防火墙虚拟系统

一.实验拓扑

二.实验需求

1 、只存在一个公网 IP 地址，公司内网所有部门都需要借用同一个接口访问外网

2 、财务部禁止访问 Internet ，研发部门只有部分员工可以访问 Internet ，行政部门全部可以访问互联网

3 、为三个部门的虚拟系统分配相同的资源类

4、内部研发部能够访问财务部

5、由根系统管理员创建虚拟系统 abc 并且为其分配资源以及配置管理员

6、根系统管理员为内网用户创建安全策略和 NAT 策略

7、由 abc 三个虚拟系统各自完成 IP 、路由、安全策略配置

三.实验配置

开启虚拟系统并创建资源类

 其中r1，r2，r3内容一致

创建虚拟系统

 vsysb和vsysc创建方式与vsysa一致

创建管理员

[FW]switch vsys vsysa
[FW-vsysa]aaa
[FW-vsysa-aaa]manager-user admin@@vsysa 
[FW-vsysa-aaa-manager-user-admin@@vsysa]password 
Enter Password:admin@123
Confirm Password:admin@123
[FW-vsysa-aaa-manager-user-admin@@vsysa]level 15 
[FW-vsysa-aaa-manager-user-admin@@vsysa]service-type web telnet ssh 
[FW-vsysa-aaa-manager-user-admin@@vsysa]quit
[FW-vsysa-aaa]bind manager-user admin@@vsysa role system-admin

vsysb和vsysc管理员创建方式与a相同

配置FW路由器基本配置

[FW1]dis current-configuration interface
interface GigabitEthernet1/0/0
 undo shutdown
 ip address 11.0.0.1 255.255.255.0
#
interface GigabitEthernet1/0/1
 undo shutdown
 ip binding vpn-instance vsysa
 ip address 10.3.0.254 255.255.255.0
#
interface GigabitEthernet1/0/2
 undo shutdown
 ip binding vpn-instance vsysb
 ip address 10.3.1.254 255.255.255.0
#
interface GigabitEthernet1/0/3
 undo shutdown
 ip binding vpn-instance vsysc
 ip address 10.3.2.254 255.255.255.0
#
interface Virtual-if0
 ip address 172.16.0.1 255.255.255.0
#
interface Virtual-if1
 ip address 172.16.1.1 255.255.255.0
#
interface Virtual-if2
 ip address 172.16.2.1 255.255.255.0
#
interface Virtual-if3
 ip address 172.16.3.1 255.255.255.0
#
interface GigabitEthernet1/0/1
 undo shutdown
 ip binding vpn-instance vsysa
 ip address 10.3.0.254 255.255.255.0
#
interface Virtual-if1
 ip address 172.16.1.1 255.255.255.0
#
return
#
interface GigabitEthernet1/0/2
 undo shutdown
 ip binding vpn-instance vsysb
 ip address 10.3.1.254 255.255.255.0
#
interface Virtual-if2
 ip address 172.16.2.1 255.255.255.0
#
return
#
interface GigabitEthernet1/0/3
 undo shutdown
 ip binding vpn-instance vsysc
 ip address 10.3.2.254 255.255.255.0
#
interface Virtual-if3
 ip address 172.16.3.1 255.255.255.0
#
return

[r1]dis current-configuration interface
interface GigabitEthernet0/0/0
 ip address 11.0.0.2 255.255.255.0
interface LoopBack0
 ip address 100.1.1.1 255.255.255.0

public区域安全策略及nat策略

[FW1-policy-security-rule-to_internet]dis this
2025-03-04 12:29:40.900 
#
 rule name to_internet
  source-zone trust
  destination-zone untrust
  action permit
#
return
[FW1]nat-policy
[FW1-policy-nat]
[FW1-policy-nat]
[FW1-policy-nat]dis this
2025-03-04 12:30:09.980 
#
nat-policy
 rule name a
  source-zone trust
  destination-zone untrust
  source-address 10.3.0.0 mask 255.255.0.0
  action source-nat easy-ip
#
return
[FW1]ip route-static 0.0.0.0 0 11.0.0.2 
[FW1]dis zone 
2025-03-04 12:37:35.800 
local
 priority is 100
 interface of the zone is (0):
#
trust
 priority is 85
 interface of the zone is (2):
    GigabitEthernet0/0/0
    Virtual-if0
#
untrust
 priority is 5
 interface of the zone is (1):
    GigabitEthernet1/0/0
#
dmz
 priority is 50
 interface of the zone is (0):
#
vpn-instance vsysa local
 priority is 100
 interface of the zone is (0):
#
vpn-instance vsysa trust
 priority is 85
 interface of the zone is (1):
    GigabitEthernet1/0/1
#
vpn-instance vsysa untrust
 priority is 5
 interface of the zone is (1):
    Virtual-if1
#
vpn-instance vsysa dmz
 priority is 50
 interface of the zone is (0):
#
vpn-instance vsysb local
 priority is 100
 interface of the zone is (0):
#
vpn-instance vsysb trust
 priority is 85
 interface of the zone is (1):
    GigabitEthernet1/0/2
#
vpn-instance vsysb untrust
 priority is 5
 interface of the zone is (1):
    Virtual-if2
#
vpn-instance vsysb dmz
 priority is 50
 interface of the zone is (0):
#
vpn-instance vsysc local
 priority is 100
 interface of the zone is (0):
#
vpn-instance vsysc trust
 priority is 85
 interface of the zone is (1):
    GigabitEthernet1/0/3
#
vpn-instance vsysc untrust
 priority is 5
 interface of the zone is (1):
    Virtual-if3
#
vpn-instance vsysc dmz
 priority is 50
 interface of the zone is (0):
#

vsysa区域安全策略及缺省路由

[FW1-vsysa-policy-security]dis this
2025-03-04 12:31:46.930 
#
security-policy
 rule name to_vsysb
  source-zone trust
  destination-zone untrust
  source-address 10.3.0.0 mask 255.255.255.0
  destination-address 10.3.1.0 mask 255.255.255.0
  action permit
 rule name to_internet
  source-zone trust
  destination-zone untrust
  source-address address-set aa
  action permit
#
return
[FW1-vsysa]ip route-static 0.0.0.0 0 public 

vsysb区域安全策略及缺省路由

[FW1-vsysb]security-policy 
[FW1-vsysb-policy-security]dis this
2025-03-04 12:34:14.740 
#
security-policy
 rule name to_vsysa
  source-zone untrust
  destination-zone trust
  source-address 10.3.0.0 mask 255.255.255.0
  destination-address 10.3.1.0 mask 255.255.255.0
  action permit
#
return
[FW1-vsysb]ip route-static 0.0.0.0 0 public 

vsysc区域安全策略及缺省路由

[FW1-vsysc]security-policy 
[FW1-vsysc-policy-security]dis this
2025-03-04 12:35:21.580 
#
security-policy
 rule name to_internet
  source-zone trust
  destination-zone untrust
  source-address 10.3.2.0 mask 255.255.255.0
  action permit
#
return
[FW1-vsysc]ip route-static 0.0.0.0 0 public 

四.实验验证

pc1研发部能够访问外网 

pc2财务部不能访问

 pc3行政部可以访问

pc1研发部可以访问pc2财务部