Describes VLAN division and settings in layer-3 Switch configurations.

The instance explains VLAN division and configuration issues in layer-3 Switch configurations. vlan division and configuration issues cannot be avoided in layer-3 Switch configurations. Generally, there are four categories, how to retrieve it becomes a concern. This article explains how to set VLANs in depth from the principles of division, configuration ideas, and testing process.

The IP address of the DGS-3627 switch is 192.168.0.1, which is also the Virtual Interface address of VLAN40, Vlan40 and router connection. The 24 port of the DGS-3627 switch is connected to the LAN port of the router, the LAN port address of the router is 192.168.0.99, And the VLAN40 is in the same IP segment, then, how can I configure the client, layer-3 switch, and router to enable the computer to access the Internet?

VLAN division for layer-3 switches:
◆ VLAN10 Virtual interface: 192.168.1.1 switch interface: Port 1 VID: 10 interface: if10
◆ VLAN20 Virtual interface: 192.168.2.1 vswitch interface: Port 2 VID: 20 interface: if20
◆ VLAN30 Virtual interface: 192.168.3.1 vswitch interface: Port 3 VID: 30 interface: if30
◆ VLAN40 Virtual interface: 192.168.0.1 vswitch interface: Port 4-24 VID: 40 interface: system

Create a default route
Add the command create iproute default 192.168.0.99 to the vswitch

Set several static routes on the vro:
192.168.1.0/255.255.255.0 192.168.0.1
192.168.2.0/255.255.255.0 192.168.0.1
192.168.3.0/255.255.255.0 192.168.0.1

Layer-3 Switch configuration client settings, 2 CIDR blocks as an Example
Ip: 192.168.2.X
Mask: 255.255.255.0
Gw: 192.168.2.1

After a layer-3 switch is configured with a virtual interface, each Vlan can access each other. To control user access, you can use the access control list for management. In terms of access control, you can set the acl to allow all users to access the Internet:
Create access_profile ip source_ip_mask 255.255.255.0.0 destination_ip_mask 255.255.255.255 profile_id 1 permit
Config access_profile profile_id 1 add access_id 1 ip source_ip 192.168.0.0 destination_ip 192.168.0.99

All the CIDR blocks of the layer-3 Switch allow access to the public CIDR Block vlan10 of the server:
Create access_profile ip source_ip_mask 255.255.255.0.0 destination_ip_mask 255.255.255.0 profile_id 5 permit
Config access_profile profile_id 5 add access_id 1 ip source_ip 192.168.0.0 destination_ip 192.168.1.0

Layer-3 Switch configurations prohibit mutual access between VLANs:
Create access_profile ip source_ip_mask 255.255.255.0 destination_ip_mask 255.255.255.0 profile_id 10 deny
Config access_profile profile_id 10 add access_id 1 ip source_ip 192.168.2.0 destination_ip 192.168.0.0 deny
Config access_profile profile_id 10 add access_id 2 ip source_ip 192.168.2.0 destination_ip 192.168.3.0 deny
Config access_profile profile_id 10 add access_id 3 ip source_ip 192.168.0.0 destination_ip 192.168.2.0 deny
Config access_profile profile_id 10 add access_id 4 ip source_ip 192.168.0.0 destination_ip 192.168.3.0 deny
Config access_profile profile_id 10 add access_id 5 ip source_ip 192.168.3.0 destination_ip 192.168.2.0 deny
Config access_profile profile_id 10 add access_id 6 ip source_ip 192.168.3.0 destination_ip 192.168.0.0 deny