防火墙虚拟实验

最新推荐文章于 2026-01-06 22:02:48 发布

原创最新推荐文章于 2026-01-06 22:02:48 发布 · 282 阅读

3 ·

CC 4.0 BY-SA版权

文章标签：

#数据库 #服务器

一、实验拓扑

在这里插入图片描述

二、实验需求

1、只存在一个公网IP地址，公司内网所有部门都需要借用同一个接口访问外网

2、财务部禁止访问Internet，研发部门只有部分员工可以访问Internet，行政部门全部可以访问互联网

3、为三个部门的虚拟系统分配相同的资源类

三、实验步骤

1.配置资源类

[FW]vsys enable  
[FW]resource-class r1   
[FW-resource-class-r1]resource-item-limit session reserved-number 500 maximum 10
00

2、管理员配置

[FW]switch vsys vsysa 
<FW-vsysa>sys
Enter system view, return user view with Ctrl+Z.
[FW-vsysa]aaa
[FW-vsysa-aaa]manager-user admin@@vsysa  
[FW-vsysa-aaa-manager-user-admin@@vsysa]password  
[FW-vsysa-aaa-manager-user-admin@@vsysa]level 15 
[FW-vsysa-aaa-manager-user-admin@@vsysa]service-type web telnet ssh 
Warning: The user access modes include Telnet or FTP, so security risks exist.
[FW-vsysa-aaa-manager-user-admin@@vsysa]quit	
[FW-vsysa-aaa]bind manager-user admin@@vsysa role system-admin

在这里插入图片描述

在这里插入图片描述

创建安全策略和NAT策略

[FW]security-policy 	
[FW-policy-security]rule name to_internet
[FW-policy-security-rule-to_internet]source-zone trust
[FW-policy-security-rule-to_internet]destination-zone
[FW-policy-security-rule-to_internet]destination-zone untrust
[FW-policy-security-rule-to_internet]access-authentication
[FW-policy-security-rule-to_internet]action permit
[FW]nat-policy 
[FW-policy-nat]rule name nat1
[FW-policy-nat-rule-nat1]source-zone trust
[FW-policy-nat-rule-nat1]egress-interface GigabitEthernet 1/0/0
[FW-policy-nat-rule-nat1]source-zone 
[FW-policy-nat-rule-nat1]source-address 10.3.0.0 16

vsysa配置如下：

[FW]switch vsys vsysa
<FW-vsysa>sys
Enter system view, return user view with Ctrl+Z.
[FW-vsysa]int g 1/0/1
[FW-vsysa-GigabitEthernet1/0/1]ip address 10.3.0.254 24
[FW-vsysa]interface Virtual-Template	
[FW-vsysa]interface Virtual-if 1
[FW-vsysa-Virtual-if1]ip address 172.16.1.1 24
[FW-vsysa]firewall zone trust
[FW-vsysa-zone-trust]add int g 1/0/1
[FW-vsysa]firewall zone untrust	
[FW-vsysa-zone-untrust]add int Virtual-if 1
[FW-vsysa]ip route-static 0.0.0.0 0 public 
[FW-vsysa]ip address-set ip_add01 type object 
[FW-vsysa-object-address-set-ip_add01]address range 10.3.0.1 10.3.0.10
[FW-vsysa]security-policy
[FW-vsysa-policy-security-rule-to_internet]source-zone trust 
[FW-vsysa-policy-security-rule-to_internet]destination-zone untrust
[FW-vsysa-policy-security-rule-to_internet]source-zone 
[FW-vsysa-policy-security-rule-to_internet]source-address address-set ip_add01
[FW-vsysa-policy-security-rule-to_internet]action permit

vsysb配置如下:

[FW]switch vsys vsysb
<FW-vsysb>sys
Enter system view, return user view with Ctrl+Z.
[FW-vsysb]int g 1/0/2
[FW-vsysb-GigabitEthernet1/0/2]ip address 10.3.1.254 24
[FW-vsysb]interface Virtual-Template	
[FW-vsysb]interface Virtual-if 2
[FW-vsysb-Virtual-if2]ip address 172.16.2.1 24
[FW-vsysb]firewall zone trust 
[FW-vsysb-zone-trust]add int g 1/0/2
[FW-vsysb]firewall zone untrust 	
[FW-vsysb-zone-untrust]add int Virtual-if 2
[FW-vsysb]ip route-static 0.0.0.0 0 public

vsysc配置如下

[FW]switch vsys vsysc
<FW-vsysc>sys
Enter system view, return user view with Ctrl+Z.
[FW-vsysc]int g 1/0/3
[FW-vsysc-GigabitEthernet1/0/3]ip address 10.3.2.254 24
[FW-vsysc-GigabitEthernet1/0/3]q
[FW-vsysc]int	
[FW-vsysc]interface v	
[FW-vsysc]interface Virtual-Template	
[FW-vsysc]interface Vlanif	
[FW-vsysc]interface Virtual-if 3
[FW-vsysc-Virtual-if3]ip address 172.16.3.1 24
[FW-vsysc-Virtual-if3]q
[FW-vsysc]firewall zone trust 
[FW-vsysc-zone-trust]add int g 1/0/3
[FW-vsysc-zone-trust]q
[FW-vsysc]firewall zone untrust 	
[FW-vsysc-zone-untrust]add int Virtual-if 3
[FW-vsysc-zone-untrust]q
[FW-vsysc]ip route-static 0.0.0.0 0 public

[FW1]ip route-static vpn-instance vsysa 10.3.1.0 24 vpn-instance vsysb