Sx300 Series Switches Typical Configuration Examples

Example for Configuring a Layer 3 Switch to Work with a Firewall for Internet Access

Layer 3 Switch

Layer 3 switches provide the routing function, which indicates a network-layer function in the OSI model.

Layer 3 switches can work at Layer 2 and Layer 3 and be deployed at the access layer or aggregation layer as user gateways.

Configuration Notes

This example uses firewall configurations of USG6650 V500R001C60. For other firewall configurations, see the corresponding documentation.

This example applies to the following products and versions when a switch functions as a DHCP server:
- V200R005C00SPC300 and later versions: S2350-EI, S5300-LI
- S2320-EI, S3300-SI, S3300-EI, S3300-HI
- S5300-SI, S5300-EI, S5300-HI, S5310-EI, S5320-LI, S5320-SI, S5320-EI, S5320-HI, S5330-SI, S5330-HI, S5331-S, S5331-H, S5332-H, S5335-L, S5335-L1, S5335-S, S5336-S
- S6300-EI, S6320-SI, S6320-EI, S6320-HI, S6330-H
- S9303, S9306, S9312, S9310, S9310X, S9300X-4, S9300X-8, S9300X-12, S9303E, S9306E, S9312E
For the product models whose applicable versions are not listed above, see Table 1 in "Applicable Products and Versions" for details.

Networking Requirements

In Figure 1-2, a company has multiple departments that belong to different network segments, and each department needs to access the Internet. It is required that users access the Internet through the Layer 3 switch and firewall and that the Layer 3 switch function as the gateway of users.

Figure 1-2 Configuring a Layer 3 switch to work with a firewall for Internet access

Configuration Roadmap

The configuration roadmap is as follows:

Configure the switch as the gateway of users to allow users to communicate across network segments through VLANIF interfaces.
Configure the switch as the DHCP server to assign IP addresses to users.
Configure an interzone security policy for the firewall so that packets of different zones can be forwarded.
Configure the PAT function on the firewall to enable intranet users to access the Internet.

Procedure

Configure the switch.

# Configure the interfaces connected to users and corresponding VLANIF interfaces.

<HUAWEI> system-view
[HUAWEI] sysname Switch
[Switch] vlan batch 2 3
[Switch] interface gigabitethernet 0/0/2
[Switch-GigabitEthernet0/0/2] port link-type access   //Set the link type of the interface to access.
[Switch-GigabitEthernet0/0/2] port default vlan 2   //Add the interface to VLAN 2.
[Switch-GigabitEthernet0/0/2] quit
[Switch] interface gigabitethernet 0/0/3
[Switch-GigabitEthernet0/0/3] port link-type access
[Switch-GigabitEthernet0/0/3] port default vlan 3   
[Switch-GigabitEthernet0/0/3] quit
[Switch] interface vlanif 2
[Switch-Vlanif2] ip address 192.168.1.1 24
[Switch-Vlanif2] quit
[Switch] interface vlanif 3
[Switch-Vlanif3] ip address 192.168.2.1 24
[Switch-Vlanif3] quit

# Configure the interface connected to the firewall and corresponding VLANIF interface.

[Switch] vlan batch 100
[Switch] interface gigabitethernet 0/0/1
[Switch-GigabitEthernet0/0/1] port link-type access
[Switch-GigabitEthernet0/0/1] port default vlan 100   
[Switch-GigabitEthernet0/0/1] quit
[Switch] interface vlanif 100
[Switch-Vlanif100] ip address 192.168.100.2 24
[Switch-Vlanif100] quit

# Configure the default route.

[Switch] ip route-static 0.0.0.0 0.0.0.0 192.168.100.1   //The next hop of the default route is the IP address 192.168.100.1 of the firewall interface.

# Configure the DHCP server.

[Switch] dhcp enable   
[Switch] interface vlanif 2
[Switch-Vlanif2] dhcp select interface   //DHCP uses an interface address pool to assign IP addresses to intranet users.
[Switch-Vlanif2] dhcp server dns-list 114.114.114.114 223.5.5.5   //The configured DNS-list 114.114.114.114 is a public DNS server address, which is the same for carriers. In practice, the DNS-list address needs to be configured based on the DNS assigned to a carrier.
[Switch-Vlanif2] quit
[Switch] interface vlanif 3
[Switch-Vlanif3] dhcp select interface
[Switch-Vlanif3] dhcp server dns-list 114.114.114.114 223.5.5.5
[Switch-Vlanif3] quit

Configure the firewall.

# Configure an IP address for the interface connected to the switch.

<USG> system-view
[USG] interface gigabitethernet 1/0/1
[USG-GigabitEthernet1/0/1] ip address 192.168.100.1 255.255.255.0   
[USG-GigabitEthernet1/0/1] quit

# Configure an IP address for the interface connected to the Internet.

[USG] interface gigabitethernet 1/0/2
[USG-GigabitEthernet1/0/2] ip address 203.0.113.2 255.255.255.0   //The IP address of the interface connected to the Internet is on the same network segment as the public IP address.
[USG-GigabitEthernet1/0/2] quit

# Configure a default route and a return route.

[USG] ip route-static 0.0.0.0 0.0.0.0 203.0.113.1   //Configure a static default route with the next hop pointing to the public IP address 203.0.113.1.
[USG] ip route-static 192.168.0.0 255.255.0.0 192.168.100.2   //Configure a return route with the next hop pointing to the IP address 192.168.100.2 of the switch's uplink interface.

# Configure security zones.

[USG] firewall zone trust   //Configure a trust zone.
[USG-zone-trust] add interface gigabitethernet 1/0/1
[USG-zone-trust] quit
[USG] firewall zone untrust   //Configure an untrust zone.
[USG-zone-untrust] add interface gigabitethernet 1/0/2
[USG-zone-untrust] quit

# Configure a security policy to allow inter-zone access.

[USG6600] security-policy
[USG6600-policy-security] rule name policy1
[USG6600-policy-security-rule-policy1] source-zone trust
[USG6600-policy-security-rule-policy1] destination-zone untrust
[USG6600-policy-security-rule-policy1] source-address 192.168.0.0 mask 255.255.0.0
[USG6600-policy-security-rule-policy1] action permit
[USG6600-policy-security-rule-policy1] quit
[USG6600-policy-security] quit

# Configure a PAT address pool to allow interface address translation.

[USG6600] nat address-group addressgroup1    
[USG6600-address-group-addressgroup1] mode pat
[USG6600-address-group-addressgroup1] route enable
[USG6600-address-group-addressgroup1] section 0 203.0.113.2 203.0.113.2    //Translated public IP address
[USG6600-address-group-addressgroup1] quit

# Configure a PAT policy so that source IP addresses are automatically translated when devices on a specified network segment of an internal network access the Internet.

[USG6600] nat-policy    
[USG6600-policy-nat] rule name policy_nat1
[USG6600-policy-nat-rule-policy_nat1] source-zone trust
[USG6600-policy-nat-rule-policy_nat1] destination-zone untrust
[USG6600-policy-nat-rule-policy_nat1] source-address 192.168.0.0 mask 255.255.0.0   //Source IP address that can be translated using PAT
[USG6600-policy-nat-rule-policy_nat1] action source-nat address-group addressgroup1
[USG6600-policy-nat-rule-policy_nat1] quit
[USG6600-policy-nat] quit
[USG6600] quit

Check the configuration.
Configure an IP address 192.168.1.2/24 and a gateway address 192.168.1.1 for PC1, and configure an IP address 192.168.2.2/24 and a gateway address 192.168.2.1 for PC2.

Configure an IP address 203.0.113.1/24 and a gateway address 203.0.113.2 for external network.

After the configurations are complete, PC1 and PC2 can ping the external network IP address 203.0.113.1/24 and access the Internet.

Configuration Files

Switch configuration file

#
sysname Switch
#
vlan batch 2 to 3 100
#
dhcp enable
#
interface Vlanif2
 ip address 192.168.1.1 255.255.255.0
 dhcp select interface
 dhcp server dns-list 114.114.114.114 223.5.5.5
#
interface Vlanif3
 ip address 192.168.2.1 255.255.255.0
 dhcp select interface
 dhcp server dns-list 114.114.114.114 223.5.5.5
#
interface Vlanif100
 ip address 192.168.100.2 255.255.255.0
#
interface GigabitEthernet0/0/1
 port link-type access
 port default vlan 100
#
interface GigabitEthernet0/0/2
 port link-type access
 port default vlan 2
#
interface GigabitEthernet0/0/3
 port link-type access
 port default vlan 3
#
ip route-static 0.0.0.0 0.0.0.0 192.168.100.1
#
return

USG configuration file

#
interface GigabitEthernet1/0/1
 ip address 192.168.100.1 255.255.255.0
#
interface GigabitEthernet0/0/2
 ip address 203.0.113.2 255.255.255.0
#
firewall zone trust
 set priority 85
 add interface GigabitEthernet1/0/1
#
firewall zone untrust
 set priority 5
 add interface GigabitEthernet0/0/2
#
 ip route-static 0.0.0.0 0.0.0.0 203.0.113.1
 ip route-static 192.168.0.0 255.255.0.0 192.168.100.2
#
nat address-group addressgroup1 0  
 mode pat 
 route enable 
 section 0 203.0.113.2 203.0.113.2     
# 
security-policy   
 rule name policy1   
  source-zone trust     
  destination-zone untrust     
  source-address 192.168.0.0 mask 255.255.0.0   
  action permit    
# 
nat-policy    
 rule name policy_nat1      
  source-zone trust 
  destination-zone untrust    
  source-address 192.168.0.0 mask 255.255.0.0    
  action source-nat address-group addressgroup1  
#   
return

Layer 3 Switch

Translation

Favorite

Download

Update Date：2024-03-14

Document ID：EDOC1000069608

Downloads：5961

Average rating：4.86Points

Digital Signature File

digtal sigature tool