防火墙虚拟系统实验 作业

拓扑图

实验需求分析

只存在一个公网 IP 地址，公司内网所有部门都需要借用同一个接口访问外网
财务部禁止访问 Internet ，研发部门只有部分员工可以访问 Internet ，行政部门全部可以访问互联网
为三个部门的虚拟系统分配相同的资源类

由根系统管理员创建虚拟系统 abc 并且为其分配资源以及配置管理员
根系统管理员为内网用户创建安全策略和 NAT 策略
由 abc 三个虚拟系统各自完成 IP 、路由、安全策略配置

实验步骤

基础配置

[FW]interface GigabitEthernet 1/0/1
[FW-GigabitEthernet1/0/1]ip add 10.3.0.254 24
[FW]interface GigabitEthernet 1/0/2
[FW-GigabitEthernet1/0/2]ip add 10.3.1.254 24
[FW]interface GigabitEthernet 1/0/3
[FW-GigabitEthernet1/0/3]ip add 10.3.2.254 24
[FW]interface GigabitEthernet 1/0/0
[FW-GigabitEthernet1/0/0]ip add 11.1.1.1 24
[R1]interface GigabitEthernet 0/0/0
[R1-GigabitEthernet0/0/0]ip add 11.1.1.2 24
[R1]int LoopBack  0
[R1-LoopBack0]ip add 100.1.1.1 24

配置策略

[FW]security-policy
[FW-policy-security]rule name to_internet
[FW-policy-security-rule-to_internet]source-zone trust 
[FW-policy-security-rule-to_internet]destination-zone untrust 
[FW-policy-security-rule-to_internet]action permit 
 
[FW]nat-policy
[FW-policy-nat]rule name nat1
[FW-policy-nat-rule-nat1]source-zone trust 
[FW-policy-nat-rule-nat1]egress-interface GigabitEthernet 1/0/0
[FW-policy-nat-rule-nat1]source-address 10.3.0.0 16
[FW-policy-nat-rule-nat1]action source-nat easy-ip 

vsysa

[FW]switch vsys vsysa 
[FW-vsysa]int g1/0/1
[FW-vsysa-GigabitEthernet1/0/1]ip add 10.3.0.254 24
[FW-vsysa]interface Virtual-if 1
[FW-vsysa-Virtual-if1]ip add 172.16.1.1 24
[FW-vsysa]firewall zone trust 
[FW-vsysa-zone-trust]add int g1/0/1
[FW-vsysa]firewall zone untrust 
[FW-vsysa-zone-untrust]add int Virtual-if 1
[FW-vsysa]ip route-static 0.0.0.0 0 public  
[FW-vsysa]ip address-set ip_add01 type object  
[FW-vsysa-object-address-set-ip_add01]add range 10.3.0.1 10.3.0.10
[FW-vsysa]security-policy  
[FW-vsysa-policy-security]rule name to_internet
[FW-vsysa-policy-security-rule-to_internet]source-zone trust 
[FW-vsysa-policy-security-rule-to_internet]destination-zone untrust 
[FW-vsysa-policy-security-rule-to_internet]source-address address-set ip_add01
[FW-vsysa-policy-security-rule-to_internet]action permit 

vsysb

[FW]switch vsys vsysb
[FW-vsysb]int g 1/0/2
[FW-vsysb-GigabitEthernet1/0/2]ip add 10.3.1.254 24
[FW-vsysb]interface Virtual-if 2
[FW-vsysb-Virtual-if2]ip add 172.16.2.1 24
[FW-vsysb]firewall zone trust 
[FW-vsysb-zone-trust]add int g1/0/2
[FW-vsysb]firewall zone untrust 
[FW-vsysb-zone-untrust]add int Virtual-if 2
[FW-vsysb]ip route-static 0.0.0.0 0 public 

vsysc

[FW]switch vsys vsysc.
[FW-vsysc]int g1/0/3
[FW-vsysc-GigabitEthernet1/0/3]ip add 10.3.2.254 24
[FW-vsysc]firewall zone trust 
[FW-vsysc-zone-trust]add int g1/0/3
[FW-vsysc]firewall zone untrust 
[FW-vsysc-zone-untrust]add int Virtual-if 3
[FW-vsysc]ip route-static 0.0.0.0 0 public 
[FW-vsysc]security-policy
[FW-vsysc-policy-security]rule name to_internet
[FW-vsysc-policy-security-rule-to_internet]source-zone trust 
[FW-vsysc-policy-security-rule-to_internet]destination-zone untrust 
[FW-vsysc-policy-security-rule-to_internet]source-address 10.3.2.0 24
[FW-vsysc-policy-security-rule-to_internet]action permit 

---

[FW]switch vsys vsysa
[FW-vsysa]security-policy
[FW-vsysa-policy-security]rule name to_vsysb
[FW-vsysa-policy-security-rule-to_vsysb]source-zone trust 
[FW-vsysa-policy-security-rule-to_vsysb]destination-zone untrust 
[FW-vsysa-policy-security-rule-to_vsysb]source-address 10.3.0.0 24
[FW-vsysa-policy-security-rule-to_vsysb]destination-address 10.3.1.0 24
[FW-vsysa-policy-security-rule-to_vsysb]action permit 
[FW-vsysa-policy-security]rule move to_vsysb before to_internet
[FW]switch vsys vsysb
[FW-vsysb]security-policy
[FW-vsysb-policy-security]rule name to_vsysa
[FW-vsysb-policy-security-rule-to_vsysa]source-zone untrust 
[FW-vsysb-policy-security-rule-to_vsysa]destination-zone trust 
[FW-vsysb-policy-security-rule-to_vsysa]source-address 10.3.0.0 24
[FW-vsysb-policy-security-rule-to_vsysa]destination-address 10.3.1.0 24
[FW-vsysb-policy-security-rule-to_vsysa]action permit 
[FW]ip route-static vpn-instance vsysa 10.3.1.0 24 vpn-instance vsysb

防火墙web配置