Freedom9 freeGuard Slim 100, Руководство пользователя

Страница: 140 / 170

S E C U R I T Y Z O N E S A N D I N T E R F A C E S
9
9-6
User Guide
set interface {interface name} zone {name_str}
Example: Binding the eth0 Interface to the “Sales” Security Zone
set interface eth0 zone sales
save
GUI Example: Binding the ETH0 Interface to the “Sales” Security Zone
1.
Select Network > Interface > Edit (for eth0)
2.
Select the following, then click Apply :
Zone Name: Sales
Moving Interfaces between Security Zones
Unbinding an interface removes the interface from the assigned zone and places it into the zone
specified in the set interface command. To move an interface from one assigned zone to
another, use the set interface command and assign the interface to the new zone. The new zone
policies are enforced to the specified interface.
Example: Moving the eth0 Interface to the Trust security Zone
set interface eth0 zone trust
save
GUI Example: Moving the ETH0 Interface to the Trust Security Zone
1.
Network > Interface > Edit (for eth0)
2.
Select the following, then click Apply :
Zone Name: Trust
Configuring Subinterfaces
A subinterface is a logical interface that uses an 802.1q tag to identify membership to a specific
VLAN on a physical interface. After you configure a subinterface and assign it to a zone, traffic
can pass from VLANs associated with the subinterface to other physical or logical interfaces on
the appliance. Additionally, security policies assigned to a zone containing a
subinterface enforces that policy on all traffic to and from that subinterface.
The interface name that refers to the subinterface has the following format:
{physical interface name.vlan_id}
For example, interface eth0.125 is the subinterface for the VLAN with VLAN id 125 located on the
eth0 physical interface.
Use the
set interface command to bind a subinterface to a physical interface. You must specify
the vlan_id that defines the 802.1q tag. The name of the physical interface associated with the
VLAN ID and subinterface IP address are required to create the subinterface.
set interface {physical interface name.vlan_id} ip {ip_addr/mask}
[NOTE]
The vlan_id must fall within the range of 1 to 4000.