学习视频来源:华为安全认证HCIE
个人在学习的同时,也验证了视频中的实验部分,现将授课笔记和实验笔记整理下来。
网络拓扑
关键配置及验证
OKLABFW删除原有trust区域的接口,并将其放入untrust和dmz区域中
firewall zone trust
undo add interface GigabitEthernet 0/0/1.2
undo add interface GigabitEthernet 0/0/1.4
firewall zone untrust
add interface GigabitEthernet 0/0/1.2
firewall zone dmz
add interface GigabitEthernet 0/0/1.4
测试验证Inside无法ping通Outside
[Inside]ping 202.100.1.1
PING 202.100.1.1: 56 data bytes, press CTRL_C to break
Request time out
Request time out
Request time out
Request time out
Request time out
--- 202.100.1.1 ping statistics ---
5 packet(s) transmitted
0 packet(s) received
100.00% packet loss
[Inside]
OKLABFW修改域间策略
firewall packet-filter default permit interzone trust untrust directio
n outbound
查看域间策略规则修改情况
[OKLAB-FW]dis firewall packet-filter default all
20:07:22 2021/06/28
Firewall default packet-filter action is:
----------------------------------------------------------------------
packet-filter in public:
local -> trust :
inbound : default: permit; || IPv6-acl: null
outbound : default: permit; || IPv6-acl: null
local -> untrust :
inbound : default: deny; || IPv6-acl: null
outbound : default: permit; || IPv6-acl: null
local -> dmz :
inbound : default: deny; || IPv6-acl: null
outbound : default: permit; || IPv6-acl: null
trust -> untrust :
inbound : default: deny; || IPv6-acl: null
outbound : default: permit; || IPv6-acl: null
trust -> dmz :
inbound : default: deny; || IPv6-acl: null
outbound : default: deny; || IPv6-acl: null
dmz -> untrust :
inbound : default: deny; || IPv6-acl: null
outbound : default: deny; || IPv6-acl: null
packet-filter between VFW:
[OKLAB-FW]
验证Inside可以ping通Outside
[Inside]ping 202.100.1.1
PING 202.100.1.1: 56 data bytes, press CTRL_C to break
Reply from 202.100.1.1: bytes=56 Sequence=1 ttl=254 time=80 ms
Reply from 202.100.1.1: bytes=56 Sequence=2 ttl=254 time=80 ms
Reply from 202.100.1.1: bytes=56 Sequence=3 ttl=254 time=90 ms
Reply from 202.100.1.1: bytes=56 Sequence=4 ttl=254 time=100 ms
Reply from 202.100.1.1: bytes=56 Sequence=5 ttl=254 time=130 ms
--- 202.100.1.1 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 80/96/130 ms
[Inside]
恢复域间策略规则
firewall packet-filter default deny interzone trust untrust direction
outbound
OKLABFW配置域间详细转发策略
policy interzone trust untrust outbound
policy create-mode auto-sort enable
policy 5
action permit
policy service service-set icmp
policy source 10.1.1.0 mask 24
policy destination 202.100.1.0 mask 24
再次验证Inside可以ping通Outside
<Inside>ping 202.100.1.1
PING 202.100.1.1: 56 data bytes, press CTRL_C to break
Reply from 202.100.1.1: bytes=56 Sequence=1 ttl=254 time=110 ms
Reply from 202.100.1.1: bytes=56 Sequence=2 ttl=254 time=80 ms
Reply from 202.100.1.1: bytes=56 Sequence=3 ttl=254 time=110 ms
Reply from 202.100.1.1: bytes=56 Sequence=4 ttl=254 time=90 ms
Reply from 202.100.1.1: bytes=56 Sequence=5 ttl=254 time=110 ms
--- 202.100.1.1 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 80/100/110 ms
<Inside>