防火墙源 NAT 实验

1.实验拓扑

 

2.实验步骤

步骤 1 完成 USG6330-1 上、下行业务接口的配置。配置各接口 IP 地址并加入相应安全区域。

<USG> system-view

[USG6000V1]sysname USG6330-1

[USG6330-1] interface GigabitEthernet 1/0/1

[USG6330-1-GigabitEthernet1/0/1] ip address 10.1.2.1 255.255.255.0

[USG6330-1-GigabitEthernet1/0/1] quit

[USG6330-1] interface GigabitEthernet 1/0/4

[USG6330-1-GigabitEthernet1/0/4] ip address 40.1.1.1 255.255.255.0

[USG6330-1-GigabitEthernet1/0/4] quit

[USG6330-1] firewall zone trust

[USG6330-1-zone-trust] add interface GigabitEthernet 1/0/1

[USG6330-1-zone-trust] quit

[USG6330-1] firewall zone untrust

[USG6330-1-zone-untrust] add interface GigabitEthernet 1/0/4

[USG6330-1-zone-untrust] quit

步骤 2 配置 Trust 区域和 Untrust 区域的域间转发策略。

[USG6330-1]security-policy

[USG6330-1-policy-security] rule name policy_sec

[USG6330-1-policy-security-rule-policy_sec] source-zone trust

[USG6330-1-policy-security-rule-policy_sec] destination-zone untrust

[USG6330-1-policy-security-rule-policy_sec] action permit

[USG6330-1-policy-security-rule-policy_sec] quit

步骤 3 配置 NAT 地址池，公网地址范围为 2.2.2.2-2.2.2.5。

[USG6330-1]nat address-group natpool

[USG6330-1-address-group-natpool]section 2.2.2.2 2.2.2.5

步骤 4 配置 NAT 策略。

[USG6330-1]nat-policy

[USG6330-1-policy-nat]rule name source_nat

[USG6330-1-policy-nat-rule-source_nat]destination-zone untrust

[USG6330-1-policy-nat-rule-source_nat]source-zone trust

[USG6330-1-policy-nat-rule-source_nat]action nat address-group natpool

步骤 5 配置 Switch。

分别将两台 Switch 的三个接口加入同一个 VLAN，缺省即可。