USG虚拟墙和MPLSVPN配置-静态路由

On By 去哪儿

实验拓扑

实验目的

划分OA和OT区域，实现OA和OT内的VLAN数据交互都经过防火墙，再过公共区域的PUBILC实现数据交互。之前相互通讯采用静态路由。

1、配置WEB登录用户

[USG6600E]aaa
[USG6600E-aaa]manager-user admin
[USG6600E-aaa-manager-user-admin]password cipher njpc@1259
[USG6600E-aaa-manager-user-admin]service-type web ssh telnet 
[USG6600E-aaa-manager-user-admin]level 15
[USG6600E-aaa-manager-user-admin]authentication-scheme admin_local

2、通过管理口登录管理界面

3、启用虚拟系统

4、新建虚拟系统

OA和OT，如下图创建OT虚拟系统，OA同样步骤创建

分配接口到OT

5、切换到虚拟系统OT

6、修改接口安全区域和配置IP地址

将接口0/0/0分配到trust，0/0/1分配到untrust

OT配置后

OA配置后

7、配置路由

OT配置后

OA配置后

8、防火墙策略放行

每个虚拟墙默认的策略是拒绝，编辑策略为全部放行

8、交换机VLAN和防火墙接口配置

9、配置MPLS-VPN

[HUAWEI]ip vpn-instance OT
[HUAWEI-vpn-instance-OT]ipv4-family
[HUAWEI]ip vpn-instance OA
[HUAWEI-vpn-instance-OA]ipv4-family

10、应用对应的VLAN和IP地址

[HUAWEI]INT VLAN 201
[HUAWEI-Vlanif201]IP binding vpn-instance OT
[HUAWEI-Vlanif201]IP ADDRESS 171.30.1.2 30
[HUAWEI-Vlanif201]INT VLAN 202
[HUAWEI-Vlanif202]IP ADDRESS 171.30.1.6 30
[HUAWEI-Vlanif202]INT VLAN 301
[HUAWEI-Vlanif301]IP binding vpn-instance OA
[HUAWEI-Vlanif301]IP ADDRESS 171.30.1.10 30
[HUAWEI-Vlanif301]INT VLAN 302                
[HUAWEI-Vlanif302]IP ADDRESS 171.30.1.14 30

11、配置静态路由

公共区域的路由

ip route-static 171.30.1.0 255.255.255.252 171.30.1.5 description PUBLIC-TO-OT
ip route-static 171.30.1.8 255.255.255.252 171.30.1.13 description PUBLIC-TO-OA

OT区域的路由

ip route-static vpn-instance OT 0.0.0.0 0.0.0.0 171.30.1.1

OA区域的路由

ip route-static vpn-instance OA 0.0.0.0 0.0.0.0 171.30.1.9