Switch configuration: layer-3 Core + Firewall

Source: Internet
Author: User

Layer-3 egress connection to the internal port of the firewall

It is recommended that layer-3 core switches use VLAN1 to connect to the firewall's internal port. The Intranet access to the Internet may be slow due to IP redirection !!

The specific examples and solutions are as follows:

The core of a certain Enterprise Network is 4506, And the access is basically 2950 series. The core is an X 4548 GB & nbs p;-RJ Business Board, with 48 ports uplinked to the firewall and others downlink to the client. The client gateway points to the core switch, which slows down the Internet access. Direct to the firewall, the speed is normal, and the firewall address is 172.16.1.1 core configuration is as follows:

core_switch#show run
Building configuration...
Current configuration : 6061 bytes
!
version 12.1
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
service compress-config
!
hostname core_switch
!
enable secret 5 $1$21p4$rcisbziyY7iFWx0w7jm6d.
enable password kindy
!
vtp mode transparent
ip subnet-zero
!
spanning-tree extend system-id
!
!
vlan 2
name vlan2
!
interface GigabitEthernet1/1
!
interface GigabitEthernet1/2
!
interface GigabitEthernet2/1
description To ZXC
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet2/2
description To HYS-310
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet2/3
description To HYS-303
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet2/4
description To PGZ
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet2/5
description To WLZ
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet2/6
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet3/1
description To BACK_24
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet3/2
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet3/3
!
interface GigabitEthernet3/4
!
interface GigabitEthernet3/5
!
interface GigabitEthernet3/6
!
interface GigabitEthernet4/1
switchport trunk encapsulation dot1q
switchport mode trunk
!
....
....
....
!
interface GigabitEthernet4/47
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet4/48
!
interface Vlan1
ip address 172.16.1.121 255.255.255.0
!
interface Vlan2
ip address 172.16.2.1 255.255.255.0
!
ip classless
ip route 0.0.0.0 0.0.0.0 172.16.1.1
no ip http server
!
!
!
line con 0
password ******
login
stopbits 1
line vty 0 4
password ******
login
!
end

--------------------------------------------

Because the above configuration is to directly connect the firewall's internal port to the layer-3 core VLAN1, the access to the Internet is very slow ..

The solution is as follows:

1. Disable VLAN 1 redirection.

Int vlan 1

No ip redirects

2. Connect the firewall's internal network cables to other VLANs of the core

Related Articles]

  • Application Environment of Layer 2 to Layer 7 switches
  • Adjustment idea: Use vswitches to solve LAN security
  • Vswitch technology development and product market positioning

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.