防火墙安全策略

2025/2/12 9:15:09 来源：https://blog.csdn.net/z_ar_d/article/details/145359871 浏览: 次关键词：防火墙安全策略

文章目录

实验拓扑图
分析
子接口配置
- 子接口1.1
- 子接口1.2
- 检查
- - 发现ping不通
  - 排错
  - ping通
  - - PC1
    - PC2
    - PC3
安全策略
- 创建地址
- 创建时间
- 创建策略
测试
- PC1(办公区)
- 生产区
- - PC2
  - PC3(特例)

实验拓扑图

分析

FW左侧10.0.0.254是网关，右侧两个vlan需要配置子接口
针对要求写出对应的安全策略，要创建对应的时间段，写出源目安全区
最后一条特例需要将PC3单独从生产区拉出来写

子接口配置

在图形界面当中修改，新建接口需要定义接口名称，选择类型，选择安全区域，确定vlan，写好IP地址

子接口1.1

子接口1.2

检查

先配置好交换机vlan方便进行ping测试

发现ping不通

排错

ping通了PC3却不能ping通PC1的网关，说明问题出现在网关所在的子接口上

最后发现是因为没有在1.1子接口允许ping服务才导致的不通

[USG6000V1]int g 1/0/1.1
[USG6000V1-GigabitEthernet1/0/1.1]service-manage ping permit

ping通

PC1

PC2

PC3

安全策略

创建地址

直接命令行创建

[USG6000V1]ip address-set OFFICE type object 
[USG6000V1-object-address-set-OFFICE]address 192.168.1.0 mask 25

用图形界面创建

创建时间

[USG6000V1]time-range working-time
[USG6000V1-time-range-working-time]period-range 08:00:00 to 18:00:00 working-day

创建策略

针对要求二

[USG6000V1]security-policy
[USG6000V1-policy-security]rule name police_1
[USG6000V1-policy-security-rule-police_1]description OF_to_OA --描述规则
[USG6000V1-policy-security-rule-police_1]source-zone trust     --源区域
[USG6000V1-policy-security-rule-police_1]destination-zone dmz  --目标区域
[USG6000V1-policy-security-rule-police_1]source-address address-set OFFICE  --源地址
[USG6000V1-policy-security-rule-police_1]destination-address address-set OA  --目标地址
[USG6000V1-policy-security-rule-police_1]time-range working-time  --调用时间集
[USG6000V1-policy-security-rule-police_1]action permit --设置动作允许

针对要求三

[USG6000V1]security-policy
[USG6000V1-policy-security]rule name policy_3
[USG6000V1-policy-security-rule-policy_3]description OF_to_Web
[USG6000V1-policy-security-rule-policy_3]source-zone trust 
[USG6000V1-policy-security-rule-policy_3]destination-zone dmz
[USG6000V1-policy-security-rule-policy_3]source-address address-set OFFICE
[USG6000V1-policy-security-rule-policy_3]destination-address address-set Web
[USG6000V1-policy-security-rule-policy_3]action permit

针对要求四

[USG6000V1]security-policy
[USG6000V1-policy-security]rule name policy_3
[USG6000V1-policy-security-rule-policy_3]description Pr_to_OA
[USG6000V1-policy-security-rule-policy_3]source-zone trust 
[USG6000V1-policy-security-rule-policy_3]destination-zone dmz
[USG6000V1-policy-security-rule-policy_3]source-address address-set Produce
[USG6000V1-policy-security-rule-policy_3]destination-address address-set OA
[USG6000V1-policy-security-rule-policy_3]action permit

要求五