Step-by-Step Switch and Firewall Configuration Guide (VLAN, DHCP, NAT, and Routing)

Switch configuration (2 steps):

vlan batch 2 3

interface gigabitethernet0/0/2

port link-type access

port default vlan 2

quit

interface gigabitethernet0/0/3

port link-type access

port default vlan 3

quit

Uplink to firewall (step 2):

interface gigabitethernet0/0/1

port link-type trunk

port trunk allow-pass vlan 2 3

quit

Firewall as a layer‑3 device (5 steps): Step 1 – Create sub‑interfaces:

vlan batch 2 3

interface gigabitethernet0/0/1.1

vlan-type dot1q 2

ip address 192.168.1.1 24

quit

interface gigabitethernet0/0/1.2

vlan-type dot1q 3

ip address 192.168.2.1 24

quit

Step 2 – Enable DHCP and DNS:

dhcp enable

interface gigabitethernet0/0/1.1

dhcp select interface

dhcp server dns-list 114.114.114.114 223.5.5.5

quit

interface gigabitethernet0/0/1.2

dhcp select interface

dhcp server dns-list 114.114.114.114 223.5.5.5

quit

Step 3 – Configure security zones and default policy:

firewall zone trust

add interface gigabitethernet0/0/1

add interface gigabitethernet0/0/1.1

add interface gigabitethernet0/0/1.2

quit

firewall zone untrust

add interface gigabitethernet0/0/2

quit

firewall packet-filter default permit all

Step 4 – Configure public interface IP and static route:

interface gigabitethernet0/0/2

ip address 200.0.0.2 255.255.255.0

quit

ip route-static 0.0.0.0 0.0.0.0 200.0.0.1

Step 5 – Enable NAT for outbound traffic:

nat address-group 1 200.0.0.2 200.0.0.2

nat-policy interzone trust untrust outbound

policy 1

policy source 192.168.0.0 0.0.255.255

action source-nat

address-group 1

quit

Firewall as a layer‑2 device using VLANIF (5 steps): Step 1 – Create VLANIF interfaces:

vlan batch 2 3

interface gigabitethernet0/0/1

portswitch

port link-type trunk

port trunk permit vlan 2 3

quit

interface vlanif 2

ip address 192.168.1.1 24

quit

interface vlanif 3

ip address 192.168.2.1 24

quit

Step 2 – Enable DHCP and DNS on VLANIFs (same commands as above, applied to vlanif 2 and 3).

Step 3 – Configure zones and default policy (same as layer‑3 steps, using vlanif interfaces).

Step 4 – Configure public interface IP and static route (same as layer‑3 step 4).

Step 5 – Configure NAT for outbound traffic (same as layer‑3 step 5).