ensp防火墙之NAT

需求: 要做到内网用户能够正常通过nat转换为公网地址访问外网，且外网用户能访问内网的web服务器，服务器不能主动发出请求报文.

1.配置IP地址
FW1:
int gi 1/0/0 
  ip add 192.168.1.1 24
int gi 1/0/1
  ip add 9.9.9.1 24 
int gi 1/0/2
  ip add 20.91.1.1 29

AR1:
int gi 0/0/0
  ip add 20.91.1.2 29
int gi 0/0/1
  ip add 8.8.8.1 24


2.划分vlan 并给vlan if地址配置好ip地址
#创建vlan并划分vlan到对应接口
SW1：
vlan batch 10 20 990
int gi 0/0/1
  port link-type access
  port default vlan 10
int gi 0/0/2
  port link-type access
  port default vlan 20
int gi 0/0/3
  port link-type access
  port default vlan 990

#给vlan if接口配上ip地址
int vlan 10
  ip add 192.168.2.1 24
int vlan 20
  ip add 192.168.3.1 24
int vlan 990 
  ip add 192.168.1.11 24


3.防火墙上划分安全区域
#trust 高优先级区域 dmz 中等优先级区域  untrust 低优先级区域
firewall zone trust 
  add int gi 1/0/0
firewall zone dmz
  add int gi 1/0/1
firewall zone untrust 
  add int gi 1/0/2
 

4.防火墙上配置安全策略
#三条策略  trust --> untrust  trust --> dmz  untrust --> dmz
security-policy
rule name T-U
source-zone trust
destination-zone untrust 
action permit

security-policy
rule name T-DMZ
source-zone trust
destination-zone dmz
action permit

security-policy
rule name U-DMZ
source-zone untrust
destination-zone dmz
action permit 


5.在交换机和防火墙上写两条缺省和两条指向内网的路由,路由器也配一条回包路由.
SW1:
ip route-static 0.0.0.0 0 192.168.1.1

FW1:
ip route-static 192.168.2.0 24 192.168.1.11
ip route-static 192.168.3.0 24 192.168.1.11
ip route-static 0.0.0.0 0 20.91.1.2

AR1:
ip route-static 20.91.1.0 29 21.91.1.1 

6.配置nat
#配置内网用户基于防火墙出口地址来访问外网.
nat-policy
rule name OA_CMNET
source-zone trust 
destination-zone untrust
action source-nat easy-ip

#配置nat server 让服务器固定在某个ip 方便访问 
nat server policy_web1 protocol tcp global 20.91.1.3 80 inside 9.9.9.9 80 n
o-reverse 

测试:

1.内网-->外网

测试访问正常！

2.外网-->内网web服务器

测试访问正常！