eNSP—防火墙基本操作2

德暮

已于 2023-03-09 22:22:20 修改

阅读量869

点赞数

文章标签：网络互联

于 2022-02-25 21:38:13 首次发布

本文链接：https://blog.csdn.net/m0_46237205/article/details/123140802

版权

该配置教程详细展示了如何通过FW1防火墙设置，实现client1与client2之间的ping通信，以及client1访问FTP/HTTP服务和client2访问HTTP服务的功能。配置包括了接口IP地址设定、区域划分以及基于区域的策略制定，确保了特定流量的安全通过。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

拓扑如下：
在这里插入图片描述
【1】FW1的基本配置：

[SRG]sysname FW1
[FW1]int g0/0/1
[FW1-GigabitEthernet0/0/1]ip add 10.1.1.254 24
[FW1-GigabitEthernet0/0/1]int g0/0/2
[FW1-GigabitEthernet0/0/2]ip add 20.1.1.254 24
[FW1-GigabitEthernet0/0/2]int g0/0/3
[FW1-GigabitEthernet0/0/3]ip add 100.1.1.254 24

【2】防火墙的区域划分

[FW1]firewall zone trust 
[FW1-zone-trust]add int g0/0/1
[FW1-zone-trust]quit
[FW1]firewall zone untrust 
[FW1-zone-untrust]add int g0/0/2
[FW1-zone-untrust]quit
[FW1]firewall zone name dmz1
[FW1-zone-dmz1]set priority 69
[FW1-zone-dmz1]add int g0/0/3

【3】要求1（client1 ping通client2）的配置：

[FW1]policy interzone trust untrust outbound 
[FW1-policy-interzone-trust-untrust-outbound]policy 1
[FW1-policy-interzone-trust-untrust-outbound-1]policy source 10.1.1.1 0
[FW1-policy-interzone-trust-untrust-outbound-1]policy destination 20.1.1.1 0
[FW1-policy-interzone-trust-untrust-outbound-1]policy service service-set icmp
[FW1-policy-interzone-trust-untrust-outbound-1]action permit

在这里插入图片描述

【4】要求2（client1可以访问FTP/HTTP服务）的配置：

[FW1]policy interzone trust dmz1 outbound 
[FW1-policy-interzone-trust-dmz1-outbound]policy 1
[FW1-policy-interzone-trust-dmz1-outbound-1]policy source 10.1.1.1 0
[FW1-policy-interzone-trust-dmz1-outbound-1]policy destination 100.1.1.1 0 
[FW1-policy-interzone-trust-dmz1-outbound-1]policy service service-set http
[FW1-policy-interzone-trust-dmz1-outbound-1]action permit 
[FW1-policy-interzone-trust-dmz1-outbound-1]quit
[FW1-policy-interzone-trust-dmz1-outbound]policy 2
[FW1-policy-interzone-trust-dmz1-outbound-2]policy source 10.1.1.1 0
[FW1-policy-interzone-trust-dmz1-outbound-2]policy destination 100.1.1.1 0
[FW1-policy-interzone-trust-dmz1-outbound-2]policy service service-set ftp
[FW1-policy-interzone-trust-dmz1-outbound-2]action permit
[SRG-policy-interzone-trust-dmz1-outbound-2]quit
[SRG-policy-interzone-trust-dmz1-outbound]quit
[SRG]firewall interzone trust dmz1
[SRG-interzone-trust-dmz1]detect ftp

在这里插入图片描述

【5】要求3（client2 可以访问http服务）的配置：

[FW1]policy interzone untrust dmz1 inbound 
[FW1-policy-interzone-dmz1-untrust-inbound]policy 1
[FW1-policy-interzone-dmz1-untrust-inbound-1]policy source 20.1.1.1 0
[FW1-policy-interzone-dmz1-untrust-inbound-1]policy destination 100.1.1.1 0
[FW1-policy-interzone-dmz1-untrust-inbound-1]policy service service-set http
[FW1-policy-interzone-dmz1-untrust-inbound-1]action permit

在这里插入图片描述