三层的出口连接防火墙的内口
三层核心交换机最好别用VLAN1连接防火墙内口。可能会因为IP重定向问题导致内网访问外网速度奇慢！！
具体事例及解决办法如下：
某企业网核心为4506，接入基本为2950系列。核心有一块X4548GB&nbs p;-RJ业务板，其中48口上联到防火墙，其他下联到客户端。客户端网关指向核心交换机，上网速度奇慢。指向防火墙则速度正常，防火墙地址为172.16.1.1核心配置如下：
core_switch#showrun
Buildingconfiguration...
Currentconfiguration:6061bytes
!
version12.1
noservicepad
servicetimestampsdebuguptime
servicetimestampsloguptime
noservicepassword-encryption
servicecompress-config
!
hostnamecore_switch
!
enablesecret5$1$21p4$rcisbziyY7iFWx0w7jm6d.
enablepasswordkindy
!
vtpmodetransparent
ipsubnet-zero
!
spanning-treeextendsystem-id
!
!
vlan2
namevlan2
!
interfaceGigabitEthernet1/1
!
interfaceGigabitEthernet1/2
!
interfaceGigabitEthernet2/1
descriptionToZXC
switchporttrunkencapsulationdot1q
switchportmodetrunk
!
interfaceGigabitEthernet2/2
descriptionToHYS-310
switchporttrunkencapsulationdot1q
switchportmodetrunk
!
interfaceGigabitEthernet2/3
descriptionToHYS-303
switchporttrunkencapsulationdot1q
switchportmodetrunk
!
interfaceGigabitEthernet2/4
descriptionToPGZ
switchporttrunkencapsulationdot1q
switchportmodetrunk
!
interfaceGigabitEthernet2/5
descriptionToWLZ
switchporttrunkencapsulationdot1q
switchportmodetrunk
!
interfaceGigabitEthernet2/6
switchporttrunkencapsulationdot1q
switchportmodetrunk
!
interfaceGigabitEthernet3/1
descriptionToBACK_24
switchporttrunkencapsulationdot1q
switchportmodetrunk
!
interfaceGigabitEthernet3/2
switchporttrunkencapsulationdot1q
switchportmodetrunk
!
interfaceGigabitEthernet3/3
!
interfaceGigabitEthernet3/4
!
interfaceGigabitEthernet3/5
!
interfaceGigabitEthernet3/6
!
interfaceGigabitEthernet4/1
switchporttrunkencapsulationdot1q
switchportmodetrunk
!
....
....
....
!
interfaceGigabitEthernet4/47
switchporttrunkencapsulationdot1q
switchportmodetrunk
!
interfaceGigabitEthernet4/48
!
interfaceVlan1
ipaddress172.16.1.121255.255.255.0
!
interfaceVlan2
ipaddress172.16.2.1255.255.255.0
!
ipclassless
iproute0.0.0.00.0.0.0172.16.1.1
noiphttpserver
!
!
!
linecon0
password******
login
stopbits1
linevty04
password******
login
!
end
--------------------------------------------
因为上面的配置是把防火墙的内口直接接如了三层核心的VLAN1内，所以出现访问外网速度奇慢的现象。。
解决办法如下：
intvlan1
noipredirects
2、将防火墙的内网线接如核心的其他VLAN
