100字范文 > 华为防火墙区域配置

华为防火墙区域配置

时间：2023-10-02 17:45:09

相关推荐

华为防火墙区域配置

防火墙区域配置实验

文章目录

防火墙区域配置实验实验需求实验配置步骤一：地址配置步骤二：OSPF和默认路由配置步骤三：防火墙配置实验结果

实验需求

防火墙区域配置

trust区域内R1上的业务网段192.168.0.0/24和192.168.1.0/24仅能访问DMZ区域的web服务器trust区域内R1上的业务网段192.168.2.0/24和192.168.3.0/24仅能访问DMZ区域的ftp服务器位于untrust区域的全部外部网段都能够访问dmz区域的web服务器和ftp服务器trust区域内除192.168.0.0/24以外所有的业务网段都能访问untrust区域的外部网段

实验拓扑如下图

按照拓扑图上的IP配置好各个设备的IP地址，防火墙与trust和dmz区域采用OSPF打通路由；防火墙和untrust区域采用默认路由连通路由。

实验配置

步骤一：地址配置

配置过程略

步骤二：OSPF和默认路由配置

配置过程略

注意:别忘记把静态路由引入到ospf中

步骤三：防火墙配置

1）将接口加入到相应的安全区域

[FW-zone-trust]firewall zone trust[FW-zone-trust] add interface GigabitEthernet0/0/1[FW-zone-untrust]firewall zone untrust[FW-zone-untrust] add interface GigabitEthernet0/0/2[FW-zone-dmz]firewall zone dmz[FW-zone-dmz] add interface GigabitEthernet0/0/0[FW-zone-dmz] add interface GigabitEthernet0/0/3

2）配置安全区域间策略

inbound：数据包从低安全级别区域到高安全级别区域

outbound：数据包从高安全级别区域到低安全级别区域

这个咱可以类比一下，高安全级别区域就是自己家，低安全级别区域就是亲戚家。你过年去亲戚家走亲戚就是从家里出去（outbound），从亲戚家回来就是回家（inbound）。

#1）trust区域到dmz区域[FW]policy interzone trust dmz outbound #建立trust到dmz的域间策略[FW-policy-interzone-trust-dmz-outbound] policy 10 #策略索引，创建第10条策略[FW-policy-interzone-trust-dmz-outbound-10] policy source 192.168.1.10 0 #匹配的源地址[FW-policy-interzone-trust-dmz-outbound-10] policy source 192.168.0.0 0.0.1.255 [FW-policy-interzone-trust-dmz-outbound-10] policy destination 172.16.2.200 0 #匹配的目的地址[FW-policy-interzone-trust-dmz-outbound-10] action permit #执行动作为允许，当数据包命中该节点定义的规则就执行该动作[FW-policy-interzone-trust-dmz-outbound] policy 20 #创建第20条策略[FW-policy-interzone-trust-dmz-outbound-20] policy source 192.168.2.0 0.0.1.255 [FW-policy-interzone-trust-dmz-outbound-20] policy destination 172.16.2.100 0[FW-policy-interzone-trust-dmz-outbound-20] action permit #2）trust区域到untrust区域[FW]policy interzone trust untrust outbound[FW-policy-interzone-trust-untrust-outbound] policy 10 [FW-policy-interzone-trust-untrust-outbound-10] policy source 192.168.1.0 0.0.0.255[FW-policy-interzone-trust-untrust-outbound-10] policy source 192.168.2.0 0.0.0.255[FW-policy-interzone-trust-untrust-outbound-10] policy source 192.168.3.0 0.0.0.255[FW-policy-interzone-trust-untrust-outbound-10] action permit #3）untrust区域到dmz区域的域间策略[FW]policy interzone dmz untrust inbound[FW-policy-interzone-dmz-untrust-inbound] policy 10 [FW-policy-interzone-dmz-untrust-inbound-10] action permit [FW-policy-interzone-dmz-untrust-inbound-10] policy source 200.1.1.0 0.0.0.255[FW-policy-interzone-dmz-untrust-inbound-10] policy source 200.2.2.0 0.0.0.255[FW-policy-interzone-dmz-untrust-inbound-10] policy source 200.3.3.0 0.0.0.255[FW-policy-interzone-dmz-untrust-inbound-10] policy destination 172.16.2.100 0 [FW-policy-interzone-dmz-untrust-inbound-10] policy destination 172.16.2.200 0

3）防火墙配置NAT

nat-policy的执行动作

source-nat：表示对该数据流进行源地址NAT转换

no-nat：不对该数据流进行NAT转换

nat地址集配置如下：ip address-set nat type groupaddress 0 192.168.0.0 0.0.3.255[FW]nat-policy interzone trust untrust outbound [FW-nat-policy-interzone-trust-untrust-outbound] policy 10 [FW-nat-policy-interzone-trust-untrust-outbound-10] action source-nat #执行动作为源NAT[FW-nat-policy-interzone-trust-untrust-outbound-10] policy source address-set nat #匹配源地址进行NAT转换[FW-nat-policy-interzone-trust-untrust-outbound-10] easy-ip GigabitEthernet0/0/2 #指定easy-ip接口