mam taki malutki problem. Chcialbym skonfigurowac 2 subinterface'y, kazdy w innymi vlanie(strefie), zrobilem to w nastepujacy sposob:
1. Wrzucielm interface 0/4 w strefe null
2. Stworzylem strefy VLAN156,VLAN160
3. Dodalem 2 subinterfejsy do vlanow i stref, nadalem tagi
Lacznosc dziala (logi to pokazuja), niestety nie dziala NAT - jest wlaczony na interfejs 'wyjsciowy' i jest wlaczony na interfejsc vlan'u ktory ma byc natowany.
Inny interfejsc fixyczny , ktory jest takze natowany dziala prawidlowo. ACL takze nie blokuje ruchu, routing dziala i moge osiagnac interfejs natujacy. W logch ewidentnie nie widac translacji
. Kawalek kodu:Pewnie to banalny problem dla wyjadacza ale cos kurka mi umyka widocznie ...
Kod: Zaznacz cały
set vrouter trust-vr sharable
set vrouter "untrust-vr"
set vrouter "trust-vr"
set zone "Trust" vrouter "trust-vr"
set zone "Untrust" vrouter "trust-vr"
set zone "DMZ" vrouter "trust-vr"
set zone "VLAN" vrouter "trust-vr"
set zone id 100 "LAN"
set zone id 103 "VLAN156"
set zone id 104 "VLAN160"
set zone "Untrust-Tun" vrouter "trust-vr"
set interface "ethernet0/0" zone "Untrust"
set interface "ethernet0/1" zone "LAN"
set interface "ethernet0/4.1" tag 156 zone "VLAN156"
set interface "ethernet0/4.2" tag 160 zone "VLAN160"
set interface "bgroup0" zone "DMZ"
set interface "bgroup1" zone "Trust"
set interface bgroup1 port ethernet0/2
set interface bgroup0 port ethernet0/3
unset interface vlan1 ip
set interface ethernet0/0 ip 192.168.48.2/27
set interface ethernet0/0 nat
set interface ethernet0/1 ip 10.48.11.194/22
set interface ethernet0/1 route
set interface ethernet0/4.1 ip 172.16.56.1/22
set interface ethernet0/4.1 nat
set interface ethernet0/4.2 ip 172.16.60.1/27
set interface ethernet0/4.2 route
set interface bgroup0 ip 172.16.52.1/27
set interface bgroup0 route
set interface bgroup1 ip 172.16.48.1/22
set interface bgroup1 nat
set interface ethernet0/4.1 mtu 1500
set interface ethernet0/4.2 mtu 1500
set interface ethernet0/0 proxy dns
set interface ethernet0/4.1 proxy dns
set interface bgroup1 proxy dns
set interface ethernet0/1 ip manageable
set interface ethernet0/0 manage ping
set interface ethernet0/1 manage ssh
set interface ethernet0/1 manage ssl
set interface ethernet0/1 manage web
set interface ethernet0/4.1 manage ping
set interface ethernet0/4.2 manage ping
set address "Trust" "0.0.0.0/0" 0.0.0.0 0.0.0.0
set address "Trust" "172.16.48.0/22" 172.16.48.0 255.255.252.0
set address "Untrust" "10.0.0.0/8" 10.0.0.0 255.0.0.0
set address "Untrust" "172.16.48.0/22" 172.16.48.0 255.255.252.0
set address "VLAN160" "172.16.60.4/32" 172.16.60.4 255.255.255.255
set route 0.0.0.0/0 interface ethernet0/0 gateway 192.168.48.1 permanent
set vrouter "untrust-vr"
set vrouter "trust-vr"
