电脑装配网

防火墙

 人阅读 | 作者lilintao | 时间:2023-06-09 07:41

防火墙安全区域及安全策略配置

拓扑图

步骤一. 登录设备(Console)

1.连接配置口电缆。

a. 关闭FW及配置终端的电源。

b. 通过配置电缆将配置终端的RS-232串口与FW的Console口相连。

c. 经安装检查后上电。

2.超级终端软件的配置(可以从Internet上获取如putty等免费超级终端软件。)。

a. 下载putty软件到本地并双击运行该软件。

b. 选择“Session”,将“Connection type”设置为“Serial”。

c. 配置通过串口连接设备的参数。具体参数配置如图所示。

d. 单击“Open”。

3. 按“Enter”键,按照提示输入缺省管理员账号“admin”和密码“Admin@123”。

4. 修改缺省管理员账号的密码,并进入CLI界面。

说明:为提高安全性,密码必须满足最小复杂度要求,即包含英文大写字母(A~Z)、英文小写字母(a~z)、数字(0~9)、特殊字符(如!、@、#、$、%等)中的三种。

请牢记输入的新密码避免无法登录。

步骤二. 基本配置与IP编址

给路由器和防火墙配置地址,并配置静态路由,在交换机上配置VLAN。

<Huawei>system-view

Enter system view, return user view with Ctrl+Z.

[Huawei]sysname R1

[R1]interface GigabitEthernet 0/0/1

[R1-GigabitEthernet0/0/1]ip address 10.0.10.1 24

[R1-GigabitEthernet0/0/1]interface loopback 0

[R1-LoopBack0]ip address 10.0.1.1 24

<Huawei>system-view

Enter system view, return user view with Ctrl+Z.

[Huawei]sysname R2

[R2]interface GigabitEthernet0/0/1

[R2-GigabitEthernet0/0/1]ip address 10.0.20.1 24

[R2-GigabitEthernet0/0/1]interface loopback 0

[R2-LoopBack0]ip address 10.0.2.2 24

<Huawei>system-view

Enter system view, return user view with Ctrl+Z.

[Huawei]sysname R3

[R3]interface GigabitEthernet 0/0/1

[R3-GigabitEthernet0/0/1]ip address 10.0.30.1 24

[R3-GigabitEthernet0/0/1]interface loopback 0

[R3-LoopBack0]ip address 10.0.3.3 24

防火墙默认会启用GigabitEthernet0/0/0接口的ip地址,为避免干扰,可以删除。

<USG6300>system-view

Enter system view, return user view with Ctrl+Z.

[USG6300]sysname FW

[FW]int GigabitEthernet 0/0/0

[FW-GigabitEthernet0/0/0]undo ip address

[FW-GigabitEthernet0/0/0]interface GigabitEthernet 1/0/0

[FW-GigabitEthernet1/0/0]ip address 10.0.10.254 24

[FW-GigabitEthernet1/0/0]interface GigabitEthernet 1/0/1

[FW-GigabitEthernet1/0/1]ip address 10.0.20.254 24

[FW-GigabitEthernet1/0/1]interface GigabitEthernet 1/0/2

[FW-GigabitEthernet1/0/2]ip address 10.0.30.254 24

[FW-GigabitEthernet1/0/2]quit

交换机上需要按照需求定义VLAN。

[Quidway]sysname S1

[S1]vlan batch 11 to 13

[S1]interface GigabitEthernet 0/0/1

[S1-GigabitEthernet0/0/1]port link-type access

[S1-GigabitEthernet0/0/1]port default vlan 11

[S1-GigabitEthernet0/0/1]interface GigabitEthernet 0/0/2

[S1-GigabitEthernet0/0/2]port link-type access

[S1-GigabitEthernet0/0/2]port default vlan 12

[S1-GigabitEthernet0/0/2]interface GigabitEthernet 0/0/3

[S1-GigabitEthernet0/0/3]port link-type access

[S1-GigabitEthernet0/0/3]port default vlan 13

[S1-GigabitEthernet0/0/3]interface GigabitEthernet 0/0/21

[S1-GigabitEthernet0/0/21]port link-type access

[S1-GigabitEthernet0/0/21]port default vlan 11

[S1-GigabitEthernet0/0/21]interface GigabitEthernet 0/0/22

[S1-GigabitEthernet0/0/22]port link-type access

[S1-GigabitEthernet0/0/22]port default vlan 12

[S1-GigabitEthernet0/0/22]interface GigabitEthernet 0/0/23

[S1-GigabitEthernet0/0/23]port link-type access

[S1-GigabitEthernet0/0/23]port default vlan 13

在R1、R2和R3上配置缺省路由,在FW上配置明确的静态路由,实现三个Loopback0接口连接的网段之间路由畅通。

[R1]ip route-static 0.0.0.0 0 10.0.10.254

[R2]ip route-static 0.0.0.0 0 10.0.20.254

[R3]ip route-static 0.0.0.0 0 10.0.30.254

[FW]ip route-static 10.0.1.0 24 10.0.10.1

[FW]ip route-static 10.0.2.0 24 10.0.20.1

[FW]ip route-static 10.0.3.0 24 10.0.30.1

配置完成后检查防火墙路由信息。

步骤三. 配置防火墙区域

防火墙上默认有四个区域,分别是“local“、”trust“、”untrust“、”dmz“。实验中我们使用到“trust“、”untrust“和”dmz“三个区域,分别将对应接口加入各安全区域,由于默认配置将GE0/0/0加入了“trust”区域,为避免干扰,将其删除。

[FW]firewall zone dmz

[FW-zone-dmz]add interface GigabitEthernet 1/0/2

[FW-zone-dmz]firewall zone trust

[FW-zone-trust]add interface GigabitEthernet 1/0/1

[FW-zone-trust]undo add interface GigabitEthernet 0/0/0

[FW-zone-trust]fire zone untrust

[FW-zone-untrust]add interface GigabitEthernet 1/0/0

[FW-zone-untrust]quit

检查各接口的区域:

检查各区域的优先级:

可以看到三个接口已经被划分到相应的区域内,默认情况下不同区域间是不可互通的,因此此时路由器之间流量无法通过。

步骤四. 配置安全策略

如果防火墙域间没有配置安全策略,或查找安全策略时,所有的安全策略都没有命中,则默认执行域间的缺省包过滤动作(拒绝通过)。

配置安全策略,仅允许Trust区域访问其他区域,不允许其他区域之间的访问。

[FW]security-policy

[FW-policy-security]rule name policy_sec_1

[FW-policy-security-rule-policy_sec_1]source-zone trust

[FW-policy-security-rule-policy_sec_1]destination-zone untrust

[FW-policy-security-rule-policy_sec_1]action permit

[FW-policy-security-rule-policy_sec_1]rule name policy_sec_2

[FW-policy-security-rule-policy_sec_2]source-zone trust

[FW-policy-security-rule-policy_sec_2]destination-zone dmz

[FW-policy-security-rule-policy_sec_2]action permit

[FW-policy-security-rule-policy_sec_2]quit

[FW-policy-security]quit

检查配置结果:

检查从trust到untrust和dmz的连通性:

检查从untrust到trust和dmz的连通性:

检查从dmz到untrust和trust的连通性:

经过验证,以trust区域为源的数据可以访问untrust和dmz,但以其他区域为源的数据不能互访。

配置域间包过滤策略,允许Untrust区域访问DMZ区域的特定服务器。

DMZ区域有一个服务器,IP地址为10.0.3.3,需要对Untrust区域开放Telnet服务。同时为了测试网络,需要开放ICMP Ping测试功能。

[FW-policy-security-rule-policy_sec_3]source-zone untrust

[FW-policy-security-rule-policy_sec_3]destination-zone dmz

[FW-policy-security-rule-policy_sec_3]destination-address 10.0.3.3 mask 255.255.255.255

[FW-policy-security-rule-policy_sec_3]service icmp

[FW-policy-security-rule-policy_sec_3]service telnet

[FW-policy-security-rule-policy_sec_3]action permit

为了能在进行Telnet测试,在R3上开启Telnet功能。

[R3]telnet server enable

[R3]aaa

[R3-aaa]local-user test password irreversible-cipher Admin@123 Admin@123

[R3-aaa]local-user test service-type telnet

[R3-aaa]quit

[R3]user-interface vty 0 4

[R3-ui-vty0-4]authentication-mode aaa

[R3-ui-vty0-4]protocol inbound telnet

测试从R1(untrust)到R3(dmz)的ping和telnet:

根据验证可知,只有访问指定地址的icmp和telnet可以通过,其他流量全部禁止。

最终设备配置

<S1>display current-configuration

!Software Version V200R008C00SPC500

#

sysname S1

#

vlan batch 11 to 13

#

interface GigabitEthernet0/0/1

port link-type access

port default vlan 11

#

interface GigabitEthernet0/0/2

port link-type access

port default vlan 12

#

interface GigabitEthernet0/0/3

port link-type access

port default vlan 13

#

interface GigabitEthernet0/0/21

port link-type access

port default vlan 11

#

interface GigabitEthernet0/0/22

port link-type access

port default vlan 12

#

interface GigabitEthernet0/0/23

port link-type access

port default vlan 13

#

return

<R1>display current-configuration

[V200R007C00SPC600]

#

sysname R1

#

interface GigabitEthernet0/0/1

ip address 10.0.10.1 255.255.255.0

#

interface LoopBack0

ip address 10.0.1.1 255.255.255.0

#

ip route-static 0.0.0.0 0.0.0.0 10.0.10.254

#

return

<R2>display current-configuration

[V200R007C00SPC600]

#

sysname R2

#

interface GigabitEthernet0/0/1

ip address 10.0.20.1 255.255.255.0

#

interface LoopBack0

ip address 10.0.2.2 255.255.255.0

#

ip route-static 0.0.0.0 0.0.0.0 10.0.20.254

#

return

<R3>display current-configuration

[V200R007C00SPC600]

#

sysname R3

#

aaa

local-user test password irreversible-cipher Admin@123

local-user test privilege level 0

local-user test service-type telnet

#

interface GigabitEthernet0/0/1

ip address 10.0.30.1 255.255.255.0

#

interface LoopBack0

ip address 10.0.3.3 255.255.255.0

#

telnet server enable

#

ip route-static 0.0.0.0 0.0.0.0 10.0.30.254

#

user-interface vty 0 4

authentication-mode aaa

protocol inbound telnet

#

return

<FW>display current-configuration

#

sysname FW

#

interface GigabitEthernet1/0/0

ip address 10.0.10.254 255.255.255.0

#

interface GigabitEthernet1/0/1

ip address 10.0.20.254 255.255.255.0

#

interface GigabitEthernet1/0/2

ip address 10.0.30.254 255.255.255.0

#

firewall zone local

set priority 100

#

firewall zone trust

set priority 85

add interface GigabitEthernet1/0/1

#

firewall zone untrust

set priority 5

add interface GigabitEthernet1/0/0

#

firewall zone dmz

set priority 50

add interface GigabitEthernet1/0/2

#

ip route-static 10.0.1.0 255.255.255.0 10.0.10.1

ip route-static 10.0.2.0 255.255.255.0 10.0.20.1

ip route-static 10.0.3.0 255.255.255.0 10.0.30.1

#

security-policy

rule name policy_sec_1

source-zone trust

destination-zone untrust

action permit

rule name policy_sec_2

source-zone trust

destination-zone dmz

action permit

rule name policy_sec_3

source-zone untrust

destination-zone dmz

destination-address 10.0.3.3 mask 255.255.255.255

service icmp

service telnet

action permit

#

return


文章标签:

本文链接:『转载请注明出处』