Wasai firewall implements single-arm routing for inter-VLAN Communication

Huasai firewall implements single-arm routing to implement inter-VLAN communication network equipment: One USG2130, several S2700 switches www.2cto.com customer requirement: VLAN division on the switch and single-arm routing on USG2130, at the same time, mutual access is required between the three CIDR blocks, and the three CIDR blocks can be connected to the INTERNET. Because the USG2130 has only one layer-3 interface WAN port, the port supporting the sub-interface is also a WAN port (E0/0/0). Based on current requirements, you must use this port as an intranet interface. Create a VLAN and use a VLAN interface as an Internet interface. If you place VLANs in the same region, it is complicated to implement inter-VLAN access control. If VLAN sub-interfaces are divided into different regions, it is simple and reliable to implement through Inter-Domain packet filtering. Important configuration: www.2cto.com 1. Enter the sub-interface, configure the IP address, and perform 802.1Q encapsulation. [USG2130] int e0/0/0.1 [USG2130-Ethernet0/0/0.1] description VLAN10 [USG2130-Ethernet0/0/0.1] ip address 192.168.1.1 24 [USG2130-Ethernet0/0/0.1] vlan-type dot1q 10 [USG2130] int e0/0/0.2 [USG2130-Ethernet0/0/0.2] description VLAN20 [USG2130-Ethernet0/0/0.2] ip add 192.168.2.1 24 [USG2130-Ethernet0/0/0.2] vlan-type dot1q 20 [USG2130] int e0/0/0.3 [USG2130-Ethernet0/0/0.3] description VLAN30 [USG2130-Ethernet0/0/0.3] I P add 192.168.3.1 24 [USG2130-Ethernet0/0/0.3] vlan-type dot1q 302, create a VLAN for connecting to the Internet, and configure the IP address. [USG2130] interface Ethernet1/0/0 [USG2130-Ethernet1/0/0] ip address 192.168.100.1 24 [USG2130-Ethernet1/0/0] description TO-INTERNET 3. Add ports to the corresponding region [USG2130] firewwall zone trust [USG2130-zone-trust] add interface e0/0/0.1 [USG2130-zone-trust] add interface e0/0/0.2 [USG2130-zone-trust] add interface e0/0/0.3 [USG2130] firewall zone untrust [USG2130-zone-untrust] add interface e1 /0/0 4. Complete NAT configuration [USG2130] firewall int Erzone trust untrust outbound [USG2130-interzone-trust-untrust] policy 10 [USG2130-interzone-trust-untrust-policy10] source 192.168.0.0 255.255.0.0 5, the port connecting between the switch and the firewall can directly use the TRUNK port, the configurations of other VLANs are the same as those of VLANs, so that communication between VLANs can be performed through firewalls.