拓?fù)鋱D

場(chǎng)景：

         你是公司的網(wǎng)絡(luò)管理員。公司使用網(wǎng)絡(luò)防火墻隔離成三個(gè)區(qū)域?，F(xiàn)在要將DMZ區(qū)域中的一臺(tái)服務(wù)器（IP地址：10.0.3.3）提供的telnet服務(wù)發(fā)布出去，對(duì)外公開(kāi)的地址是10.0.10.20、24.并且內(nèi)部網(wǎng)絡(luò)Trust區(qū)域的用戶通過(guò)Easy-IP的方式訪問(wèn)外部區(qū)域。其它方向的訪問(wèn)被禁止。

         在交換機(jī)上將G0/0/1與G0/0/21接口定義到vlan11，將G0/0/2與G0/0/22接口定義到vlan12，將G0/0/3與G0/0/23接口定義到vlan13.分別規(guī)劃了三個(gè)網(wǎng)段。

學(xué)習(xí)任務(wù)

步驟一.基本配置與IP編址

         首先給三個(gè)路由器配置地址信息。

[Huawei]sysname R1

[R1]interface g0/0/1

[R1-GigabitEthernet0/0/1]ip add 10.0.10.124

[R1-GigabitEthernet0/0/1]desc this portconnect to S1-G0/0/1

[R1-GigabitEthernet0/0/1]interfaceloopback0

[R1-LoopBack0]ip add 10.0.1.1 24

[R1-LoopBack0]q

[Huawei]sysname R2

[R2]interface g0/0/1

[R2-GigabitEthernet0/0/1]ip add 10.0.20.224

[R2-GigabitEthernet0/0/1]desc this portconnect to S1-G0/0/2

[R2-GigabitEthernet0/0/1]interfaceloopback0

[R2-LoopBack0]ip add 10.0.2.2 24

[R2-LoopBack0]q

[Huawei]sysname R3

[R3]interface g0/0/1

[R3-GigabitEthernet0/0/1]ip add 10.0.30.324

[R3-GigabitEthernet0/0/1]desc this portconnect to S1-G0/0/3

[R3-GigabitEthernet0/0/1]interfaceloopback0

[R3-LoopBack0]ip add 10.0.3.3 24

[R3-LoopBack0]q

給防火墻配置地址時(shí)，G0/0/1配置10.0.20.254/24.

[SRG]sysname FW

13:06:03 2014/07/08

[FW]interface g0/0/1

13:06:30 2014/07/08

[FW-GigabitEthernet0/0/1]ip add 10.0.20.25424

13:07:01 2014/07/08

[FW-GigabitEthernet0/0/1]desc this portconnect to S1-G0/0/22

13:07:52 2014/07/08

[FW-GigabitEthernet0/0/1]interface g0/0/0

13:08:23 2014/07/08

[FW-GigabitEthernet0/0/0]dis this

13:08:31 2014/07/08

#

interface GigabitEthernet0/0/0

 alias GE0/MGMT

 ipaddress 192.168.0.1 255.255.255.0

 dhcpselect interface

 dhcpserver gateway-list 192.168.0.1

#

return

[FW-GigabitEthernet0/0/0]undo ip add

13:08:42 2014/07/08

Info: The DHCP server configuration on thisinterface will be deleted.

[FW-GigabitEthernet0/0/0]display this

13:08:46 2014/07/08

#

interface GigabitEthernet0/0/0

 alias GE0/MGMT

#

return

[FW-GigabitEthernet0/0/0]ip add 10.0.10.25424

13:09:29 2014/07/08

[FW-GigabitEthernet0/0/0]desc this portconnect to S1-G0/0/21

13:10:05 2014/07/08

[FW-GigabitEthernet0/0/0]interface G0/0/2

13:10:15 2014/07/08

[FW-GigabitEthernet0/0/2]ip add 10.0.30.25424

13:10:28 2014/07/08

[FW-GigabitEthernet0/0/2]desc this portconnect to S1-G0/0/23

13:10:53 2014/07/08

[FW-GigabitEthernet0/0/2]q

交換機(jī)上需要按照需求定義vlan

[Huawei]sysname S1

[S1]vlan batch 11 to 13

Info: This operation may take a fewseconds. Please wait for a moment...done.

[S1]interface g0/0/1

[S1-GigabitEthernet0/0/1]port link-typeaccess

[S1-GigabitEthernet0/0/1]port default vlan11

[S1]interface g0/0/2

[S1-GigabitEthernet0/0/2]port link-typeaccess

[S1-GigabitEthernet0/0/2]port default vlan12

[S1-GigabitEthernet0/0/2]interface g0/0/3

[S1-GigabitEthernet0/0/3]port link-typeaccess

[S1-GigabitEthernet0/0/3]port default vlan13

[S1-GigabitEthernet0/0/3]interface g0/0/21

[S1-GigabitEthernet0/0/21]port link-typeaccess

[S1-GigabitEthernet0/0/21]port default vlan11

[S1-GigabitEthernet0/0/21]interface g0/0/22

[S1-GigabitEthernet0/0/22]port link-typeaccess

[S1-GigabitEthernet0/0/22]port default vlan12

[S1-GigabitEthernet0/0/22]interface g0/0/23

[S1-GigabitEthernet0/0/23]port link-typeaccess

[S1-GigabitEthernet0/0/23]port default vlan13

步驟二.將接口配置到安全區(qū)域

         防火墻默認(rèn)有四個(gè)區(qū)域，分別是“local”、“trust"、“untrust”、“dmz”。

         實(shí)驗(yàn)中我們用到“trust”、'untrust"、“dmz”三個(gè)區(qū)域。將G0/0/0加入untrust區(qū)域、g/0/0/2加入dmz和g/0/0/1加入trust。

[FW]firewall zone trust

13:45:31 2014/07/08

[FW-zone-trust]dis this

13:45:35 2014/07/08

#

firewall zone trust

 setpriority 85

 addinterface GigabitEthernet0/0/0

#

return

[FW-zone-trust]undo add inter       

[FW-zone-trust]undo add interface g0/0/0

13:46:01 2014/07/08

[FW-zone-trust]add interface g0/0/1

13:46:22 2014/07/08

[FW-zone-trust]firewall zone untrust

[FW-zone-untrust]add interface g0/0/0

13:47:24 2014/07/08

[[FW-zone-untrust]firewall zone dmz

13:48:06 2014/07/08

[FW-zone-dmz]add interface g0/0/2

13:48:13  2014/07/08

[FW-zone-dmz]q

         默認(rèn)情況下，防火墻并不允許出local區(qū)域外的其它區(qū)域之間進(jìn)行通信。為了便于驗(yàn)證配置的正確性，我們首先將防火墻區(qū)域之間的默認(rèn)過(guò)濾規(guī)則配置為允許所有區(qū)域間通信。配置完成后在FW設(shè)備上測(cè)試連通性。

最新評(píng)論