devbox
从前慢现在也慢
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

[eNSP]华为防火墙基础——Local、DMZ、Trust、Untrust互联_ensp防火墙trust和untrust

作者：从前慢现在也慢 | 2024-04-23 00:43:42

赞

踩

ensp防火墙trust和untrust

设备清单：1台PC、2台路由器（AR2220）、1台防火墙（USG6000V）

试验拓扑：实验目的：实现trust、untrust、local、dmz区域互通。PC可以ping通R-1和R-2。

试验说明：PC在trust内、R-2在untrust内、R-1在dmz内。ip地址见拓扑。

配置开始：

R1的IP地址：

  1. <R1>dis ip in br
  2. Interface                         IP Address/Mask      Physical   Protocol  
  3. GigabitEthernet0/0/0              172.16.0.1/24        up         up        
  4. GigabitEthernet0/0/1              unassigned           down       down      
  5. NULL0                             unassigned           up         up(s)

R2的IP地址：

  1. <R2>dis ip in br
  2. Interface                         IP Address/Mask      Physical   Protocol  
  3. GigabitEthernet0/0/0              10.0.0.2/24          up         up        
  4. GigabitEthernet0/0/1              unassigned           down       down      
  5. NULL0                             unassigned           up         up(s)

FW的IP地址：  华为防火墙默认账号/密码：admin/Admin@123 登录后要修改密码。

  1. <FW>dis ip in br
  2. Interface                         IP Address/Mask      Physical   Protocol  
  3. GigabitEthernet0/0/0              192.168.0.1/24       down       down      
  4. GigabitEthernet1/0/0              192.168.1.254/24     up         up        
  5. GigabitEthernet1/0/1              10.0.0.1/24          up         up        
  6. GigabitEthernet1/0/2              172.16.0.1/24        up         up

接着 在FW中将接口划入对应的区域：

  1. [FW]firewall zone trust 
  2. [FW-zone-trust]add interface GigabitEthernet 1/0/0
  3.  
  4. [FW]firewall zone untrust 
  5. [FW-zone-untrust]add interface GigabitEthernet 1/0/1
  6.  
  7. [FW]firewall zone dmz 
  8. [FW-zone-dmz]add interface GigabitEthernet 1/0/2

配置防火墙

  1. [FW]int g 1/0/0
  2. [FW-GigabitEthernet1/0/0]service-manage ping permit 
  3. [FW-GigabitEthernet1/0/0]q
  4. [FW]security-policy 
  5. [FW-policy-security]rule name ping
  6. [FW-policy-security-rule-ping]source-zone local untrust trust dmz 	
  7. [FW-policy-security-rule-ping]destination-zone local untrust trust dmz 
  8. //本意是让防护墙的区域互通，所以不做其他策略！
  9. //工作中不建议这样配置！！！
  10. [FW-policy-security-rule-ping]service icmp
  11. [FW-policy-security-rule-ping]action permit 
  12. [FW-policy-security-rule-ping]dis th
  13. #
  14.  rule name ping
  15.   source-zone dmz
  16.   source-zone local
  17.   source-zone trust
  18.   source-zone untrust
  19.   destination-zone dmz
  20.   destination-zone local
  21.   destination-zone trust
  22.   destination-zone untrust
  23.   service icmp
  24.   action permit
  25. #
  26. return

测试防火墙直连：

  1. [FW]ping 192.168.1.1
  2.   PING 192.168.1.1: 56  data bytes, press CTRL_C to break
  3.     Reply from 192.168.1.1: bytes=56 Sequence=1 ttl=128 time=32 ms
  4.     Reply from 192.168.1.1: bytes=56 Sequence=2 ttl=128 time=4 ms
  5.     Reply from 192.168.1.1: bytes=56 Sequence=3 ttl=128 time=4 ms
  6.     Reply from 192.168.1.1: bytes=56 Sequence=4 ttl=128 time=5 ms
  7.     Reply from 192.168.1.1: bytes=56 Sequence=5 ttl=128 time=4 ms
  8.  
  9.   --- 192.168.1.1 ping statistics ---
  10.     5 packet(s) transmitted
  11.     5 packet(s) received
  12.     0.00% packet loss
  13.     round-trip min/avg/max = 4/9/32 ms
  14.  
  15. [FW]ping 10.0.0.2
  16.   PING 10.0.0.2: 56  data bytes, press CTRL_C to break
  17.     Reply from 10.0.0.2: bytes=56 Sequence=1 ttl=255 time=51 ms
  18.     Reply from 10.0.0.2: bytes=56 Sequence=2 ttl=255 time=14 ms
  19.     Reply from 10.0.0.2: bytes=56 Sequence=3 ttl=255 time=15 ms
  20.     Reply from 10.0.0.2: bytes=56 Sequence=4 ttl=255 time=4 ms
  21.     Reply from 10.0.0.2: bytes=56 Sequence=5 ttl=255 time=6 ms
  22.  
  23.   --- 10.0.0.2 ping statistics ---
  24.     5 packet(s) transmitted
  25.     5 packet(s) received
  26.     0.00% packet loss
  27.     round-trip min/avg/max = 4/18/51 ms
  28.  
  29. [FW]ping 172.16.0.1
  30.   PING 172.16.0.1: 56  data bytes, press CTRL_C to break
  31.     Reply from 172.16.0.1: bytes=56 Sequence=1 ttl=255 time=47 ms
  32.     Reply from 172.16.0.1: bytes=56 Sequence=2 ttl=255 time=7 ms
  33.     Reply from 172.16.0.1: bytes=56 Sequence=3 ttl=255 time=8 ms
  34.     Reply from 172.16.0.1: bytes=56 Sequence=4 ttl=255 time=9 ms
  35.     Reply from 172.16.0.1: bytes=56 Sequence=5 ttl=255 time=12 ms
  36.  
  37.   --- 172.16.0.1 ping statistics ---
  38.     5 packet(s) transmitted
  39.     5 packet(s) received
  40.     0.00% packet loss
  41.     round-trip min/avg/max = 7/16/47 ms

接着配置OSPF和OSPF防火墙策略：

  1. [R1]ospf 1 router-id  1.1.1.1
  2. [R1-ospf-1]area 0
  3. [R1-ospf-1-area-0.0.0.0]network 172.16.0.1 0.0.0.0
  1. [R2]ospf 1 router-id 2.2.2.2 
  2. [R2-ospf-1]area 0
  3. [R2-ospf-1-area-0.0.0.0]network 10.0.0.2 0.0.0.0
  1. [FW]ospf 1 router-id 3.3.3.3
  2. [FW-ospf-1]area 0
  3. [FW-ospf-1-area-0.0.0.0]network 192.168.1.254 0.0.0.0
  4. [FW-ospf-1-area-0.0.0.0]network 10.0.0.1 0.0.0.0
  5. [FW-ospf-1-area-0.0.0.0]network 172.16.0.254 0.0.0.0

查看邻居是否建立：

  1. [FW-ospf-1-area-0.0.0.0]dis ospf peer brief 
  2.  
  3. 	 OSPF Process 1 with Router ID 3.3.3.3
  4. 		  Peer Statistic Information
  5.  ----------------------------------------------------------------------------
  6.  Area Id          Interface                        Neighbor id      State    
  7.  0.0.0.0          GigabitEthernet1/0/1             2.2.2.2          Full        
  8.  0.0.0.0          GigabitEthernet1/0/2             1.1.1.1          Full        
  9.  ----------------------------------------------------------------------------

接下来配置防火墙的OSPF策略：

  1. [FW]security-policy 
  2. [FW-policy-security]rule name OSPF
  3. [FW-policy-security-rule-OSPF]service ospf 
  4. [FW-policy-security-rule-OSPF]source-zone local dmz untrust 
  5. [FW-policy-security-rule-OSPF]destination-zone dmz local untrust 
  6. [FW-policy-security-rule-OSPF]action permit 
  7. [FW-policy-security-rule-OSPF]dis th
  8. #
  9.  rule name OSPF
  10.   source-zone dmz
  11.   source-zone local
  12.   source-zone untrust
  13.   destination-zone dmz
  14.   destination-zone local
  15.   destination-zone untrust
  16.   service ospf
  17.   action permit
  18. #
  19. return

最后测试PC是否能ping通路由器：

  1. PC>ping 10.0.0.2
  2.  
  3. Ping 10.0.0.2: 32 data bytes, Press Ctrl_C to break
  4. From 10.0.0.2: bytes=32 seq=1 ttl=254 time=31 ms
  5. From 10.0.0.2: bytes=32 seq=2 ttl=254 time=16 ms
  6.  
  7. --- 10.0.0.2 ping statistics ---
  8.   2 packet(s) transmitted
  9.   2 packet(s) received
  10.   0.00% packet loss
  11.   round-trip min/avg/max = 16/23/31 ms
  12.  
  13.  
  14. PC>ping 172.16.0.1
  15.  
  16. Ping 172.16.0.1: 32 data bytes, Press Ctrl_C to break
  17. From 172.16.0.1: bytes=32 seq=1 ttl=254 time=16 ms
  18. From 172.16.0.1: bytes=32 seq=2 ttl=254 time=15 ms
  19. From 172.16.0.1: bytes=32 seq=3 ttl=254 time=16 ms
  20.  
  21. --- 172.16.0.1 ping statistics ---
  22.   5 packet(s) transmitted
  23.   5 packet(s) received
  24.   0.00% packet loss
  25.   round-trip min/avg/max = 0/12/16 ms
  26.  
  27. PC>

试验结束，仅以此来记录本人HCIE-Datacom备考中涉及的知识点，不用作任何教学。突发奇想，想做一个自己的博客，就这样开始了，之前的试验会慢慢补齐。请理性观看，如有错误希望指正！

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/从前慢现在也慢/article/detail/471310
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号