RTX1210を使うとGUIでVLANが簡単に組めて、MACアドレスで認識してくれるのでとても便利なのですが、そのままだとVLANのネットワークに所属するクライアントからPingが打てません。
こんな風になっているとして、
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 |
ip route default gateway dhcp lan2 ip keepalive 1 icmp-echo 10 5 dhcp lan2 ip lan1 address 192.168.11.1/24 switch control use lan1 on terminal=on vlan lan1/1 802.1q vid=101 name=VLAN101 ip lan1/1 address 192.168.101.1/24 ip lan1/1 secure filter in 600000 600001 600002 600012 vlan lan1/2 802.1q vid=102 name=VLAN102 ip lan1/2 address 192.168.102.1/24 ip lan1/2 secure filter in 600003 600004 600005 600012 vlan lan1/3 802.1q vid=103 name=VLAN103 ip lan1/3 address 192.168.103.1/24 ip lan1/3 secure filter in 600006 600007 600008 600012 vlan lan1/4 802.1q vid=104 name=VLAN104 ip lan1/4 address 192.168.104.1/24 ip lan1/4 secure filter in 600009 600010 600011 600012 description lan2 NURO_LAN2 ip lan2 address dhcp ip lan2 secure filter in 101003 101020 101021 101022 101023 101024 101025 101030 101032 101100 ip lan2 secure filter out 101013 101020 101021 101022 101023 101024 101025 101026 101027 101099 dynamic 101080 101081 101082 101083 101084 101085 101098 101099 ip lan2 nat descriptor 200 ip filter 101000 reject 10.0.0.0/8 * * * * ip filter 101001 reject 172.16.0.0/12 * * * * ip filter 101002 reject 192.168.0.0/16 * * * * ip filter 101003 reject 192.168.11.0/24 * * * * ip filter 101010 reject * 10.0.0.0/8 * * * ip filter 101011 reject * 172.16.0.0/12 * * * ip filter 101012 reject * 192.168.0.0/16 * * * ip filter 101013 reject * 192.168.11.0/24 * * * ip filter 101020 reject * * udp,tcp 135 * ip filter 101021 reject * * udp,tcp * 135 ip filter 101022 reject * * udp,tcp netbios_ns-netbios_ssn * ip filter 101023 reject * * udp,tcp * netbios_ns-netbios_ssn ip filter 101024 reject * * udp,tcp 445 * ip filter 101025 reject * * udp,tcp * 445 ip filter 101026 restrict * * tcpfin * www,21,nntp ip filter 101027 restrict * * tcprst * www,21,nntp ip filter 101030 pass * 192.168.11.0/24 icmp * * ip filter 101031 pass * 192.168.11.0/24 established * * ip filter 101032 pass * 192.168.11.0/24 tcp * ident ip filter 101033 pass * 192.168.11.0/24 tcp ftpdata * ip filter 101034 pass * 192.168.11.0/24 tcp,udp * domain ip filter 101035 pass * 192.168.11.0/24 udp domain * ip filter 101036 pass * 192.168.11.0/24 udp * ntp ip filter 101037 pass * 192.168.11.0/24 udp ntp * ip filter 101099 pass * * * * * ip filter 101100 pass * * gre * * ip filter 500000 restrict * * * * * ip filter 600000 reject 192.168.101.0/24 192.168.102.0/24 ip filter 600001 reject 192.168.101.0/24 192.168.103.0/24 ip filter 600002 reject 192.168.101.0/24 192.168.104.0/24 ip filter 600003 reject 192.168.102.0/24 192.168.101.0/24 ip filter 600004 reject 192.168.102.0/24 192.168.103.0/24 ip filter 600005 reject 192.168.102.0/24 192.168.104.0/24 ip filter 600006 reject 192.168.103.0/24 192.168.101.0/24 ip filter 600007 reject 192.168.103.0/24 192.168.102.0/24 ip filter 600008 reject 192.168.103.0/24 192.168.104.0/24 ip filter 600009 reject 192.168.104.0/24 192.168.101.0/24 ip filter 600010 reject 192.168.104.0/24 192.168.102.0/24 ip filter 600011 reject 192.168.104.0/24 192.168.103.0/24 ip filter 600012 pass * * ip filter dynamic 101080 * * ftp ip filter dynamic 101081 * * domain ip filter dynamic 101082 * * www ip filter dynamic 101083 * * smtp ip filter dynamic 101084 * * pop3 ip filter dynamic 101085 * * submission ip filter dynamic 101098 * * tcp ip filter dynamic 101099 * * udp nat descriptor type 200 masquerade nat descriptor address outer 200 primary dhcp service server dhcp server rfc2131 compliant except remain-silent dhcp scope 1 192.168.11.2-192.168.11.191/24 dhcp scope 10101 192.168.101.2-192.168.101.93/24 dhcp scope 10102 192.168.102.2-192.168.102.93/24 dhcp scope 10103 192.168.103.2-192.168.103.93/24 dhcp scope 10104 192.168.104.2-192.168.104.93/24 dns host lan1 lan1/1 lan1/2 lan1/3 lan1/4 dns server dhcp lan2 dns server select 500201 dhcp lan2 any . dns private address spoof on httpd host lan1 dashboard accumulate traffic on switch select 00:a0:de:ab:d2:30 switch control function set vlan-id 101 103 switch control function set vlan-id 102 104 switch control function set vlan-port-mode 1 hybrid switch control function set vlan-access 2 101 switch control function set vlan-access 3 101 switch control function set vlan-access 4 101 switch control function set vlan-access 5 102 switch control function set vlan-access 6 102 switch control function set vlan-access 7 102 switch control function set vlan-access 8 102 switch control function set vlan-trunk 1 101 join switch control function set vlan-trunk 1 102 join switch select ac:44:f2:3e:40:b9 switch control function set vlan-port-mode 1 hybrid switch control function set vlan-access 2 101 switch control function set vlan-access 3 101 switch control function set vlan-access 4 101 switch control function set vlan-access 5 102 switch control function set vlan-access 6 102 switch control function set vlan-access 7 102 switch control function set vlan-access 8 102 switch control function set vlan-trunk 1 101 join switch control function set vlan-trunk 1 102 join |
ICMPを通すフィルターを設定しよう
WANのIN側にPingを許可するフィルターを設定してあげれます。
|
1 2 3 |
ip filter 10 pass * * icmp ip lan2 secure filter in 10 101003 101020 101021 101022 101023 101024 101025 101030 101032 101100 save |
これでVLANに所属しているクライアントからPingがばすっばすっ打てます。
VLAN間同士でもっと自由に通信がしたい
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 |
vlan lan1/1 802.1q vid=101 name=VLAN101 ip lan1/1 address 192.168.101.1/24 ip lan1/1 secure filter in 600000 600001 600002 600012 vlan lan1/2 802.1q vid=102 name=VLAN102 ip lan1/2 address 192.168.102.1/24 ip lan1/2 secure filter in 600003 600004 600005 600012 vlan lan1/3 802.1q vid=103 name=VLAN103 ip lan1/3 address 192.168.103.1/24 ip lan1/3 secure filter in 600006 600007 600008 600012 vlan lan1/4 802.1q vid=104 name=VLAN104 ↓ vlan lan1/1 802.1q vid=101 name=VLAN101 ip lan1/1 address 192.168.101.1/24 vlan lan1/2 802.1q vid=102 name=VLAN102 ip lan1/2 address 192.168.102.1/24 vlan lan1/3 802.1q vid=103 name=VLAN103 ip lan1/3 address 192.168.103.1/24 vlan lan1/4 802.1q vid=104 name=VLAN104 |
すべてはずすでなく、フィルターの調整とかも出来ます。
お疲れ様です。
