actual combat | F1060 Firewall transparent mode typical networking configuration case (access)



image.png


Networking and description


image.png

Networking instructions :

This case uses H3C HCL Simulator's F1060 Firewall to simulate the transparent mode of firewall, typical networking configuration . In order to achieve PC Between each other PING through , So you need to SW1、R1 Through the routing point to achieve routing reachability .F1060 be in R1、SW1 Between , So will F1060 Configure to transparent mode , use access By R1、SW1 Transparent transmission service .

Configuration steps

1、 Configure correctly according to the network topology IP Address  

2、R1 And SW1 Running between ospf Routing protocol  

3、 take F1060 The firewall is configured in transparent mode , use access By R1、SW1 Transparent transmission service .

Configure key points
SW1:
<H3C>sys
System View: return to User View with Ctrl+Z.
[H3C]sysname SW1
[SW1]vlan 100
[SW1-vlan100]quit
[SW1]int vlan 100
[SW1-Vlan-interface100]ip address 172.16.1.1 24
[SW1-Vlan-interface100]quit
[SW1]int gi 1/0/1
[SW1-GigabitEthernet1/0/1]port link-type access
[SW1-GigabitEthernet1/0/1]port access vlan 100
[SW1-GigabitEthernet1/0/1]quit
[SW1]int gi 1/0/2
[SW1-GigabitEthernet1/0/2]port link-mode route
[SW1-GigabitEthernet1/0/2]des <connect to FW1>
[SW1-GigabitEthernet1/0/2]ip address 10.0.0.1 30
[SW1-GigabitEthernet1/0/2]quit
[SW1]int loopback 0
[SW1-LoopBack0]ip address 1.1.1.1 32
[SW1-LoopBack0]quit
[SW1]ospf 1 router-id 1.1.1.1
[SW1-ospf-1]area 0.0.0.0
[SW1-ospf-1-area-0.0.0.0]network 10.0.0.1 0.0.0.0
[SW1-ospf-1-area-0.0.0.0]network 1.1.1.1 0.0.0.0
[SW1-ospf-1-area-0.0.0.0]network 172.16.1.0 0.0.0.255
[SW1-ospf-1-area-0.0.0.0]quit
[SW1-ospf-1]quit
[SW1]
R1:
<H3C>sys
System View: return to User View with Ctrl+Z.
[H3C]sysname R1
[R1]int loopback 0
[R1-LoopBack0]ip address 2.2.2.2 32
[R1-LoopBack0]quit
[R1]int gi 0/1
[R1-GigabitEthernet0/1]ip address 192.168.1.1 24
[R1-GigabitEthernet0/1]quit
[R1]int gi 0/0
[R1-GigabitEthernet0/0]des <connect to FW1>
[R1-GigabitEthernet0/0]ip address 10.0.0.2 30
[R1-GigabitEthernet0/0]quit
[R1]ospf 1 router-id 2.2.2.2
[R1-ospf-1]area 0.0.0.0
[R1-ospf-1-area-0.0.0.0]network 10.0.0.2 0.0.0.0
[R1-ospf-1-area-0.0.0.0]network 2.2.2.2 0.0.0.0
[R1-ospf-1-area-0.0.0.0]network 192.168.1.0 0.0.0.255
[R1-ospf-1-area-0.0.0.0]quit
[R1-ospf-1]quit
FW1 Transparent mode configuration key points :
<H3C>sys
System View: return to User View with Ctrl+Z.
[H3C]sysname FW1
[FW1]vlan 10
[FW1-vlan10]quit
[FW1]int range gi 1/0/2 to gi 1/0/3
[FW1-if-range]port link-mode bridge
[FW1-if-range]port link-type access
[FW1-if-range]port access vlan 10
[FW1-if-range]quit
[FW1]security-zone name Trust
[FW1-security-zone-Trust]import interface GigabitEthernet 1/0/3 vlan 10
[FW1-security-zone-Trust]quit
[FW1]security-zone name Untrust
[FW1-security-zone-Untrust]import interface GigabitEthernet 1/0/2 vlan 10
[FW1-security-zone-Untrust]quit
[FW1]acl basic 2002
[FW1-acl-ipv4-basic-2002]rule 0 permit source any
[FW1-acl-ipv4-basic-2002]quit
[FW1]
[FW1]zone-pair security source trust destination untrust
[FW1-zone-pair-security-Trust-Untrust]packet-filter 2002
[FW1-zone-pair-security-Trust-Untrust]quit
[FW1]
[FW1]zone-pair security source untrust destination trust
[FW1-zone-pair-security-Untrust-Trust]packet-filter 2002
[FW1-zone-pair-security-Untrust-Trust]quit
[FW1]
[FW1]zone-pair security source trust destination local
[FW1-zone-pair-security-Trust-Local]packet-filter 2002
[FW1-zone-pair-security-Trust-Local]quit
[FW1]
[FW1]zone-pair security source local destination trust
[FW1-zone-pair-security-Local-Trust]packet-filter 2002
[FW1-zone-pair-security-Local-Trust]quit
[FW1]
[FW1]zone-pair security source untrust destination local
[FW1-zone-pair-security-Untrust-Local]packet-filter 2002
[FW1-zone-pair-security-Untrust-Local]quit
[FW1]
[FW1]zone-pair security source local destination untrust
[FW1-zone-pair-security-Local-Untrust]packet-filter 2002
[FW1-zone-pair-security-Local-Untrust]quit
[FW1]
[FW1]zone-pair security source trust destination trust
[FW1-zone-pair-security-Trust-Trust]packet-filter 2002
[FW1-zone-pair-security-Trust-Trust]quit
[FW1]
[FW1]zone-pair security source untrust destination untrust
[FW1-zone-pair-security-Untrust-Untrust]packet-filter 2002
[FW1-zone-pair-security-Untrust-Untrust]quit
test :
all PC Fill in all IP Address :

image.png

image.png


PC Between each other PING through :

image.png

image.png

View separately SW1、R1 Of OSPF Neighborhood information :

image.png

image.png

View separately SW1、R1 The routing table for :

image.png

image.png

see FW1 Of zone-pair:image.png

reminder : If we want to realize the remote login management of firewall , It is recommended to add a new link to the switch or router , Do out of band management .

thus ,F1060 Transparent mode typical networking configuration case (access) Completed !


 

Technology

Technique

yes

use

Come on

learn

Of

,

No

yes

use

Come on

closed

hidden

Of