防火墙usg5500高级策略

卧屎仙人

已于 2024-07-04 20:42:44 修改

阅读量1.1k

点赞数 3

文章标签：华为

于 2024-05-11 19:06:30 首次发布

本文链接：https://blog.youkuaiyun.com/m0_74439942/article/details/135205956

版权

在这里插入图片描述
tip:默认不使用g0/0/0口

首先将接口加入区域

firewall zone trust
 set priority 85
 add interface GigabitEthernet0/0/1
 add interface GigabitEthernet0/0/4
#
firewall zone untrust
 set priority 5
 add interface GigabitEthernet0/0/2
#
firewall zone dmz
 set priority 50
 add interface GigabitEthernet0/0/3

1、192.168.0.0/24 网段可以访问Server1

policy interzone trust untrust outbound
 policy 2
  action permit
policy source 192.168.0.0 mask 16

2、PC2 不能访问Server1

policy interzone trust untrust outbound
  policy 1
   action deny
    policy source 192.168.0.100 mask 32
tip 拒绝策略先配置，所以这里是policy 1

3、192.168.1.0/24网段不能ping通server1，但可以访问Server1的网站

policy interzone trust untrust outbound
 policy 3
  action permit
   policy service service-set http
   policy source 192.168.1.0 mask 24

4、untrust区的计算机只可以访问dmz区服务器server2的网站

policy interzone dmz untrust inbound
 policy 1
  action permit
   policy source 172.16.0.0 mask 24

5、trust区192.168.1.0/24网段可以访问dmz区服务器，而192.168.0.0/24网段不能访问

policy interzone trust dmz outbound
 policy 1
  action deny
   policy source 192.168.0.0 mask 24
 policy 2
  action permit
   policy source 192.168.0.0 mask 16

6、192.168.0.0/24网段不可以ping通192.168.1.0/24 网段(域内策略）

policy zone trust
 policy 1
  action deny
   policy source 192.168.0.0 mask 24
   policy destination 192.168.1.2 mask 32

7、Server1可以ping通防火墙接口

policy interzone local untrust inbound
 policy 1
  action permit
  policy source 172.16.0.2 mask 32

8、PC1访问 PC4 时进行地址转换

nat address-group 1 172.16.66.6 172.16.66.6
建立地址池
nat-policy interzone trust untrust outbound
 policy 1
  action source-nat
  policy destination 172.16.0.3 mask 32
  address-group 1
  应用地址池