Basic configuration of Huawei Firewall USG
Topology Diagram:
Switch configuration (LAV1):
Vlan batch 10 20 100 / / establish VLAN
Interface GigabitEthernet0/0/1 / / configure the port to be ACCESS and VLAN
Port link-type access
Port default vlan 10
Interface GigabitEthernet0/0/2
Port link-type access
Port default vlan 20
Interface GigabitEthernet0/0/3
Port link-type access
Port default vlan 100
Interface GigabitEthernet0/0/23 / / configure trunk and allow VLAN. Huawei default trunk does not allow any VLAN to pass.
Port link-type trunk
Port trunk allow-pass vlan 10 20
Interface GigabitEthernet0/0/24
Port link-type access
Port default vlan 100
AR1 configuration:
Interface GigabitEthernet0/0/0
Ip address 202.1.1.1 255.255.255.0
Ip route-static 0.0.0.0 0.0.0.0 202.1.1.254
AR2 configuration:
Interface GigabitEthernet0/0/0
Ip address 192.168.1.1 255.255.255.0
Ip route-static 0.0.0.0 0.0.0.0 192.168.1.254
AR3 configuration:
Interface GigabitEthernet0/0/0
Ip address 10.1.1.1 255.255.255.0
Ip route-static 0.0.0.0 0.0.0.0 10.1.1.254
Firewall configuration:
Interface GigabitEthernet0/0/1.10
Vlan-type dot1q 10
Alias GigabitEthernet0/0/1.10
Ip address 202.1.1.254 255.255.255.0
Interface GigabitEthernet0/0/1.20
Vlan-type dot1q 20
Alias GigabitEthernet0/0/1.20
Ip address 192.168.1.254 255.255.255.0
Interface GigabitEthernet0/0/2
Ip address 10.1.1.254 255.255.255.0
# configure the ports included in trust ZONE
Firewall zone trust
Set priority 85
Add interface GigabitEthernet0/0/0
Add interface GigabitEthernet0/0/2
# configure the ports included in untrust ZONE
Firewall zone untrust
Set priority 5
Add interface GigabitEthernet0/0/1.10
# configure the ports included in DMZ ZONE
Firewall zone dmz
Set priority 50
Add interface GigabitEthernet0/0/1.20
# configure Policy
Policy interzone trust untrust outbound
Policy 0
Action permit
Policy source 10.1.1.0 mask 255.255.255.0
