华为eNSP配置防火墙的安全域和安全策略-问答二五

华为eNSP配置防火墙的安全域和安全策略

的有关信息介绍如下：

华为eNSP配置防火墙的安全域和安全策略

本次实验主要讲述的是华为防火墙USG6000V的配置，区别与USG5500的配置，在安全策略上，配置命令不一样

目的实现不同域之间的通信

一、搭建本次实验的拓扑

防火墙一台、路由器三台、交换机一台

二、配置设备的接口信息

system-view Enter system view, return user view with Ctrl+Z.[Huawei]sysname R1[R1]interface GigabitEthernet 0/0/1

[R1-GigabitEthernet0/0/1]ip address 10.0.10.1 24[R1-GigabitEthernet0/0/1]quit[R1]interface loopback 0[R1-LoopBack0]ip address 10.0.1.1 24system-view Enter system view, return user view with Ctrl+Z.[Huawei]sysname R2[R2]interface GigabitEthernet0/0/1[R2-GigabitEthernet0/0/1]ip address 10.0.20.1 24[R2-GigabitEthernet0/0/1]quit[R2]interface loopback 0[R2-LoopBack0]ip address 10.0.2.2 24system-viewEnter system view, return user view with Ctrl+Z.[Huawei]sysname R3[R3]interface GigabitEthernet 0/0/1[R3-GigabitEthernet0/0/1]ip address 10.0.30.1 24[R3-GigabitEthernet0/0/1]quit[R3]interface loopback 0 [R3-LoopBack0]ip address 10.0.3.3 24

防火墙信息

[FW]int GigabitEthernet 0/0/0[FW-GigabitEthernet0/0/0]undo ip address[FW-GigabitEthernet0/0/0]quit[FW]interface GigabitEthernet 1/0/0[FW-GigabitEthernet1/0/0]ip address 10.0.10.254 24[FW-GigabitEthernet1/0/0]quit[FW]interface GigabitEthernet 1/0/1[FW-GigabitEthernet1/0/1]ip address 10.0.20.254 24[FW-GigabitEthernet1/0/1]quit[FW]interface GigabitEthernet 1/0/2[FW-GigabitEthernet1/0/2]ip address 10.0.30.254 24[FW-GigabitEthernet1/0/2]quit

三、划分本次实验需要的VLAN

[Quidway]sysname S1[S1]vlan batch 11 to 13[S1]interface GigabitEthernet 0/0/1[S1-GigabitEthernet0/0/1]port link-type access[S1-GigabitEthernet0/0/1]port default vlan 11[S1-GigabitEthernet0/0/1]quit[S1]interface GigabitEthernet 0/0/2[S1-GigabitEthernet0/0/2]port link-type access[S1-GigabitEthernet0/0/2]port default vlan 12[S1-GigabitEthernet0/0/2]quit[S1]interface GigabitEthernet 0/0/3[S1-GigabitEthernet0/0/3]port link-type access[S1-GigabitEthernet0/0/3]port default vlan 13[S1-GigabitEthernet0/0/3]quit[S1]interface GigabitEthernet 0/0/21[S1-GigabitEthernet0/0/21]port link-type access[S1-GigabitEthernet0/0/21]port default vlan 11[S1-GigabitEthernet0/0/21]quit[S1]interface GigabitEthernet 0/0/22[S1-GigabitEthernet0/0/22]port link-type access[S1-GigabitEthernet0/0/22]port default vlan 12[S1-GigabitEthernet0/0/22]quit[S1]interface GigabitEthernet 0/0/23[S1-GigabitEthernet0/0/23]port link-type access[S1-GigabitEthernet0/0/23]port default vlan 13

四、配置静态路由信息

[R1]ip route-static 0.0.0.0 0 10.0.10.254[R2]ip route-static 0.0.0.0 0 10.0.20.254[R3]ip route-static 0.0.0.0 0 10.0.30.254[FW]ip route-static 10.0.1.0 24 10.0.10.1[FW]ip route-static 10.0.2.0 24 10.0.20.1[FW]ip route-static 10.0.3.0 24 10.0.30.1

五、配置防火墙的区域

[FW]firewall zone dmz[FW-zone-dmz]add interface GigabitEthernet 1/0/2[FW-zone-dmz]quit[FW]firewall zone trust[FW-zone-trust]add interface GigabitEthernet 1/0/1[FW-zone-trust]undo add interface GigabitEthernet 0/0/0[FW-zone-trust]quit

[FW]firewall zone untrust[FW-zone-untrust]add interface GigabitEthernet 1/0/0[FW-zone-untrust]quit

六、配置防火墙的安全策略

[FW]security-policy[FW-policy-security]rule name policy_sec_1[FW-policy-security-rule-policy_sec_1]source-zone trust[FW-policy-security-rule-policy_sec_1]destination-zone untrust[FW-policy-security-rule-policy_sec_1]action permit[FW-policy-security-rule-policy_sec_1]quit[FW-policy-security]rule name policy_sec_2[FW-policy-security-rule-policy_sec_2]source-zone trust[FW-policy-security-rule-policy_sec_2]destination-zone dmz[FW-policy-security-rule-policy_sec_2]action permit[FW-policy-security-rule-policy_sec_2]quit[FW-policy-security]quit

七、验证防火墙各个区域间通信

ping -a 10.0.1.1 10.0.2.2 PING 10.0.2.2: 56 data bytes, press CTRL_C to break Reply from 10.0.2.2: bytes=56 Sequence=1 ttl=254 time=240 ms Reply from 10.0.2.2: bytes=56 Sequence=2 ttl=254 time=80 ms Reply from 10.0.2.2: bytes=56 Sequence=3 ttl=254 time=50 ms Reply from 10.0.2.2: bytes=56 Sequence=4 ttl=254 time=70 ms Reply from 10.0.2.2: bytes=56 Sequence=5 ttl=254 time=60 ms

--- 10.0.2.2 ping statistics --- 5 packet(s) transmitted 5 packet(s) received 0.00% packet loss round-trip min/avg/max = 50/100/240 ms

ping -a 10.0.1.1 10.0.3.3 PING 10.0.3.3: 56 data bytes, press CTRL_C to break Request time out Reply from 10.0.3.3: bytes=56 Sequence=2 ttl=254 time=150 ms Reply from 10.0.3.3: bytes=56 Sequence=3 ttl=254 time=70 ms Reply from 10.0.3.3: bytes=56 Sequence=4 ttl=254 time=70 ms Reply from 10.0.3.3: bytes=56 Sequence=5 ttl=254 time=60 ms

--- 10.0.3.3 ping statistics --- 5 packet(s) transmitted 4 packet(s) received 20.00% packet loss round-trip min/avg/max = 60/87/150 ms