三层的出口连接防火墙的内口 。三层核心交换机最好别用VLAN1连接防火墙内口。可能会因为IP 重定向问题导致内网访问外网速度奇慢！
具体事例及解决办法如下：
某企业网核心为4506，接入基本为2950系列。核心有一块X 4548 GB&nbs p;-RJ业务板，其中48口上联到防火墙，其他下联到客户端。客户端网关指向核心交换机，上网速度奇慢。指向防火墙则速度正常，防火墙地址为172.16.1.1 核心配置如下：
core_switch#show run
Building configuration...
Current configuration : 6061 bytes
!
version 12.1
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
service compress-config
!
hostname core_switch
!
enable secret 5 $1$21p4$rcisbziyY7iFWx0w7jm6d.
enable password kindy
!
vtp mode
transparent (
server|client)
ip subnet-zero
!
spanning-tree extend system-id
!
!
vlan 2
name vlan2
interface GigabitEthernet1/1
interface GigabitEthernet1/2
interface GigabitEthernet2/1
description To ZXC
switchport trunk encapsulation dot1q (the other encapsulation protocol is ISL,a protocol of cisco proprietory)
switchport mode trunkinterface GigabitEthernet2/2
description To HYS-310
switchport trunk encapsulation dot1q
switchport mode trunkinterface GigabitEthernet2/3
description To HYS-303
switchport trunk encapsulation dot1q
switchport mode trunkinterface GigabitEthernet2/4
description To PGZ
switchport trunk encapsulation dot1q
switchport mode trunkinterface GigabitEthernet2/5
description To WLZ
switchport trunk encapsulation dot1q
switchport mode trunkinterface GigabitEthernet2/6
switchport trunk encapsulation dot1q
switchport mode trunk
interface GigabitEthernet3/1
description To BACK_24
switchport trunk encapsulation dot1q
switchport mode trunkinterface GigabitEthernet3/2
switchport trunk encapsulation dot1q
switchport mode trunkinterface GigabitEthernet3/3
interface GigabitEthernet3/4
interface GigabitEthernet3/5
interface GigabitEthernet3/6
interface GigabitEthernet4/1
switchport trunk encapsulation dot1q
switchport mode trunkinterface GigabitEthernet4/47
switchport trunk encapsulation dot1q
switchport mode trunkinterface GigabitEthernet4/48
interface Vlan1
ip address 172.16.1.121 255.255.255.0interface Vlan2
ip address 172.16.2.1 255.255.255.0ip classless
ip route 0.0.0.0 0.0.0.0 172.16.1.1 （
specify the default route)
no ip http server
line con 0
password ******
login
stopbits 1
line vty 0 4
password ******
login
end
因为上面的配置是把防火墙的内口直接接入了三层核心的Vlan1内，所以出现访问外网速度奇慢的现象。如何解决这个问题，方法如下：
1、关闭Vlan1的重定向功能。
int vlan1
no ip redirects
2、
将防火墙的inside接入核心的其它Vlan.