ensp双向NAT

防火墙FW1

interface g1/0/0

ip address 192.168.71.1 24

interface g1/0/1

ip address 192.168.71.1 24

interface g1/0/2

ip address 200.0.71.1 24

 

firewall zone trust

add interface g1/0/0

firewall zone dmz

add interface g1/0/1

firewall zone untrust

add interface g1/0/2

 

ip address-set client246 type object

address 192.168.71.2 0

address 192.168.71.4 0

address 192.168.71.6 0

 

ip address-set client35 type object

address 192.168.71.3 0

address 192.168.71.5 0

 

time-range daytime

period-range 08:00:00 to 17:30:00 daily

time-range evening

period-range 17:30:00 to 22:00:00 daily

 

security-policy（安全策略）

rule name P1

destination-zone untrust

source-address address-set client246

time-range daytime

service http

action permit

 

rule name P2

destination-zone untrust

source-address 192.168.71.7 32

action permit

 

rule name P3

destination-zone untrust

source-address address-set client35

time-range evening

service ftp

action permit

 

rule name P4

destination-zone dmz

source-zone trust

action permit

 

rule name P5

destination-zone dmz

source-zone untrust

service http

action permit

 

ip route-static 200.100.70.0 24 200.0.70.2（静态）

ip route-static 200.200.70.0 24 200.0.70.2（静态）

 

nat address-group natpool

section 200.0.70.10 200.0.70.11

mode pat

 

nat-policy

rule name P1

destination-zone untrust

source-zone trust

action source-nat address-group natpool

 

nat server httpserver protocol tcp global 200.0.70.100 www inside 192.168.70.2 www

 

路由器R1

interface g0/0/0

ip address 200.0.70.2 24

interface g0/0/1

ip address 200.100.70.1 24

interface g0/0/2

ip address 200.200.70.1 24

 

ip route-static 192.168.70.0 24 200.0.70.1（静态）

trust246三台主机在8:00-17:30可以访问untrust http服务器

 trust7主机可以全天访问untrust