智能选路+NAT实验

实验拓扑：

实验要求：

按照图中给定ip分配，合理划分安全区域，NAT，智能选路透明DNS

实验步骤：

1客户端为aa，双向绑定为免认证

2客户端为bb，为Portal认证

3.创建安全策略：创建untrust1和untrust2两个安全策略划分接口

[FW]firewall zone name untrust1
[FW-zone-untrust1]add interface g1/0/1 
[FW]firewall zone trust 
[FW-zone-trust]add interface GigabitEthernet 1/0/0
[FW]firewall zone untrust1
[FW-zone-untrust1]set priority 10
[FW]firewall zone name untrust2
[FW-zone-untrust2]set priority 15
[FW-zone-untrust2]add interface g1/0/2

4.配置路由器IP

[FW]int g1/0/0
[FW-GigabitEthernet1/0/0]ip add 192.168.1.254 24
[FW-GigabitEthernet1/0/0]int g1/0/1
[FW-GigabitEthernet1/0/1]ip add 11.0.0.1 24
[FW]int g1/0/2
[FW-GigabitEthernet1/0/2]ip add 12.0.0.1 24

[r1]int g0/0/0
[r1-GigabitEthernet0/0/0]ip add 11.0.0.2 24
[r1-GigabitEthernet0/0/0]int g0/0/1
[r1-GigabitEthernet0/0/1]ip add 100.1.1.254 24
[r1-GigabitEthernet0/0/2]ip add 110.1.1.254 24

[r2]int g0/0/0
[r2-GigabitEthernet0/0/0]ip add 12.0.0.2 24
[r2-GigabitEthernet0/0/1]int g0/0/2
[r2-GigabitEthernet0/0/2]ip add 200.1.1.254 24
[r2-GigabitEthernet0/0/1]ip add 210.1.1.254 24

5.安全策略：安全策略为客户端访问web服务器以及dns服务器两个安全策略 

[FW]security-policy 
[FW-policy-security]rule name dns
[FW-policy-security-rule-dns]source-zone trust 
[FW-policy-security-rule-dns]destination-zone untrust1 untrust2
[FW-policy-security-rule-dns]source-address 192.168.1.0 mask 255.255.255.0
[FW-policy-security-rule-dns]action permit
[FW-policy-security]rule name web
[FW-policy-security-rule-web]source-zone trust
[FW-policy-security-rule-web]destination-zone untrust1 untrust2
[FW-policy-security-rule-web]source-address 192.168.1.0 mask 255.255.255.0
[FW-policy-security-rule-dns]action permit

6.net策略：使用源nat,NAPT技术 

[FW]nat address-group nat_1
[FW-address-group-nat_1]section 11.0.0.10 11.0.0.10
[FW-address-group-nat_1]mode pat
[FW-address-group-nat_1]route enable 
[FW]nat address-group nat_2
[FW-address-group-nat_2]section 12.0.0.10 12.0.0.10
[FW-address-group-nat_2]mode pat
[FW-address-group-nat_2]route enable
[FW]nat-policy
[FW-policy-nat]rule	
[FW-policy-nat]rule name policy_1
[FW-policy-nat-rule-policy_1]source-zone trust
[FW-policy-nat-rule-policy_1]d
[FW-policy-nat-rule-policy_1]destination-zone untrust1
[FW-policy-nat-rule-policy_1]source-address 192.168.1.0 24
[FW-policy-nat-rule-policy_1]action source-nat address-group nat_1
[FW-policy-nat]rule name policy_2
[FW-policy-nat-rule-policy_2]source-zone trust
[FW-policy-nat-rule-policy_2]de	
[FW-policy-nat-rule-policy_2]destination-zone untrust2
[FW-policy-nat-rule-policy_2]source-address 192.168.1.0 24
[FW-policy-nat-rule-policy_2]action source-nat address-group nat_2

7.智能选路-isp选路：

给服务器配置健康检查：进入接口调用健康检查

导入运营商服务器

配置接口链路生成明细路由

[FW]healthcheck enable 
[FW]healthcheck 	
[FW]healthcheck name dianxin
[FW-healthcheck-dianxin]destination 110.1.1.1 interface GigabitEthernet 1/0/1 pr
otocol tcp-simple destination-port 80

[FW]int g1/0/1
[FW-GigabitEthernet1/0/1]healthcheck dianxin
[FW-GigabitEthernet1/0/1]int g1/0/2
[FW-GigabitEthernet1/0/2]healthcheck liantong

8.透明DNS：配置真实DNS服务器信息，配置透明代理，真实服务器与虚拟服务器绑定

[FW]slb enable 
[FW]slb
[FW-slb]group 0 dns
[FW-slb-group-0]metric roundrobin 
[FW-slb-group-0]rserver 1 rip 100.1.1.1 port 53
[FW-slb-group-0]rserver 2 rip 200.1.1.1 port 53
[FW-slb]vserver 0 dns
[FW-slb-vserver-0]vip 10.10.10.10
[FW-slb-vserver-0]group dns

[FW]dns-transparent-policy
[FW-policy-dns]dns transparent-proxy enable 
[FW-policy-dns]dns server bind interface GigabitEthernet 1/0/1 preferred 100.1.1
.1 
[FW-policy-dns]dns server bind interface GigabitEthernet 1/0/2 preferred 200.1.1
.1
[FW-policy-dns]rule name dnspolicy_1
[FW-policy-dns-rule-dnspolicy_1]source-address 192.168.1.0 24
[FW-policy-dns-rule-dnspolicy_1]enable 
[FW-policy-dns-rule-dnspolicy_1]action tpdns 

实验结果验证：因为免认证所以直接能访问，protal认证需要认证页面输入用户名密码，在没有输入的情况下访问不了