Cisco PIX 525 Spezifikationen PDF herunterladen (Seite 97)

2-37

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 2 Establishing Connectivity

Using VLANs with the Firewall

In Figure 2-9, the PIX Firewall is configured with one physical and one logical interface assigned to

VLAN 2 and VLAN 3. The PIX Firewall interconnects the two VLANs, while providing firewall

services, such as access lists, to improve network security.

To configure this example, follow these steps:

Step 1 Assign the interface speed to a physical interface by entering the following command:

interface ethernet0 auto

Step 2 Assign VLAN2 to the physical interface (ethernet0) by entering the following command:

interface ethernet0 vlan2 physical

By assigning a VLAN to the physical interface, you ensure that all frames forwarded on the interface

will be tagged. VLAN 1 is not used because that is the default native VLAN for Cisco switches. Without

the physical parameter, the default for the interface command is to create a logical interface.

Step 3 Create a new logical interface (VLAN3) and tie it to the physical interface (ethernet0) by entering the

following command:

interface ethernet0 vlan3 logical

This will allow the PIX Firewall to send and receive VLAN-tagged packets with a VLAN identifier equal

to 3 on the physical interface, ethernet0.

Step 4 Configure the logical and physical interfaces by entering the following commands:

nameif ethernet0 outside security0

nameif vlan3 dmz security50

ipaddress outside 192.168.101.1 255.255.255.0

ipaddress dmz 192.168.103.1 255.255.255.0

The first line assigns the name outside to ethernet0 (the physical interface) and sets the security level to

zero. The second line assigns the name dmz to vlan3 (the logical interface) and sets the security level to

50. The third and fourth lines assign IP addresses to both interfaces.

After this configuration is enabled, the outside interface sends packets with a VLAN identifier of 2, and

the dmz interface sends packets with a VLAN identifier of 3. Both types of packets are transmitted from

the same physical interface (ethernet0).

Managing VLANs

To display information about the VLAN configuration, enter the following command:

show interface

To temporarily disable a logical interface, enter the following command:

interface ethernet0 vlan_id shutdown

Replace vlan_id with the VLAN ID associated with the logical interface that you want to temporarily

shut down.

To change the VLAN ID of a logical interface, enter the following command:

interface change-vlan old_vlan_id new_vlan_id

1 2 ... 92 93 94 95 96 97 98 99 100 101 102 ... 465 466

Keine Kommentare

Cisco PIX 525 Spezifikationen Seite 97