虚拟系统互访实验

最新推荐文章于 2025-10-29 20:49:28 发布

原创最新推荐文章于 2025-10-29 20:49:28 发布 · 159 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#java #服务器 #网络

一、搭建拓扑

二、实验需求

1、FW作为出口，只有一个公网接口和IP地址，所有内网访问都需要经过这个接口
2、财务部禁止访问Internet，研发部门部分员工可以访问，行政部门所有员工可以访问
3、三个部门业务体量差不多，为其分配相同的虚拟系统资源
4、研发部直接访问行政部

三、配置

1、创建虚拟系统，分配资源、配置管理员

[FW1]vsys enable   ---启动虚拟系统
[FW1]display resource global-resource  --查看全局资源
2025-08-15 12:00:08.380 
 Global resource table:
 ------------------------------------------------------------
                           Global-Number        Remained-Number     
 session                   5000                 5000                
 session-rate              6000                 6000                
 ipv6 session              128                  128                 
 ipv6 session-rate         10000                10000               
 bandwidth                 10                   10                  
 policy                    1000                 1000                
 traffic-policy            16                   16                  
 ssl-vpn-concurrent        100                  100                 
 online-user               500                  500                 
 user                      500                  500                 
 user-group                128                  128                 
 security-group            500                  500                 
 l2tp-tunnel               200                  200                 
 ipsec-tunnel              10                   10                  
 ------------------------------------------------------------

##创建资源类
[FW1]resource-class r1	
[FW1-resource-class-r1]resource-item-limit session reserved-number 500 maximum 1000	
[FW1-resource-class-r1]resource-item-limit bandwidth 2 outbound 	
[FW1-resource-class-r1]resource-item-limit policy reserved-number 200
[FW1-resource-class-r1]resource-item-limit user reserved-number 100	
[FW1-resource-class-r1]resource-item-limit user-group reserved-number 10

[FW1]resource-class r2
[FW1-resource-class-r2]resource-item-limit session reserved-number 500 maximum 1000
[FW1-resource-class-r2]resource-item-limit bandwidth 2 outbound 
[FW1-resource-class-r2]resource-item-limit policy reserved-number 200
[FW1-resource-class-r2]resource-item-limit user reserved-number 100
[FW1-resource-class-r2]resource-item-limit user-group reserved-number 10

[FW1]resource-class r3
[FW1-resource-class-r3]resource-item-limit session reserved-number 500 maximum 1000
[FW1-resource-class-r3]resource-item-limit bandwidth 2 outbound 
[FW1-resource-class-r3]resource-item-limit policy reserved-number 200
[FW1-resource-class-r3]resource-item-limit user reserved-number 100
[FW1-resource-class-r3]resource-item-limit user-group reserved-number 10

##将接口划入对应虚拟系统
[FW1]vsys name vsysa
[FW1-vsys-vsysa]assign interface GigabitEthernet 1/0/1

[FW1]vsys name vsysb
[FW1-vsys-vsysb]assign interface GigabitEthernet 1/0/2

[FW1]vsys name vsysc
[FW1-vsys-vsysc]assign interface GigabitEthernet 1/0/3

##创建管理员（命令行方式创建）
[FW1]switch vsys vsysa
<FW1-vsysa>sys
[FW1-vsysa]aaa
[FW1-vsysa-aaa]manager-user admin@@vsysa
[FW1-vsysa-aaa-manager-user-admin@@vsysa]password

Enter Password:admin@123

Confirm Password:admin@123	
[FW1-vsysa-aaa-manager-user-admin@@vsysa]service-type web
[FW1-vsysa-aaa-manager-user-admin@@vsysa]level 15
[FW1-vsysa-aaa]bind manager-user admin@@vsysa role system-admin

web界面创建

2、给根系统创建路由和NAT策略

3、部门配置

研发部：

[FW1]switch vsys vsysa
<FW1-vsysa>sys
[FW1-vsysa]interface g1/0/1
[FW1-vsysa-GigabitEthernet1/0/1]ip add 10.3.0.254 24

[FW1-vsysa]interface Virtual-if 1
[FW1-vsysa-Virtual-if1]ip add 172.16.0.2 24

[FW1-vsysa]firewall zone trust 
[FW1-vsysa-zone-trust]add interface g1/0/1

[FW1-vsysa]firewall zone untrust 
[FW1-vsysa-zone-untrust]add interface Virtual-if 1
[FW1-vsysa]ip route-static  0.0.0.0 0 public

财务部：

[FW1]switch vsys vsysb
<FW1-vsysb>
<FW1-vsysb>sys
[FW1-vsysb]interface g1/0/2
[FW1-vsysb-GigabitEthernet1/0/2]ip add 10.3.1.254 24

[FW1-vsysb]interface Virtual-if 2
[FW1-vsysb-Virtual-if2]ip add 172.16.2.1 24
	
[FW1-vsysb]firewall zone trust 
[FW1-vsysb-zone-trust]add interface g1/0/2
[FW1-vsysb]firewall zone untrust 
[FW1-vsysb-zone-untrust]add interface Virtual-if 2
	
[FW1-vsysb]ip route-static 0.0.0.0 0 public

行政部：

[FW1]switch vsys vsysc
<FW1-vsysc>sys
[FW1-vsysc]interface g1/0/3
[FW1-vsysc-GigabitEthernet1/0/3]ip add 10.3.2.254 24

[FW1-vsysc]interface Virtual-if 3
[FW1-vsysc-Virtual-if3]ip add 172.16.3.1 24	
[FW1-vsysc]firewall zone trust 
[FW1-vsysc-zone-trust]add interface g1/0/3

[FW1-vsysc]firewall zone untrust 
[FW1-vsysc-zone-untrust]add interface Virtual-if 3
	
[FW1-vsysc]ip route-static 0.0.0.0 0 public

研发部访问行政部：

[FW1]switch vsys vsysa
<FW1-vsysa>sys
[FW1-vsysa]security-policy
[FW1-vsysa-policy-security]rule name to_vsysc
[FW1-vsysa-policy-security-rule-to_vsysc]source-zone trust 	
[FW1-vsysa-policy-security-rule-to_vsysc]destination-zone untrust 	
[FW1-vsysa-policy-security-rule-to_vsysc]source-address 10.3.0.0 24
[FW1-vsysa-policy-security-rule-to_vsysc]destination-address 10.3.2.0 24
[FW1-vsysa-policy-security-rule-to_vsysc]action permit 
[FW1-vsysa-policy-security]rule move to_vsysc before to_internet	
[FW1-vsysa-policy-security]display this 
2025-08-15 13:05:55.590 
#
security-policy
 rule name to_vsysc
  source-zone trust
  destination-zone untrust
  source-address 10.3.0.0 mask 255.255.255.0
  destination-address 10.3.2.0 mask 255.255.255.0
  action permit
#
return
[FW1-vsysa-policy-security]display this 
2025-08-15 13:09:10.170 
#
security-policy
 rule name to_vsysc
  source-zone trust
  destination-zone untrust
  source-address 10.3.0.0 mask 255.255.255.0
  destination-address 10.3.2.0 mask 255.255.255.0
  action permit
 rule name to_internet
  source-zone trust
  destination-zone untrust
  source-address address-set ipa_address_1
  action permit

[FW1]switch vsys vsysc
<FW1-vsysc>
<FW1-vsysc>sys
[FW1-vsysc]security-policy	
[FW1-vsysc-policy-security]rule name to_vsysa	
[FW1-vsysc-policy-security-rule-to_vsysa]source-zone untrust 
[FW1-vsysc-policy-security-rule-to_vsysa]destination-zone trust 
[FW1-vsysc-policy-security-rule-to_vsysa]source-address 10.3.0.0 24
[FW1-vsysc-policy-security-rule-to_vsysa]destination-address 10.3.2.0 24	
[FW1-vsysc-policy-security-rule-to_vsysa]action permit 	
[FW1-vsysc-policy-security]rule move to_vsysa before to_internet	
[FW1-vsysc-policy-security]display this 
2025-08-15 13:16:16.930 
#
security-policy
 rule name to_vsysa
  source-zone untrust
  destination-zone trust
  source-address 10.3.0.0 mask 255.255.255.0
  destination-address 10.3.2.0 mask 255.255.255.0
  action permit
 rule name to_internet
  source-zone trust
  destination-zone untrust
  action permit
#
return