01-虚拟系统配置

拓扑：

[r1]interface GigabitEthernet 0/0/0

[r1-GigabitEthernet0/0/0]ip address 12.0.0.2 24

[r1]interface LoopBack 0

[r1-LoopBack0]ip address 100.1.1.1 24

fw：

[fw]interface GigabitEthernet 0/0/0

[fw-GigabitEthernet0/0/0]service-manage all permit

[fw]interface GigabitEthernet 1/0/0

[fw-GigabitEthernet1/0/0]ip address 12.0.0.1 24

需求一

安全策略要求：

1、只存在一个公网IP地址，公司内网所有部门都需要借用同一个接口访问外网

2、财务部禁止访问Internet，研发部门只有部分员工可以访问Internet，行政部门全部可以访问互联网

3、为三个部门的虚拟系统分配相同的资源类

启动虚拟系统

[FW]vsys enable

配置资源类

1：

[fw-resource-class-1]resource-item-limit session reserved-number 500 maximum 1000

[fw-resource-class-1]resource-item-limit bandwidth 2 outbound

[fw-resource-class-1]resource-item-limit policy reserved-number 200

[fw-resource-class-1]resource-item-limit user reserved-number 100

[fw]display resource global-resource

2：

同1

3：

同1

创建虚拟系统

[fw]vsys name vsysa

[fw-vsys-vsysa]assign resource-class 1

[fw-vsys-vsysa]assign interface GigabitEthernet 1/0/1

[fw]vsys name vsysb

[fw-vsys-vsysa]assign resource-class 2

[fw-vsys-vsysa]assign interface GigabitEthernet 1/0/2

[fw]vsys name vsysc

[fw-vsys-vsysa]assign resource-class 3

[fw-vsys-vsysa]assign interface GigabitEthernet 1/0/3

管理员配置

vsysa :

[FW]switch vsys vsysa

[FW-vsysa]aaa

[FW-vsysa-aaa]manager-user admin@@vsysa

[FW-vsysa-aaa-manager-user-admin@@vsysa]password

Confirm Password:admin@123

[FW-vsysa-aaa-manager-user-admin@@vsysa]level 15

[FW-vsysa-aaa-manager-user-admin@@vsysa]service-type web telnet ssh

[FW-vsysa-aaa-manager-user-admin@@vsysa]quit

[FW-vsysa-aaa]bind manager-user admin@@vsysa role system-admin

vsysb:

[fw]switch vsys vsysb

system-view

[fw-vsysb]aaa

[fw-vsysb-aaa]manager-user admin@@vsysb

[fw-vsysb-aaa-manager-user-admin@@vsysb]password

Enter Password:admin@123

Confirm Password:admin@123

[fw-vsysb-aaa-manager-user-admin@@vsysb]level 15

[fw-vsysb-aaa-manager-user-admin@@vsysb]service-type web ssh telnet

[fw-vsysc-aaa-manager-user-admin@@vsysb]q

[fw-vsysb-aaa]bind manager-user admin@@vsysb role system-admin

vsysc:

[fw]switch vsys vsysc

system-view

[fw-vsysc]aaa

[fw-vsysc-aaa]manager-user admin@@vsysc

[fw-vsysc-aaa-manager-user-admin@@vsysc]password

Enter Password:admin@123

Confirm Password:admin@123

[fw-vsysc-aaa-manager-user-admin@@vsysc]level 15

[fw-vsysc-aaa-manager-user-admin@@vsysc]service-type web ssh telnet

[fw-vsysc-aaa-manager-user-admin@@vsysc]q

[fw-vsysc-aaa]bind manager-user admin@@vsysc role system-admin

web：

配置根虚拟接口ip

fw

[fw]interface Virtual-if0

[fw-Virtual-if0]ip address 172.16.0.1 24

区域划分

[fw]firewall zone trust

[fw-zone-trust]add interface Virtual-if 0

[fw]firewall zone untrust

[fw-zone-untrust]add interface GigabitEthernet 1/0/0

静态路由：

安全策略

[fw]security-policy

[fw-policy-security]rule name t_to_internet

[fw-policy-security-rule-t_to_internet]source-zone trust

[fw-policy-security-rule-t_to_internet]destination-zone untrust

[fw-policy-security-rule-t_to_internet]action permit

nat策略

[fw]nat-policy

[fw-policy-nat]rule name 1

[fw-policy-nat-rule-1]source-zone trust

[fw-policy-nat-rule-1]destination-zone untrust

[fw-policy-nat-rule-1]source-address 10.3.0.0 16

[fw-policy-nat-rule-1]action source-nat easy-ip

接口，缺省路由和区域划分：

vsysa：

接口ip：

[fw]switch vsys vsysa

system-view

[fw-vsysa]interface GigabitEthernet 1/0/1

[fw-vsysa-GigabitEthernet1/0/1]ip address 10.3.0.254 24

[fw-vsysa]interface Virtual-if 1

[fw-vsysa-Virtual-if1]ip address 172.16.1.1 24

区域划分：

[fw-vsysa]firewall zone trust

[fw-vsysa-zone-trust]add interface GigabitEthernet 1/0/1

[fw-vsysa]firewall zone untrust

[fw-vsysa-zone-untrust]add interface Virtual-if 1

缺省路由；

[fw-vsysa]ip route-static 0.0.0.0 0 public

地址组：

[fw-vsysa]ip address-set 1 type object

[fw-vsysa-object-address-set-1]address range 10.3.0.1 10.3.0.10

安全策略：

[fw-vsysa]security-policy

[fw-vsysa-policy-security]rule name 1

[fw-vsysa-policy-security-rule-1]source-zone trust

[fw-vsysa-policy-security-rule-1]destination-zone untrust

[fw-vsysa-policy-security-rule-1]source-address address-set 1

[fw-vsysa-policy-security-rule-1]action permit

vsysb：

[fw]switch vsys vsysb

system-view

[fw-vsysb]interface GigabitEthernet 1/0/2

[fw-vsysb-GigabitEthernet1/0/2]ip address 10.3.1.254 24

[fw-vsysb]interface Virtual-if 2

[fw-vsysb-Virtual-if2]ip address 172.16.1.1 24

[fw-vsysb]firewall zone trust

[fw-vsysb-zone-trust]add interface GigabitEthernet 1/0/2

[fw-vsysb]firewall zone untrust

[fw-vsysb-zone-untrust]add interface Virtual-if 2

[fw-vsysb]ip route-static 0.0.0.0 0 public

vsysc：

[fw]switch vsys vsysc

system-view

[fw-vsysc]interface GigabitEthernet 1/0/3

[fw-vsysc-GigabitEthernet1/0/3]ip address 10.3.2.254 24

[fw-vsysc]interface Virtual-if 3

[fw-vsysc-Virtual-if3]ip address 172.16.2.1 24

[fw-vsysc]firewall zone trust

[fw-vsysc-zone-trust]add interface GigabitEthernet 1/0/3

[fw-vsysc]firewall zone untrust

[fw-vsysc-zone-untrust]add interface Virtual-if 3

[fw-vsysc]ip route-static 0.0.0.0 0 public

[fw-vsysc]security-policy

[fw-vsysc-policy-security]rule name 3

[fw-vsysc-policy-security-rule-3]source-zone trust

[fw-vsysc-policy-security-rule-3]destination-zone untrust

[fw-vsysc-policy-security-rule-3]source-address 10.3.2.0 24

[fw-vsysc-policy-security-rule-3]action permit

测试：

pc1ip0.1访问100.1.1.1

将0.1改为0.11

pc2ping100.1.1.1

pc3ping100.1.1.1

pc1 ping pc2

a:

[fw-vsysa-policy-security]rule name a_to_b

[fw-vsysa-policy-security-rule-a_to_b]source-zone trust

[fw-vsysa-policy-security-rule-a_to_b]destination-zone untrust

[fw-vsysa-policy-security-rule-a_to_b]source-address 10.3.0.0 24

[fw-vsysa-policy-security-rule-a_to_b]destination-address 10.3.1.0 24

[fw-vsysa-policy-security-rule-a_to_b]action permit

[fw-vsysa-policy-security]rule move a_to_b before 1

b:

[fw-vsysb-policy-security]rule name 2

[fw-vsysb-policy-security-rule-2]source-zone untrust

[fw-vsysb-policy-security-rule-2]destination-zone trust

[fw-vsysb-policy-security-rule-2]source-address 10.3.0.0 24

[fw-vsysb-policy-security-rule-2]destination-address 10.3.1.0 24

[fw-vsysb-policy-security-rule-2]action permit

public：

[fw]ip route-static 10.3.1.0 24 vpn-instance vsysb

[fw]ip route-static vpn-instance vsysa 10.3.1.0 24 vpn-instance vsysb

a_to_c

根：

[fw]ip route-static vpn-instance vsysa 10.3.2.0 24 vpn-instance vsysc

a:

[fw-policy-security]rule name a_to_c

[fw-policy-security-rule-a_to_c]source-zone trust

[fw-policy-security-rule-a_to_c]destination-zone untrust

[fw-policy-security-rule-a_to_c]source-address 10.3.0.0 24

[fw-policy-security-rule-a_to_c]destination-address 10.3.2.0 24

[fw-policy-security-rule-a_to_c]action permit

c:

[fw-vsysc-policy-security]rule name 4

[fw-vsysc-policy-security-rule-4]source-zone untrust

[fw-vsysc-policy-security-rule-4]destination-zone trust

[fw-vsysc-policy-security-rule-4]source-address 10.3.0.0 24

[fw-vsysc-policy-security-rule-4]destination-address 10.3.2.0 24

[fw-vsysc-policy-security-rule-4]action permit

:15

b_to_c

根：

[fw]ip route-static vpn-instance vsysb 10.3.2.0 24 vpn-instance vsysc

b:

[fw-vsysb-policy-security]rule name 3

[fw-vsysb-policy-security-rule-3]source-zone trust

[fw-vsysb-policy-security-rule-3]destination-zone untrust

[fw-vsysb-policy-security-rule-3]source-address 10.3.1.0 24

[fw-vsysb-policy-security-rule-3]destination-address 10.3.2.0 24

[fw-vsysb-policy-security-rule-3]action permit

c:

[fw-vsysc-policy-security]rule name 5

[fw-vsysc-policy-security-rule-5]source-zone untrust

[fw-vsysc-policy-security-rule-5]destination-zone trust

[fw-vsysc-policy-security-rule-5]source-address 10.3.1.0 24

[fw-vsysc-policy-security-rule-5]destination-address 10.3.2.0 24

[fw-vsysc-policy-security-rule-5]action permit

：

b_to_a

根：

[fw]ip route-static vpn-instance vsysb 10.3.0.0 24 vpn-instance vsysa

a:

[fw-vsysa-policy-security]rule name b_to_a

[fw-vsysa-policy-security-rule-b_to_a]source-zone untrust

[fw-vsysa-policy-security-rule-b_to_a]destination-zone trust

[fw-vsysa-policy-security-rule-b_to_a]source-address 10.3.1.0 24

[fw-vsysa-policy-security-rule-b_to_a]destination-address 10.3.0.0 24

[fw-vsysa-policy-security-rule-b_to_a]action permit

b:

[fw-vsysb-policy-security]rule name 4

[fw-vsysb-policy-security-rule-4]source-zone trust

[fw-vsysb-policy-security-rule-4]destination-zone untrust

[fw-vsysb-policy-security-rule-4]source-address 10.3.1.0 24

[fw-vsysb-policy-security-rule-4]destination-address 10.3.0.0 24

[fw-vsysb-policy-security-rule-4]action permit

c_to_a

根：

[fw]ip route-static vpn-instance vsysc 10.3.0.0 24 vpn-instance vsysa

a:

[fw-vsysa-policy-security]rule name c_to_a

[fw-vsysa-policy-security-rule-c_to_a]source-zone untrust

[fw-vsysa-policy-security-rule-c_to_a]destination-zone trust

[fw-vsysa-policy-security-rule-c_to_a]source-address 10.3.2.0 24

[fw-vsysa-policy-security-rule-c_to_a]destination-address 10.3.0.0 24

[fw-vsysa-policy-security-rule-c_to_a]action permit

c:已经有t_unt的安全策略

c_to_b

根：

[fw]ip route-static vpn-instance vsysc 10.3.1.0 24 vpn-instance vsysb

b:

[fw-vsysb-policy-security]rule name 5

[fw-vsysb-policy-security-rule-5]source-zone untrust

[fw-vsysb-policy-security-rule-5]destination-zone trust

[fw-vsysb-policy-security-rule-5]source-address 10.3.2.0 24

[fw-vsysb-policy-security-rule-5]destination-address 10.3.1.0 24

[fw-vsysb-policy-security-rule-5]action permit