Campus Network smoothwall solution-Multi-VLAN Solution

Summary:

In this article, we will discuss how to deploy the smoothwall proxy server in a typical campus network environment.

This section mainly discusses how to configure Static Routing in multiple VLANs (because of other problems such as localization, update, Port Mirroring, and Backflow ).

I have already demonstrated the situation clearly)

Campus Network Topology

Smoothwall Configuration:
Internet
Ip: 202.98.30.69
Mask: zookeeper without authorization
DG: 202.98.56.94
DNS: 61.128.128.68

LAN:

Ip: 172.16.200.1
Mask: 255.255.255.0

Core Switch configuration: (20 VLANs are divided) [size = 4] [/size]

[Color = darkred] [/color] interface "tech"
Ip address 172.16.6.1 255.255.255.0
Ip vlan name "vlan6"
!
Interface "server"
Ip address 172.16.7.1 255.255.255.0
Ip vlan name "vlan7"
!
Interface "zonghe"
Ip address 172.16.8.1 255.255.255.0
Ip vlan name "vlan8"
!
Interface "lib"
Ip address 172.16.9.1 255.255.255.0
Ip vlan name "vlan9"
!
Interface "yijiao"
Ip address 172.16.12.1 255.255.255.0
Ip vlan name "vlan12"
!
Interface "sanjiao"
Ip address 172.16.11.1 255.255.255.0
Ip vlan name "vlan11"
!
Interface "2 jiao"
Ip address 172.16.13.1 255.255.255.0
Ip vlan name "vlan13"
!
Interface jifang-5"
Ip address 172.16.14.1 255.255.255.0
Ip vlan name "vlan14"
!
Interface "art"
Ip address 172.16.15.1 255.255.255.0
Ip vlan name "vlan15"
!
Interface "vlan2"
Ip address 172.16.2.1 255.255.255.0
Ip vlan name "vlan2"
!
Interface "vlan3"
Ip address 172.16.3.1 255.255.255.0
Ip vlan name "vlan3"
!
Interface "vlan4"
Ip address 172.16.4.1 255.255.255.0
Ip vlan name "vlan4"
!
Interface "vlan5"
Ip address 172.16.5.1 255.255.255.0
Ip vlan name "vlan5"
!
Interface "vlan16"
Ip address 172.16.16.1 255.255.255.0
Ip vlan name "vlan16"
!
Interface "vlan17"
Ip address 172.16.17.1 255.255.255.0
Ip vlan name "vlan17"
!
Interface "vlan18"
Ip address 172.16.18.1 255.255.255.0
Ip vlan name "vlan18"
!
Interface "vlan19"
Ip address 172.16.19.1 255.255.255.0
Ip vlan name "vlan19"
!
Interface "vlan20"
Ip address 172.16.20.1 255.255.255.0
Ip vlan name "vlan20"
!
Interface "upload"
Ip address 172.16.200.2 255.255.255.0
Ip vlan name "upload"
!
Interface "vlan10"
Ip address 172.16.10.1 255.255.255.0
Ip vlan name "vlan10"
!

Ip route 0.0.0.0 0.0.0.0 172.16.200.1 1 low (default route)

A configures A host in vlan 7 as follows:

Ip: 172.16.7.5
Mask: 255.255.255.0
DG: 172.16.7.1
DNS: 61.128.128.68

This network can be summarized as follows:
A --- core switch ---- proxy server ---- Internet

Let's assume that we ping the data packet of DNS 61.128.128.68 of Chongqing Telecom in A for analysis.

A sends an icmp packet first to the local gateway 172.16.7.1 to check if the destination address is not the address of this network segment.

Then, the core switch sends the data packet to 172.16.200.1 Based on the default route.
SW forwards the packet to 61.128.128.68 through NAT. Through this analysis, we find that the default configuration,

The sent package can successfully reach the destination address.

What about the returned data packet? Through analysis, we know that the returned data packet can successfully reach 172.16.200.1. Is that true?

He can also return to 172.16.7.5,
Let's log on to the sw root Interface and take a look.

# Route
Kernel IP routing table
Destination Gateway Genmask Flags Metric Ref Use Iface
202.98.30.69 0.0.0.0 255.255.255.255.u 0 0 eth1
172.16.200.0 0.0.0.0 255.255.255.0 U 0 0 0 eth0
0.0.0.0 202.98.56.94 0.0.0.0 UG 0 0 0 eth1

From this routing table, we can clearly know that there are only three routes, and when the returned data packet is 172.16.200.1

The packet is discarded and cannot be returned.

Here we can solve this problem by manually adding a static route on the root Login sw.
We learned the following command through the guidance of the destiny and the flying stars outside the sky:

Route add-net 172.16.2.0 netmask 255.255.255.0 gw 172.16.200.2
Route add-net 172.16.3.0 netmask 255.255.255.0 gw 172.16.200.2
Route add-net 172.16.4.0 netmask 255.255.255.0 gw 172.16.200.2
Route add-net 172.16.5.0 netmask 255.255.255.0 gw 172.16.200.2
Route add-net 172.16.6.0 netmask 255.255.255.0 gw 172.16.200.2
Route add-net 172.16.7.0 netmask 255.255.255.0 gw 172.16.200.2
Route add-net 172.16.8.0 netmask 255.255.255.0 gw 172.16.200.2
Route add-net 172.16.8.0 netmask 255.255.255.0 gw 172.16.200.2
Route add-net 172.16.10.0 netmask 255.255.255.0 gw 172.16.200.2
Route add-net 172.16.11.0 netmask 255.255.255.0 gw 172.16.200.2
Route add-net 172.16.12.0 netmask 255.255.255.0 gw 172.16.200.2
Route add-net 172.16.w.netmask 255.255.255.0 gw 172.16.200.2
Route add-net 172.16.14.0 netmask 255.255.255.0 gw 172.16.200.2
Route add-net 172.16.15.0 netmask 255.255.255.0 gw 172.16.200.2
Route add-net 172.16.16.0 netmask 255.255.255.0 gw 172.16.200.2
Route add-net 172.16.w.netmask 255.255.255.0 gw 172.16.200.2
Route add-net 172.16.18.0 netmask 255.255.255.0 gw 172.16.200.2
Route add-net 172.16.19.0 netmask 255.255.255.0 gw 172.16.200.2
Route add-net 172.16.20.0 netmask 255.255.255.0 gw 172.16.200.2

The route information is the sw that tells us to send the data if the destination address of the returned data packet is 172.16.7.0/24.

For 172.16.200.2 (switch), you can find the corresponding Machine Based on the vlan in the switch packet.

.

In this way, every computer in our school can access the Internet.

I found a p4 1.6 + 256 M + 40g hard drive + 2 8139 Nic proxy for more than 500 computers in our school to access the Internet (online at the same time)

Generally, there are 300 servers.

When we restart sw, we will find that the route information is lost. How can we solve this problem,

In fact, the solution is the same as the solution for reflux, but the script is different. Next time I continue to write it.
Article entry: csh responsible editor: csh