設備:防火牆forti 101f
coreswitch cisco 3560 -24pf
core下面因預算問題會接一般hub
防火牆上設定對接介面ip 192.168.10.1
需要做3個vlan，其中vlan30跟vlan10及20不通，但三個vlan又要通過同一台防火牆上網。
switch的設定如下，要透過第24port連到firewall，但目前只有同為vlan10的會通，想請教一下各位，還有其他解法嗎?

hostname Switch
!
!
!
!
ip dhcp pool 10
 network 192.168.10.0 255.255.255.0
 default-router 192.168.10.254
 dns-server 8.8.8.8
ip dhcp pool 20
 network 192.168.20.0 255.255.255.0
 default-router 192.168.20.254
 dns-server 8.8.8.8
ip dhcp pool 30
 network 192.168.30.0 255.255.255.0
 default-router 192.168.30.254
 dns-server 8.8.8.8
!
!
ip routing
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
spanning-tree mode pvst
!
!
!
!
!
!
interface FastEthernet0/1
 switchport access vlan 10
 switchport mode access
!
interface FastEthernet0/2
 switchport access vlan 30
 switchport mode access
!
interface FastEthernet0/3
 switchport access vlan 20
 switchport mode access
!
interface FastEthernet0/4
!
interface FastEthernet0/5
!
interface FastEthernet0/6
!
interface FastEthernet0/7
!
interface FastEthernet0/8
!
interface FastEthernet0/9
!
interface FastEthernet0/10
!
interface FastEthernet0/11
!
interface FastEthernet0/12
!
interface FastEthernet0/13
!
interface FastEthernet0/14
!
interface FastEthernet0/15
!
interface FastEthernet0/16
!
interface FastEthernet0/17
!
interface FastEthernet0/18
!
interface FastEthernet0/19
!
interface FastEthernet0/20
!
interface FastEthernet0/21
!
interface FastEthernet0/22
!
interface FastEthernet0/23
!
interface FastEthernet0/24
 switchport access vlan 10
 switchport mode access
!
interface GigabitEthernet0/1
!
interface GigabitEthernet0/2
!
interface Vlan1
 no ip address
 shutdown
!
interface Vlan10
 mac-address 00e0.8f09.ac01
 ip address 192.168.10.254 255.255.255.0
!
interface Vlan20
 mac-address 00e0.8f09.ac02
 ip address 192.168.20.254 255.255.255.0
!
interface Vlan30
 mac-address 00e0.8f09.ac03
 ip address 192.168.30.254 255.255.255.0
 ip access-group vlan30_only in
!
ip classless
ip route 0.0.0.0 0.0.0.0 192.168.10.1 
ip route 192.168.10.0 255.255.255.0 192.168.10.1 
ip route 192.168.20.0 255.255.255.0 192.168.10.1 
ip route 192.168.30.0 255.255.255.0 192.168.10.1 
!
ip flow-export version 9
!
!
ip access-list extended vlan30_only
 deny ip 192.168.30.0 0.0.0.255 192.168.10.0 0.0.0.255
 deny ip 192.168.30.0 0.0.0.255 192.168.20.0 0.0.0.255
 permit ip any any
!
!
!
!
!
!
line con 0
!
line aux 0
!
line vty 0 4
 login
!
!
!
!
end