智能选路+NAT实验

一、拓扑图

二、配置实验

（1）IP配置

1、防火墙配置

[FW1]interface GigabitEthernet 0/0/0
[FW1-GigabitEthernet0/0/0]service-manage all permit

[FW1]interface GigabitEthernet 1/0/0
[FW1-GigabitEthernet1/0/0]ip address 192.168.1.254 24
[FW1]interface GigabitEthernet 1/0/1
[FW1-GigabitEthernet1/0/1]ip address 12.0.0.1 24
[FW1]interface GigabitEthernet 1/0/2
[FW1-GigabitEthernet1/0/2]ip address 13.0.0.1 24

2、R1配置

[R1]interface GigabitEthernet 0/0/0
[R1-GigabitEthernet0/0/0]ip add 12.0.0.2 24
[R1]interface GigabitEthernet 0/0/1
[R1-GigabitEthernet0/0/1]ip add 100.1.1.254 24
[R1]interface GigabitEthernet 0/0/2
[R1-GigabitEthernet0/0/2]ip add 110.1.1.254 24

3、R2配置

[R2]interface GigabitEthernet 0/0/0
[R2-GigabitEthernet0/0/0]ip add 13.0.0.3 24
[R2]interface GigabitEthernet 0/0/1
[R2-GigabitEthernet0/0/1]ip add 200.1.1.254 24
[R2]interface GigabitEthernet 0/0/2
[R2-GigabitEthernet0/0/2]ip add 210.1.1.254 24

4、其他配置

（2）安全区域

[FW1]firewall zone trust1 
[FW1-zone-trust]add interface GigabitEthernet 1/0/0

[FW1]firewall zone name Untrust_1
[FW1-zone-Untrust_1]set priority 70
[FW1-zone-Untrust_1]add interface GigabitEthernet 1/0/1

[FW1]firewall zone name Untrust_2
[FW1-zone-Untrust_2]set priority 80
[FW1-zone-Untrust_2]add interface GigabitEthernet 1/0/2

（3）创建DNS服务器

[FW1]slb enable
[FW1]slb
[FW1-slb]
[FW1-slb]group 0 dns
[FW1-slb-group-0]rserver 0 rip 200.1.1.1 port 53
[FW1-slb-group-0]rserver 1 rip 100.1.1.1 port 53

[FW1]slb
[FW1-slb]vserver 0 dns
[FW1-slb-vserver-0]vip 10.10.10.10	
[FW1-slb-vserver-0]group dns

（4）DNS服务器透明代理功能

[FW1-policy-dns]dns server bind interface GigabitEthernet 1/0/1 preferred 100.1.1.1
[FW1-policy-dns]dns server bind interface GigabitEthernet 1/0/2 preferred 200.1.1.1

[FW1-policy-dns]rule name dns_policy
[FW1-policy-dns-rule-dns_policy]source-address 192.168.1.0 24
[FW1-policy-dns-rule-dns_policy]enable 
Info: The policy is enabled successfully. 
[FW1-policy-dns-rule-dns_policy]action tpdns 

（5）配置安全策略

（6）链路带宽以及过载保护机制

（7）NAT策略