FireBrick FB6602, Руководство пользователя

Страница: 50 / 152

Interfaces and Subnets
35
<port name="LAN"
ports="3 4"/>
...
</config>
In this example, "WAN" and "ADMIN" groups consists of a single port each, physical ports 1 and 2 respectively.
The "LAN" group consists of two physical ports, numbers 3 and 4. Ports 3 and 4 are members of a single
layer 2 broadcast domain, and are equivalent in function in terms of communication between the FB6000 and
another device.
6.3. Defining an interface
To create or edit interfaces, select the Interface category in the top-level icons - under the section headed
"Ethernet interface (port-group/vlan) and subnets", you will see the list of existing
interface top-level
objects (if any), and an "Add" link.
The primary attributes that define an interface are the name of the physical port group it uses, an optional
VLAN ID, and an optional name. If the VLAN ID is not specified, it defaults to "0" which means only untagged
packets will be received by the interface.
To create a new interface, click on the Add link to take you to a new interface defintion. Tick the
port
checkbox
and select one of the defined port groups. If the interface is to exist in a VLAN, tick the
vlan
checkbox and
enter the VLAN ID in the text field.
Editing an existing interface works similarly - click the Edit link next to the interface you want to modify.
An interface object can have the following child objects :-
• One or more subnet definition objects
• Zero or more DHCP server settings objects
• Zero or more Virtual Router Redundancy Protocol (VRRP) settings objects (refer to Chapter 14)
6.3.1. Defining subnets
Each interface can have one or more subnets definitions associated with it. The ability to specify multiple
subnets on an interface can be used where it is necessary to communicate with devices on two different subnets
and it is acceptable that the subnets exist in the same broadcast domain. For example, it may not be possible to
reassign machine addresses to form a single subnet, but the machines do not require firewalling from each other.
Note
As discussed in Section 6.1, an interface is associated with a broadcast domain ; therefore multiple
subnets existing in a single broadcast domain are not 'isolated' (at layer 2) from each other. Effective
firewalling (at layer 3) cannot be established between such subnets ; to achieve that, subnets need to
exist in different broadcast domains, and thus be on different interfaces. An example of this is seen in
the factory default configuration, which has two interfaces, "WAN" and "LAN", allowing firewalling
of the LAN from the Internet.
You may also have both IPv4 and IPv6 subnets on an interface where you are also using IPv6 networking.
The primary attributes that define a subnet are the IP address range of the subnet, the IP address of the FB6000
itself on that subnet, and an optional name.
The IP address and address-range are expressed together using CIDR notation - if you are not familiar with this
notation, please refer to Appendix B for an overview.