防火墙FW1
interface g1/0/0
ip address 192.168.71.1 24
interface g1/0/1
ip address 192.168.71.1 24
interface g1/0/2
ip address 200.0.71.1 24
firewall zone trust
add interface g1/0/0
firewall zone dmz
add interface g1/0/1
firewall zone untrust
add interface g1/0/2
ip address-set client246 type object
address 192.168.71.2 0
address 192.168.71.4 0
address 192.168.71.6 0
ip address-set client35 type object
address 192.168.71.3 0
address 192.168.71.5 0
time-range daytime
period-range 08:00:00 to 17:30:00 daily
time-range evening
period-range 17:30:00 to 22:00:00 daily
security-policy(安全策略)
rule name P1
destination-zone untrust
source-address address-set client246
time-range daytime
service http
action permit
rule name P2
destination-zone untrust
source-address 192.168.71.7 32
action permit
rule name P3
destination-zone untrust
source-address address-set client35
time-range evening
service ftp
action permit
rule name P4
destination-zone dmz
source-zone trust
action permit
rule name P5
destination-zone dmz
source-zone untrust
service http
action permit
ip route-static 200.100.70.0 24 200.0.70.2(静态)
ip route-static 200.200.70.0 24 200.0.70.2(静态)
nat address-group natpool
section 200.0.70.10 200.0.70.11
mode pat
nat-policy
rule name P1
destination-zone untrust
source-zone trust
action source-nat address-group natpool
nat server httpserver protocol tcp global 200.0.70.100 www inside 192.168.70.2 www
路由器R1
interface g0/0/0
ip address 200.0.70.2 24
interface g0/0/1
ip address 200.100.70.1 24
interface g0/0/2
ip address 200.200.70.1 24
ip route-static 192.168.70.0 24 200.0.70.1(静态)
trust246三台主机在8:00-17:30可以访问untrust http服务器
trust7主机可以全天访问untrust