

[Device-security-policy-ip-0-dhcpin] source-zone trust

[Device-security-policy-ip-0-dhcpin] destination-zone local

[Device-security-policy-ip-0-dhcpin] service dhcp-server

[Device-security-policy-ip-0-dhcpin] quit

# 配置安全策略dhcpout允许设备回复用户的DHCP协议报文通过。

[Device-security-policy-ip] rule name dhcpout

[Device-security-policy-ip-1-dhcpout] action pass

[Device-security-policy-ip-1-dhcpout] source-zone local

[Device-security-policy-ip-1-dhcpout] destination-zone trust

[Device-security-policy-ip-0-dhcpin] service dhcp-client

[Device-security-policy-ip-1-dhcpout] quit

# 配置安全策略trust-untrust允许trust安全域源地址范围为10.1.1.0/24的用户访问untrust安全域网络。

[Device-security-policy-ip] rule name trust-untrust

[Device-security-policy-ip-2-trust-untrust] action pass

[Device-security-policy-ip-2-trust-untrust] source-zone trust

[Device-security-policy-ip-2-trust-untrust] destination-zone untrust

[Device-security-policy-ip-2-trust-untrust] source-ip-subnet 10.1.1.0 24

[Device-security-policy-ip-2-trust-untrust] quit

# 配置安全策略untrust-trust允许untrust安全域网络访问trust安全域目的地址为10.1.1.2的FTP服务器。

[Device-security-policy-ip] rule name untrust-trust

[Device-security-policy-ip-3-untrust-trust] action pass

[Device-security-policy-ip-3-untrust-trust] source-zone untrust

[Device-security-policy-ip-3-untrust-trust] destination-zone trust

[Device-security-policy-ip-3-untrust-trust] destination-ip-host 10.1.1.2

[Device-security-policy-ip-3-untrust-trust] quit

[Device-security-policy-ip] quit

验证配置

# Host A、Host B上ping测试Internet的连通性，可以ping通Internet地址20.1.1.3。

C:\>ping 20.1.1.3

Pinging 20.1.1.3 with 32 bytes of data:

Reply from 20.1.1.3: bytes=32 time=3ms TTL=254

Reply from 20.1.1.3: bytes=32 time=2ms TTL=254

Reply from 20.1.1.3: bytes=32 time=1ms TTL=254

Reply from 20.1.1.3: bytes=32 time=2ms TTL=254

 

Ping statistics for 20.1.1.3:

    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),

Approximate round trip times in milli-seconds:

    Minimum = 1ms, Maximum = 3ms, Average = 2ms

# 在Device上检查会话表，存在Host与20.1.1.3的会话表。

[Device] display session table ipv4

Slot 1:

Initiator:

  Source      IP/port: 10.1.1.6/229

  Destination IP/port: 20.1.1.3/2048

  DS-Lite tunnel peer: -

  VPN instance/VLAN ID/Inline ID: -/-/-

  Protocol: ICMP(1)

  Inbound interface: GigabitEthernet1/0/2

  Source security zone: Trust

 

Initiator:

  Source      IP/port: 10.1.1.7/229

  Destination IP/port: 20.1.1.3/2048

  DS-Lite tunnel peer: -

  VPN instance/VLAN ID/Inline ID: -/-/-

  Protocol: ICMP(1)

  Inbound interface: GigabitEthernet1/0/2

  Source security zone: Trust

 

Total sessions found: 2

# 在Device上检查NAT会话的简要信息。

[Device]display nat session brief

Slot 1:

Protocol   Source IP/port         Destination IP/port    Global IP/port

ICMP       10.1.1.6/229           20.1.1.3/2048          20.1.1.2/0

ICMP       10.1.1.7/229           20.1.1.3/2048          20.1.1.2/0

 

Total sessions found: 2

# 外网设备可以通过FTP目的地址20.1.1.2来访问内网地址为10.1.1.2的FTP服务器。

配置文件

Device

#

nat address-group 0

 address 20.1.1.2 20.1.1.2

#

 dhcp enable

#

dhcp server ip-pool 1

 gateway-list 10.1.1.1

 network 10.1.1.0 mask 255.255.255.0

 dns-list 20.1.1.15

 forbidden-ip 10.1.1.2

#

interface GigabitEthernet1/0/1

 ip address 20.1.1.1 255.255.255.0

#

interface GigabitEthernet1/0/2

 ip address 10.1.1.1 255.255.255.0

#

security-zone name Trust

 import interface GigabitEthernet1/0/2

#

security-zone name Untrust

 import interface GigabitEthernet1/0/1

#

 ip route-static 0.0.0.0 0 20.1.1.3

#

nat global-policy

 rule name 2

  service ftp

  source-zone untrust

  destination-ip host 20.1.1.2

  action dnat ip-address 10.1.1.2 local-port 21

 rule name 1

  source-zone trust

  destination-zone untrust

  source-ip subnet 10.1.1.0 24

  action snat address-group 0

#

security-policy ip

 rule 0 name dhcpin

  action pass

  source-zone trust

  destination-zone local

 rule 1 name dhcpout

  action pass

  source-zone local

  destination-zone trust

 rule 2 name trust-untrust

  action pass

  source-zone trust

  destination-zone untrust

  source-ip-subnet 10.1.1.0 255.255.255.0

 rule 3 name untrust-trust

  action pass

  source-zone untrust

  destination-zone trust

  destination-ip-host 10.1.1.2

#