华为eNSP配置防火墙的安全域和安全策略

操作方法

• 01

  一、搭建本次实验的拓扑 防火墙一台、路由器三台、交换机一台

  

• 02

  二、配置设备的接口信息 <Huawei>system-view Enter system view, return user view with Ctrl+Z.[Huawei]sysname R1[R1]interface GigabitEthernet 0/0/1 [R1-GigabitEthernet0/0/1]ip address 10.0.10.1 24[R1-GigabitEthernet0/0/1]quit[R1]interface loopback 0[R1-LoopBack0]ip address 10.0.1.1 24<Huawei>system-view Enter system view, return user view with Ctrl+Z.[Huawei]sysname R2[R2]interface GigabitEthernet0/0/1[R2-GigabitEthernet0/0/1]ip address 10.0.20.1 24[R2-GigabitEthernet0/0/1]quit[R2]interface loopback 0[R2-LoopBack0]ip address 10.0.2.2 24<Huawei>system-viewEnter system view, return user view with Ctrl+Z.[Huawei]sysname R3[R3]interface GigabitEthernet 0/0/1[R3-GigabitEthernet0/0/1]ip address 10.0.30.1 24[R3-GigabitEthernet0/0/1]quit[R3]interface loopback 0 [R3-LoopBack0]ip address 10.0.3.3 24 防火墙信息 [FW]int GigabitEthernet 0/0/0[FW-GigabitEthernet0/0/0]undo ip address[FW-GigabitEthernet0/0/0]quit[FW]interface GigabitEthernet 1/0/0[FW-GigabitEthernet1/0/0]ip address 10.0.10.254 24[FW-GigabitEthernet1/0/0]quit[FW]interface GigabitEthernet 1/0/1[FW-GigabitEthernet1/0/1]ip address 10.0.20.254 24[FW-GigabitEthernet1/0/1]quit[FW]interface GigabitEthernet 1/0/2[FW-GigabitEthernet1/0/2]ip address 10.0.30.254 24[FW-GigabitEthernet1/0/2]quit

  

• 03

  三、划分本次实验需要的VLAN [Quidway]sysname S1[S1]vlan batch 11 to 13[S1]interface GigabitEthernet 0/0/1[S1-GigabitEthernet0/0/1]port link-type access[S1-GigabitEthernet0/0/1]port default vlan 11[S1-GigabitEthernet0/0/1]quit[S1]interface GigabitEthernet 0/0/2[S1-GigabitEthernet0/0/2]port link-type access[S1-GigabitEthernet0/0/2]port default vlan 12[S1-GigabitEthernet0/0/2]quit[S1]interface GigabitEthernet 0/0/3[S1-GigabitEthernet0/0/3]port link-type access[S1-GigabitEthernet0/0/3]port default vlan 13[S1-GigabitEthernet0/0/3]quit[S1]interface GigabitEthernet 0/0/21[S1-GigabitEthernet0/0/21]port link-type access[S1-GigabitEthernet0/0/21]port default vlan 11[S1-GigabitEthernet0/0/21]quit[S1]interface GigabitEthernet 0/0/22[S1-GigabitEthernet0/0/22]port link-type access[S1-GigabitEthernet0/0/22]port default vlan 12[S1-GigabitEthernet0/0/22]quit[S1]interface GigabitEthernet 0/0/23[S1-GigabitEthernet0/0/23]port link-type access[S1-GigabitEthernet0/0/23]port default vlan 13

  

• 04

  四、配置静态路由信息 [R1]ip route-static 0.0.0.0 0 10.0.10.254[R2]ip route-static 0.0.0.0 0 10.0.20.254[R3]ip route-static 0.0.0.0 0 10.0.30.254[FW]ip route-static 10.0.1.0 24 10.0.10.1[FW]ip route-static 10.0.2.0 24 10.0.20.1[FW]ip route-static 10.0.3.0 24 10.0.30.1

  

• 05

  五、配置防火墙的区域 [FW]firewall zone dmz[FW-zone-dmz]add interface GigabitEthernet 1/0/2[FW-zone-dmz]quit[FW]firewall zone trust[FW-zone-trust]add interface GigabitEthernet 1/0/1[FW-zone-trust]undo add interface GigabitEthernet 0/0/0[FW-zone-trust]quit [FW]firewall zone untrust[FW-zone-untrust]add interface GigabitEthernet 1/0/0[FW-zone-untrust]quit

  

• 06

  六、配置防火墙的安全策略 [FW]security-policy[FW-policy-security]rule name policy_sec_1[FW-policy-security-rule-policy_sec_1]source-zone trust[FW-policy-security-rule-policy_sec_1]destination-zone untrust[FW-policy-security-rule-policy_sec_1]action permit[FW-policy-security-rule-policy_sec_1]quit[FW-policy-security]rule name policy_sec_2[FW-policy-security-rule-policy_sec_2]source-zone trust[FW-policy-security-rule-policy_sec_2]destination-zone dmz[FW-policy-security-rule-policy_sec_2]action permit[FW-policy-security-rule-policy_sec_2]quit[FW-policy-security]quit

  

• 07

  七、验证防火墙各个区域间通信 <R1>ping -a 10.0.1.1 10.0.2.2  PING 10.0.2.2: 56  data bytes, press CTRL_C to break    Reply from 10.0.2.2: bytes=56 Sequence=1 ttl=254 time=240 ms    Reply from 10.0.2.2: bytes=56 Sequence=2 ttl=254 time=80 ms    Reply from 10.0.2.2: bytes=56 Sequence=3 ttl=254 time=50 ms    Reply from 10.0.2.2: bytes=56 Sequence=4 ttl=254 time=70 ms    Reply from 10.0.2.2: bytes=56 Sequence=5 ttl=254 time=60 ms --- 10.0.2.2 ping statistics ---    5 packet(s) transmitted    5 packet(s) received    0.00% packet loss    round-trip min/avg/max = 50/100/240 ms <R1>ping -a 10.0.1.1 10.0.3.3  PING 10.0.3.3: 56  data bytes, press CTRL_C to break    Request time out    Reply from 10.0.3.3: bytes=56 Sequence=2 ttl=254 time=150 ms    Reply from 10.0.3.3: bytes=56 Sequence=3 ttl=254 time=70 ms    Reply from 10.0.3.3: bytes=56 Sequence=4 ttl=254 time=70 ms    Reply from 10.0.3.3: bytes=56 Sequence=5 ttl=254 time=60 ms --- 10.0.3.3 ping statistics ---    5 packet(s) transmitted    4 packet(s) received    20.00% packet loss    round-trip min/avg/max = 60/87/150 ms