Table of Contents
Advertisement
S9700 Core Routing Switch
Configuration Guide - SPU
2.10.1 Establishing the Configuration Task
Before configuring the transparent firewall, familiarize yourself with the applicable
environment, complete the pre-configuration tasks, and obtain the data required for the
configuration. This will help you complete the configuration task quickly and accurately.
Applicable Environment
When a firewall works as a transparent firewall (also called bridge firewall), the interfaces of
the firewall cannot be configured with IP addresses or NAT. The zone where the interfaces reside
is the Layer 2 zone. All the external users connected to the interfaces of the Layer 2 zone belong
to the same subnet.
When transmitting packets between the interfaces of the Layer 2 zone, the SPU searches for an
outbound interface according to the MAC addresses of packets. In this case, the SPU functions
as a transparent bridge. Different from the bridge, the SPU forwards the received IP packets to
the upper layer, and then determines whether to allow the packets to pass according to the session
table or ACL rules. In addition, the SPU provides the attack defense functions.
The SPU in transparent mode supports the functions such as ACL-based packet filtering, ASPF
detection, attack defense check, and traffic monitoring.
Pre-configuration Tasks
Before configuring the transparent firewall, complete the following tasks:
l
l
l
Data Preparation
To configure the transparent firewall, you need the following data.
No.
1
2
2.10.2 Configuring the Transparent Firewall
The transparent firewall filters packets based on source MAC addresses, destination MAC
addresses, and Ethernet types.
Context
A transparent firewall discards all the packets entering the inter-zone, including service packets
and protocol packets. To permit these packets, configure an ACL.
l
Issue 01 (2012-03-15)
Configuring zones and adding interfaces to the zones
Configuring the interzone and enabling the firewall function in the interzone
Configuring the VLAN on the interface
Data
VLAN bridge instance ID
Number of the interface bound to the VLAN bridge instance
To permit Layer 2 protocol packets, configure a Layer 2 ACL. For example, permit the
packets with the following characteristics:
Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
2 Firewall Configuration
51
Advertisement
Table of Contents
