华为防火墙虚拟系统间互访

1.配置trust区域
[FW1-GigabitEthernet1/0/1]ip add 10.1.1.1 24
[FW1-GigabitEthernet1/0/1]service-manage ping permit
[FW1-GigabitEthernet1/0/2]ip add 10.1.2.1 24
[FW1-GigabitEthernet1/0/2]service-manage ping permit
[FW1]firewall zone trust
[FW1-zone-trust]add interface g1/0/1
[FW1-zone-trust]add interface g1/0/2

2.配置untrust区域
[FW1-GigabitEthernet1/0/0]ip add 20.1.1.1 24
[FW1-GigabitEthernet1/0/0]service-manage ping permit
[FW1]firewall zone untrust
[FW1-zone-untrust]add interface g1/0/0
[AR1-GigabitEthernet0/0/0]ip add 20.1.1.2 24
[AR1-GigabitEthernet0/0/1]ip add 20.1.2.2 24

3.配置访问外网
[FW1]ip route-static 0.0.0.0 0.0.0.0 20.1.1.2
[FW1]ip route-static vpn-instance vsys1 10.1.2.0 24 vpn-instance vsys2
[FW1]ip route-static vpn-instance vsys2 10.1.1.0 24 vpn-instance vsys1
[FW1]security-policy
[FW1-policy-security]rule name out
[FW1-policy-security-rule-out]source-zone trust
[FW1-policy-security-rule-out]source-address range 10.1.1.2 10.1.1.10
[FW1-policy-security-rule-out]source-address 10.1.2.0 24
[FW1-policy-security-rule-out]destination-zone untrust
[FW1-policy-security-rule-out]action permit
[FW1]nat-policy
[FW1-policy-nat]rule name source_nat
[FW1-policy-nat-rule-source_nat]source-zone trust
[FW1-policy-nat-rule-source_nat]destination-zone untrust
[FW1-policy-nat-rule-source_nat]action source-nat easy-ip
4.使能虚拟系统功能
[FW1]vsys enable //使能虚拟系统
[FW1]vsys name vsys1
[FW1-vsys-vsys1]assign interface g1/0/1
[FW1]vsys name vsys2
[FW1-vsys-vsys2]assign interface g1/0/2
5.配置资源类
[FW1]resource-class r0 //开启虚拟系统功能后默认生成
[FW1]resource-class r1 //进入资源类视图
[FW1-resource-class-r1]resource-item-limit session reserved-number 1000 maximum 3000 //指定会话的保证值和最大值
[FW1-resource-class-r1]resource-item-limit policy reserved-number 500 //指定策略保证值
[FW1-resource-class-r1]resource-item-limit ssl-vpn-concurrent reserved-number 30 //指定ssl vpn并发用户的保证值
[FW1-resource-class-r1]resource-item-limit user reserved-number 100 //指定用户保证值
[FW1-resource-class-r1]resource-item-limit user-group reserved-number 30 //指定用户组保证值
[FW1]resource-class r2
[FW1-resource-class-r2]resource-item-limit session reserved-number 1000 maximum 3000
[FW1-resource-class-r2]resource-item-limit policy reserved-number 100
[FW1-resource-class-r2]resource-item-limit user reserved-number 100
6.为虚拟系统分配资源
[FW1]vsys name vsys1
[FW1-vsys-vsys1]assign resource-class r1
[FW1]vsys name vsys2
[FW1-vsys-vsys2]assign resource-class r2
7.配置虚拟系统
[FW1]switch vsys vsys1 //转入虚拟系统
[FW1-vsys1]ip address-set to_internet type group
[FW1-vsys1-group-address-set-to_internet]address 0 range 10.1.1.2 10.1.1.10
[FW1-vsys1]time-range worktime
[FW1-vsys1-time-range-worktime]period-range 8:00:00 to 18:00:00 working-day
[FW1-vsys1-GigabitEthernet1/0/1]ip address 10.1.1.1 24
[FW1-vsys1-GigabitEthernet1/0/1]service-manage ping permit
[FW1]firewall zone trust
[FW1-zone-trust]add interface Virtual-if0
[FW1-vsys1]firewall zone trust
[FW1-vsys1-zone-trust]add interface g1/0/1
[FW1-vsys1]firewall zone untrust
[FW1-vsys1-zone-untrust]add interface Virtual-if1
[FW1]switch vsys vsys2
[FW1-vsys2]time-range worktime
[FW1-vsys2-time-range-worktime]period-range 8:00:00 to 18:00:00 working-day
[FW1-vsys2]interface g1/0/2
[FW1-vsys2-GigabitEthernet1/0/2]ip add 10.1.2.1 24
[FW1-vsys2]firewall zone trust
[FW1-vsys2-zone-trust]add interface g1/0/2
[FW1-vsys2]firewall zone untrust
[FW1-vsys2-zone-untrust]add interface Virtual-if2
8.虚拟系统访问外网
[FW1-vsys1]ip route-static 0.0.0.0 0.0.0.0 public
[FW1-vsys1]security-policy
[FW1-vsys1-policy-security]rule name out
[FW1-vsys1-policy-security-rule-out]source-zone trust
[FW1-vsys1-policy-security-rule-out]source-address range 10.1.1.2 10.1.1.10
[FW1-vsys1-policy-security-rule-out]destination-zone untrust
[FW1-vsys1-policy-security-rule-out]action permit
[FW1-vsys2]ip route-static 0.0.0.0 0.0.0.0 public
[FW1-vsys2]security-policy
[FW1-vsys2-policy-security]rule name out
[FW1-vsys2-policy-security-rule-out]source-zone trust
[FW1-vsys2-policy-security-rule-out]source-address 10.1.2.0 24
[FW1-vsys2-policy-security-rule-out]destination-zone untrust
[FW1-vsys2-policy-security-rule-out]action permit
9.虚拟系统互访
[FW1]switch vsys vsys1
sys
[FW1-vsys1]security-policy
[FW1-vsys1-policy-security]rule name to_vsys2
[FW1-vsys1-policy-security-rule-to_vsys2]source-zone trust
[FW1-vsys1-policy-security-rule-to_vsys2]source-address range 10.1.1.20 10.1.1.30
[FW1-vsys1-policy-security-rule-to_vsys2]destination-zone untrust
[FW1-vsys1-policy-security-rule-to_vsys2]destination-address range 10.1.2.20 10.1.2.30
[FW1-vsys1-policy-security-rule-to_vsys2]action permit
[FW1-vsys1-policy-security]rule name in
[FW1-vsys1-policy-security-rule-in]source-zone untrust
[FW1-vsys1-policy-security-rule-in]source-address range 10.1.2.20 10.1.2.30
[FW1-vsys1-policy-security-rule-in]destination-zone trust
[FW1-vsys1-policy-security-rule-in]destination-address range 10.1.1.20 10.1.1.30
[FW1-vsys1-policy-security-rule-in]action permit
[FW1-vsys2]security-policy
[FW1-vsys2-policy-security]rule name to_vsys1
[FW1-vsys2-policy-security-rule-to_vsys1]source-zone trust
[FW1-vsys2-policy-security-rule-to_vsys1]source-address range 10.1.2.20 10.1.2.30
[FW1-vsys2-policy-security-rule-to_vsys1]destination-zone untrust
[FW1-vsys2-policy-security-rule-to_vsys1]destination-address range 10.1.1.20 10.1.1.30
[FW1-vsys2-policy-security-rule-to_vsys1]action permit
[FW1-vsys2-policy-security]rule name in
[FW1-vsys2-policy-security-rule-in]source-zone untrust
[FW1-vsys2-policy-security-rule-in]source-address range 10.1.1.20 10.1.1.30
[FW1-vsys2-policy-security-rule-in]destination-zone trust
[FW1-vsys2-policy-security-rule-in]destination-address range 10.1.2.20 10.1.2.30
[FW1-vsys2-policy-security-rule-in]action permit
[FW1-GigabitEthernet1/0/0]set public-interface //设置公网接口
10.验证
PC1中只有10.1.1.2-10.1.1.10网段可以访问外网

PC2都可以访问外网

将PC1和PC2的地址改到可以互访的网段内，才能互访