拓扑图
配置路由器与防火墙之间的互联地址为192.168.5.2/24,在路由器OSPF中发布与防火墙互联网段。
配置防火墙与路由器互联地址为192.168.5.1/24. 配置与外网互联地址为192.168.12.9/24,设置外网默认路由。
配置内网访问外网nat规则,保护内网地址。 设置访问策略,部门1、部门2设置可以访问外网,部门三设置为不能访问外网。
防火墙使用USG5500
配置cloud
配置防火墙
<SRG>sys
[SRG]firewall zone trust
[SRG-zone-trust]add interface GigabitEthernet 0/0/2
[SRG-zone-trust]qu
[SRG]firewall zone untrust
[SRG-zone-untrust]add interface GigabitEthernet 0/0/1
[SRG-zone-untrust]qu
[SRG]interface GigabitEthernet 0/0/2
[SRG-GigabitEthernet0/0/2]ip address 192.168.5.1 24
[SRG-GigabitEthernet0/0/2]qu
[SRG]interface GigabitEthernet 0/0/1
[SRG-GigabitEthernet0/0/1]ip address 192.168.12.9 24
[SRG-GigabitEthernet0/0/1]qu
[SRG]ip route-static 0.0.0.0 0 192.168.12.1
[SRG]policy interzone trust untrust outbound
[SRG-policy-interzone-trust-untrust-outbound]policy 0
[SRG-policy-interzone-trust-untrust-outbound-0]action permit
[SRG-policy-interzone-trust-untrust-outbound-0]policy source 172.16.0.0 0.0.255.255
[SRG-policy-interzone-trust-untrust-outbound-0]quit
[SRG-policy-interzone-trust-untrust-outbound]qu
[SRG]nat-policy interzone trust untrust outbound
[SRG-nat-policy-interzone-trust-untrustoutbound]policy 1
[SRG-nat-policy-interzone-trust-untrust-outbound-1]action source-nat
[SRG-nat-policy-interzone-trust-untrust-outbound-1]policy source 172.16.0.0 0.0.255.255
[SRG-nat-policy-interzone-trust-untrust-outbound-1]easy-ip GigabitEthernet 0/0/1
[SRG-nat-policy-interzone-trust-untrust-outbound-1]qu
[SRG-nat-policy-interzone-trust-untrust-outbound]qu
[SRG]ospf 1
[SRG-ospf-1]area 0
[SRG-ospf-1-area-0.0.0.0]network 192.168.5.0 0.0.0.255
[SRG-ospf-1-area-0.0.0.0]qu
[SRG-ospf-1]default-route-advertise always cost 200 type 1
配置R1
[R1]interface GigabitEthernet 0/0/2
[R1-GigabitEthernet0/0/2]ip address 192.168.5.2 24
[R1-GigabitEthernet0/0/2]quit
[R1]ospf 1
[R1-ospf-1]area 0
[R1-ospf-1-area-0.0.0.0]network 192.168.5.0 0.0.0.255
测试