1.1 Configuration Notes
l This example uses Huawei S series modular switches, USG firewalls, and NE routers to describe the configuration procedure.
l The configuration procedure in this example involves only the enterprise network egress. For the internal network configuration, see "Large-Sized Campus Networks" in the Huawei S Series Campus Switch Quick Configuration Guide.
l Only the connection configurations between firewalls and switches and the HRP configurations on firewalls are provided in the following procedure. For the security service plan on the firewalls and security policies, attack defense, bandwidth management, and IPSec on the campus network, see Firewall Configuration Examples.
l This example describes only the routers and switches at the egress of campus network. For the Internet-side configurations on routers, see the NE Router Configuration Guide.
1.2 Networking Requirements
At the egress of a large-sized campus network, core switches connect to routers to access the Internet through upstream interfaces. Firewalls connect to the core switches in bypass mode to filter service traffic.
To simplify network and improve reliability, a switch cluster is deployed at the core layer.
HRP (active/standby mode) is deployed on firewalls. If one firewall fails, services are switched to another firewall.
Each of the core switches is dual homed to two egress routers, and VRRP is configured between routers to ensure reliability.
To improve link reliability, Eth-Trunks are configured between core switches and egress routers, core switches and firewalls, and two firewalls.
The networking diagram is as follows.
Figure 1-1 Networking diagram at the campus egress (HRP firewalls in bypass mode)
![[All About Switches] 1 Example for Configuring the Egress of a Large-scale Campu-1296485-1](data/attachment/forum/dm/ecommunity/uploads/2015/0929/15/560a395ea86e2.png)
In Layer 3 forwarding environment, traffic inside and outside the campus network is directly forwarded by switches, but does not pass through FW1 and FW2. When traffic needs to be forwarded to FWs for filtering through switches, the VRF function must be configured on switches. The CSS is divided into a virtual switch VRF-A and a root switch Public, which are separated from each other.
Public is connected to the egress routers, and forwards traffic from the Internet to FWs for filtering and traffic from FWs to the egress routers.
VRF-A is connected to the intranet, and forwards traffic from FWs to the intranet and traffic from intranet to FWs for filtering.
The following logical network diagram shows the traffic forwarding paths.
Figure 1-2 Connections between physical interfaces of switches, routers, and firewalls
![[All About Switches] 1 Example for Configuring the Egress of a Large-scale Campu-1296485-2](data/attachment/forum/dm/ecommunity/uploads/2015/0929/15/560a397267e58.png)
In this example, the core switches work in Layer 3 mode. The firewalls connect to Layer 3 switches through upstream and downstream interfaces. VRRP needs to be configured on both upstream and downstream service interfaces of firewalls, as shown below.
Figure 1-3 Connections between Layer 3 interfaces of switches, routers, and firewalls
![[All About Switches] 1 Example for Configuring the Egress of a Large-scale Campu-1296485-3](data/attachment/forum/dm/ecommunity/uploads/2015/0929/15/560a3984472ce.png)
The traffic (in blue) from the intranet to the Internet is forwarded as follows:
1. When traffic from the intranet to the Internet reaches VRF-A, it is then forwarded to the firewalls based on the static route (next hop is the downstream VRRP virtual IP address of firewalls) configured on VRF-A.
2. After filtering the traffic, the firewalls forward traffic to Public based on the static route (next hop is the CSS's VLANIF 20).
3. Public forwards traffic to routers based on the static route (next hop is the router VRRP virtual IP address).
The traffic (in red) from the Internet to the intranet is forwarded as follows:
1. The traffic from the Internet to the intranet reaches the routers, and is then forwarded to Public based on the OSPF routing table.
2. Public forwards the traffic to firewalls based on the static route (next hop is the upstream VRRP virtual IP address of firewalls).
3. After filtering the traffic, the firewalls forward traffic to VRF-A based on the static route (next hop is the CSS's VLANIF 30).
4. VRF-A forwards the traffic to aggregation switches based on OSPF routing table, and then the aggregation switches forward the traffic to service networks.
1.3 Data Plan
Table 1-1 Link aggregation data plan
|
Device |
Interface Number |
Member Interface |
VLANIF |
IP Address |
Remote Device |
Remote Interface Number |
|
Router1 |
Eth-trunk1.100 |
10GE1/0/1 10GE1/0/2 |
- |
10.10.4.2/24 |
Switch 1 Switch 2 |
Eth-Trunk1 |
|
Router2 |
Eth-trunk1.100 |
10GE1/0/1 10GE1/0/2 |
- |
10.10.4.3/24 |
Switch 1 Switch 2 |
Eth-Trunk2 |
|
VRRP of Router 1 and Router 2 |
- |
- |
- |
10.10.4.100/24 |
- |
- |
|
CSS (Switch 1 and Switch 2) |
Eth-trunk1 |
10GE1/4/0/0 10GE2/4/0/0 |
VLANIF10 |
10.10.4.1/24 |
Router 1 |
Eth-Trunk1 |
|
Eth-trunk2 |
10GE1/4/0/1 10GE2/4/0/1 |
VLANIF10 |
10.10.4.1/24 |
Router 2 |
Eth-Trunk1 |
|
|
Eth-trunk4 |
GE1/1/0/7 GE2/1/0/7 |
VLANIF20 |
10.10.2.1/24 |
FW 1 |
Eth-Trunk4 |
|
|
Eth-trunk5 |
GE1/1/0/8 GE2/1/0/8 |
VLANIF30 |
10.10.3.1/24 |
FW 1 |
Eth-Trunk5 |
|
|
Eth-trunk6 |
GE1/2/0/7 GE2/2/0/7 |
VLANIF20 |
10.10.2.1/24 |
FW 2 |
Eth-Trunk6 |
|
|
Eth-trunk7 |
GE1/2/0/8 GE2/2/0/8 |
VLANIF30 |
10.10.3.1/24 |
FW 2 |
Eth-Trunk7 |
|
|
Eth-trunk8 |
GE1/3/0/1 GE2/3/0/1 |
VLANIF100 |
10.10.100.1/24 |
Service network 1 |
- (omitted in this example) |
|
|
Eth-trunk9 |
GE1/3/0/2 GE2/3/0/2 |
VLANIF200 |
10.10.200.1/24 |
Service network 2 |
- (omitted in this example) |
|
|
FW1 |
Eth-trunk1 |
GE2/0/0 GE2/0/1 |
- |
10.1.1.1/24 |
FW2 |
Eth-Trunk1 |
|
Eth-Trunk4 |
GE1/0/0 GE1/0/1 |
- |
10.10.2.2/24 |
Switch 1 Switch 2 |
Eth-Trunk4 |
|
|
Eth-Trunk5 |
GE1/1/0 GE1/1/1 |
- |
10.10.3.2/24 |
Switch 1 Switch 2 |
Eth-Trunk5 |
|
|
FW2 |
Eth-trunk1 |
GE2/0/0 GE2/0/1 |
- |
10.1.1.2/24 |
FW1 |
Eth-Trunk1 |
|
Eth-Trunk6 |
GE1/0/0 GE1/0/1 |
- |
10.10.2.3/24 |
Switch 1 Switch 2 |
Eth-Trunk6 |
|
|
Eth-Trunk7 |
GE1/1/0 GE1/1/1 |
- |
10.10.3.3/24 |
Switch 1 Switch 2 |
Eth-Trunk7 |
|
|
VRRP1 of FW 1 and FW 2 (upstream) |
- |
- |
- |
10.10.2.5/24 |
- |
- |
|
VRRP2 of FW 1 and FW 2 (downstream) |
- |
- |
- |
10.10.3.5/24 |
- |
- |
1.4 Configuration Roadmap
The configuration roadmap is as follows:
1. Configure the CSS for core switches.
2. Assign IP addresses to the interfaces between switches, firewalls, and routers.
To improve link reliability, configure inter-chassis Eth-Trunks between switches and firewalls and between switches and routers.
Configure security zones on the firewalls' interfaces.
3. Configure VRRP on egress routers.
To ensure reliability between the core switches and two egress routers, deploy VRRP between the two egress routers so that VRRP heartbeat packets are exchanged through the core switches. Router1 functions as the master device, and Router2 functions as the backup device.
4. Deploy routing.
Configure the VRF function on switches to divide the CSS into a virtual switch VRF-A and a root switch Public, which separate the service network routes and public network routes.
To steer the upstream traffic on each device, configure a default route on core switches, of which the next hop is the VRRP virtual IP address of the egress routers.
To steer the return traffic of two egress routers, configure OSPF between the egress routers and core switches, and advertise all user network segment routes on the core switches into OSPF on egress routers.
To forward the upstream traffic of service networks to firewalls, configure a default route on switches, of which the next hop is the virtual IP address of VRRP VRID2 on firewalls.
To forward the downstream traffic of service network 1 to firewalls, configure a default route on switches, of which the next hop is the virtual IP address of VRRP VRID1 on firewalls.
To forward the downstream traffic of service network 2 to firewalls, configure a default route on switches, of which the next hop is the virtual IP address of VRRP VRID1 on firewalls.
To forward the upstream traffic of service networks to switches, configure a default route on firewalls, of which the next hop is the IP address of VLANIF 20 on switches.
To forward the downstream traffic of service network 1 to switches, configure a default route on firewalls, of which the next hop is the IP address of VLANIF 30 on switches.
To forward the downstream traffic of service network 2 to switches, configure a default route on firewalls, of which the next hop is the IP address of VLANIF 30 on switches.
5. Configure HRP on firewalls.
![[All About Switches] 1 Example for Configuring the Egress of a Large-scale Campu-1666293-1](data/attachment/forum/dm/ecommunity/uploads/2015/0929/15/560a39b3443a2.png)
![[All About Switches] 1 Example for Configuring the Egress of a Large-scale Campu-1666293-2](data/attachment/forum/dm/ecommunity/uploads/2015/0929/15/560a38278d658.jpg){kind=small}
![[All About Switches] 1 Example for Configuring the Egress of a Large-scale Campu-1666293-3](data/attachment/forum/dm/ecommunity/uploads/2015/0929/15/560a39bea33a7.png)
![[All About Switches] 1 Example for Configuring the Egress of a Large-scale Campu-1666315-1](data/attachment/forum/dm/ecommunity/uploads/2015/0929/15/560a385188327.jpg){kind=small}
