[eNSP]华为防火墙基础——Local、DMZ、Trust、Untrust互联

设备清单：1台PC、2台路由器（AR2220）、1台防火墙（USG6000V）

试验拓扑：实验目的：实现trust、untrust、local、dmz区域互通。PCindex.php/tags-653.html" >可以ping通R-1和R-2。

试验说明：PC在trust内、R-2在untrust内、R-1在dmz内。ip地址见拓扑。

配置开始：

R1的IP地址：

dis ip in brInterface                         IP Address/Mask      Physical   Protocol  GigabitEthernet0/0/0              172.16.0.1/24        up         up        GigabitEthernet0/0/1              unassigned           down       down      NULL0                             unassigned           up         up(s)    

R2的IP地址：

dis ip in brInterface                         IP Address/Mask      Physical   Protocol  GigabitEthernet0/0/0              10.0.0.2/24          up         up        GigabitEthernet0/0/1              unassigned           down       down      NULL0                             unassigned           up         up(s)  

FW的IP地址：  华为防火墙默认账号/密码：admin/Admin@123 登录后要修改密码。

dis ip in brInterface                         IP Address/Mask      Physical   Protocol  GigabitEthernet0/0/0              192.168.0.1/24       down       down      GigabitEthernet1/0/0              192.168.1.254/24     up         up        GigabitEthernet1/0/1              10.0.0.1/24          up         up        GigabitEthernet1/0/2              172.16.0.1/24        up         up             

接着 在FW中将接口划入对应的区域：

[FW]firewall zone trust [FW-zone-trust]add interface GigabitEthernet 1/0/0[FW]firewall zone untrust [FW-zone-untrust]add interface GigabitEthernet 1/0/1[FW]firewall zone dmz [FW-zone-dmz]add interface GigabitEthernet 1/0/2

配置防火墙

[FW]int g 1/0/0[FW-GigabitEthernet1/0/0]service-manage ping permit [FW-GigabitEthernet1/0/0]q[FW]security-policy [FW-policy-security]rule name ping[FW-policy-security-rule-ping]source-zone local untrust trust dmz [FW-policy-security-rule-ping]destination-zone local untrust trust dmz //本意是让防护墙的区域互通，所以不做其他策略！//工作中不建议这样配置！！！[FW-policy-security-rule-ping]service icmp[FW-policy-security-rule-ping]action permit [FW-policy-security-rule-ping]dis th# rule name ping  source-zone dmz  source-zone local  source-zone trust  source-zone untrust  destination-zone dmz  destination-zone local  destination-zone trust  destination-zone untrust  service icmp  action permit#return

测试防火墙直连：

[FW]ping 192.168.1.1  PING 192.168.1.1: 56  data bytes, press CTRL_C to break    Reply from 192.168.1.1: bytes=56 Sequence=1 ttl=128 time=32 ms    Reply from 192.168.1.1: bytes=56 Sequence=2 ttl=128 time=4 ms    Reply from 192.168.1.1: bytes=56 Sequence=3 ttl=128 time=4 ms    Reply from 192.168.1.1: bytes=56 Sequence=4 ttl=128 time=5 ms    Reply from 192.168.1.1: bytes=56 Sequence=5 ttl=128 time=4 ms  --- 192.168.1.1 ping statistics ---    5 packet(s) transmitted    5 packet(s) received    0.00% packet loss    round-trip min/avg/max = 4/9/32 ms[FW]ping 10.0.0.2  PING 10.0.0.2: 56  data bytes, press CTRL_C to break    Reply from 10.0.0.2: bytes=56 Sequence=1 ttl=255 time=51 ms    Reply from 10.0.0.2: bytes=56 Sequence=2 ttl=255 time=14 ms    Reply from 10.0.0.2: bytes=56 Sequence=3 ttl=255 time=15 ms    Reply from 10.0.0.2: bytes=56 Sequence=4 ttl=255 time=4 ms    Reply from 10.0.0.2: bytes=56 Sequence=5 ttl=255 time=6 ms  --- 10.0.0.2 ping statistics ---    5 packet(s) transmitted    5 packet(s) received    0.00% packet loss    round-trip min/avg/max = 4/18/51 ms[FW]ping 172.16.0.1  PING 172.16.0.1: 56  data bytes, press CTRL_C to break    Reply from 172.16.0.1: bytes=56 Sequence=1 ttl=255 time=47 ms    Reply from 172.16.0.1: bytes=56 Sequence=2 ttl=255 time=7 ms    Reply from 172.16.0.1: bytes=56 Sequence=3 ttl=255 time=8 ms    Reply from 172.16.0.1: bytes=56 Sequence=4 ttl=255 time=9 ms    Reply from 172.16.0.1: bytes=56 Sequence=5 ttl=255 time=12 ms  --- 172.16.0.1 ping statistics ---    5 packet(s) transmitted    5 packet(s) received    0.00% packet loss    round-trip min/avg/max = 7/16/47 ms

接着配置OSPF和OSPF防火墙策略：

[R1]ospf 1 router-id  1.1.1.1[R1-ospf-1]area 0[R1-ospf-1-area-0.0.0.0]network 172.16.0.1 0.0.0.0

[R2]ospf 1 router-id 2.2.2.2 [R2-ospf-1]area 0[R2-ospf-1-area-0.0.0.0]network 10.0.0.2 0.0.0.0

[FW]ospf 1 router-id 3.3.3.3[FW-ospf-1]area 0[FW-ospf-1-area-0.0.0.0]network 192.168.1.254 0.0.0.0[FW-ospf-1-area-0.0.0.0]network 10.0.0.1 0.0.0.0[FW-ospf-1-area-0.0.0.0]network 172.16.0.254 0.0.0.0

查看邻居是否建立：

[FW-ospf-1-area-0.0.0.0]dis ospf peer brief  OSPF Process 1 with Router ID 3.3.3.3  Peer Statistic Information ---------------------------------------------------------------------------- Area Id          Interface                        Neighbor id      State     0.0.0.0          GigabitEthernet1/0/1             2.2.2.2          Full         0.0.0.0          GigabitEthernet1/0/2             1.1.1.1          Full         ----------------------------------------------------------------------------

接下来配置防火墙的OSPF策略：

[FW]security-policy [FW-policy-security]rule name OSPF[FW-policy-security-rule-OSPF]service ospf [FW-policy-security-rule-OSPF]source-zone local dmz untrust [FW-policy-security-rule-OSPF]destination-zone dmz local untrust [FW-policy-security-rule-OSPF]action permit [FW-policy-security-rule-OSPF]dis th# rule name OSPF  source-zone dmz  source-zone local  source-zone untrust  destination-zone dmz  destination-zone local  destination-zone untrust  service ospf  action permit#return

最后测试PC是否能ping通路由器：

PC>ping 10.0.0.2Ping 10.0.0.2: 32 data bytes, Press Ctrl_C to breakFrom 10.0.0.2: bytes=32 seq=1 ttl=254 time=31 msFrom 10.0.0.2: bytes=32 seq=2 ttl=254 time=16 ms--- 10.0.0.2 ping statistics ---  2 packet(s) transmitted  2 packet(s) received  0.00% packet loss  round-trip min/avg/max = 16/23/31 msPC>ping 172.16.0.1Ping 172.16.0.1: 32 data bytes, Press Ctrl_C to breakFrom 172.16.0.1: bytes=32 seq=1 ttl=254 time=16 msFrom 172.16.0.1: bytes=32 seq=2 ttl=254 time=15 msFrom 172.16.0.1: bytes=32 seq=3 ttl=254 time=16 ms--- 172.16.0.1 ping statistics ---  5 packet(s) transmitted  5 packet(s) received  0.00% packet loss  round-trip min/avg/max = 0/12/16 msPC>

试验结束，仅以此来记录本人HCIE-Datacom备考中涉及的知识点，不用作任何教学。突发奇想，想做一个自己的博客，就这样开始了，之前的试验会慢慢补齐。请理性观看，如有错误希望指正！