虚拟系统配置

实验topo

基础配置

R1

FW

需求一

安全策略要求：
1、只存在一个公网IP地址，公司内网所有部门都需要借用同一个接口访问外网
2、财务部禁止访问Internet，研发部门只有部分员工可以访问Internet，行政部门全部可以访问互联网
3、为三个部门的虚拟系统分配相同的资源类

1.启动虚拟系统

[FW]vsys enable 

2.配置资源类型

R1

[FW-resource-class-r1]resource-item-limit 	
[FW-resource-class-r1]resource-item-limit session reserved-number 500 maximum 10
[FW]dis resource global-resource 

r2

[FW]resource-class r2
[FW-resource-class-r2]resource-item-limit session reserved-number 500 maximum 10
00
[FW-resource-class-r2]resource-item-limit bandwidth 2 outbound
[FW-resource-class-r2]resource-item-limit policy reserved-number 200
[FW-resource-class-r2]resource-item-limit user reserved-number 100

r3

[FW]resource-class r3
[FW-resource-class-r3]resource-item-limit session reserved-number 500 maximum 10
00
[FW-resource-class-r3]resource-item-limit bandwidth 2 outbound
[FW-resource-class-r3]resource-item-limit policy reserved-number 200
[FW-resource-class-r3]resource-item-limit user reserved-number 100

创建虚拟系统

VSYSa

[FW]vsys name vsysa
[FW-vsys-vsysa]assign resource-class r1
[FW-vsys-vsysa]assign interface GigabitEthernet 1/0/1

VSYSb

[FW]vsys name vsysb
[FW-vsys-vsysb]assign resource-class r2
[FW-vsys-vsysb]assign interface GigabitEthernet 1/0/2

VSYSa

[FW]vsys name vsysc
[FW-vsys-vsysc]assign resource-class r3
[FW-vsys-vsysc]assign interface GigabitEthernet 1/0/3

总览

公共接口：勾选后，该接口发出的流量为出方向，即为共有接口。一般而言，在虚拟系统中，只有存在多个物理接口时，才会配置公共接口，来代替Virtual-if接口。----资源类中的出接口带宽，只有在接口为公共接口时才有效。

管理员配置

[FW]switch vsys vsysa ---切换到vsysa系统中
[FW-vsysa]aaa
[FW-vsysa-aaa]manager-user admin@@vsysa ---创建vsysa虚拟系统管理员，@@为固定，前为用户名，后为虚拟系统名称
[FW-vsysa-aaa-manager-user-admin@@vsysa]password --配置密码，需要输入两遍，密码没有回显
Enter Password:admin@123
Confirm Password:admin@123
[FW-vsysa-aaa-manager-user-admin@@vsysa]level 15 --设定权限
[FW-vsysa-aaa-manager-user-admin@@vsysa]service-type web telnet ssh ---设定登录服务，一般选择ssh和web即可
[FW-vsysa-aaa-manager-user-admin@@vsysa]quit
[FW-vsysa-aaa]bind manager-user admin@@vsysa role system-admin ---定义admin@@vsysa用户为系统管理员

nat策略

[FW]security-policy
[FW-policy-security]rule name to_internet
[FW-policy-security-rule-to_internet]source-zone trust 
[FW-policy-security-rule-to_internet]destination-zone untrust 
[FW-policy-security-rule-to_internet]action permit 
[FW-policy-security]q
[FW]nat-policy 
[FW-policy-nat]rule name nat1
[FW-policy-nat-rule-nat1]source-zone trust 
[FW-policy-nat-rule-nat1]destination-zone
[FW-policy-nat-rule-nat1]egress-interface GigabitEthernet 1/0/0
[FW-policy-nat-rule-nat1]source-address 10.3.0.0 16	
[FW-policy-nat-rule-nat1]action source-nat easy-ip 

虚拟系统配置

a

[FW]switch vsys vsysa
<FW-vsysa>sys
[FW-vsysa]int g 1/0/1	
[FW-vsysa-GigabitEthernet1/0/1]ip address 10.3.0.254 24
[FW-vsysa-GigabitEthernet1/0/1]q
[FW-vsysa]interface Virtual-if 1
[FW-vsysa-Virtual-if1]ip address 172.16.1.1 24
[FW-vsysa-Virtual-if1]q
[FW-vsysa]firewall zone trust 
[FW-vsysa-zone-trust]add int g 1/0/1
[FW-vsysa-zone-trust]q
[FW-vsysa]firewall zone untrust 
[FW-vsysa-zone-untrust]add int Virtual-if 1
[FW-vsysa-zone-untrust]q
[FW-vsysa]ip route-static 0.0.0.0 0 public 
[FW-vsysa]ip address-set ip_add01 type object
[FW-vsysa-object-address-set-ip_add01]add range 10.3.0.1 10.3.0.10
[FW-vsysa-object-address-set-ip_add01]q
[FW-vsysa]security-policy 
[FW-vsysa-policy-security]rule name to_internet
[FW-vsysa-policy-security-rule-to_internet]source-zone trust 
[FW-vsysa-policy-security-rule-to_internet]destination-zone untrust 
[FW-vsysa-policy-security-rule-to_internet]source-address address-set ip_add01
[FW-vsysa-policy-security-rule-to_internet]action permit 

b

[FW]switch vsys vsysb
<FW-vsysb>sys
[FW-vsysb]int g1/0/2
[FW-vsysb-GigabitEthernet1/0/2]ip add 10.3.1.254 24
[FW-vsysb-GigabitEthernet1/0/2]q
[FW-vsysb]int Virtual-if 2
[FW-vsysb-Virtual-if2]ip add 172.16.2.1 24
[FW-vsysb-Virtual-if2]q
[FW-vsysb]firewall zone trust 
[FW-vsysb-zone-trust]add int g 1/0/2
[FW-vsysb-zone-trust]q
[FW-vsysb]firewall zone untrust 	
[FW-vsysb]firewall zone untrust 
[FW-vsysb-zone-untrust]add int Virtual-if 2
[FW-vsysb-zone-untrust]q
[FW-vsysb]ip route-static 0.0.0.0 0 public 

c

[FW]switch vsys vsysb
<FW-vsysb>sys
[FW-vsysc-GigabitEthernet1/0/3]ip add 10.3.2.254 24
[FW-vsysc-GigabitEthernet1/0/3]int Virtual-if 3
[FW-vsysc-Virtual-if3]ip add 172.16.3.1 24
[FW-vsysc-Virtual-if3]q
[FW-vsysc]firewall zone trust
[FW-vsysc-zone-trust]add int g1/0/3
[FW-vsysc-zone-trust]q
[FW-vsysc]firewall zone untrust 
[FW-vsysc-zone-untrust]add int Virtual-if 3
[FW-vsysc-zone-untrust]q
[FW-vsysc]ip route-static 0.0.0.0 0 public 
[FW-vsysc]security-policy	
[FW-vsysc]security-policy 
[FW-vsysc-policy-security]rule name to_internet
[FW-vsysc-policy-security-rule-to_internet]source-zone trust 
[FW-vsysc-policy-security-rule-to_internet]destination-zone untrust 
[FW-vsysc-policy-security-rule-to_internet]source-address 10.3.2.0 24
[FW-vsysc-policy-security-rule-to_internet]action permit 

[FW]ip route-static vpn-instance vsysa 10.3.1.0 24 vpn-instance vsysb ---补充vsysa到vsysb的明细路由

测试