防火墙安全策略

实验拓扑图

分析

FW左侧10.0.0.254是网关，右侧两个vlan需要配置子接口
针对要求写出对应的安全策略，要创建对应的时间段，写出源目安全区
最后一条特例需要将PC3单独从生产区拉出来写

子接口配置

在图形界面当中修改，新建接口需要定义接口名称，选择类型，选择安全区域，确定vlan，写好IP地址

子接口1.1

子接口1.2

检查

先配置好交换机vlan方便进行ping测试

发现ping不通

排错

ping通了PC3却不能ping通PC1的网关，说明问题出现在网关所在的子接口上

最后发现是因为没有在1.1子接口允许ping服务才导致的不通

[USG6000V1]int g 1/0/1.1
[USG6000V1-GigabitEthernet1/0/1.1]service-manage ping permit

ping通

PC1

PC2

PC3

安全策略

创建地址

直接命令行创建

[USG6000V1]ip address-set OFFICE type object 
[USG6000V1-object-address-set-OFFICE]address 192.168.1.0 mask 25

用图形界面创建

创建时间

[USG6000V1]time-range working-time
[USG6000V1-time-range-working-time]period-range 08:00:00 to 18:00:00 working-day

创建策略

针对要求二

[USG6000V1]security-policy
[USG6000V1-policy-security]rule name police_1
[USG6000V1-policy-security-rule-police_1]description OF_to_OA --描述规则
[USG6000V1-policy-security-rule-police_1]source-zone trust     --源区域
[USG6000V1-policy-security-rule-police_1]destination-zone dmz  --目标区域
[USG6000V1-policy-security-rule-police_1]source-address address-set OFFICE  --源地址
[USG6000V1-policy-security-rule-police_1]destination-address address-set OA  --目标地址
[USG6000V1-policy-security-rule-police_1]time-range working-time  --调用时间集
[USG6000V1-policy-security-rule-police_1]action permit --设置动作允许

针对要求三

[USG6000V1]security-policy
[USG6000V1-policy-security]rule name policy_3
[USG6000V1-policy-security-rule-policy_3]description OF_to_Web
[USG6000V1-policy-security-rule-policy_3]source-zone trust 
[USG6000V1-policy-security-rule-policy_3]destination-zone dmz
[USG6000V1-policy-security-rule-policy_3]source-address address-set OFFICE
[USG6000V1-policy-security-rule-policy_3]destination-address address-set Web
[USG6000V1-policy-security-rule-policy_3]action permit 

针对要求四

[USG6000V1]security-policy
[USG6000V1-policy-security]rule name policy_3
[USG6000V1-policy-security-rule-policy_3]description Pr_to_OA
[USG6000V1-policy-security-rule-policy_3]source-zone trust 
[USG6000V1-policy-security-rule-policy_3]destination-zone dmz
[USG6000V1-policy-security-rule-policy_3]source-address address-set Produce
[USG6000V1-policy-security-rule-policy_3]destination-address address-set OA
[USG6000V1-policy-security-rule-policy_3]action permit 

要求五

测试

注：测试时间为星期五十点半

PC1(办公区)

不在工作时间无法正常访问OA

任意时间能够访问web

生产区

PC2

任意时刻访问OA

生产区不能访问web

PC3(特例)

既能随时访问OA，又能在指定时间访问Web

在指定时间内，生产区的PC3能访问Web