华为eNSP配置防火墙的安全域和安全策略

win7-64

eNSP

一、搭建本次实验的拓扑防火墙一台、路由器三台、交换机一台

二、配置设备的接口信息system-view Enter system view, return user view with Ctrl+Z.[Huawei]sysname R1[R1]interface GigabitEthernet 0/0/1[R1-GigabitEthernet0/0/1]ip address 10.0.10.1 24[R1-GigabitEthernet0/0/1]quit[R1]interface loopback 0[R1-LoopBack0]ip address 10.0.1.1 24system-view Enter system view, return user view with Ctrl+Z.[Huawei]sysname R2[R2]interface GigabitEthernet0/0/1[R2-GigabitEthernet0/0/1]ip address 10.0.20.1 24[R2-GigabitEthernet0/0/1]quit[R2]interface loopback 0[R2-LoopBack0]ip address 10.0.2.2 24system-viewEnter system view, return user view with Ctrl+Z.[Huawei]sysname R3[R3]interface GigabitEthernet 0/0/1[R3-GigabitEthernet0/0/1]ip address 10.0.30.1 24[R3-GigabitEthernet0/0/1]quit[R3]interface loopback 0 [R3-LoopBack0]ip address 10.0.3.3 24防火墙信息[FW]int GigabitEthernet 0/0/0[FW-GigabitEthernet0/0/0]undo ip address[FW-GigabitEthernet0/0/0]quit[FW]interface GigabitEthernet 1/0/0[FW-GigabitEthernet1/0/0]ip address 10.0.10.254 24[FW-GigabitEthernet1/0/0]quit[FW]interface GigabitEthernet 1/0/1[FW-GigabitEthernet1/0/1]ip address 10.0.20.254 24[FW-GigabitEthernet1/0/1]quit[FW]interface GigabitEthernet 1/0/2[FW-GigabitEthernet1/0/2]ip address 10.0.30.254 24[FW-GigabitEthernet1/0/2]quit

三、划分本次实验需要的VLAN[Quidway]sysname S1[S1]vlan batch 11 to 13[S1]interface GigabitEthernet 0/0/1[S1-GigabitEthernet0/0/1]port link-type access[S1-GigabitEthernet0/0/1]port default vlan 11[S1-GigabitEthernet0/0/1]quit[S1]interface GigabitEthernet 0/0/2[S1-GigabitEthernet0/0/2]port link-type access[S1-GigabitEthernet0/0/2]port default vlan 12[S1-GigabitEthernet0/0/2]quit[S1]interface GigabitEthernet 0/0/3[S1-GigabitEthernet0/0/3]port link-type access[S1-GigabitEthernet0/0/3]port default vlan 13[S1-GigabitEthernet0/0/3]quit[S1]interface GigabitEthernet 0/0/21[S1-GigabitEthernet0/0/21]port link-type access[S1-GigabitEthernet0/0/21]port default vlan 11[S1-GigabitEthernet0/0/21]quit[S1]interface GigabitEthernet 0/0/22[S1-GigabitEthernet0/0/22]port link-type access[S1-GigabitEthernet0/0/22]port default vlan 12[S1-GigabitEthernet0/0/22]quit[S1]interface GigabitEthernet 0/0/23[S1-GigabitEthernet0/0/23]port link-type access[S1-GigabitEthernet0/0/23]port default vlan 13

四、配置静态路由信息[R1]ip route-static 0.0.0.0 0 10.0.10.254[R2]ip route-static 0.0.0.0 0 10.0.20.254[R3]ip route-static 0.0.0.0 0 10.0.30.254[FW]ip route-static 10.0.1.0 24 10.0.10.1[FW]ip route-static 10.0.2.0 24 10.0.20.1[FW]ip route-static 10.0.3.0 24 10.0.30.1

五、配置防火墙的区域[FW]firewall zone dmz[FW-zone-dmz]add interface GigabitEthernet 1/0/2[FW-zone-dmz]quit[FW]firewall zone trust[FW-zone-trust]add interface GigabitEthernet 1/0/1[FW-zone-trust]undo add interface GigabitEthernet 0/0/0[FW-zone-trust]quit[FW]firewall zone untrust[FW-zone-untrust]add interface GigabitEthernet 1/0/0[FW-zone-untrust]quit

七、验证防火墙各个区域间通信ping -a 10.0.1.1 10.0.2.2  PING 10.0.2.2: 56  data bytes, press CTRL_C to break    Reply from 10.0.2.2: bytes=56 Sequence=1 ttl=254 time=240 ms    Reply from 10.0.2.2: bytes=56 Sequence=2 ttl=254 time=80 ms    Reply from 10.0.2.2: bytes=56 Sequence=3 ttl=254 time=50 ms    Reply from 10.0.2.2: bytes=56 Sequence=4 ttl=254 time=70 ms    Reply from 10.0.2.2: bytes=56 Sequence=5 ttl=254 time=60 ms  --- 10.0.2.2 ping statistics ---    5 packet(s) transmitted    5 packet(s) received    0.00% packet loss    round-trip min/avg/max = 50/100/240 msping -a 10.0.1.1 10.0.3.3  PING 10.0.3.3: 56  data bytes, press CTRL_C to break    Request time out    Reply from 10.0.3.3: bytes=56 Sequence=2 ttl=254 time=150 ms    Reply from 10.0.3.3: bytes=56 Sequence=3 ttl=254 time=70 ms    Reply from 10.0.3.3: bytes=56 Sequence=4 ttl=254 time=70 ms    Reply from 10.0.3.3: bytes=56 Sequence=5 ttl=254 time=60 ms  --- 10.0.3.3 ping statistics ---    5 packet(s) transmitted    4 packet(s) received    20.00% packet loss    round-trip min/avg/max = 60/87/150 ms

注意防火墙的端口的优先级

配置策略要注意从哪到哪