虚拟系统配置

需求

安全策略要求：
1、只存在一个公网IP地址，公司内网所有部门都需要借用同一个接口访问外网
2、财务部禁止访问Internet，研发部门只有部分员工可以访问Internet，行政部门全部可以访问互联网
3、为三个部门的虚拟系统分配相同的资源类

配置思路

配置思路：
1、由根系统管理员创建虚拟系统abc并且为其分配资源以及配置管理员
2、根系统管理员为内网用户创建安全策略和NAT策略
3、由abc三个虚拟系统各自完成IP、路由、安全策略配置

启动虚拟系统

[USG6000V1]vsys enable

2，配置资源类

 

[USG6000V1]resource-class r1	
[USG6000V1-resource-class-r1]resource-item-limit session reserved-number  500 ma
ximum  1000

 

查看剩余公共资源

[USG6000V1]vsys name vsysa
[USG6000V1-vsys-vsysa]assign resource-class r1
[USG6000V1-vsys-vsysa]assign interface GigabitEthernet 1/0/1

3，创建虚拟系统

 

[USG6000V1]vsys name vsysa
[USG6000V1-vsys-vsysa]assign resource-class r1
[USG6000V1-vsys-vsysa]assign interface GigabitEthernet 1/0/1

 4，管理员设置

[USG6000V1]switch vsys vsysa
<USG6000V1-vsysa>sys
[USG6000V1-vsysa]aaa
[USG6000V1-vsysa-aaa]manager-user admin@@vsysa
[USG6000V1-vsysa-aaa-manager-user-admin@@vsysa]password

Enter Password:

Confirm Password:
[USG6000V1-vsysa-aaa-manager-user-admin@@vsysa]level 15
[USG6000V1-vsysa-aaa-manager-user-admin@@vsysa]service-type web telnet ssh
Warning: The user access modes include Telnet or FTP, so security risks exist.	
[USG6000V1-vsysa-aaa-manager-user-admin@@vsysa]quit 	
[USG6000V1-vsysa-aaa]bind manager-user admin@@vsysa role system-admin 

切换虚拟系统

 配置缺省路由

根系统

[USG6000V1]security-policy
[USG6000V1-policy-security]rule name to_internet	
[USG6000V1-policy-security-rule-to_internet]source-zone trust 
[USG6000V1-policy-security-rule-to_internet]destination-zone untrust 	
[USG6000V1-policy-security-rule-to_internet]action permit 
[USG6000V1-policy-security-rule-to_internet]q
[USG6000V1-policy-security]q	
[USG6000V1]nat-policy
[USG6000V1-policy-nat]rule name nat1
[USG6000V1-policy-nat-rule-nat1]source-zone tr	
[USG6000V1-policy-nat-rule-nat1]source-zone trust 
[USG6000V1-policy-nat-rule-nat1]egress-interface  g1/0/0
[USG6000V1-policy-nat-rule-nat1]source-address 10.3.0.0 16
[USG6000V1-policy-nat-rule-nat1]action source-nat  easy-ip 

虚拟系统a

USG6000V1]switch vsys vsysa
<USG6000V1-vsysa>sys
Enter system view, return user view with Ctrl+Z.
[USG6000V1-vsysa]interface g1/0/1
[USG6000V1-vsysa-GigabitEthernet1/0/1]ip address 10.3.0.254 24
[USG6000V1-vsysa]interface Virtual-if 1
[USG6000V1-vsysa-Virtual-if1]ip address 172.16.1.1 24
[USG6000V1-vsysa]firewall zone trust 
[USG6000V1-vsysa-zone-trust]add interface g1/0/1
[USG6000V1-vsysa]firewall zone untrust 	
[USG6000V1-vsysa-zone-untrust]add interface Virtual-if 1
[USG6000V1-vsysa]ip route-static 0.0.0.0 0 public 
[USG6000V1-vsysa]ip address-set ip_add01 type object 
[USG6000V1-vsysa-object-address-set-ip_add01]address range 10.3.0.1 10.3.0.10
[USG6000V1-vsysa]security-policy	
[USG6000V1-vsysa-policy-security]rule name to_internet	
[USG6000V1-vsysa-policy-security-rule-to_internet]source-zone trust 
[USG6000V1-vsysa-policy-security-rule-to_internet]destination-zone untrust 	
[USG6000V1-vsysa-policy-security-rule-to_internet]source-address address-set ip_
add01
[USG6000V1-vsysa-policy-security-rule-to_internet]action permit