Layer-3 egress connection to the internal port of the firewall
It is recommended that layer-3 core switches use VLAN1 to connect to the firewall's internal port. The Intranet access to the Internet may be slow due to IP redirection !!
The specific examples and solutions are as follows:
The core of a certain Enterprise Network is 4506, And the access is basically 2950 series. The core is an X 4548 GB & nbs p;-RJ Business Board, with 48 ports uplinked to the firewall and others downlink to the client. The client gateway points to the core switch, which slows down the Internet access. Direct to the firewall, the speed is normal, and the firewall address is 172.16.1.1 core configuration is as follows:
core_switch#show run
Building configuration...
Current configuration : 6061 bytes
!
version 12.1
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
service compress-config
!
hostname core_switch
!
enable secret 5 $1$21p4$rcisbziyY7iFWx0w7jm6d.
enable password kindy
!
vtp mode transparent
ip subnet-zero
!
spanning-tree extend system-id
!
!
vlan 2
name vlan2
!
interface GigabitEthernet1/1
!
interface GigabitEthernet1/2
!
interface GigabitEthernet2/1
description To ZXC
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet2/2
description To HYS-310
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet2/3
description To HYS-303
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet2/4
description To PGZ
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet2/5
description To WLZ
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet2/6
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet3/1
description To BACK_24
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet3/2
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet3/3
!
interface GigabitEthernet3/4
!
interface GigabitEthernet3/5
!
interface GigabitEthernet3/6
!
interface GigabitEthernet4/1
switchport trunk encapsulation dot1q
switchport mode trunk
!
....
....
....
!
interface GigabitEthernet4/47
switchport trunk encapsulation dot1q
switchport mode trunk
!
interface GigabitEthernet4/48
!
interface Vlan1
ip address 172.16.1.121 255.255.255.0
!
interface Vlan2
ip address 172.16.2.1 255.255.255.0
!
ip classless
ip route 0.0.0.0 0.0.0.0 172.16.1.1
no ip http server
!
!
!
line con 0
password ******
login
stopbits 1
line vty 0 4
password ******
login
!
end
-------------------------------------------- |
Because the above configuration is to directly connect the firewall's internal port to the layer-3 core VLAN1, the access to the Internet is very slow ..
The solution is as follows:
1. Disable VLAN 1 redirection.
Int vlan 1
No ip redirects
2. Connect the firewall's internal network cables to other VLANs of the core
Related Articles]
- Application Environment of Layer 2 to Layer 7 switches
- Adjustment idea: Use vswitches to solve LAN security
- Vswitch technology development and product market positioning
