华为HCIE安全实验 | 配置Local安全策略

网络拓扑

关键配置及验证

OKLABFW配置本地转发策略

policy interzone local untrust inbound
 policy 0 
  action permit 
  policy service service-set icmp
  policy source 202.100.1.0 mask 24

验证Outside可以ping通untrust接口

<Outside>ping 202.100.1.10
  PING 202.100.1.10: 56  data bytes, press CTRL_C to break
    Reply from 202.100.1.10: bytes=56 Sequence=1 ttl=255 time=90 ms
    Reply from 202.100.1.10: bytes=56 Sequence=2 ttl=255 time=170 ms
    Reply from 202.100.1.10: bytes=56 Sequence=3 ttl=255 time=70 ms
    Reply from 202.100.1.10: bytes=56 Sequence=4 ttl=255 time=440 ms
    Reply from 202.100.1.10: bytes=56 Sequence=5 ttl=255 time=60 ms

  --- 202.100.1.10 ping statistics ---
    5 packet(s) transmitted
    5 packet(s) received
    0.00% packet loss
    round-trip min/avg/max = 60/166/440 ms

<Outside>