Example for Configuring ACL-based Redirection

Networking Requirements

As shown in Figure 1, users need to access the Internet. User devices connect to the gateway router through access switch SwitchB and core switch SwitchA and communicate with the Internet through the gateway.

To ensure data and network security, users want to ensure security of all traffic from the Internet to servers. Redirection can be configured to send all traffic from the external network to the internal network to the firewall.

Figure 1 Networking for configuring redirection

Configuration Roadmap

Connect SwitchA to the core firewall in bypass mode to filter traffic.
Configure the device to redirect all traffic from the Internet to the firewall because traffic entering the firewall is Layer 2 traffic.
Configure port isolation on the interface of SwitchA connected to the firewall to prevent loops, disable MAC address learning to prevent MAC address flapping.

Procedure

Create VLANs and configure interfaces to ensure Layer 2 connectivity.

# Create VLAN 100 and VLAN 200 on SwitchB.

<HUAWEI> system-view
[HUAWEI] sysname SwitchB
[SwitchB] vlan batch 100 200

# Configure GE0/0/2 and GE0/0/3 on SwitchB as access interfaces, add GE0/0/2 to VLAN 200 and GE0/0/3 to VLAN 100; configure GE0/0/1 as a trunk interface and add GE0/0/1 to VLAN 100 and VLAN 200.

[SwitchB] interface gigabitethernet 0/0/2
[SwitchB-GigabitEthernet0/0/2] port link-type access
[SwitchB-GigabitEthernet0/0/2] port default vlan 200
[SwitchB-GigabitEthernet0/0/2] quit
[SwitchB] interface gigabitethernet 0/0/3
[SwitchB-GigabitEthernet0/0/3] port link-type access
[SwitchB-GigabitEthernet0/0/3] port default vlan 100
[SwitchB-GigabitEthernet0/0/3] quit
[SwitchB] interface gigabitethernet 0/0/1
[SwitchB-GigabitEthernet0/0/1] port link-type trunk
[SwitchB-GigabitEthernet0/0/1] port trunk allow-pass vlan 100 200
[SwitchB-GigabitEthernet0/0/1] quit

# Create VLAN 100 and VLAN 200 on SwitchA.

<HUAWEI> system-view
[HUAWEI] sysname SwitchA
[SwitchA] vlan batch 100 200

# Configure GE0/0/1, GE0/0/2, GE0/0/3, and GE0/0/4 on SwitchA as trunk interfaces and add them to VLAN 100 and VLAN 200. Add GE0/0/3 and GE0/0/4 to the same port isolation group. Disable MAC address learning on GE0/0/4 to prevent MAC address flapping.

[SwitchA] interface gigabitethernet 0/0/1
[SwitchA-GigabitEthernet0/0/1] port link-type trunk
[SwitchA-GigabitEthernet0/0/1] port trunk allow-pass vlan 100 200
[SwitchA-GigabitEthernet0/0/1] quit
[SwitchA] interface gigabitethernet 0/0/2
[SwitchA-GigabitEthernet0/0/2] port link-type trunk
[SwitchA-GigabitEthernet0/0/2] port trunk allow-pass vlan 100 200
[SwitchA-GigabitEthernet0/0/2] quit
[SwitchA] interface gigabitethernet 0/0/3
[SwitchA-GigabitEthernet0/0/3] port link-type trunk
[SwitchA-GigabitEthernet0/0/3] port trunk allow-pass vlan 100 200
[SwitchA-GigabitEthernet0/0/3] port-isolate enable
[SwitchA-GigabitEthernet0/0/3] quit
[SwitchA] interface gigabitethernet 0/0/4
[SwitchA-GigabitEthernet0/0/4] port link-type trunk
[SwitchA-GigabitEthernet0/0/4] port trunk allow-pass vlan 100 200
[SwitchA-GigabitEthernet0/0/4] port-isolate enable
[SwitchA-GigabitEthernet0/0/4] mac-address learning disable
[SwitchA-GigabitEthernet0/0/4] quit

Configure ACL-based redirection so that the firewall filters traffic.

# Configure a basic ACL to match all forwarded packets.

[SwitchA] acl 4001
[SwitchA-acl-L2-4001] rule permit vlan-id 100
[SwitchA-acl-L2-4001] rule permit vlan-id 200
[SwitchA-acl-L2-4001] quit

# Configure redirection to a specified interface in the inbound direction of GigabitEthernet0/0/1 on SwitchA.

[SwitchA] interface gigabitethernet 0/0/1
[SwitchA-GigabitEthernet0/0/1] traffic-redirect inbound acl 4001 interface gigabitethernet 0/0/3
[SwitchA-GigabitEthernet0/0/1] quit

Verify the configuration.

# Check information about the ACL and action on the interface in the inbound direction.

[SwitchA] display traffic-applied interface gigabitethernet 0/0/1 inbound
-----------------------------------------------------------                     
ACL applied inbound interface GigabitEthernet0/0/1                              
                                                                                 ACL 4001                                                                        
 rule 5 permit vlan-id 100                                                      
ACTIONS:                                                                        
 redirect interface GigabitEthernet0/0/3                                        
-----------------------------------------------------------                     
                                                                                 ACL 4001                                                                        
 rule 10 permit vlan-id 200                                                     
ACTIONS:                                                                        
 redirect interface GigabitEthernet0/0/3                                        
-----------------------------------------------------------

Configuration Files

SwitchA configuration file

#
sysname SwitchA
#
vlan batch 100 200
#
acl number 4001  
 rule 5 permit vlan-id 100
 rule 10 permit vlan-id 200
#
interface GigabitEthernet0/0/1
 port link-type trunk
 port trunk allow-pass vlan 100 200
 traffic-redirect inbound acl 4001 interface GigabitEthernet0/0/3
#
interface GigabitEthernet0/0/2
 port link-type trunk
 port trunk allow-pass vlan 100 200
#
interface GigabitEthernet0/0/3
 port link-type trunk
 port trunk allow-pass vlan 100 200
 port-isolate enable group 1
#
interface GigabitEthernet0/0/4
 port link-type trunk
 mac-address learning disable
 port trunk allow-pass vlan 100 200
 port-isolate enable group 1
#
return

SwitchB configuration file

#
sysname SwitchB
#
vlan batch 100 200
#
interface GigabitEthernet0/0/1
 port link-type trunk
 port trunk allow-pass vlan 100 200
#
interface GigabitEthernet0/0/2
 port link-type access 
 port default vlan 200
#
interface GigabitEthernet0/0/3
 port link-type access
 port default vlan 100
#
return