#Configuration# SangforNGAF Bridge mode in Trunk port Deployment Configuration Guide

#Configuration# SangforNGAF Bridge mode in Trunk port Deployment Configuration Guide

Product:NGAF

Version:8.0.35

1. Introduction

1.1 Scenario

The enterprise network is across-tier layer 3 environment, there are routers deployed on the publicnetwork gateway, the original environment cannot be changed, and need totransparently deploy the NGAF device into the network.

1.2 Requirements

1. NGAF with firmware version of 8.0.35.

2. ConfigurationGuide

Topology:

Step 1. Loginto the device via the default IP of the management port (ETH0). The default IPof the management port is 10.251.251.251/24. Configure an IP address in thesame network segment on the computer via https://10.251.251.251.

Step 2. InNetwork > Interfaces > Physical Interface, click the interface that needsto be set as the external network interface, select eth2 as the externalinterface, select Layer 2 for Type, select the custom uplink area for the area,select the WAN attribute checkbox, and the connection type as Trunk.

Step 3. InNetwork > Interfaces > Physical Interface, click the interface that needsto be set as the intranet interface, select eth3 as the intranet interface,select the Layer 2 for Type, choose the custom down-linked zone for the area,and Trunk for the connection type.

Step 4. Configurethe management interface in Network>Interfaces>VLAN Interface, configurethe logical interface of the VLAN interface as the management interface withVLAN ID 2, and assign the management address 192.168.2.2/24.

Step 5. Configurethe route. You need to configure a default route to 0.0.0.0/0.0.0.0 pointing tothe same network segment as the management IP of the predecessor gateway192.168.2.1, enter Network > Route > Static Route to configure, click NewStatic Route, configure the default route Dst IP/Netmask to 0.0.0.0/0, the Next[1]Hop IP is 192.168.2.1.

Step 6. .Configure the application control policy to release the Internet accessprivileges for intranet users. In Policies>Access Control>ApplicationControl Policy, add a new application control policy to release theinside-to-outside data access privileges, select a custom lower-link area forthe source area, select a custom intranet for the source address, select acustom upper-link area for the destination area, all for the destinationaddress, any for the service, and all for the application.

Step 7. Oncethe basic configuration is complete, connect the device to the network, witheth2 port connected to the front routing and eth3 port connected to theintranet layer 2 switch.

3. Precaution

1. Confirm the interface properties of the upstream anddownstream devices. If the other party is a Trunk interface, the AF interfaceneeds to select Trunk.

2. Need to confirm the deployment environmentof the firewall, pay attention to not loop.

3. Through the VLAN IP or separate configuration managementinterface to manage the device.

Thanks for your great job !

thank you for this wonderful information