6、中小企业网络架构-防火墙基本配置

墨蓝 2023-06-26 03:26 26阅读 0赞

## 网络拓扑： ##

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70][]

## 配置思路： ##

配置下联接口；配置上联接口；配置端口区域；配置域间策略；配置静态路由；配置NAT

## 操作步骤： ##

## 一、防火墙 ##

1、配置下联接口

<usg>system-view
    [usg]sysname FW1
    [FW1]interface  GigabitEthernet  0/0/1
    [FW1-GigabitEthernet0/0/1]ip address 192.168.7.254 255.255.255.0
    [FW1-GigabitEthernet0/0/1]description connecct to SW1
    [FW1-GigabitEthernet0/0/1]quit
    
    [FW1]interface  GigabitEthernet  0/0/2
    [FW1-GigabitEthernet0/0/2]ip address 192.168.6.254 255.255.255.0
    [FW1-GigabitEthernet0/0/2]description connecct to SW2
    [FW1-GigabitEthernet0/0/2]quit

2、配置上联接口

[FW1]interface  GigabitEthernet  0/0/0
    [FW1-GigabitEthernet0/0/0]ip address 100.1.1.1 255.255.255.248
    [FW1-GigabitEthernet0/0/0]description connect to ISP1
    [FW1-GigabitEthernet0/0/0]quit

3、配置端口区域

trust区域
    [FW1]firewall zone  trust
    [FW1-zone-trust]set priority 85
    [FW1-zone-trust]add interface GigabitEthernet 0/0/1
    [FW1-zone-trust]add interface GigabitEthernet 0/0/2
    [FW1-zone-trust]quit
    
    untrust区域
    [FW1]firewall zone  untrust
    [FW1-zone-untrust]set priority 5
    [FW1-zone-untrust]add interface GigabitEthernet 0/0/0
    [FW1-zone-untrust]quit

4、配置域间策略（生产环境根据实际情况选择）

[FW1]firewall packet-filter default permit all

5、配置静态路由

[FW1]ip route-static 192.168.0.0 255.255.0.0 192.168.7.253
    [FW1]ip route-static 192.168.0.0 255.255.0.0 192.168.6.253
    [FW1]ip route-static 0.0.0.0 0.0.0.0 100.1.1.5

6、配置NAT

[FW1]nat-policy interzone trust  untrust  outbound
    [FW1-nat-policy-interzone-trust-untrust-outbound]policy 1
    [FW1-nat-policy-interzone-trust-untrust-outbound]action source-nat
    [FW1-nat-policy-interzone-trust-untrust-outbound]policy source 192.168.0.0 mask 16
    [FW1-nat-policy-interzone-trust-untrust-outbound]easy-ip GigabitEthernet0/0/0
    [FW1-nat-policy-interzone-trust-untrust-outbound-1]quit
    [FW1-nat-policy-interzone-trust-untrust-outbound]quit

## 二、客户端测试 ##

1、PC端口设置自动获取IP

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 1][]

2、相互ping测试

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 2][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 3][]

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 4][]

3、内网访问ISP，查看防火墙NAT转发记录

![watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 5][]

[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70]: https://img-blog.csdnimg.cn/20200103102915682.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 1]: https://img-blog.csdnimg.cn/20191230093840944.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 2]: https://img-blog.csdnimg.cn/20191230101015666.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 3]: https://img-blog.csdnimg.cn/20191230101103664.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 4]: https://img-blog.csdnimg.cn/20191230101152661.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv,size_16,color_FFFFFF,t_70
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv_size_16_color_FFFFFF_t_70 5]: https://img-blog.csdnimg.cn/20191230112723931.png?x-oss-process=image/watermark,type_ZmFuZ3poZW5naGVpdGk,shadow_10,text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3RsYWRhZ2lv,size_16,color_FFFFFF,t_70