防火墙网络+DHCP的基础配置
1,基础布局
2,交换机配置用以设置内网网关
[LSW1]int Vlanif 1
[LSW1-Vlanif1]ip address 192.168.0.250 24
3,路由器AR1配置
[AR1]interface GigabitEthernet 0/0/1
[AR1-GigabitEthernet0/0/1]ip address 192.168.0.254 24
[AR1-GigabitEthernet0/0/1]q
[AR1]ip pool dhcp01
[AR1-ip-pool-dhcp01]gateway-list 192.168.0.254
[AR1-ip-pool-dhcp01]network 192.168.0.0 mask 24
[AR1-ip-pool-dhcp01]excluded-ip-address 192.168.0.240 192.168.0.250
[AR1-ip-pool-dhcp01]dns-list 6.6.6.6
[AR1-ip-pool-dhcp01]lease day 3
[AR1-GigabitEthernet0/0/1]dhcp enable
[AR1-GigabitEthernet0/0/1]dhcp select global
[AR1]interface GigabitEthernet 0/0/0
[AR1-GigabitEthernet0/0/0]ip add
[AR1-GigabitEthernet0/0/0]ip address 66.1.1.1 24
[AR1]ip route-static 0.0.0.0 0.0.0.0 66.1.1.2
4,防火墙配置
初始username:admin\password:Admin@123
5:
[FW1-GigabitEthernet1/0/0]ip address 66.1.1.2 24
[FW1-zone-trust]add interface GigabitEthernet 1/0/0
[FW1]ip route-static 192.168.0.0 255.255.255.0 66.1.1.1
[FW1-GigabitEthernet1/0/0]service-manage ping permit//允许ping通防火墙
6,设置端口1/0/1 ip 67.1.1.1后 设置外网区域
[FW1-GigabitEthernet1/0/1]ip address 67.1.1.1 24
[FW1]firewall zone untrust//进入非信任区域
[FW1-zone-untrust]add interface GigabitEthernet 1/0/1 //加入非信任区域
[FW1]nat-policy// 配置NAT地址转换
[FW1-policy-nat]rule name r1// 指定策略名称
[FW1-policy-nat-rule-r1]source-zone trust//来自信任区域
[FW1-policy-nat-rule-r1]destination-zone untrust//去往非信任区域
[FW1-policy-nat-rule-r1]action source-nat easy-ip//做地址转换,转成出口ip,easy-ip能在做地址转换的时候自动转成设备出接口的地址。
[FW1]security-policy//进入安全策略
[FW1-policy-security]rule name r1//新建一个安全策略,叫做r1
[FW1-policy-security-rule-r1]source-zone trust//来自信任区域
[FW1-policy-security-rule-r1]destination-zone untrust//去往非信任区域
[FW1-policy-security-rule-r1]action permit允许行动
7,设置服务器区域
[FW1]interface GigabitEthernet 1/0/2
[FW1-GigabitEthernet1/0/2]ip address 68.1.1.1 24
[FW1]firewall zone dmz
[FW1-zone-dmz]add interface GigabitEthernet 1/0/2
[FW1]nat-policy
[FW1-policy-nat]rule name r2
[FW1-policy-nat-rule-r2]source-zone trust
[FW1-policy-nat-rule-r2]destination-zone dmz
[FW1-policy-nat-rule-r2]action source-nat easy-ip
[FW1]security-policy
[FW1-policy-security]rule name r2
[FW1-policy-security-rule-r2]source-zone trust
[FW1-policy-security-rule-r2]destination-zone dmz
[FW1-policy-security-rule-r2]action permit