華為防火墻綜合實驗
設計需求：
1：局域網需求
（1）vlan的設計
vlan10，教務部，網絡地址為172.16.10.0/24
vlan20，後勤部，網絡地址為172.16.20.0/24
vlan15，財務部，網絡地址為172.16.15.0/24
（2）資源訪問
要求教務部和後勤部可以上網，並且可以訪問DMZ區域的FTP和WEB服務
財務部不能和其他vlan通信，也不能上網，但是能夠訪問DMZ區域的FTP和WEB服務
2：防火墻安全區域的設計
防火墻接口G1/0/0加入到trust區域
防火墻接口G1/0/4和G1/0/5加入DMZ區域
G1/0/1加入untrust區域
3：互聯網用戶訪問內網服務器的設計
要求在互聯網上能夠訪問DMZ區域中的WEB服務，但不能訪問它的FTP服務
配置步驟：
1：內網二層交換機配置
<Huawei>undo terminal monitor
<Huawei>sys
[Huawei]sysname S2
[S2]
[S2]vlan batch 10 15 20
[S2]
[S2]int e0/0/10
[S2-Ethernet0/0/10]port link-type hybrid
[S2-Ethernet0/0/10]port hybrid pvid vlan 10
[S2-Ethernet0/0/10]port hybrid untagged vlan 10 20
[S2-Ethernet0/0/10]quit
[S2]
[S2]int g0/0/20
[S2-Ethernet0/0/20]port link-type hybrid
[S2-Ethernet0/0/20]port hybrid untagged vlan 10 20
[S2-Ethernet0/0/20]quit
[S2]
[S2]int g0/0/15
[S2-Ethernet0/0/15]port link-type hybrid
[S2-Ethernet0/0/15]port hybrid pvid vlan 15
[S2-Ethernet0/0/15]port hybrid untagged vlan 1 15
[S2-Ethernet0/0/15]quit
[S2]
[S2]int g0/0/1
[S2-Ethernet0/0/1]port link-type hybrid
[S2-Ethernet0/0/1]port hybrid untagged vlan 1 10 15 20
[S2-Ethernet0/0/1]quit
[S2]
2：運營商路由器的IP地址的設置
<Huawei>undo terminal monitor
<Huawei>sys
[Huawei]sysname R1
[R1]int g0/0/0
[R1-GigabitEthernet0/0/0]ip add 201.1.1.2 30
[R1-GigabitEthernet0/0/0]quit
[R1]
[R1]int g0/0/1
[R1-GigabitEthernet0/0/1]ip add 101.1.1.254 24
[R1-GigabitEthernet0/0/1]quit
[R1]
[R1]int g0/0/2
[R1-GigabitEthernet0/0/2]ip add 100.0.0.254 24
[R1-GigabitEthernet0/0/2]quit
[R1]
2：防火墻設置
（1）Ip地址的設置
<USG6000V1>undo terminal monitor
<USG6000V1>sys
[USG6000V1]int g1/0/0
[USG6000V1-GigabitEthernet1/0/0]ip add 172.16.1.1 16
[USG6000V1]int g1/0/1
[USG6000V1-GigabitEthernet1/0/1]ip add 201.1.1.1 30
[USG6000V1-GigabitEthernet1/0/1]quit
[USG6000V1]
[USG6000V1]int g1/0/4
[USG6000V1-GigabitEthernet1/0/4]ip add 10.1.1.1 24
[USG6000V1-GigabitEthernet1/0/4]quit
[USG6000V1]
（2）安全區域的設置
[USG6000V1]firewall zone trust
[USG6000V1-zone-trust]add int g1/0/0
[USG6000V1-zone-trust]quit
[USG6000V1]
[USG6000V1]firewall zone dmz
[USG6000V1-zone-dmz]add int g1/0/4
[USG6000V1-zone-dmz]quit
[USG6000V1]
[USG6000V1]firewall zone name untrust
[USG6000V1-zone-jiaoyu]add int g1/0/1
[USG6000V1-zone-jiaoyu]quit
[USG6000V1]
（3）設置安全策略，使內網用戶可以訪問dmz區域的FTP服務和WEB服務
[USG6000V1]security-policy
[USG6000V1-policy-security]rule name sec_1
[USG6000V1-policy-security-rule-sec_1]source-zone trust
[USG6000V1-policy-security-rule-sec_1]destination-zone dmz
[USG6000V1-policy-security-rule-sec_1]service ftp
[USG6000V1-policy-security-rule-sec_1]service http
[USG6000V1-policy-security-rule-sec_1]action permit
[USG6000V1-policy-security-rule-sec_1]quit
[USG6000V1-policy-security]quit
[USG6000V1]
（4）設置安全策略，使內網用戶可以訪問互聯網，並且阻止財務部上網
[USG6000V1]security-policy
[USG6000V1-policy-security]rule name sec_2
[USG6000V1-policy-security-rule-sec_3]source-zone trust
[USG6000V1-policy-security-rule-sec_2]source-address 172.16.20.0 24
[USG6000V1-policy-security-rule-sec_2]source-address 172.16.10.0 24
[USG6000V1-policy-security-rule-sec_3]destination-zone untrust
[USG6000V1-policy-security-rule-sec_3]action permit
[USG6000V1-policy-security-rule-sec_3]quit
[USG6000V1-policy-security]quit
[USG6000V1]
（5）設置安全策略，使互聯網用戶能夠訪問DMZ區域的WEB服務
[USG6000V1]security-policy
[USG6000V1-policy-security]rule name sec_3
[USG6000V1-policy-security-rule-sec_3]source-zone untrust
[USG6000V1-policy-security-rule-sec_3]destination-zone dmz
[USG6000V1-policy-security-rule-sec_3]destination-address 10.1.1.0 24
[USG6000V1-policy-security-rule-sec_3]service http
[USG6000V1-policy-security-rule-sec_3]action permit
[USG6000V1-policy-security-rule-sec_3]quit
[USG6000V1-policy-security]quit
[USG6000V1]
（6）配置防火墻默認路由
[USG6000V1]ip route-static 0.0.0.0 0.0.0.0 201.1.1.2
（7）配置nat
[USG6000V1]nat-policy
[USG6000V1-policy-nat]rule name nat_policy
[USG6000V1-policy-nat-rule-nat_policy]source-address 172.16.0.0 16
[USG6000V1-policy-nat-rule-nat_policy]source-zone trust
[USG6000V1-policy-nat-rule-nat_policy]destination-zone untrust
[USG6000V1-policy-nat-rule-nat_policy]action nat easy-ip
[USG6000V1-policy-nat-rule-nat_policy]quit
[USG6000V1-policy-nat]quit
[USG6000V1]
[USG6000V1]nat server natserver_web protocol tcp global 200.0.0.1 80 inside 10.1.1.10 80 no-reverse
[USG6000V1]ip route-static 200.0.0.1 32 NULL 0
在運營商的路由器上配置前往200.0.0.1的；路由
ip route-static 200.0.0.0 24 201.1.1.1
3：驗證訪問
略
華為防火墻綜合實驗