综合实验

综合实验----双机热备、IPSec、FTP、NAT Server

实验环境

实验目的

1.规划并配置IP地址，并实现私网访问公网（Client1）

2.通过IPSec VPN技术实现总部和分部互访（只允许PC1和PC2互访）

3.分部服务器（Server1）对公网用户提供FTP服务（公网地址为200.1.2.20/24）

4.总部FW1和FW2使用双机热备技术提高可靠性：

​ 上连ISP的VRRP虚拟地址为200.1.2.10/24

​ 下连私网的VRRP虚拟地址为192.168.3.10/24

​ 实现主备部署（FW1为主，FW2为备）

5.所有防火墙连接ISP的区域属于untrust区域；连接私网主机的区域属于trust区域；连接服务器（Server1）的区域属于DMZ区域；防火墙互联的区域属于DMZ区域。

具体步骤

1.规划网络配置IP并配置基本路由

PC1

IP:192.168.3.20 掩码：24 网关：192.168.3.10

PC2

IP:192.168.1.20 掩码：24 网关：192.168.1.254

Client1

IP:200.1.1.20 掩码：24 网关：200.1.1.254

Server1

IP:192.168.2.20 掩码：24 网关：192.168.2.254

R1

<Huawei>sys
[Huawei]sy R1
[R1]int g0/0/2
[R1-GigabitEthernet0/0/2]ip add 200.1.1.254 24
[R1-GigabitEthernet0/0/2]int g0/0/1
[R1-GigabitEthernet0/0/1]ip add 200.1.3.2 24. 
[R1-GigabitEthernet0/0/1]int g0/0/0
[R1-GigabitEthernet0/0/0]ip add 200.1.2.3 24
[R1-GigabitEthernet0/0/0]q
[R1]ospf 
[R1-ospf-1]ar 0	
[R1-ospf-1-area-0.0.0.0]network 200.1.1.0 0.0.0.255
[R1-ospf-1-area-0.0.0.0]network 200.1.2.0 0.0.0.255
[R1-ospf-1-area-0.0.0.0]network 200.1.3.0 0.0.0.255 

FW3

<USG6000V1>sys
[USG6000V1]sy FW3
[FW3]int g1/0/0
[FW3-GigabitEthernet1/0/0]ip add 200.1.3.1 24
[FW3-GigabitEthernet1/0/0]int g1/0/1
[FW3-GigabitEthernet1/0/1]ip add 192.168.1.254 24
[FW3-GigabitEthernet1/0/1]int g1/0/2
[FW3-GigabitEthernet1/0/2]ip add 192.168.2.254 24
[FW3-GigabitEthernet1/0/2]q
[FW3]ospf
[FW3-ospf-1]ar 0    //area 0
[FW3-ospf-1-area-0.0.0.0]int g1/0/0
[FW3-GigabitEthernet1/0/0]os e a 0    //ospf enable area 0

FW2

<USG6000V1>sy
[USG6000V1]sy FW2
[FW2]int g1/0/0
[FW2-GigabitEthernet1/0/0]ip add 200.1.2.2 24
[FW2-GigabitEthernet1/0/0]int g1/0/1
[FW2-GigabitEthernet1/0/1]ip add 192.168.3.2 24
[FW2-GigabitEthernet1/0/1]int g1/0/2
[FW2-GigabitEthernet1/0/2]ip add 10.1.1.2 24
[FW2-GigabitEthernet1/0/2]q
[FW2]ospf
[FW2]ospf 
[FW2-ospf-1]ar 0    //area 0
[FW2-ospf-1-area-0.0.0.0]int g1/0/0
[FW2-GigabitEthernet1/0/0]os e a 0    //ospf enable area 0

FW1

<USG6000V1>sy
[USG6000V1]sy FW1
[FW1]int g1/0/0
[FW1-GigabitEthernet1/0/0]ip add 200.1.2.1 24
[FW1-GigabitEthernet1/0/0]int g1/0/1
[FW1-GigabitEthernet1/0/1]ip add 192.168.3.1 24
[FW1-GigabitEthernet1/0/1]int g1/0/2
[FW1-GigabitEthernet1/0/2]ip add 10.1.1.1 24
[FW1-GigabitEthernet1/0/2]q
[FW1]ospf 
[FW1-ospf-1]ar 0    //area 0
[FW1-ospf-1-area-0.0.0.0]int g1/0/0
[FW1-GigabitEthernet1/0/0]os e a 0    //ospf enable area 0

2.使用IPSec VPN技术实现总部和分部互访

FW3

//接口加入安全域
[FW3]firewall zone untrust	
[FW3-zone-untrust]add interface g1/0/0
[FW3-zone-untrust]q	
[FW3]firewall zone trust 
[FW3-zone-trust]add int g1/0/1
[FW3-zone-trust]q	
[FW3]firewall zone  dmz 
[FW3-zone-dmz]add int g1/0/2
//配置IPSec策略
[FW3]ike proposal 1
[FW3-ike-proposal-1]				//这里使用系统默认的认证和加密的加密方式
[FW3-ike-proposal-1]q
[FW3]ike peer FW12	
[FW3-ike-peer-FW12]pre-shared-key huawei	
[FW3-ike-peer-FW12]ike-proposal 1
[FW3-ike-peer-FW12]remote-address 200.1.2.10
[FW3-ike-peer-FW12]q
[FW3]acl 3000
[FW3-acl-adv-3000]	
[FW3-acl-adv-3000]rule permit ip source 192.168.1.0 0.0.0.255 destination192.168.3.0 0.0.0.255
[FW3-acl-adv-3000]q
[FW3]ipsec proposal 1
[FW3-ipsec-proposal-1]di th			//这里使用系统默认的认证和加密的加密方式
2021-04-01 03:40:14.010 
#
ipsec proposal 1
esp authentication-algorithm sha2-256
esp encryption-algorithm aes-256
#
return
[FW3-ipsec-proposal-1]q
[FW3]ipsec policy runtime 10 isakmp
[FW3-ipsec-policy-isakmp-runtime-10]security acl 3000
[FW3-ipsec-policy-isakmp-runtime-10]ike-peer FW12
[FW3-ipsec-policy-isakmp-runtime-10]proposal 1
//配置访问的静态路由
[FW3]ip route-static 192.168.3.0 24 200.1.3.2
//为接口添加IPSec策略
[FW3]int g1/0/0
[FW3-GigabitEthernet1/0/0]ipsec policy runtime 
//配置安全策略
[FW3]security-policy
[FW3-policy-security]rule name	
[FW3-policy-security]rule name u_l
[FW3-policy-security-rule-u_l]source-zone untrust	
[FW3-policy-security-rule-u_l]destination-zone local 
[FW3-policy-security-rule-u_l]source-address 200.1.2.10 32
[FW3-policy-security-rule-u_l]destination-address 200.1.3.1 24   //32
[FW3-policy-security-rule-u_l]service esp	
[FW3-policy-security-rule-u_l]action permit
[FW3-policy-security-rule-u_l]q
[FW3-policy-security]rule name u_t
[FW3-policy-security-rule-u_t]source-zone untrust trust 	
[FW3-policy-security-rule-u_t]destination-zone trust  untrust 
[FW3-policy-security-rule-u_t]source-address 192.168.3.0 24
[FW3-policy-security-rule-u_t]source-address 192.168.1.0 24
[FW3-policy-security-rule-u_t]destination-address 192.168.1.0 24
[FW3-policy-security-rule-u_t]destination-address 192.168.3.0 24
[FW3-policy-security-rule-u_t]action permit 
[FW3-policy-security-rule-u_t]q
[FW3-policy-security]q
//创建isakmp服务
[FW3]ip service-set isakmp type object 
[FW3-object-service-set-isakmp]service protocol  udp source-port 500
[FW3-object-service-set-isakmp]q
//配置安全策略（关于isakmp报文交互）
[FW3]security-policy
[FW3-policy-security]rule name isakmp	
[FW3-policy-security-rule-isakmp]source-zone untrust local 	
[FW3-policy-security-rule-isakmp]destination-zone local untrust 
[FW3-policy-security-rule-isakmp]source-address 200.1.2.10 32
[FW3-policy-security-rule-isakmp]source-address 200.1.3.1 32
[FW3-policy-security-rule-isakmp]destination-address 200.1.3.1 32
[FW3-policy-security-rule-isakmp]destination-address 200.1.2.10 32
[FW3-policy-security-rule-isakmp]service isakmp 
[FW3-policy-security-rule-isakmp]action permit 
[FW3-policy-security-rule-isakmp]q
[FW3-policy-security]q

FW2

//接口加入安全域
[FW2]firewall zone trust 
[FW2-zone-trust]add int g1/0/1
[FW2-zone-trust]q
[FW2]firewall zone untrust 
[FW2-zone-untrust]add int g1/0/0
[FW2-zone-untrust]q	
[FW2]firewall zone dmz 
[FW2-zone-dmz]add int g1/0/2
//配置防火墙的双机热备（FW2为备）
[FW2]int g1/0/1
[FW2-GigabitEthernet1/0/1]vrrp vrid 2 virtual-ip 192.168.3.10 standby
[FW2-GigabitEthernet1/0/1]int g1/0/0
[FW2-GigabitEthernet1/0/0]vrrp vrid 1 virtual-ip 200.1.2.10 standby 
[FW2]hrp int g1/0/2 remote 10.1.1.1
[FW2]hrp enable 
//配置访问的静态路由
HRP_S[FW2]ip route-static 192.168.1.0 24 200.1.2.3

FW1

//接口加入安全域
[FW1]firewall zone untrust 
[FW1-zone-untrust]add int g1/0/0
[FW1-zone-untrust]q	
[FW1]firewall zone trust 
[FW1-zone-trust]add int g1/0/1
[FW1-zone-trust]q
[FW1]firewall zone  dmz 
[FW1-zone-dmz]add int g1/0/2
//配置防火墙的双机热备（FW1为主）
[FW1]int g1/0/1
[FW1-GigabitEthernet1/0/1]vrrp vrid 2 virtual-ip 192.168.3.10 active 
[FW1-GigabitEthernet1/0/1]int g1/0/0
[FW1-GigabitEthernet1/0/0]vrrp vrid 1 virtual-ip 200.1.2.10 active
[FW1]hrp int g1/0/2 remote 10.1.1.2
[FW1]hrp enable
//配置访问的静态路由
HRP_M[FW1]ip route-static 192.168.1.0 24 200.1.2.3

FW1&FW2

//配置IPSec策略
HRP_M[FW1]acl 3000 (+B)	
HRP_M[FW1-acl-adv-3000]rule permit ip source 192.168.3.0 0.0.0.255 destination 192.168.1.0 0.0.0.255 (+B)
HRP_M[FW1-acl-adv-3000]q
HRP_M[FW1]ikeproposal 1 (+B)			//这里使用系统默认的认证和加密的加密方式
HRP_M[FW1-ike-proposal-1]di th
2021-04-01 04:35:29.880 
#
ike proposal 1
encryption-algorithm aes-256
dh group14
authentication-algorithm sha2-256
authentication-method pre-share
integrity-algorithm hmac-sha2-256
prf hmac-sha2-256
#
return
HRP_M[FW1-ike-proposal-1]q
HRP_M[FW1]ipsec proposal 1 (+B)			//这里使用系统默认的认证和加密的加密方式
HRP_M[FW1-ipsec-proposal-1]di th
2021-04-01 04:36:10.010 
#
ipsec proposal 1
esp authentication-algorithm sha2-256
esp encryption-algorithm aes-256
#
return
HRP_M[FW1-ipsec-proposal-1]q
HRP_M[FW1]ike peer FW3 (+B)
HRP_M[FW1-ike-peer-FW3]pre-shared-key huawei (+B)	
HRP_M[FW1-ike-peer-FW3]ike-proposal 1 (+B)
HRP_M[FW1-ike-peer-FW3]remote-address 200.1.3.1 (+B)
HRP_M[FW1-ike-peer-FW3]q
HRP_M[FW1]ipsec policy runtime 10 isakmp  (+B)
HRP_M[FW1-ipsec-policy-isakmp-runtime-10]security acl 3000 (+B)
HRP_M[FW1-ipsec-policy-isakmp-runtime-10]proposal 1 (+B)	
HRP_M[FW1-ipsec-policy-isakmp-runtime-10]ike-peer FW3 (+B)
HRP_M[FW1-ipsec-policy-isakmp-runtime-10]q
//为接口添加IPSec策略
HRP_M[FW1]int g1/0/0 (+B)
HRP_M[FW1-GigabitEthernet1/0/0]ipsec policy runtime  (+B)
//配置安全策略
HRP_M[FW1]security-policy (+B)
HRP_M[FW1-policy-security]rule name u_l (+B)	
HRP_M[FW1-policy-security-rule-u_l]source-zone untrust  (+B)
HRP_M[FW1-policy-security-rule-u_l]destination-zone local  (+B)
HRP_M[FW1-policy-security-rule-u_l]source-address 200.1.3.1 32 (+B)
HRP_M[FW1-policy-security-rule-u_l]destination-address 200.1.2.10 24 (+B)
HRP_M[FW1-policy-security-rule-u_l]service esp  (+B)
HRP_M[FW1-policy-security-rule-u_l]action permit  (+B)
HRP_M[FW1-policy-security-rule-u_l]q
HRP_M[FW1-policy-security]rule name u_t (+B)	
HRP_M[FW1-policy-security-rule-u_t]source-zone trust  untrust  (+B)
HRP_M[FW1-policy-security-rule-u_t]destination-zone untrust  trust  (+B)
HRP_M[FW1-policy-security-rule-u_t]source-address 192.168.3.0 24 (+B)
HRP_M[FW1-policy-security-rule-u_t]source-address 192.168.1.0 24 (+B)
HRP_M[FW1-policy-security-rule-u_t]destination-address 192.168.1.0 24 (+B)
HRP_M[FW1-policy-security-rule-u_t]destination-address 192.168.3.0 24 (+B)
HRP_M[FW1-policy-security-rule-u_t]action permit  (+B)
HRP_M[FW1-policy-security-rule-u_t]q
HRP_M[FW1-policy-security]q
//创建isakmp服务
HRP_M[FW1]ip service-set isakmp type object  (+B)
HRP_M[FW1-object-service-set-isakmp]service protocol  udp source-port 500 (+B)
//配置安全策略（关于isakmp报文交互）
HRP_M[FW1]security-policy  (+B)
HRP_M[FW1-policy-security]rule name isakmp (+B)
HRP_M[FW1-policy-security-rule-isakmp]source-zone untrust local  (+B)
HRP_M[FW1-policy-security-rule-isakmp]destination-zone local untrust  (+B)
HRP_M[FW1-policy-security-rule-isakmp]source-address 200.1.3.1 32 (+B)
HRP_M[FW1-policy-security-rule-isakmp]source-address 200.1.2.10 32 (+B)
HRP_M[FW1-policy-security-rule-isakmp]destination-address 200.1.2.10 32 (+B)
HRP_M[FW1-policy-security-rule-isakmp]destination-address 200.1.3.1 32 (+B)
HRP_M[FW1-policy-security-rule-isakmp]service isakmp  (+B)
HRP_M[FW1-policy-security-rule-isakmp]action permit  (+B)

3.实现总部访问公网

FW1

//实现内网到外网NAT地址转换
HRP_M[FW1]nat address-group 1  //(+B)不加B，但行得通，自己两个都配，最后删了一个
HRP_M[FW1-address-group-1]section 200.1.2.11 //(+B)
HRP_M[FW1-address-group-1]q
HRP_M[FW1]nat-policy (+B)
HRP_M[FW1-policy-nat]rule name no_nat (+B)
HRP_M[FW1-policy-nat-rule-no_nat]source-zone trust  (+B)
HRP_M[FW1-policy-nat-rule-no_nat]destination-zone untrust  (+B)
HRP_M[FW1-policy-nat-rule-no_nat]source-address 192.168.3.0 24 (+B)
HRP_M[FW1-policy-nat-rule-no_nat]destination-address 192.168.1.0 24	 (+B)
HRP_M[FW1-policy-nat-rule-no_nat]action no-nat (+B)
HRP_M[FW1-policy-nat-rule-no_nat]q
HRP_M[FW1-policy-nat]rule name nat (+B)
HRP_M[FW1-policy-nat-rule-nat]source-zone trust (+B)
HRP_M[FW1-policy-nat-rule-nat]destination-zone untrust (+B)
HRP_M[FW1-policy-nat-rule-nat]source-address 192.168.3.0 24 (+B)
HRP_M[FW1-policy-nat-rule-nat]action source-nat address-group 1 (+B)
HRP_M[FW1-policy-nat-rule-nat]q
HRP_M[FW1-policy-nat]q
//配置内网到外网NAT地址转换的安全策略
HRP_M[FW1]security-policy (+B)
HRP_M[FW1-policy-security]rule name nat (+B)
HRP_M[FW1-policy-security-rule-nat]source-zone trust  (+B)	
HRP_M[FW1-policy-security-rule-nat]destination-zone untrust  (+B)	
HRP_M[FW1-policy-security-rule-nat]source-address 192.168.3.0 24 (+B)
HRP_M[FW1-policy-security-rule-nat]action permit  (+B)
//配置默认路由
HRP_M[FW1]ip route-static 0.0.0.0 0 200.1.2.3

4.实现分部服务器（Server1）对公网用户提供FTP服务

FW3

//配置NAT Server的安全策略
[FW3]security-policy
[FW3-policy-security]rule name ftp
[FW3-policy-security-rule-ftp]source-zone untrust 
[FW3-policy-security-rule-ftp]destination-zone dmz
[FW3-policy-security-rule-ftp]destination-address 192.168.2.20 24
[FW3-policy-security-rule-ftp]action permit 
[FW3-policy-security-rule-ftp]q
[FW3-policy-security]q
//配置NAT Server
[FW3]nat server huaweiftp global 200.1.3.20 inside 192.168.2.20

5.实现分部访问公网

FW3

//实现内网到外网NAT地址转换
[FW3]nat address-group 1
[FW3-address-group-1]section 200.1.3.12
[FW3-address-group-1]q
[FW3]nat-policy
[FW3-policy-nat]rule name no_nat
[FW3-policy-nat-rule-no_nat]source-zone trust 
[FW3-policy-nat-rule-no_nat]destination-zone untrust
[FW3-policy-nat-rule-no_nat]source-address 192.168.1.0 24
[FW3-policy-nat-rule-no_nat]destination-address 192.168.3.0 24
[FW3-policy-nat-rule-no_nat]action no-nat
[FW3-policy-nat-rule-no_nat]q
[FW3-policy-nat]rule name nat
[FW3-policy-nat-rule-nat]source-zone trust
[FW3-policy-nat-rule-nat]destination-zone untrust
[FW3-policy-nat-rule-nat]source-address 192.168.1.0 24
[FW3-policy-nat-rule-nat]action source-nat address-group 1
[FW3-policy-nat-rule-nat]q
[FW3-policy-nat]q
//配置内网到外网NAT地址转换的安全策略
[FW3]security-policy	
[FW3-policy-security]rule name nat
[FW3-policy-security-rule-nat]source-zone trust
[FW3-policy-security-rule-nat]destination-zone untrust
[FW3-policy-security-rule-nat]source-address 192.168.1.0 24
[FW3-policy-security-rule-nat]action permit
[FW3-policy-security-rule-nat]q
[FW3-policy-security]q
//配置默认路由
[FW3]ip route-static 0.0.0.0 0 200.1.3.2

结果测试

总部私网主机PC1访问公网

对访问过程抓包

通过ping结果和抓包分析可以得出总部内网主机成功访问公网。

总部私网PC1访问分部主机PC2

对访问过程抓包

通过ping结果和抓包分析可以得出总部与分部内的内网主机成功实现安全互访。

分部私网主机PC2访问公网

对访问过程抓包

通过ping结果和抓包分析可以得出分部内网主机成功访问公网。

分部服务器对公网用户提供FTP服务

客户端

服务器端

对访问过程抓包

总结

在做综合实验的过程中发现实验并不是很困难，只是在配置过程中需仔细看清配置内容，尽量减少失误，这样可以减少最后排查问题的复杂程度。实现防火墙双机热备下NAT访问公网时，仅需在主机处实现NAT后，备份机也会拥有相同NAT转换策略，即可实现内网主机访问公网的热备。