实验需求内网划分网段Client1 为财务部终端Client2 为研发部终端内网部署 Web-Server 服务器在 FW 防火墙上导入电信、联通 ISP 网段路由配置默认路由公网路由器运行 OSPF 协议实现公网各网段互通公网用户 1 通过电信 DNS 解析访问 Web-Server流量从 FW 的 GE1/0/0 接口进入公网用户 2 通过联通 DNS 解析访问 Web-Server流量从 FW 的 GE1/0/2 接口进入财务部访问 FTP 服务器时经由电信网络转发研发部访问 FTP 服务器时经由联通网络转发采用策略路由实现流量选路开启 IP-Link 链路检测功能策略路由基于源 IP 结合用户认证方式部署用户认证配置财务部终端采用免认证方式研发部终端采用匿名认证方式完成用户组与地址组配置外网访问内网 Web 服务器使用 NAT Server 进行地址映射内网终端访问互联网采用 Easy-IP 方式实现地址转换配置防火墙精准安全策略控制网络访问权限。# FW1 sysname FW1 aaa manager-user admin password Admin123 interface GigabitEthernet0/0/0 ip address 192.168.0.1 255.255.255.0 service-manage all permit ip-link check enable firewall session stateful enable firewall interzone trust untrust detect ftp interface GigabitEthernet 0/0/2 portswitch port link-type access port default vlan 10 interface GigabitEthernet 0/0/3 portswitch port link-type access port default vlan 20 interface GigabitEthernet 0/0/4 portswitch port link-type access port default vlan 30 interface Vlanif 10 ip address 192.168.1.254 255.255.255.0 interface Vlanif 20 ip address 192.168.2.254 255.255.255.0 interface Vlanif 30 ip address 192.168.3.254 255.255.255.0 interface GigabitEthernet 1/0/0 ip address 14.0.0.1 255.255.255.0 interface GigabitEthernet 1/0/2 ip address 12.0.0.1 255.255.255.0 firewall zone trust set priority 85 add interface Vlanif 10 add interface Vlanif 20 add interface Vlanif 30 firewall zone untrust set priority 5 add interface GigabitEthernet 1/0/0 add interface GigabitEthernet 1/0/2 ip address-object Finance 192.168.1.0 mask 255.255.255.0 ip address-object RD 192.168.2.0 mask 255.255.255.0 ip address-object WebServer 192.168.3.3 mask 255.255.255 ip address-object FTP_Server 50.0.0.1 mask 255.255.255 ip address-object DNS_Tel 34.0.0.2 mask 255.255.255 ip address-object DNS_Uni 200.1.1.2 mask 255.255.255 ip address-object User_Tel 100.1.1.0 mask 255.255.255 ip address-object User_Uni 102.1.1.0 mask 255.255.255 aaa authentication scheme Auth_Fin authentication-mode none authentication scheme Auth_RD authentication-mode anonymous user-group Finance_Group bind authentication-scheme Auth_Fin user-group RD_Group bind authentication-scheme Auth_RD user-ip-mapping Finance_Group Finance user-ip-mapping RD_Group RD ip-link Tel_Link destination 14.0.0.2 interface GigabitEthernet 1/0/0 ip-link Tel_Link interval 1000 ip-link Tel_Link retry 3 ip-link Uni_Link destination 12.0.0.2 interface GigabitEthernet 1/0/2 ip-link Uni_Link interval 1000 ip-link Uni_Link retry 3 policy-based-route FTP_PBR permit node 10 if-match source-address Finance if-match destination-address FTP_Server apply next-hop 14.0.0.2 apply output-interface GigabitEthernet 1/0/0 apply ip-link Tel_Link policy-based-route FTP_PBR permit node 20 if-match source-address RD if-match destination-address FTP_Server apply next-hop 12.0.0.2 apply output-interface GigabitEthernet 1/0/2 apply ip-link Uni_Link interface Vlanif 10 policy-based-route FTP_PBR interface Vlanif 20 policy-based-route FTP_PBR ip route-static 100.1.1.0 255.255.255.0 14.0.0.2 ip route-static 34.0.0.0 255.255.255.0 14.0.0.2 ip route-static 102.1.1.0 255.255.255.0 12.0.0.2 ip route-static 200.1.1.0 255.255.255.0 12.0.0.2 ip route-static 23.0.0.0 255.255.255.0 12.0.0.2 ip route-static 0.0.0.0 0 14.0.0.2 preference 60 track ip-link Tel_Link ip route-static 0.0.0.0 0 12.0.0.2 preference 70 track ip-link Uni_Link nat-policy rule 10 permit source Finance destination untrust nat easy-ip rule 20 permit source RD destination untrust nat easy-ip nat server TelWeb protocol tcp global 14.0.0.1 www inside WebServer www nat server UnicomWeb protocol tcp global 12.0.0.1 www inside WebServer www security-policy rule 10 permit source Finance destination DNS_Tel service dns rule 11 permit source Finance destination DNS_Uni service dns rule 12 permit source RD destination DNS_Tel service dns rule 13 permit source RD destination DNS_Uni service dns rule 20 permit source Finance destination FTP_Server service ftp rule 21 permit source RD destination FTP_Server service ftp rule 30 permit source Finance destination untrust rule 31 permit source RD destination untrust rule 40 permit source User_Tel destination WebServer service www rule 41 permit source User_Uni destination WebServer service www rule 99 deny # R4 sysname R4 interface GigabitEthernet 0/0/0 ip address 14.0.0.2 255.255.255.0 interface GigabitEthernet 0/0/3 ip address 100.1.1.254 255.255.255.0 interface GigabitEthernet 0/0/2 ip address 34.0.0.254 255.255.255.0 interface GigabitEthernet 0/0/1 ip address 23.0.0.4 255.255.255.0 ospf 1 router-id 4.4.4.4 area 0 network 14.0.0.0 0.0.0.255 network 100.1.1.0 0.0.0.255 network 34.0.0.0 0.0.0.255 network 23.0.0.0 0.0.0.255 ip route-static 192.168.0.0 255.255.252.0 14.0.0.1 # R2 sysname R2 interface GigabitEthernet 0/0/0 ip address 12.0.0.2 255.255.255.0 interface GigabitEthernet 0/0/1 ip address 200.1.1.254 255.255.255.0 interface GigabitEthernet 0/0/3 ip address 102.1.1.254 255.255.255.0 interface GigabitEthernet 0/0/2 ip address 23.0.0.2 255.255.255.0 ospf 1 router-id 2.2.2.2 area 0 network 12.0.0.0 0.0.0.255 network 200.1.1.0 0.0.0.255 network 102.1.1.0 0.0.0.255 network 23.0.0.0 0.0.0.255 ip route-static 192.168.0.0 255.255.252.0 12.0.0.1 # R3 sysname R3 interface GigabitEthernet 0/0/0 ip address 23.0.0.3 255.255.255.0 interface GigabitEthernet 0/0/2 ip address 50.0.0.254 255.255.255.0 ospf 1 router-id 3.3.3.3 area 0 network 23.0.0.0 0.0.0.255 network 50.0.0.0 0.0.0.255