智能选路+NAT实验

IP配置

[r2]interface GigabitEthernet 0/0/0
[r2-GigabitEthernet0/0/0]ip address 13.0.0.3 24
[r2-GigabitEthernet0/0/0]interface GigabitEthernet 0/0/1
[r2-GigabitEthernet0/0/1]ip address 100.1.1.254  24
[r2-GigabitEthernet0/0/1]interface GigabitEthernet 0/0/2
[r2-GigabitEthernet0/0/2]ip address 110.1.1.254 24
 
[r3]interface GigabitEthernet 0/0/0
[r3-GigabitEthernet0/0/0]ip address 12.0.0.2 24
[r3-GigabitEthernet0/0/0]interface GigabitEthernet 0/0/1     
[r3-GigabitEthernet0/0/1]ip address 210.1.1.254 24
[r3-GigabitEthernet0/0/1]interface GigabitEthernet 0/0/2
[r3-GigabitEthernet0/0/2]ip address 200.1.1.254 24
 
[FW]interface GigabitEthernet 0/0/0    
[FW-GigabitEthernet0/0/0]service-manage all permit 
[FW]interface GigabitEthernet 1/0/0    
[FW-GigabitEthernet1/0/0]ip address 192.168.1.254 24
[FW-GigabitEthernet1/0/0]interface GigabitEthernet 1/0/1
[FW-GigabitEthernet1/0/1]ip address 13.0.0.1 24
[FW-GigabitEthernet1/0/1]interface GigabitEthernet 1/0/2
[FW-GigabitEthernet1/0/2]ip address 12.0.0.1 24

安全区域划分

[FW]firewall zone trust     
[FW-zone-trust]add interface GigabitEthernet 1/0/0
[FW]firewall zone name untrust_1
[FW-zone-untrust_1]set priority 10
[FW-zone-untrust_1]add interface GigabitEthernet 1/0/1
[FW]firewall zone name untrust_2
[FW-zone-untrust_2]set priority 15
[FW-zone-untrust_2]add interface GigabitEthernet 1/0/2

配置真实dns服务器

[FW]slb enable 
[FW]slb
[FW-slb]group 0 dns
[FW-slb-group-0]metric roundrobin
[FW-slb-group-0]rserver 0 rip 100.1.1.1 port 53
[FW-slb-group-0]rserver 1 rip 200.1.1.1 port 53

创建虚拟dns服务器

[FW]slb 
[FW-slb]vserver 0 dns
[FW-slb-vserver-0]vip 10.10.10.10
[FW-slb-vserver-0]group dns

配置dns服务器透明代理功能

[FW]dns-transparent-policy  
[FW-policy-dns]dns transparent-proxy enable

防火墙对应接口绑定要代理的服务器IP

[FW]dns-transparent-policy   
[FW-policy-dns]dns server bind interface GigabitEthernet 1/0/1 preferred 100.1.1.1
[FW-policy-dns]dns server bind interface GigabitEthernet 1/0/2 preferred 200.1.1.1

透明代理策略 

[FW]dns-transparent-policy   
[FW-policy-dns]rule name dns_polic
[FW-policy-dns-rule-dns_polic]source-address 192.168.1.0 24
[FW-policy-dns-rule-dns_polic]enable   
[FW-policy-dns-rule-dns_polic]action tpdns

安全策略 

[FW-policy-security]rule name internet
[FW-policy-security-rule-internet]source-zone trust 
[FW-policy-security-rule-internet]destination-zone untrust_1 untrust_2
[FW-policy-security-rule-internet]source-address 192.168.1.0 mask 255.255.255.0
[FW-policy-security-rule-internet]action permit

nat策略

[FW]nat-policy    
[FW-policy-nat]rule name 2
[FW-policy-nat-rule-2]source-zone trust     
[FW-policy-nat-rule-2]destination-zone untrust_2
[FW-policy-nat-rule-polic1]source-address 192.168.1.0 24
[FW-policy-nat-rule-2]action source-nat easy-ip

nat（地址池）

[FW]nat address-group 1
[FW-address-group-1]section 13.0.0.10
[FW-address-group-1]mode pat
[FW-address-group-1]route enable

配置nat策略

[FW]nat-policy
[FW-policy-nat]rule name polic1
[FW-policy-nat-rule-polic1]source-zone trust 
[FW-policy-nat-rule-polic1]destination-zone untrust_1
[FW-policy-nat-rule-polic1]source-address 192.168.1.0 mask 255.255.255.0
[FW-policy-nat-rule-polic1]action source-nat address-group 1

配置安全策略 

测试

[FW]display firewall session table
[FW]display firewall server-map

[FW-address-group-1]mode no-pat global
[FW-address-group-1]mode pat

nat地址池配置

[FW]nat address-group 1
[FW-address-group-1]mode no-pat global 
[FW-address-group-1]section 13.0.0.10    
[FW-address-group-1]route enable 
[FW-address-group-1]smart-nopat 13.0.0.20
 
[FW]nat address-group 2
[FW-address-group-2]mode no-pat global 
[FW-address-group-2]section 12.0.0.10    
[FW-address-group-2]route enable     
[FW-address-group-2]smart-nopat 12.0.0.20

nat策略

[FW]nat-policy
[FW-policy-nat]rule name 1
[FW-policy-nat-rule-1]source-zone trust
[FW-policy-nat-rule-1]destination-zone untrust_1 
[FW-policy-nat-rule-1]source-address 192.168.1.0 24 
[FW-policy-nat-rule-1]action source-nat address-group 1 
[FW]nat-policy 
[FW-policy-nat]rule name 2
[FW-policy-nat-rule-2]source-zone trust     
[FW-policy-nat-rule-2]destination-zone untrust_2    
[FW-policy-nat-rule-2]source-address 192.168.1.0 24
[FW-policy-nat-rule-2]action source-nat address-group 2

安全策略

查看server-map表、会话表

[FW]display firewall server-map
[FW]display firewall session table

三元组 NAT 

配置地址池

[FW]nat address-group 1
[FW-address-group-1]mode full-cone global 
[FW-address-group-1]section 13.0.0.10
[FW-address-group-1]route enable

配置nat策略

[FW]nat-policy     
[FW-policy-nat]rule name 1
[FW-policy-nat-rule-1]source-zone trust 
[FW-policy-nat-rule-1]destination-zone untrust_1    
[FW-policy-nat-rule-1]source-address 192.168.1.0 24
[FW-policy-nat-rule-1]action source-nat address-group 1

开启端口过滤功能

[FW]firewall endpoint-independent filter enable 

测试

[FW]display firewall server-map 
[FW]display firewall session table 

智能选路
就近选路
配置健康检查

[FW]healthcheck enable
[FW]healthcheck name isp1 
[FW-healthcheck-isp1]destination 110.1.1.1 interface GigabitEthernet 1/0/1 proto
col tcp-simple  destination-port 80
[FW-healthcheck-isp1]destination 100.1.1.1 interface GigabitEthernet 1/0/1 proto
col tcp-simple destination-port 80
 
[FW]healthcheck enable 
[FW]healthcheck name isp2    
[FW-healthcheck-isp2]destination 200.1.1.1 interface GigabitEthernet 1/0/2 proto
col tcp-simple destination-port 80
[FW-healthcheck-isp2]destination 210.1.1.1 interface GigabitEthernet 1/0/2 proto
col tcp-simple destination-port 80

 应用健康检查 

[FW]interface GigabitEthernet 1/0/1
[FW-GigabitEthernet1/0/1]healthcheck isp1
 
[FW]interface GigabitEthernet 1/0/2
[FW-GigabitEthernet1/0/2]healthcheck isp2

查看unr路由表 

[FW]display ip routing-table protocol unr

缺省路由

[FW]ip route-static 0.0.0.0 0 13.0.0.3 
[FW]ip route-static 0.0.0.0 0 12.0.0.2

策略路由选路
IP-Link安全策略

[FW-policy-security]rule name ip_link
[FW-policy-security-rule-ip_link]source-zone trust 
[FW-policy-security-rule-ip_link]destination-zone untrust_1 untrust_2
[FW-policy-security-rule-ip_link]action permit

IP-Link功能

[FW]ip-link check enable 
[FW]ip-link name p_1
[FW-iplink-p_1]destination 13.0.0.3 interface GigabitEthernet 1/0/1
[FW]ip-link name p_2
[FW-iplink-p_2]destination 12.0.0.2 interface GigabitEthernet 1/0/2

配置策略路由

[FW]policy-based-route
[FW-policy-pbr]rule name 1
[FW-policy-pbr-rule-1]source-zone trust 
[FW-policy-pbr-rule-1]source-address 192.168.1.1 mask 255.255.255.0 
[FW-policy-pbr-rule-1]destination-address 100.1.1.1 mask 255.255.255.0 
[FW-policy-pbr-rule-1]track ip-link p_1
[FW-policy-pbr-rule-1]action pbr next-hop 13.0.0.3

配置全局选路策略

配置接口所在链路带宽以及过载保护机制

[FW]interface  GigabitEthernet 1/0/1
[FW-GigabitEthernet1/0/1]bandwidth ingress 200000    
[FW-GigabitEthernet1/0/1]bandwidth egress 200000
[FW-GigabitEthernet1/0/1]bandwidth ingress 200000 threshold 95
[FW-GigabitEthernet1/0/1]bandwidth egress 200000 threshold 95
[FW-GigabitEthernet1/0/1]gateway 13.0.0.3
[FW]interface GigabitEthernet 1/0/2    
[FW-GigabitEthernet1/0/2]bandwidth ingress 100000 threshold 95
[FW-GigabitEthernet1/0/2]bandwidth egress 100000 threshold 95
[FW-GigabitEthernet1/0/2]gateway 12.0.0.2

配置全局选路策略

[FW]multi-linkif
[FW-multi-linkif]mode proportion-of-bandwidth
[FW-multi-linkif]add linkif 1
[FW-multi-linkif]add linkif 2
[FW-multi-linkif]session persistence enable
[FW-multi-linkif]session persistence mode destination-ip