防火墙配置

LSW2
配置vlan的地址和分配接口类型
配置静态路由

[LSW2]vlan batch 13 100
[LSW2]int vlan 13
[LSW2-Vlanif13]ip add 192.168.66.254 24
[LSW2-Vlanif13]int vlan 100
[LSW2-Vlanif100]ip add 10.0.2.2 30
[LSW2-Vlanif100]int g0/0/2
[LSW2-GigabitEthernet0/0/2]port link-t	
[LSW2-GigabitEthernet0/0/2]port link-type a
[LSW2-GigabitEthernet0/0/2]port def vlan 13
[LSW2-GigabitEthernet0/0/2]int g0/0/1
[LSW2-GigabitEthernet0/0/1]port link-t	
[LSW2-GigabitEthernet0/0/1]port link-type a
[LSW2-GigabitEthernet0/0/1]port def vlan 100
[LSW2]ip route-static 192.168.64.0 24 10.0.2.1
[LSW2]ip route-static 192.168.65.0 24 10.0.2.1

LSW4
配置vlan的地址和分配接口类型
配置静态路由

[LSW4]vlan batch 11 to 13 100
[LSW4]int vlan 11
[LSW4-Vlanif11]ip add 192.168.64.254 24
[LSW4-Vlanif11]int vlan 12
[LSW4-Vlanif12]ip add 192.168.65.254 24
[LSW4-Vlanif12]int vlan 100
[LSW4-Vlanif100]ip add 10.0.1.2 30
[LSW4-Vlanif100]int g0/0/1
[LSW4-GigabitEthernet0/0/1]port link-t	
[LSW4-GigabitEthernet0/0/1]port link-type a
[LSW4-GigabitEthernet0/0/1]port def vlan 100
[LSW4-GigabitEthernet0/0/1] int g0/0/2
[LSW4-GigabitEthernet0/0/2]port link-t	
[LSW4-GigabitEthernet0/0/2]port link-type a
[LSW4-GigabitEthernet0/0/2]port def vlan 11
[LSW4-GigabitEthernet0/0/2]int g0/0/3
[LSW4-GigabitEthernet0/0/3]port link-type a
[LSW4-GigabitEthernet0/0/3]port def vlan 12
[LSW4-GigabitEthernet0/0/3]q
[LSW4]ip route-static 192.168.66.0 24 10.0.1.1

FW1
配置防火墙接口地址

[USG6000V1]int g1/0/1
[USG6000V1-GigabitEthernet1/0/1]ip add 10.0.2.1 30
[USG6000V1-GigabitEthernet0/0/0]int g1/0/0
[USG6000V1-GigabitEthernet1/0/0]ip add 10.0.1.1 30

配置安全区域，进入untrust区域
将接口g1/0/1 g1/0/0添加到untrust区域

[USG6000V1]firewall zone untrust
[USG6000V1-zone-untrust]add interface GigabitEthernet 1/0/0
[USG6000V1-zone-untrust]add interface GigabitEthernet 1/0/1

在防火墙中配置静态路由，加入安全策略前，全部PC可相互访问

[USG6000V1]ip route-static 192.168.66.0 24 10.0.2.2
[USG6000V1]ip route-static 192.168.64.0 24 10.0.1.2
[USG6000V1]ip route-static 192.168.65.0 24 10.0.1.2

接下来在防火墙中添加安全策略，实现PC2、3可访问PC1而PC4、5不能
配置一条名为visit-1的安全策略，使得源地址192.168.64.0/24（255.255.255.0），目的地址192.168.88.0/24的所有（any）服务都被允许通过（permit）

[USG6000V1]security-policy 
[USG6000V1-policy-security]rule name visit-1                                                                     
[USG6000V1-policy-security-rule-visit-1]source-address 192.168.64.0 mask 255.255.255.0
[USG6000V1-policy-security-rule-visit-1]destination-address 192.168.66.0 mask 255.255.255.0
[USG6000V1-policy-security-rule-visit-1]service any
[USG6000V1-policy-security-rule-visit-1]action permit
[USG6000V1-policy-security-rule-visit-1]q

配置一条名为novisit-1的安全策略，使得源地址是192.168.65.0/24（255.255.255.0），目的地址192.168.88.0/24的所有（any）服务都被拒绝通过（deny）

[USG6000V1-policy-security]rule name novisit-1
[USG6000V1-policy-security-rule-novisit-1]source-address 192.168.65.0 mask 255.255.255.0
[USG6000V1-policy-security-rule-novisit-1]destination-address 192.168.66.0 mask 255.255.255.0                                                  
[USG6000V1-policy-security-rule-novisit-1]service any
[USG6000V1-policy-security-rule-novisit-1]action deny