FireBrick FB6602, Руководство пользователя

Страница: 49 / 152

Interfaces and Subnets
34
The interface is associated with an internal (to the
FB6000) port in this switch-port group, thus :-
• packets arriving at any of the ports in the group
and destined for a MAC address belonging to the
FB6000 will be received by the associated interface
• packets being sent out of the interface will be
forwarded to the appropriate physical port based on
normal MAC learning
A single physical port implements multiple interfaces VLANs are in use on the port - each logical interface is
specified with a different VLAN ID, the port receives
(and sends) tagged packets, the tag is removed and the
packet is processed as arriving on the interface with
matching VLAN ID
A user-defined group of physical ports implements
multiple interfaces **TBC would this ever be done?**
a
This is actually a port group, but with only a single member.
From Table 6.1 it will be apparent that, when not using VLANs, a maximum of four interfaces can be defined
- one interface per physical port. When using VLANs, the number of interfaces is ultimately limited to the
smaller of 4096 (as a result of the VLAN tag size of 12-bits) or the number of MAC addresses available for
use by a specific FB6000 (see Appendix C).
By combining the FB6000 with a VLAN capable switch, using only a single physical connection between the
switch and the FB6000, you can effectively expand the number of distinct physical interfaces, with the upper
limit on number being determined by switch capabilities, or by inherent IEEE 802.1Q VLAN or FB6000 MAC
address block size. An example of such a configuration is a multi-tenant serviced-office environment, where
the FB6000 acts as an Internet access router for a number of tenants, firewalling between tenant networks, and
maybe providing access to shared resources such as printers.
6.2. Defining port groups
Port groups come under the Interface category in the top-level icons. Under the section headed "Port grouping
and naming", you will see the list of existing port groups - port group objects (
port ) are top-level objects. If
there are less than four groups already defined, an Add link will be present.
Each group is given a user-defined name, which is used to refer to the group in any interface definitions.
To create a new group, click on the Add link to take you to a simple page where you specify the name of the
group, and select one or more physical ports to belong to the group. To select more than one physical port, hold
down the Ctrl key whilst clicking on a port number to toggle it between selected and unselected. An optional
comment can also be specified for the group, which may be useful to act as a memory jogger for the purpose
of the port group.
Editing an existing group works similarly - click the Edit link next to the group you want to modify.
The example XML below shows three port groups :-
<config ...>
...
<port name="WAN"
ports="1"/>
<port name="ADMIN"
ports="2"/>