防火墙-策略路由实验

一、拓扑图和需求1.1 拓扑简述内网交换机 SW1VLAN10财务部 Client1 192.168.1.1/24 VLAN20研发部 Client2 192.168.2.1/24 VLAN30Web-Server 192.168.3.1/24 SW1 GE0/0/1 连接防火墙 FW1 GE1/0/0Trust 区域防火墙 FW1USG6000GE1/0/0Trust 内网接口 192.168.1.254三层接口SW1 网关 GE1/0/1连接电信 ISP 路由器 R4网段14.0.0.0/24FW 地址 14.0.0.1 GE1/0/2连接联通 ISP 路由器 R2网段12.0.0.0/24FW 地址 12.0.0.1电信 ISPR4GE0/0/0 14.0.0.2GE0/0/3 100.1.1.0/24公网用户 1 GE0/0/2 34.0.0.1电信 DNS 服务器联通 ISPR2GE0/0/0 12.0.0.2GE0/0/1 23.0.0.0/24 GE0/0/2 200.1.1.1联通 DNS 服务器GE0/0/3 102.1.1.0/24公网用户 2互联网路由器 R3GE0/0/0 34.0.0.2GE0/0/1 23.0.0.2GE0/0/2 50.0.0.1FTP 服务器 50.0.0.21.2 安全区域划分Trust企业内网192.168.1.0/24、192.168.2.0/24、192.168.3.0/24Untrust电信、联通 ISP、公网、FTP 服务器所有外网网段接口归属 GE1/0/0 → TrustGE1/0/1、GE1/0/2 → Untrust二、需求分析内网划分交换机配置 VLAN 区分财务部VLAN10、研发部VLAN20、Web 服务器VLAN30防火墙创建地址组区分两个部门。路由部署公网路由器启用 OSPF 保证外网互通防火墙配置电信、联通明细 ISP 路由搭配IP-Link 检测的浮动默认路由。外网访问内网 Web配置NAT Server 双向映射电信公网用户访问防火墙电信接口地址14.0.0.1、联通公网用户访问联通接口地址12.0.0.1从对应接口进入内网访问 Web 服务器。内网访问 FTP 智能选路策略路由 PBR财务部访问 FTP → 电信链路研发部访问 FTP → 联通链路绑定 IP-Link 链路检测链路故障自动切换路由。用户认证财务部免认证研发部采用匿名认证基于地址组配置认证策略。NAT 转换内网访问外网Easy-IP 出接口地址转换外网访问内网 WebNAT Server 服务器映射。安全策略遵循最小权限精细化放行流量仅允许外网访问 Web 服务其余未授权流量默认阻断三、详细设备配置配置分为web界面和命令行部分部分配置使用web界面简洁一点3.1 SW1 三层交换机配置SW1sys [SW1]sysname SW1 # 创建VLAN [SW1]vlan batch 10 20 30 # 接入接口 [SW1]interface Ethernet0/0/0 [SW1-Ethernet0/0/0]port link-type access [SW1-Ethernet0/0/0]port default vlan 10 [SW1-Ethernet0/0/0]quit [SW1]interface Ethernet0/0/1 [SW1-Ethernet0/0/1]port link-type access [SW1-Ethernet0/0/1]port default vlan 20 [SW1-Ethernet0/0/1]quit [SW1]interface Ethernet0/0/2 [SW1-Ethernet0/0/2]port link-type access [SW1-Ethernet0/0/2]port default vlan 30 [SW1-Ethernet0/0/2]quit # 上联防火墙接口 [SW1]interface GigabitEthernet 0/0/1 [SW1-GigabitEthernet0/0/1]port link-type trunk [SW1-GigabitEthernet0/0/1]port trunk allow-pass vlan all # 三层VLANIF网关 [SW1]interface Vlanif 10 [SW1-Vlanif10]ip address 192.168.1.254 255.255.255.0 [SW1-Vlanif10]quit [SW1]interface Vlanif 20 [SW1-Vlanif20]ip address 192.168.2.254 255.255.255.0 [SW1-Vlanif20]quit [SW1]interface Vlanif 30 [SW1-Vlanif30]ip address 192.168.3.254 255.255.255.0 [SW1-Vlanif30]quit # 默认路由指向防火墙Trust接口 [SW1]ip route-static 0.0.0.0 0 192.168.1.2543.2 防火墙 FW1FWsystem-view [FW]sysname FW1 # 开启防火墙功能 [FW]firewall enable [FW]undo info-center enable # 1.接口与安全区域配置 # 内网Trust接口 [FW]interface GigabitEthernet 1/0/0 [FW-GigabitEthernet1/0/0]ip address 192.168.1.254 255.255.255.0 [FW-GigabitEthernet1/0/0]zone trust [FW-GigabitEthernet1/0/0]quit # 电信ISP接口 Untrust [FW]interface GigabitEthernet 1/0/1 [FW-GigabitEthernet1/0/1]ip address 14.0.0.1 255.255.255.0 [FW-GigabitEthernet1/0/1]zone untrust [FW-GigabitEthernet1/0/1]quit # 联通ISP接口 Untrust [FW]interface GigabitEthernet 1/0/2 [FW-GigabitEthernet1/0/2]ip address 12.0.0.1 255.255.255.0 [FW-GigabitEthernet1/0/2]zone untrust [FW-GigabitEthernet1/0/2]quit # 2.IP-Link 链路健康检测策略路由依赖 [FW]healthcheck enable # 检测电信链路可达性 [FW]healthcheck name ISP1_DETECT [FW-healthcheck-ISP1_DETECT]protocol icmp [FW-healthcheck-ISP1_DETECT]destination 14.0.0.2 interface GigabitEthernet 1/0/1 [FW-healthcheck-ISP1_DETECT]quit # 检测联通链路可达性 [FW]healthcheck name ISP2_DETECT [FW-healthcheck-ISP2_DETECT]protocol icmp [FW-healthcheck-ISP2_DETECT]destination 12.0.0.2 interface GigabitEthernet 1/0/2 [FW-healthcheck-ISP2_DETECT]quit # 3.地址对象、地址组用于安全策略认证 # 财务部地址组 [FW]address-object Finance [FW-address-object-Finance]ip 192.168.1.0 mask 255.255.255.0 [FW-address-object-Finance]quit # 研发部地址组 [FW]address-object RD [FW-address-object-RD]ip 192.168.2.0 mask 255.255.255.0 [FW-address-object-RD]quit # Web服务器地址 [FW]address-object WebServer [FW-address-object-WebServer]ip 192.168.3.1 mask 255.255.255.255 [FW-address-object-WebServer]quit # FTP服务器公网地址 [FW]address-object FTPServer [FW-address-object-FTPServer]ip 50.0.0.2 mask 255.255.255.255 [FW-address-object-FTPServer]quit # 4.策略路由财务部走电信研发走联通访问FTP # 策略路由1财务部访问FTP走电信GE1/0/1 [FW]policy-based-route PBR_FINANCE [FW-policy-based-route-PBR_FINANCE]rule 1 permit [FW-policy-based-route-PBR_FINANCE-rule-1]source-address Finance [FW-policy-based-route-PBR_FINANCE-rule-1]destination-address FTPServer [FW-policy-based-route-PBR_FINANCE-rule-1]apply next-hop 14.0.0.2 track healthcheck ISP1_DETECT [FW-policy-based-route-PBR_FINANCE-rule-1]quit [FW-policy-based-route-PBR_FINANCE]quit # 策略路由2研发部访问FTP走联通GE1/0/2 [FW]policy-based-route PBR_RD [FW-policy-based-route-PBR_RD]rule 1 permit [FW-policy-based-route-PBR_RD-rule-1]source-address RD [FW-policy-based-route-PBR_RD-rule-1]destination-address FTPServer [FW-policy-based-route-PBR_RD-rule-1]apply next-hop 12.0.0.2 track healthcheck ISP2_DETECT [FW-policy-based-route-PBR_RD-rule-1]quit [FW-policy-based-route-PBR_RD]quit # 将策略路由应用在Trust入接口 [FW]interface GigabitEthernet 1/0/0 [FW-GigabitEthernet1/0/0]policy-based-route PBR_FINANCE [FW-GigabitEthernet1/0/0]policy-based-route PBR_RD [FW-GigabitEthernet1/0/0]quit # 5.NAT配置 # 内网访问互联网 Easy-IP 出接口转换 [FW]nat-policy [FW-nat-policy]rule 1 permit source Finance destination any [FW-nat-policy-rule-1]nat easy-ip interface GigabitEthernet 1/0/1 [FW-nat-policy-rule-1]quit [FW-nat-policy]rule 2 permit source RD destination any [FW-nat-policy-rule-2]nat easy-ip interface GigabitEthernet 1/0/2 [FW-nat-policy-rule-2]quit [FW-nat-policy]quit # NAT Server 外网映射内网Web服务器公网访问内网Web # 电信侧公网用户通过14.0.0.1访问Web联通侧12.0.0.1访问Web [FW]nat server Web1 protocol tcp global 14.0.0.1 www inside 192.168.3.1 www [FW]nat server Web2 protocol tcp global 12.0.0.1 www inside 192.168.3.1 www # 6.认证配置财务部免认证研发匿名认证 [FW]authentication # 财务部免认证策略 [FW-authentication]policy Finance_Auth [FW-authentication-policy-Finance_Auth]rule permit source Finance authentication none [FW-authentication-policy-Finance_Auth]quit # 研发匿名认证 [FW-authentication]policy RD_Auth [FW-authentication-policy-RD_Auth]rule permit source RD authentication anonymous [FW-authentication-policy-RD_Auth]quit # 7.安全策略精细化策略 [FW]security-policy # 内网访问外网通用放行 [FW-security-policy]rule name Trust_To_Untrust [FW-security-policy-rule-Trust_To_Untrust]source-zone trust [FW-security-policy-rule-Trust_To_Untrust]destination-zone untrust [FW-security-policy-rule-Trust_To_Untrust]action permit [FW-security-policy-rule-Trust_To_Untrust]quit # 外网公网用户访问内网Web服务器放行 [FW-security-policy]rule name Untrust_Access_Web [FW-security-policy-rule-Untrust_Access_Web]source-zone untrust [FW-security-policy-rule-Untrust_Access_Web]destination-zone trust [FW-security-policy-rule-Untrust_Access_Web]destination-address WebServer [FW-security-policy-rule-Untrust_Access_Web]service http [FW-security-policy-rule-Untrust_Access_Web]action permit [FW-security-policy-rule-Untrust_Access_Web]quit # 默认拒绝所有其他流量 [FW-security-policy]rule name Default_Deny [FW-security-policy-rule-Default_Deny]action deny [FW-security-policy-rule-Default_Deny]quit [FW-security-policy]quit # 8.路由ISP路由默认路由 # ISP路由导入电信、联通网段USG内置ISP路由eNSP环境简化使用静态路由模拟 [FW]ip route-static 100.1.1.0 255.255.255.0 14.0.0.2 [FW]ip route-static 102.1.1.0 255.255.255.0 12.0.0.2 [FW]ip route-static 34.0.0.0 255.255.255.0 14.0.0.2 [FW]ip route-static 23.0.0.0 255.255.255.0 12.0.0.2 [FW]ip route-static 50.0.0.0 255.255.255.0 14.0.0.2 # 备份默认路由 [FW]ip route-static 0.0.0.0 0 14.0.0.2 preference 70 track healthcheck ISP1_DETECT [FW]ip route-static 0.0.0.0 0 12.0.0.2 preference 80 track healthcheck ISP2_DETECT3.3 R4电信 ISP 路由器R4sys [R4]sysname R4 [R4]interface GigabitEthernet0/0/0 [R4-GigabitEthernet0/0/0]ip address 14.0.0.2 255.255.255.0 [R4-GigabitEthernet0/0/0]quit [R4]interface GigabitEthernet0/0/3 [R4-GigabitEthernet0/0/3]ip address 100.1.1.1 255.255.255.0 [R4-GigabitEthernet0/0/3]quit [R4]interface GigabitEthernet0/0/2 [R4-GigabitEthernet0/0/2]ip address 34.0.0.1 255.255.255.0 [R4-GigabitEthernet0/0/2]quit # 回程路由指向防火墙 [R4]ip route-static 192.168.0.0 255.255.252.0 14.0.0.1 # OSPF配置公网互通 [R4]ospf 1 [R4-ospf-1]area 0 [R4-ospf-1-area-0.0.0.0]network 34.0.0.0 0.0.0.255 [R4-ospf-1-area-0.0.0.0]network 100.1.1.0 0.0.0.2553.4 R2联通 ISP 路由器R2system-view [R2]sysname R2 [R2]interface GigabitEthernet0/0/0 [R2-GigabitEthernet0/0/0]ip address 12.0.0.2 255.255.255.0 [R2-GigabitEthernet0/0/0]quit [R2]interface GigabitEthernet0/0/1 [R2-GigabitEthernet0/0/1]ip address 23.0.0.1 255.255.255.0 [R2-GigabitEthernet0/0/1]quit [R2]interface GigabitEthernet0/0/3 [R2-GigabitEthernet0/0/3]ip address 102.1.1.1 255.255.255.0 [R2-GigabitEthernet0/0/3]quit [R2]interface GigabitEthernet0/0/2 [R2-GigabitEthernet0/0/2]ip address 200.1.1.1 255.255.255.0 [R2-GigabitEthernet0/0/2]quit # 回程路由 [R2]ip route-static 192.168.0.0 255.255.252.0 12.0.0.1 # OSPF [R2]ospf 1 [R2-ospf-1]area 0 [R2-ospf-1-area-0.0.0.0]network 23.0.0.0 0.0.0.255 [R2-ospf-1-area-0.0.0.0]network 102.1.1.0 0.0.0.2553.5 R3互联网路由器R3system [R3]sysname R3 [R3]interface GigabitEthernet0/0/0 [R3-GigabitEthernet0/0/0]ip address 34.0.0.2 255.255.255.0 [R3-GigabitEthernet0/0/0]quit [R3]interface GigabitEthernet0/0/1 [R3-GigabitEthernet0/0/1]ip address 23.0.0.2 255.255.255.0 [R3-GigabitEthernet0/0/1]quit [R3]interface GigabitEthernet0/0/2 [R3-GigabitEthernet0/0/2]ip address 50.0.0.1 255.255.255.0 [R3-GigabitEthernet0/0/2]quit # OSPF [R3]ospf 1 [R3-ospf-1]area 0 [R3-ospf-1-area-0.0.0.0]network 34.0.0.0 0.0.0.255 [R3-ospf-1-area-0.0.0.0]network 23.0.0.0 0.0.0.255 [R3-ospf-1-area-0.0.0.0]network 50.0.0.0 0.0.0.255四、结果展示命令 预期4.1 基础连通防火墙display ip routing-table # 查看所有内外网路由两条ISP链路路由存在 display healthcheck status # IP-Link检测状态为Up链路正常 display policy-based-route # 策略路由规则生效 display nat server # NAT Server映射条目存在 display security-policy rule # 安全策略完整 display nat-policy rule # EasyIP策略生效4.2 预期内网访问外网 FTP 服务器Client1财务部追踪路由tracert 50.0.0.2下一跳走电信 14.0.0.2Client2研发部追踪路由tracert 50.0.0.2下一跳走联通 12.0.0.2断开电信链路财务部流量自动切换联通链路IP-Link 联动外网公网用户访问内网 Web-Server公网用户 1100.1.1.0访问14.0.0.1成功跳转 192.168.3.1 公网用户 2102.1.1.0访问12.0.0.1成功跳转 192.168.3.1NAT 验证内网主机访问互联网防火墙执行display nat session table源地址成功转换为接口公网地址认证策略验证财务部 Client1 上网无需认证研发 Client2 访问外网弹出匿名认证页面安全策略验证不存在规则的流量全部被防火墙拒绝允许流量正常转发