11、中小企业网络架构-扩展配置防火墙双出口

- 日理万妓 2023-06-30 06:54 24阅读 0赞

## 网络拓扑： ##

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70][]

vlan2所在网段访问Internet的报文正常情况下流入链路ISP1;  
vlan3所在网段访问Internet的报文正常情况下流入链路ISP2;  
vlan2和vlan3所在链路互为备份，当某vlan的链路（主链路）出现故障时，流量切换到另一vlan所在的链路（备链路）上。

## 配置思路： ##

策略路由和IP-Link联动配置思路如下：

为实现不同链路分担不同流量，需要配置基于源地址的策略路由，使来自vlan2的访问Internet报文流向链路ISP1，来自vlan3的访问Internet报文流向链路ISP2。

为实现vlan2和vlan3所在链路互为备份，保证链路不中断，需要配置如下：  
配置策略路由和IP-Link联动，由IP-Link来监视vlan2和vlan3各自主链路的可达性。当主链路出现故障时，策略路由失效，设备将查找备份路由，以保持业务的持续流通。  
配置vlan2到链路ISP2的静态路由和vlan3到链路ISP1的静态路由，作为vlan2和vlan3的备份路由。同时，将静态路由与IP-Link联动，由IP-Link来监视vlan2和vlan3各自备链路的可达性。

## 操作步骤： ##

## 一、配置ISP1 ##

1、配置vlan IP

[ISP1]vlan batch  101 103
    
    [ISP1]interface  Vlanif  101
    [ISP1-Vlanif101]ip address 100.1.1.5 255.255.255.248
    [ISP1-Vlanif101]quit
    
    [ISP1]interface  Vlanif  103
    [ISP1-Vlanif103]ip address 100.1.3.5 255.255.255.248
    [ISP1-Vlanif103]quit

2、配置端口

[ISP1]interface  GigabitEthernet  0/0/1	
    [ISP1-GigabitEthernet0/0/1]port link-type access
    [ISP1-GigabitEthernet0/0/1]port default vlan 101
    [ISP1-GigabitEthernet0/0/1]quit
    
    [ISP1]interface  GigabitEthernet  0/0/2	
    [ISP1-GigabitEthernet0/0/2]port link-type access	
    [ISP1-GigabitEthernet0/0/2]port default vlan 103
    [ISP1-GigabitEthernet0/0/2]quit

3、配置静态路由

[ISP1]ip route-static 0.0.0.0 0.0.0.0 100.1.1.1

4、配置OSPF

[ISP1]ospf router-id 1.1.1.1
    [ISP1-ospf-1]area 1
    [ISP1-ospf-1-area-0.0.0.1]network 100.1.1.0 0.0.0.7
    [ISP1-ospf-1-area-0.0.0.1]network 100.1.3.0 0.0.0.7	
    [ISP1-ospf-1-area-0.0.0.1]return

## 二、配置ISP2 ##

1、配置vlan IP

[ISP2]vlan batch 102 104
    
    [ISP2]interface  Vlanif  102
    [ISP2-Vlanif102]ip address 100.1.2.5 255.255.255.248
    [ISP2-Vlanif102]quit
    
    [ISP2]interface  Vlanif  104
    [ISP2-Vlanif104]ip address 100.1.4.5 255.255.255.248
    [ISP2-Vlanif104]quit

2、配置端口

[ISP2]interface  GigabitEthernet  0/0/1	
    [ISP2-GigabitEthernet0/0/1]port link-type access	
    [ISP2-GigabitEthernet0/0/1]port default  vlan  102
    [ISP2-GigabitEthernet0/0/1]quit
    
    [ISP2]interface  GigabitEthernet  0/0/2	
    [ISP2-GigabitEthernet0/0/2]port link-type  access
    [ISP2-GigabitEthernet0/0/2]port default  vlan  104
    [ISP2-GigabitEthernet0/0/2]quit

3、配置静态路由

[ISP2]ip route-static 0.0.0.0 0.0.0.0 100.1.2.1

4、配置OSPF

[ISP2]ospf router-id 2.2.2.2
    [ISP2-ospf-1]area 1
    [ISP2-ospf-1-area-0.0.0.1]network 100.1.2.0 0.0.0.7
    [ISP2-ospf-1-area-0.0.0.1]network 100.1.4.0 0.0.0.7
    [ISP2-ospf-1-area-0.0.0.1]return

## 三、配置Internet ##

1、配置vlan IP

[Internet]vlan batch 103 104
    
    [Internet]interface  Vlanif  103
    [Internet-Vlanif103]ip address  100.1.3.1 255.255.255.248
    [Internet-Vlanif103]quit
    
    [Internet]interface  Vlanif  104
    [Internet-Vlanif104]ip address  100.1.4.1 255.255.255.248
    [Internet-Vlanif104]quit
    
    [Internet]interface  LoopBack 0
    [Internet-LoopBack0]ip address 3.3.3.3 32
    [Internet-LoopBack0]quit

2、配置端口

[Internet]interface  GigabitEthernet  0/0/1
    [Internet-GigabitEthernet0/0/1]port link-type access
    [Internet-GigabitEthernet0/0/1]port default  vlan  103
    [Internet-GigabitEthernet0/0/1]quit
    
    [Internet]interface  GigabitEthernet  0/0/
    [Internet-GigabitEthernet0/0/2]port link-type access
    [Internet-GigabitEthernet0/0/2]port default  vlan  104
    [Internet-GigabitEthernet0/0/2]quit

3、配置OSPF

[Internet]ospf router-id 3.3.3.3 
    [Internet-ospf-1]area 1
    [Internet-ospf-1-area-0.0.0.1]network 100.1.3.0 0.0.0.7
    [Internet-ospf-1-area-0.0.0.1]network 100.1.4.0 0.0.0.7
    [Internet-ospf-1-area-0.0.0.1]network 3.3.3.3 0.0.0.0
    [Internet-ospf-1-area-0.0.0.1]return

## 四、配置防火墙 ##

1、配置上联接口

[FW1]interface  GigabitEthernet  0/0/3
    [FW1-GigabitEthernet0/0/3]ip address  100.1.2.1 255.255.255.248
    [FW1-GigabitEthernet0/0/3]description connect to ISP2
    [FW1-GigabitEthernet0/0/3]quit

2、配置端口区域

[FW1]firewall zone name isp1
    [FW1-zone-isp1]set priority 10
    [FW1-zone-isp1]add interface GigabitEthernet 0/0/0
    [FW1-zone-isp1]quit
    
    [FW1]firewall zone  name isp2
    [FW1-zone-isp2]set priority 15
    [FW1-zone-isp2]add interface GigabitEthernet 0/0/3
    [FW1-zone-isp2]quit
    
    [FW1]firewall packet-filter default permit all

3、配置ACL，确定要进行策略路由转发的报文

[FW1]acl number 3001
    [FW1-acl-adv-3001]rule  permit ip source 192.168.2.0 0.0.0.255
    [FW1-acl-adv-3001]quit
    
    [FW1]acl number 3002
    [FW1-acl-adv-3002]rule  permit ip source 192.168.3.0 0.0.0.255
    [FW1-acl-adv-3002]quit

4、配置策略路由

#策略to-isp，源地址192.168.2.0/24的报文被发到下一跳100.1.1.5
    [FW1]policy-based-route to-isp permit node 5
    [FW1-policy-based-route-to-isp-5]if-match acl 3001
    [FW1-policy-based-route-to-isp-5]apply ip-address next-hop 100.1.1.5
    [FW1-policy-based-route-to-isp-5]quit
    
    #策略to-isp，源地址192.168.3.0/24的报文被发到下一跳100.1.2.5
    [FW1]policy-based-route to-isp permit node 10
    [FW1-policy-based-route-to-isp-10]if-match acl 3002
    [FW1-policy-based-route-to-isp-10]apply ip-address next-hop 100.1.2.5
    [FW1-policy-based-route-to-isp-10]quit
    
    #分别在接口应用策略路由
    [FW1]interface  GigabitEthernet  0/0/0
    [FW1-GigabitEthernet0/0/0]ip policy-based-route to-isp
    [FW1-GigabitEthernet0/0/0]quit
    
    [FW1]interface  GigabitEthernet  0/0/3
    [FW1-GigabitEthernet0/0/3]ip policy-based-route to-isp
    [FW1-GigabitEthernet0/0/3]quit

5、配置IP-Link

说明：其中大家觉得可以用NQA的，但是在防火墙上面NQA不支持关联路由，只能用IP-Link，而且IP-link技术有一个莫大的优势，就是可以跟 策略路由联动

[FW1]ip-link check  enable
    
    #侦测FW1到目的地址为100.1.1.5之间的链路可达性
    [FW1]ip-link 1 destination 100.1.1.5 interface GigabitEthernet 0/0/0 mode icmp 
    
    #侦测FW1到目的地址为100.1.2.5之间的链路可达性
    [FW1]ip-link 2 destination 100.1.2.5 interface GigabitEthernet 0/0/3 mode icmp

![20200117101719566.png][]

6、配置缺省路由，并关联IP-Link

[FW1]ip route-static 0.0.0.0 0.0.0.0 100.1.1.5 track ip-link 1
    [FW1]ip route-static 0.0.0.0 0.0.0.0 100.1.2.5 track ip-link 2

7、NAT定义

[FW1]nat-policy interzone trust isp1 outbound
    [FW1-nat-policy-interzone-trust-isp1-outbound]policy 1
    [FW1-nat-policy-interzone-trust-isp1-outbound-1]action source-nat 
    [FW1-nat-policy-interzone-trust-isp1-outbound-1]policy source 192.168.0.0 mask 16
    [FW1-nat-policy-interzone-trust-isp1-outbound-1]easy-ip GigabitEthernet0/0/0
    [FW1-nat-policy-interzone-trust-isp1-outbound-1]return
    
    [FW1]nat-policy interzone trust isp2 outbound
    [FW1-nat-policy-interzone-trust-isp2-outbound]policy 1
    [FW1-nat-policy-interzone-trust-isp2-outbound-1]action source-nat
    [FW1-nat-policy-interzone-trust-isp2-outbound-1]policy source 192.168.0.0 mask 16
    [FW1-nat-policy-interzone-trust-isp2-outbound-1]easy-ip GigabitEthernet0/0/3
    [FW1-nat-policy-interzone-trust-isp2-outbound-1]return

8、下联接口应用策略

[FW1]interface  GigabitEthernet  0/0/1
    [FW1-GigabitEthernet0/0/1]ip address 192.168.7.254 255.255.255.0
    [FW1-GigabitEthernet0/0/1]ip policy-based-route to-isp
    [FW1-GigabitEthernet0/0/1]description connecct to SW1
    [FW1-GigabitEthernet0/0/1]quit
    
    [FW1]interface  GigabitEthernet  0/0/2
    [FW1-GigabitEthernet0/0/2]ip address 192.168.6.254 255.255.255.0
    [FW1-GigabitEthernet0/0/2]ip policy-based-route to-isp
    [FW1-GigabitEthernet0/0/2]description connect to SW2
    [FW1-GigabitEthernet0/0/2]quit

## 五、故障演示 ##

1、正常状态下

vlan2所在网段访问Internet的报文正常情况下流入链路ISP1；

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 1][]

vlan3所在网段访问Internet的报文正常情况下流入链路ISP2;

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 2][]

2、手动模拟FW1上联ISP1的G0/0/1接口故障

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 3][]

查看链路，流量都走ISP2

![20200117103336503.png][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 4][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 5][]

3、手动模拟FW1上联ISP2的G0/0/1接口故障

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 6][]

查看链路，流量都走ISP1

![20200117153801547.png][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 7][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 8][]

至此，完成。

[FW1]display  current-configuration
    #
    stp region-configuration
     region-name 703bd915f09b
     active region-configuration
    #
    acl number 3001
     rule 5 permit ip source 192.168.2.0 0.0.0.255
    #
    acl number 3002
     rule 5 permit ip source 192.168.3.0 0.0.0.255
    #
    interface Vlanif1
     alias Vlanif1
    #
    interface Virtual-Template1
     alias Virtual-Template1
    #
    interface GigabitEthernet0/0/0
     description connect to ISP1
     alias GE0/MGMT
     ip address 100.1.1.1 255.255.255.248
    #
    interface GigabitEthernet0/0/1
     description connecct to SW1
     ip address 192.168.7.254 255.255.255.0
     ip policy-based-route to-isp
    #
    interface GigabitEthernet0/0/2
     description connect to SW2
     ip address 192.168.6.254 255.255.255.0
     ip policy-based-route to-isp
    #
    interface GigabitEthernet0/0/3
     description connect to ISP2
     ip address 100.1.2.1 255.255.255.248
    #
    interface GigabitEthernet0/0/4
    #
    interface GigabitEthernet0/0/5
    #
    interface GigabitEthernet0/0/6
    #
    interface GigabitEthernet0/0/7
    #
    interface GigabitEthernet0/0/8
    #
    interface NULL0
     alias NULL0
    #
    interface LoopBack0
     alias LoopBack0
     ip address 1.1.1.1 255.255.255.255
    #
    firewall zone local
     set priority 100
    #
    firewall zone trust
     set priority 85
     add interface GigabitEthernet0/0/1
     add interface GigabitEthernet0/0/2
    #
    firewall zone untrust
     description ithis
     set priority 5
    #
    firewall zone dmz
     set priority 50
    #
    firewall zone name isp1
     set priority 10
     add interface GigabitEthernet0/0/0
    #
    firewall zone name isp2
     set priority 15
     add interface GigabitEthernet0/0/3
    #
    aaa
     local-user admin password cipher %$%$y@N.>~B^$O\xLy0F^K%=rZQH%$%$
     local-user admin service-type web terminal telnet
     local-user admin level 15
     authentication-scheme default
     #
     authorization-scheme default
     #
     accounting-scheme default
     #
     domain default
     #
    #
    nqa-jitter tag-version 1
    
    #
     ip route-static 0.0.0.0 0.0.0.0 100.1.1.5 track ip-link 1
     ip route-static 0.0.0.0 0.0.0.0 100.1.2.5 track ip-link 2
     ip route-static 192.168.0.0 255.255.0.0 192.168.7.253
     ip route-static 192.168.0.0 255.255.0.0 192.168.6.253
    #
     banner enable
    #
    user-interface con 0
     authentication-mode none
    user-interface vty 0 4
     authentication-mode none
     protocol inbound all
    #
     policy-based-route to-isp permit node 5
      if-match acl 3001
      apply ip-address next-hop 100.1.1.5
     policy-based-route to-isp permit node 10
      if-match acl 3002
      apply ip-address next-hop 100.1.2.5
    #
     slb
    #
    right-manager server-group
    #
     sysname FW1
    #
     l2tp domain suffix-separator @
    #
     firewall packet-filter default permit interzone local trust direction inbound
     firewall packet-filter default permit interzone local trust direction outbound
     firewall packet-filter default permit interzone local untrust direction inbound
     firewall packet-filter default permit interzone local untrust direction outboun
    d
     firewall packet-filter default permit interzone local dmz direction inbound
     firewall packet-filter default permit interzone local dmz direction outbound
     firewall packet-filter default permit interzone local isp1 direction inbound
     firewall packet-filter default permit interzone local isp1 direction outbound
     firewall packet-filter default permit interzone local isp2 direction inbound
     firewall packet-filter default permit interzone local isp2 direction outbound
     firewall packet-filter default permit interzone trust untrust direction inbound
     firewall packet-filter default permit interzone trust untrust direction outboun
    d
     firewall packet-filter default permit interzone trust dmz direction inbound
     firewall packet-filter default permit interzone trust dmz direction outbound
     firewall packet-filter default permit interzone trust isp1 direction inbound
     firewall packet-filter default permit interzone trust isp1 direction outbound
     firewall packet-filter default permit interzone trust isp2 direction inbound
     firewall packet-filter default permit interzone trust isp2 direction outbound
     firewall packet-filter default permit interzone dmz untrust direction inbound
     firewall packet-filter default permit interzone dmz untrust direction outbound
     firewall packet-filter default permit interzone isp1 untrust direction inbound
     firewall packet-filter default permit interzone isp1 untrust direction outbound
     firewall packet-filter default permit interzone isp2 untrust direction inbound
     firewall packet-filter default permit interzone isp2 untrust direction outbound
     firewall packet-filter default permit interzone dmz isp1 direction inbound
     firewall packet-filter default permit interzone dmz isp1 direction outbound
     firewall packet-filter default permit interzone dmz isp2 direction inbound
     firewall packet-filter default permit interzone dmz isp2 direction outbound
     firewall packet-filter default permit interzone isp2 isp1 direction inbound
     firewall packet-filter default permit interzone isp2 isp1 direction outbound
    #
     ip ttl-expires enable
     ip df-unreachables enable
    #
     undo dhcp enable
    #
     firewall ipv6 session link-state check
     firewall ipv6 statistic system enable
    #
     dns resolve
    #
     vlan batch 1 101 103
    #
     firewall statistic system enable
    #
     pki ocsp response cache refresh interval 0
     pki ocsp response cache number 0
    #
     undo dns proxy
    #
     license-server domain lic.huawei.com
    #
     web-manager enable
    #
    policy interzone trust untrust inbound
     policy 1
      action permit
    #
    policy interzone trust isp1 inbound
     policy 1
      action permit
    #
    policy interzone trust isp2 inbound
     policy 1
      action permit
    #
    nat-policy interzone trust isp1 outbound
     policy 1
     description tihsi
      action source-nat
      policy source 192.168.0.0 mask 16
      easy-ip GigabitEthernet0/0/0
    #
    nat-policy interzone trust isp2 outbound
     policy 1
      action source-nat
      policy source 192.168.0.0 mask 16
      easy-ip GigabitEthernet0/0/3
    #
    return

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20200115162615457.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv,size_16,color_FFFFFF,t_70
[20200117101719566.png]: https://img-blog.csdnimg.cn/20200117101719566.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 1]: https://img-blog.csdnimg.cn/2020011713245063.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 2]: https://img-blog.csdnimg.cn/20200117151818449.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 3]: https://img-blog.csdnimg.cn/20200117102943451.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv,size_16,color_FFFFFF,t_70
[20200117103336503.png]: https://img-blog.csdnimg.cn/20200117103336503.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 4]: https://img-blog.csdnimg.cn/20200117153245943.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 5]: https://img-blog.csdnimg.cn/20200117153342127.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 6]: https://img-blog.csdnimg.cn/20200117103510233.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv,size_16,color_FFFFFF,t_70
[20200117153801547.png]: https://img-blog.csdnimg.cn/20200117153801547.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 7]: https://img-blog.csdnimg.cn/20200117153815469.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 8]: https://img-blog.csdnimg.cn/2020011715391649.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv,size_16,color_FFFFFF,t_70

发表评论取消回复

表情：

评论列表（有 0 条评论，24人围观）

还没有评论，来说两句吧...

相关阅读

相关 11、中小企业网络架构-扩展配置防火墙双出口

网络拓扑： ![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV

- 日理万妓/ 2023年06月30日 06:54/ 0 赞/ 25 阅读

相关 10、中小企业网络架构-扩展配置MSTP、VRRP负载分担

网络拓扑： ![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L

拼搏现实的明天。/ 2023年06月28日 15:28/ 0 赞/ 10 阅读

相关 8、中小企业网络架构-优化扩展配置说明

一、内网安全部署之为什么需要安全部署分析：为什么需要安全部署呢，因为在很多时候，外网到内网的攻击是很难实现的，而大部分攻击往往出现在内网里面。 1、内网随意定义地址

浅浅的花香味﹌/ 2023年06月27日 03:55/ 0 赞/ 12 阅读

相关 7、中小企业网络架构-无线接入基本配置

网络拓扑： ![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV

古城微笑少年丶/ 2023年06月26日 05:39/ 0 赞/ 12 阅读

相关 5、中小企业网络架构-核心层交换机基本配置

网络拓扑： ![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV

古城微笑少年丶/ 2023年06月25日 14:29/ 0 赞/ 22 阅读

相关 4、中小企业网络架构-汇聚层交换机基本配置

网络拓扑： ![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV

ゞ浴缸里的玫瑰/ 2023年06月25日 14:27/ 0 赞/ 27 阅读

相关 3、中小企业网络架构-接入层交换机基本配置

网络拓扑： ![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV

深碍√TFBOYSˉ_/ 2023年06月25日 12:26/ 0 赞/ 56 阅读

相关 USG5500 配置地址池和easy-ip双出口NAT

一、组网需求： 1、某公司购买了两个运营商的公网IP，使公司内部用户能够通过NAT访问互联网。但是向A运营商只购买一个公网IP，所以想配置为easy-ip的NAT模式。向

待我称王封你为后i/ 2022年05月17日 02:34/ 0 赞/ 350 阅读

相关 H3C校园网双出口配置

1、h3c路由系列产品： ER系列：低端 MSR系列：中端 SR系列：高端 h3c交换机系列： SMB交换机：s1000 接入层交换机：s3100 汇聚层交换机：s550

女爷i/ 2022年01月15日 10:17/ 0 赞/ 211 阅读

相关 H3C设备校园网双出口配置

> 博文大纲： > > 一、策略路由是什么？ > 二、配置H3C双出口。 > （1）配置Easy\_IP映射 > （2）配置策略路由

心已赠人/ 2021年11月01日 08:22/ 0 赞/ 304 阅读