当前位置：首页 > wzjs >正文

建设西安网站高端网站建设 n磐石网络

wzjs 2025/9/22 20:38:48

建设西安网站,高端网站建设 n磐石网络,成都专门做网站的公司,网络营销的推广系统一.实验拓扑二.实验需求 1 、只存在一个公网 IP 地址，公司内网所有部门都需要借用同一个接口访问外网 2 、财务部禁止访问 Internet ，研发部门只有部分员工可以访问 Internet ，行政部门全部可以访问互联网 3 、为三个部门的虚拟系统分配相…

一.实验拓扑

二.实验需求

1 、只存在一个公网 IP 地址，公司内网所有部门都需要借用同一个接口访问外网

2 、财务部禁止访问 Internet ，研发部门只有部分员工可以访问 Internet ，行政部门全部可以访问互联网

3 、为三个部门的虚拟系统分配相同的资源类

4、内部研发部能够访问财务部

5、由根系统管理员创建虚拟系统 abc 并且为其分配资源以及配置管理员

6、根系统管理员为内网用户创建安全策略和 NAT 策略

7、由 abc 三个虚拟系统各自完成 IP 、路由、安全策略配置

三.实验配置

开启虚拟系统并创建资源类

其中r1，r2，r3内容一致

创建虚拟系统

vsysb和vsysc创建方式与vsysa一致

创建管理员

[FW]switch vsys vsysa
[FW-vsysa]aaa
[FW-vsysa-aaa]manager-user admin@@vsysa 
[FW-vsysa-aaa-manager-user-admin@@vsysa]password 
Enter Password:admin@123
Confirm Password:admin@123
[FW-vsysa-aaa-manager-user-admin@@vsysa]level 15 
[FW-vsysa-aaa-manager-user-admin@@vsysa]service-type web telnet ssh 
[FW-vsysa-aaa-manager-user-admin@@vsysa]quit
[FW-vsysa-aaa]bind manager-user admin@@vsysa role system-admin

vsysb和vsysc管理员创建方式与a相同

配置FW路由器基本配置

[FW1]dis current-configuration interface
interface GigabitEthernet1/0/0undo shutdownip address 11.0.0.1 255.255.255.0
#
interface GigabitEthernet1/0/1undo shutdownip binding vpn-instance vsysaip address 10.3.0.254 255.255.255.0
#
interface GigabitEthernet1/0/2undo shutdownip binding vpn-instance vsysbip address 10.3.1.254 255.255.255.0
#
interface GigabitEthernet1/0/3undo shutdownip binding vpn-instance vsyscip address 10.3.2.254 255.255.255.0
#
interface Virtual-if0ip address 172.16.0.1 255.255.255.0
#
interface Virtual-if1ip address 172.16.1.1 255.255.255.0
#
interface Virtual-if2ip address 172.16.2.1 255.255.255.0
#
interface Virtual-if3ip address 172.16.3.1 255.255.255.0
#
interface GigabitEthernet1/0/1undo shutdownip binding vpn-instance vsysaip address 10.3.0.254 255.255.255.0
#
interface Virtual-if1ip address 172.16.1.1 255.255.255.0
#
return
#
interface GigabitEthernet1/0/2undo shutdownip binding vpn-instance vsysbip address 10.3.1.254 255.255.255.0
#
interface Virtual-if2ip address 172.16.2.1 255.255.255.0
#
return
#
interface GigabitEthernet1/0/3undo shutdownip binding vpn-instance vsyscip address 10.3.2.254 255.255.255.0
#
interface Virtual-if3ip address 172.16.3.1 255.255.255.0
#
return

[r1]dis current-configuration interface
interface GigabitEthernet0/0/0ip address 11.0.0.2 255.255.255.0
interface LoopBack0ip address 100.1.1.1 255.255.255.0

public区域安全策略及nat策略

[FW1-policy-security-rule-to_internet]dis this
2025-03-04 12:29:40.900 
#rule name to_internetsource-zone trustdestination-zone untrustaction permit
#
return
[FW1]nat-policy
[FW1-policy-nat]
[FW1-policy-nat]
[FW1-policy-nat]dis this
2025-03-04 12:30:09.980 
#
nat-policyrule name asource-zone trustdestination-zone untrustsource-address 10.3.0.0 mask 255.255.0.0action source-nat easy-ip
#
return
[FW1]ip route-static 0.0.0.0 0 11.0.0.2 
[FW1]dis zone 
2025-03-04 12:37:35.800 
localpriority is 100interface of the zone is (0):
#
trustpriority is 85interface of the zone is (2):GigabitEthernet0/0/0Virtual-if0
#
untrustpriority is 5interface of the zone is (1):GigabitEthernet1/0/0
#
dmzpriority is 50interface of the zone is (0):
#
vpn-instance vsysa localpriority is 100interface of the zone is (0):
#
vpn-instance vsysa trustpriority is 85interface of the zone is (1):GigabitEthernet1/0/1
#
vpn-instance vsysa untrustpriority is 5interface of the zone is (1):Virtual-if1
#
vpn-instance vsysa dmzpriority is 50interface of the zone is (0):
#
vpn-instance vsysb localpriority is 100interface of the zone is (0):
#
vpn-instance vsysb trustpriority is 85interface of the zone is (1):GigabitEthernet1/0/2
#
vpn-instance vsysb untrustpriority is 5interface of the zone is (1):Virtual-if2
#
vpn-instance vsysb dmzpriority is 50interface of the zone is (0):
#
vpn-instance vsysc localpriority is 100interface of the zone is (0):
#
vpn-instance vsysc trustpriority is 85interface of the zone is (1):GigabitEthernet1/0/3
#
vpn-instance vsysc untrustpriority is 5interface of the zone is (1):Virtual-if3
#
vpn-instance vsysc dmzpriority is 50interface of the zone is (0):
#

vsysa区域安全策略及缺省路由

[FW1-vsysa-policy-security]dis this
2025-03-04 12:31:46.930 
#
security-policyrule name to_vsysbsource-zone trustdestination-zone untrustsource-address 10.3.0.0 mask 255.255.255.0destination-address 10.3.1.0 mask 255.255.255.0action permitrule name to_internetsource-zone trustdestination-zone untrustsource-address address-set aaaction permit
#
return
[FW1-vsysa]ip route-static 0.0.0.0 0 public

vsysb区域安全策略及缺省路由

[FW1-vsysb]security-policy 
[FW1-vsysb-policy-security]dis this
2025-03-04 12:34:14.740 
#
security-policyrule name to_vsysasource-zone untrustdestination-zone trustsource-address 10.3.0.0 mask 255.255.255.0destination-address 10.3.1.0 mask 255.255.255.0action permit
#
return
[FW1-vsysb]ip route-static 0.0.0.0 0 public

vsysc区域安全策略及缺省路由

[FW1-vsysc]security-policy 
[FW1-vsysc-policy-security]dis this
2025-03-04 12:35:21.580 
#
security-policyrule name to_internetsource-zone trustdestination-zone untrustsource-address 10.3.2.0 mask 255.255.255.0action permit
#
return
[FW1-vsysc]ip route-static 0.0.0.0 0 public