No relevant resource is found in the selected language.

This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Read our privacy policy>Search

Reminder

To have a better experience, please upgrade your IE browser.

upgrade

AR100-S, AR110-S, AR120-S, AR150-S, AR160-S, AR200-S, AR1200-S, AR2200-S, and AR3200-S V200R009 CLI-based Configuration Guide - Ethernet Switching

Rate and give feedback:
Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).
Example for Configuring a Traffic Policy to Implement Inter-VLAN Layer 3 Isolation

Example for Configuring a Traffic Policy to Implement Inter-VLAN Layer 3 Isolation

Networking Requirements

As shown in Figure 3-23, to ensure communication security, a company assigns visitors, employees, and servers to VLAN 10, VLAN 20, and VLAN 30 respectively. The requirements are as follows:

  • Employees, visitors, and servers can access the Internet.
  • Visitors can access only the Internet, and cannot communicate with employees in any other VLANs.
  • Employee A can access all resources in the server area, and other employees can access port 21 (FTP service) of server A.
Figure 3-23  Configuring a traffic policy to implement inter-VLAN Layer 3 isolation

Configuration Roadmap

The configuration roadmap is as follows:

  1. Create VLANs and add interfaces to the VLANs to implement Layer 2 isolation of visitors, employees, and servers.

  2. Configure VLANIF interfaces and assign IP addresses to them to implement Layer 3 connectivity between employees, servers, and visitors.

  3. Configure a routing protocol so that visitors, employees, and servers can access the Internet through the Router.

  4. Configure and apply a traffic policy so that employee A can access all resources in the server area, other employees can access only port 21 (FTP service) of server A, employees can access only servers, and visitors can access only the Internet.

Procedure

  1. Create VLANs and add interfaces to the VLANs to implement Layer 2 isolation of visitors, employees, and servers.

    # Create VLAN 10 on Router_1, add Eth2/0/1 to VLAN 10 in untagged mode and Eth2/0/2 to VLAN 10 in tagged mode. The configurations of Router_2 and Router_3 are similar to the configuration of Router_1, and are not mentioned here.

    <Huawei> system-view
    [Huawei] sysname Router_1
    [Router_1] vlan batch 10
    [Router_1] interface ethernet 2/0/1
    [Router_1-Ethernet2/0/1] port link-type access
    [Router_1-Ethernet2/0/1] port default vlan 10
    [Router_1-Ethernet2/0/1] quit
    [Router_1] interface ethernet 2/0/2
    [Router_1-Ethernet2/0/2] port link-type trunk
    [Router_1-Ethernet2/0/2] port trunk allow-pass vlan 10
    [Router_1-Ethernet2/0/2] quit

    # Create VLAN 10, VLAN 20, VLAN 30, and VLAN 100 on Router_4, and add Eth2/0/1-Eth2/0/4 to VLAN 10, VLAN 20, VLAN 30, and VLAN 100 in tagged mode.

    <Huawei> system-view
    [Huawei] sysname Router_4
    [Router_4] vlan batch 10 20 30 100
    [Router_4] interface ethernet 2/0/1
    [Router_4-Ethernet2/0/1] port link-type trunk
    [Router_4-Ethernet2/0/1] port trunk allow-pass vlan 10
    [Router_4-Ethernet2/0/1] quit
    [Router_4] interface ethernet 2/0/2
    [Router_4-Ethernet2/0/2] port link-type trunk
    [Router_4-Ethernet2/0/2] port trunk allow-pass vlan 20
    [Router_4-Ethernet2/0/2] quit
    [Router_4] interface ethernet 2/0/3
    [Router_4-Ethernet2/0/3] port link-type trunk
    [Router_4-Ethernet2/0/3] port trunk allow-pass vlan 30
    [Router_4-Ethernet2/0/3] quit
    [Router_4] interface ethernet 2/0/4
    [Router_4-Ethernet2/0/4] port link-type trunk
    [Router_4-Ethernet2/0/4] port trunk allow-pass vlan 100
    [Router_4-Ethernet2/0/4] quit
    

  2. Configure VLANIF interfaces and assign IP addresses to them to implement Layer 3 connectivity between employees, servers, and visitors.

    # On Router_4, Create VLAN 10, VLAN 20, VLAN 30, and VLAN 100 and assign IP addresses of 10.1.1.1/24, 10.1.2.1/24, 10.1.3.1/24, and 10.1.100.1/24 to them respectively.

    [Router_4] interface vlanif 10
    [Router_4-Vlanif10] ip address 10.1.1.1 24
    [Router_4-Vlanif10] quit
    [Router_4] interface vlanif 20
    [Router_4-Vlanif20] ip address 10.1.2.1 24
    [Router_4-Vlanif20] quit
    [Router_4] interface vlanif 30
    [Router_4-Vlanif30] ip address 10.1.3.1 24
    [Router_4-Vlanif30] quit
    [Router_4] interface vlanif 100
    [Router_4-Vlanif100] ip address 10.1.100.1 24
    [Router_4-Vlanif100] quit
    

  3. Configure a routing protocol so that visitors, employees, and servers can access the Internet through the Router.

    # Configure basic OSPF functions on Router_4 and configure OSPF to advertise network segments of hosts and the network segment between Router_4 and the router.

    [Router_4] ospf
    [Router_4-ospf-1] area 0
    [Router_4-ospf-1-area-0.0.0.0] network 10.1.1.0 0.0.0.255
    [Router_4-ospf-1-area-0.0.0.0] network 10.1.2.0 0.0.0.255
    [Router_4-ospf-1-area-0.0.0.0] network 10.1.3.0 0.0.0.255
    [Router_4-ospf-1-area-0.0.0.0] network 10.1.100.0 0.0.0.255
    [Router_4-ospf-1-area-0.0.0.0] quit
    [Router_4-ospf-1] quit
    
    NOTE:
    Perform the following configurations on the Router:
    • Add the interface connected to the Router to VLAN 100 in tagged mode and specify an IP address for VLANIF 100 on the same network segment as 10.1.100.1.
    • Configure basic OSPF functions and configure OSPF to advertise the network segment between the Router and router_4.

    For details, see the router documentation.

  4. Configure and apply a traffic policy to control access of employees, visitors, and servers.

    1. Configure ACLs to define flows.

      # Configure ACL 3000 on Router_4 to prevent visitors from accessing employees' PCs and servers.

      [Router_4] acl 3000
      [Router_4-acl-adv-3000] rule deny ip destination 10.1.2.1 0.0.0.255
      [Router_4-acl-adv-3000] rule deny ip destination 10.1.3.1 0.0.0.255
      [Router_4-acl-adv-3000] quit

      # Configure ACL 3001 on Router_4 so that employee A can access all resources in the server area and other employees can access only port 21 of server A.

      [Router_4] acl 3001
      [Router_4-acl-adv-3001] rule permit tcp destination 10.1.3.2 0 destination-port eq 21
      [Router_4-acl-adv-3001] rule permit ip source 10.1.2.2 0 destination 10.1.3.1 0.0.0.255
      [Router_4-acl-adv-3001] rule deny ip destination 10.1.3.1 0.0.0.255
      [Router_4-acl-adv-3001] quit
    2. Configure traffic classifiers to differentiate different flows.

      # Configure traffic classifiers c_custom, and c_staff on Router_4 and reference ACLs 3000, and 3001 in the traffic classifiers respectively.

      [Router_4] traffic classifier c_custom
      [Router_4-classifier-c_custom] if-match acl 3000
      [Router_4-classifier-c_custom] quit
      [Router_4] traffic classifier c_staff
      [Router_4-classifier-c_staff] if-match acl 3001
      [Router_4-classifier-c_staff] quit
    3. Configure a traffic behavior and define an action.

      # Configure a traffic behavior named b1 on Router_4 and define the permit action.

      [Router_4] traffic behavior b1
      [Router_4-behavior-b1] permit
      [Router_4-behavior-b1] quit
    4. Configure traffic policies and associate traffic classifiers with the traffic behavior in the traffic policies.

      # Create traffic policies p_custom, and p_staff on Router_4, and associate traffic classifiers c_custom, and c_staff with traffic behavior b1.

      [Router_4] traffic policy p_custom
      [Router_4-trafficpolicy-p_custom] classifier c_custom behavior b1
      [Router_4-trafficpolicy-p_custom] quit
      [Router_4] traffic policy p_staff
      [Router_4-trafficpolicy-p_staff] classifier c_staff behavior b1
      [Router_4-trafficpolicy-p_staff] quit
      
    5. Apply the traffic policies to control access of employees, visitors, and servers.

      # On Router_4, apply traffic policies p_custom, and p_staff in the inbound direction of VLANIF 10, and VLANIF 20 respectively.

      [Router_4] interface vlanif 10
      [Router_4-Vlanif10] traffic-policy p_custom inbound
      [Router_4-Vlanif10] quit
      [Router_4] interface vlanif 20
      [Router_4-Vlanif20] traffic-policy p_staff inbound
      [Router_4-Vlanif20] quit
      

  5. Verify the configuration.

    # Configure the IP address of 10.1.1.2 and default gateway address of 10.1.1.1/24 (VLANIF 10's IP address) for visitor A; configure the IP address of 10.1.2.2 and default gateway address of 10.1.2.1/24 (VLANIF 20's IP address) for employee A; configure the IP address of 10.1.2.3 and default gateway address of 10.1.2.1/24 (VLANIF 20's IP address) for employee B; configure the IP address of 10.1.3.2 and default gateway address of 10.1.3.1/24 (VLANIF 30's IP address) for server A.

    # After the configuration is complete, the following situations occur:
    • Visitor A fails to ping employee A or server A, and employee A and server A fail to ping visitor A.
    • Employee A can successfully ping server A. That is, employee A can use server A and the FTP service of server A.
    • Employee B fails to ping server A, and can only use the FTP service of server A.
    • Visitors, employees A and B, server A all can ping 10.1.100.2/24, IP address of the router interface connected to Router_4. That is, they can access the Internet.

Configuration Files

  • Router_1 configuration file

    #
    sysname Router_1
    #
    vlan batch 10
    #
    interface Ethernet2/0/1
     port link-type access
     port default vlan 10
    #
    interface Ethernet2/0/2
     port link-type trunk
     port trunk allow-pass vlan 10
    #
    return
    
  • Router_2 configuration file

    #
    sysname Router_2
    #
    vlan batch 20
    #
    interface Ethernet2/0/1
     port link-type access
     port default vlan 20
    #
    interface Ethernet2/0/2
     port link-type access
     port default vlan 20
    #
    interface Ethernet2/0/3
     port link-type trunk
     port trunk allow-pass vlan 20
    #
    return
    
  • Router_3 configuration file

    #
    sysname Router_3
    #
    vlan batch 30
    #
    interface Ethernet2/0/1
     port link-type access
     port default vlan 30
    #
    interface Ethernet2/0/2
     port link-type trunk
     port trunk allow-pass vlan 30
    #
    return
    
  • Router_4 configuration file

    #
    sysname Router_4
    #
    vlan batch 10 20 30 100
    #
    acl number 3000
     rule 5 deny ip destination 10.1.2.0 0.0.0.255
     rule 10 deny ip destination 10.1.3.0 0.0.0.255
    acl number 3001
     rule 5 permit tcp destination 10.1.3.2 0 destination-port eq ftp 
     rule 10 permit ip source 10.1.2.2 0 destination 10.1.3.0 0.0.0.255
     rule 15 deny ip destination 10.1.3.0 0.0.0.255
    #
    traffic classifier c_custom operator and
     if-match acl 3000
    traffic classifier c_staff operator and
     if-match acl 3001
    #
    traffic behavior b1
     permit
    #
    traffic policy p_custom
     classifier c_custom behavior b1
    traffic policy p_staff
     classifier c_staff behavior b1
    #
    interface Vlanif10
     ip address 10.1.1.1 255.255.255.0
     traffic-policy p_custom inbound
    #
    interface Vlanif20
     ip address 10.1.2.1 255.255.255.0
     traffic-policy p_staff inbound
    #
    interface Vlanif30
     ip address 10.1.3.1 255.255.255.0
    #
    interface Vlanif100
     ip address 10.1.100.1 255.255.255.0
    #
    interface Ethernet2/0/1
     port link-type trunk
     port trunk allow-pass vlan 10
    #
    interface Ethernet2/0/2
     port link-type trunk
     port trunk allow-pass vlan 20
    #
    interface Ethernet2/0/3
     port link-type trunk
     port trunk allow-pass vlan 30
    #
    interface Ethernet2/0/4
     port link-type trunk
     port trunk allow-pass vlan 100
    #
    ospf 1
     area 0.0.0.0
      network 10.1.1.0 0.0.0.255
      network 10.1.2.0 0.0.0.255
      network 10.1.3.0 0.0.0.255
      network 10.1.100.0 0.0.0.255
    #
    return
    
Translation
Download
Updated: 2019-05-17

Document ID: EDOC1000174108

Views: 56702

Downloads: 42

Average rating:
This Document Applies to these Products
Related Documents
Related Version
Share
Previous Next