1.vlan 2属于办公区vlan 3 属于生产区Sw1配置[sw1]vlan batch 2 3[sw1-GigabitEthernet0/0/2]port link-type access[sw1-GigabitEthernet0/0/2]port default vlan 2[sw1-GigabitEthernet0/0/3]port link-type access[sw1-GigabitEthernet0/0/3]port default vlan 3[sw1-GigabitEthernet0/0/1]port link-type trunk[sw1-GigabitEthernet0/0/1]port trunk allow-pass vlan 2 3Fw配置--接口配置[FW1-GigabitEthernet1/0/1.2]vlan-type dot1q 2[FW1-GigabitEthernet1/0/1.2]ip address 192.168.1.126 25[FW1-GigabitEthernet1/0/1.3]vlan-type dot1q 3[FW1-GigabitEthernet1/0/1.3]ip address 192.168.1.254 25[FW1-GigabitEthernet1/0/0]ip address 10.0.0.254 24--安全区域配置[FW1]firewall zone trust[FW1-zone-trust]add interface GigabitEthernet 1/0/1.2[FW1-zone-trust]add interface GigabitEthernet 1/0/1.3[FW1]firewall zone dmz[FW1-zone-dmz]add int GigabitEthernet 1/0/0--地址对象配置[FW1]ip address-set PC1 type object[FW1-object-address-set-PC1]address 192.168.1.1 mask 32[FW1]ip address-set PC2 type object[FW1-object-address-set-PC2]address 192.168.1.129 mask 32[FW1]ip address-set PC3 type object[FW1-object-address-set-PC3]address 192.168.1.130 mask 32[FW1]ip address-set OA_Server type object[FW1-object-address-set-OA_Server]address 10.0.0.1 mask 32[FW1]ip address-set Web-Server type object[FW1-object-address-set-Web-Server]address 10.0.0.2 mask 32[FW1]ip address-set Production_area type group[FW1-group-address-set-Production_area]add address-set PC2[FW1-group-address-set-Production_area]add address-set PC3-- 时间段配置[FW1]time-range worktime[FW1-time-range-worktime]period-range 08:00:00 to 18:00:00 working-day[FW1]time-range monday_update[FW1-time-range-monday_update]period-range 10:00:00 to 11:00:00 Mon--安全策略配置[FW1]security-policy[FW1-policy-security]rule name policy_01[FW1-policy-security-rule-policy_01]source-zone trust[FW1-policy-security-rule-policy_01]destination-zone dmz[FW1-policy-security-rule-policy_01]source-address address-set PC3[FW1-policy-security-rule-policy_01]destination-address address-set Web_Server[FW1-policy-security-rule-policy_01]time-range monday_update[FW1-policy-security-rule-policy_01]action permit[FW1-policy-security]rule name policy_02[FW1-policy-security-rule-policy_02]source-zone trust[FW1-policy-security-rule-policy_02]destination-zone dmz[FW1-policy-security-rule-policy_02]source-address address-set PC1[FW1-policy-security-rule-policy_02]destination-address address-set OA_Server[FW1-policy-security-rule-policy_02]time-range worktime[FW1-policy-security-rule-policy_02]action permit[FW1-policy-security]rule name policy_03[FW1-policy-security-rule-policy_03]source-zone trust[FW1-policy-security-rule-policy_03]destination-zone dmz[FW1-policy-security-rule-policy_03]source-address address-set PC1[FW1-policy-security-rule-policy_03]destination-address address-set Web_Server[FW1-policy-security-rule-policy_03]action permit[FW1-policy-security]rule name policy_04[FW1-policy-security-rule-policy_04]source-zone trust[FW1-policy-security-rule-policy_04]destination-zone dmz[FW1-policy-security-rule-policy_04]source-address address-set PC2[FW1-policy-security-rule-policy_04]source-address address-set PC3[FW1-policy-security-rule-policy_04]destination-address address-set OA_Server[FW1-policy-security-rule-policy_04]action permit