防御保护课程综合练习

易水寒181

已于 2025-02-11 01:09:20 修改

阅读量294

点赞数 3

文章标签：网络安全安全防御

于 2025-02-11 01:08:02 首次发布

本文链接：https://blog.csdn.net/weixin_74874800/article/details/145559725

版权

在这里插入图片描述
一、拓扑
二、需求分析+实验步骤

****需求一：根据表格，完成配置****

在这里插入图片描述
接口配置IP

sw2:

sys

vlan 10
vlan 20 

int g 0/0/2
port link-type access
port default vlan 10

int g 0/0/3
port link-type access
port default vlan 20
int g 0/0/1
port link-type trunk
port trunk allow-pass vlan 10 20

需求二：配置DHCP
在这里插入图片描述

FW:


ip pool dhcp-a

gateway-list 172.16.1.254
network 172.16.1.0 mask 255.255.255.0
excluded-ip-address 172.16.1.90 172.16.1.100  # 排除Client1和Client2的静态IP
dns-list 10.0.0.30

ip pool dhcp-b
gateway-list 172.16.2.254
network 172.16.2.0 mask 255.255.255.0
excluded-ip-address 172.16.2.100  # 排除PC1的静态IP
dns-list 10.0.0.30


dhcp enable


interface GigabitEthernet 1/0/1.1
dhcp select global

interface GigabitEthernet 1/0/1.2
dhcp select global

需求三：配置防火墙安全区域
在这里插入图片描述

# 分配区域设置优先级
firewall zone name Trust_A
set priority 70
add interface GigabitEthernet 1/0/1

firewall zone name Trust_B
set priority 80
add interface GigabitEthernet 1/0/1.2

firewall zone name DMZ
 add interface GigabitEthernet 1/0/0

firewall zone name Untrust
 add interface GigabitEthernet 1/0/2

需求四：配置地址组
在这里插入图片描述

FW：

# DMZ服务器地址组
ip address-set DMZ_Server type object
 address 10.0.0.10 32 name OA_Server
 address 10.0.0.20 32 name Web_Server
 address 10.0.0.30 32 name DNS_Server

# 部门A和B的地址组
ip address-set Trust_A_address type object
 address 172.16.1.90 32 name Client1
 address 172.16.1.100 32 name Client2
 address range 172.16.1.1 172.16.1.254 exclude 172.16.1.90 172.16.1.100 name Client3

ip address-set Trust_B_address type object
 address 172.16.2.100 32 name PC1
 address range 172.16.2.1 172.16.2.254 exclude 172.16.2.100 name PC2

需求五：配置管理员
在这里插入图片描述

FW：

# 创建本地用户vtyadmin
local-user vtyadmin class manage
 password cipher admin@123
 service-type telnet
 authorization-role service-admin

# 配置VTY登录权限
user-interface vty 0 4
 authentication-mode aaa
 protocol inbound telnet
 acl 2000  # 限制源IP为172.16.1.0/24

需求六：用户认证
在这里插入图片描述

1、 创建认证域openlab
aaa
 domain openlab
  authentication-scheme portal
  authorization-scheme default
  accounting-scheme default

2、 创建用户组
user-group /openlab/A name A
user-group /openlab/B name B
user-group /openlab/A/manager name manager
user-group /openlab/A/DevOps name DevOps
user-group /openlab/A/FD name FD
user-group /openlab/B/TD name TD
user-group /openlab/B/MD name MD

3、用户配置
高管
```bash
local-user user_001 class network
 password cipher admin@123  # 设置密码
 service-type portal        # 允许Portal认证
 group /openlab/A/manager   # 分配到manager组
 bind ip 172.16.1.90 mac <Client1_MAC>  # 绑定IP和MAC地址（替换为实际MAC）
 force-change-password enable  # 首次登录需修改密码
 quit

运维

local-user DevOps_001 class network
 password cipher admin@123  
 service-type portal        
 group /openlab/A/DevOps    # 分配到DevOps组
 force-change-password enable

财务

local-user FD_001 class network
 password cipher admin@123  
 service-type portal        
 group /openlab/A/FD        # 分配到FD组
 bind ip 172.16.1.100 mac <Client2_MAC>  
 force-change-password enable

技术

local-user TD_001 class network
 password cipher admin@123  
 service-type portal        
 group /openlab/B/TD        # 分配到TD组
 force-change-password enable  


local-user TD_002 class network
 password cipher admin@123
 service-type portal
 group /openlab/B/TD
 force-change-password enable


local-user TD_003 class network
 password cipher admin@123
 service-type portal
 group /openlab/B/TD
 force-change-password enable

市场

local-user MD_001 class network
 password cipher admin@123  # 设置密码
 service-type portal        # 允许Portal认证
 group /openlab/B/MD        # 分配到MD组
 force-change-password enable  # 首次登录需修改密码
 account-expire 10          # 账号过期时间为10天


local-user MD_002 class network
 password cipher admin@123
 service-type portal
 group /openlab/B/MD
 force-change-password enable
 account-expire 10


local-user MD_003 class network
 password cipher admin@123
 service-type portal
 group /openlab/B/MD
 force-change-password enable
 account-expire 10


local-user MD_004 class network
 password cipher admin@123
 service-type portal
 group /openlab/B/MD
 force-change-password enable
 account-expire 10


local-user MD_005 class network
 password cipher admin@123
 service-type portal
 group /openlab/B/MD
 force-change-password enable
 account-expire 10

4、配置用户策略
高管免认证

security-policy
 rule name policy_auth_01
  source-zone Trust_A
  destination-zone any
  source-address 172.16.1.90 32  # 高管用户IP
  action permit no-auth          # 免认证

运维Portal

rule name policy_auth_02
 source-zone Trust_A
 destination-zone dmz
 source-address 172.16.1.0 24  # 运维部用户IP范围
 destination-address 10.0.0.0 24  # DMZ服务器地址
 action permit portal          # Portal认证

技术匿名

rule name policy_auth_04
 source-zone Trust_B
 destination-zone dmz
 source-address 172.16.2.0 24  # 技术部用户IP范围
 destination-address 10.0.0.0 24  # DMZ服务器地址
 action permit anonymous       # 匿名认证

5、保存

需求七：安全策略
在这里插入图片描述

FW
policy_1


security-policy
 rule name policy_01
  source-zone Trust_A
  destination-zone Local
  source-address 172.16.1.10 32  
  service telnet                
  action permit

policy-2


 rule name policy_02
  source-zone Trust_A Trust_B
  destination-zone Local
  service dhcp                  
  action permit

policy-3

# 允许部门A和部门B访问DNS服务器
 rule name policy_03
  source-zone Trust_A Trust_B
  destination-zone dmz
  destination-address 10.0.0.30 32 
  service dns                     
  action permit

policy-4

 rule name policy_04
  source-zone Trust_A
  destination-zone dmz
  source-address 172.16.1.0 24  
  destination-address 10.0.0.0 24  
  action permit

policy-5


 rule name policy_05
 source-zone Trust_A
 destination-zone dmz
 source-address 172.16.1.90 32  # 高管IP
 source-address 172.16.1.100 32  # 财务部IP
 destination-address 10.0.0.10 32  # OA服务器IP
 destination-address 10.0.0.20 32  # Web服务器IP
 service http https             
 action permit

policy-6

time-range no_worktime
 periodic daily 00:00 to 08:00  # 每天0点到8点
 periodic daily 18:00 to 23:59  # 每天18点到23点59分

 rule name policy_06
 source-zone Trust_A
 destination-zone Untrust
 source-address 172.16.1.0 24  # 运维部IP范围
 time-range no_worktime        # 非工作时间段（需提前定义）
 action permit

policy-7

# 允许高管随时访问互联网
 rule name policy_07
  source-zone Trust_A
  destination-zone Untrust
  source-address 172.16.1.90 32  # 高管IP
  action permit

policy-8

# 允许技术部访问DMZ区域的Web服务器
 rule name policy_08
  source-zone Trust_B
  destination-zone dmz
  source-address 172.16.2.100 32  # 技术部PC1的IP
  destination-address 10.0.0.20 32  # Web服务器IP
  action permit

policy-9

# 允许技术部和市场部访问OA服务器，仅HTTP/HTTPS权限
 rule name policy_09
  source-zone Trust_B
  destination-zone dmz
  source-address 172.16.2.100 32  # 技术部PC1的IP
  source-address 172.16.2.0 24    # 市场部IP范围
  destination-address 10.0.0.10 32  # OA服务器IP
  service http https              # 允许HTTP和HTTPS服务
  action permit

policy-10

# 允许市场部访问互联网
 rule name policy_10
  source-zone Trust_B
  destination-zone Untrust
  source-address 172.16.2.0 24  # 市场部IP范围
  action permit

policy-11

time-range weekend
 periodic Saturday 00:00 to 23:59  
 periodic Sunday 00:00 to 23:59    
# 每周末拒绝除运维部以外的流量访问DMZ区域
 rule name policy_11
  source-zone Trust_A Trust_B
  destination-zone dmz
  source-address 172.16.1.0 24  # 部门A IP范围
  source-address 172.16.2.0 24  # 部门B IP范围
  time-range weekend            
  action deny