防火墙区域划分与NAT

任务目的

理解防火墙区域划分方式与流量过滤规则，掌握防火墙安全策略与NAT配置过程

任务设备、设施

Win10、ENSP、VMware、win7、typora

环境拓扑图

配置过程

基本配置

R1

<Huawei>
<Huawei>sys
Enter system view, return user view with Ctrl+Z.
[Huawei]un in en
Info: Information center is disabled.
[Huawei]sys R1
[R1]int g0/0/0
[R1-GigabitEthernet0/0/0]ip add 202.116.64.2 24
[R1-GigabitEthernet0/0/0]q
[R1]int g0/0/1
[R1-GigabitEthernet0/0/1]ip add 116.64.64.1 24
[R1-GigabitEthernet0/0/1]q
[R1]

FW1

Username:admin   //用户名admin
Password:        //密码Admin@123
The password needs to be changed. Change now? [Y/N]: y    //需要修改密码
Please enter old password:    //输入初始密码
Please enter new password:    //输入新密码 可设置为P@ssw0rd 
Please confirm new password:  //确认新密码

 Info: Your password has been changed. Save the change to survive a reboot. 
*************************************************************************
*         Copyright (C) 2014-2018 Huawei Technologies Co., Ltd.         *
*                           All rights reserved.                        *
*               Without the owner's prior written consent,              *
*        no decompiling or reverse-engineering shall be allowed.        *
*************************************************************************


<USG6000V1>sys
Enter system view, return user view with Ctrl+Z.
[USG6000V1]sys FW1
[FW1]int g0/0/0
[FW1-GigabitEthernet0/0/0]ip add 192.168.0.1 24
[FW1-GigabitEthernet0/0/0]q
[FW1]int g1/0/0
[FW1-GigabitEthernet1/0/0]ip add 192.168.10.1 24
[FW1-GigabitEthernet1/0/0]q
[FW1]int g1/0/1
[FW1-GigabitEthernet1/0/1]ip add 192.168.20.1 24
[FW1-GigabitEthernet1/0/1]q
[FW1]int g1/0/2
[FW1-GigabitEthernet1/0/2]ip add 202.116.64.1 24
[FW1-GigabitEthernet1/0/2]q	
[FW1]undo info-center enable 
Info: Saving log files...
Info: Information center is disabled.
[FW1]ip route-static 0.0.0.0 0.0.0.0 202.116.64.2
[FW1]

创建区域

[FW1]firewall zone trust	
[FW1-zone-trust]add interface g1/0/0
[FW1-zone-trust]q
[FW1]firewall zone dmz
[FW1-zone-dmz]add interface g1/0/1
[FW1-zone-dmz]q
[FW1]firewall zone untrust
[FW1-zone-untrust]add in	
[FW1-zone-untrust]add interface g1/0/2
[FW1-zone-untrust]q
[FW1]

配置安全策略，定义区域间互访规则

公司员工访问公网Web服务

[FW1]security-policy 
[FW1-policy-security]rule name trust_untrust_web
[FW1-policy-security-rule-trust_untrust_web]source-zone trust
[FW1-policy-security-rule-trust_untrust_web]destination-zone untrust
[FW1-policy-security-rule-trust_untrust_web]source-address 192.168.10.0 24	
[FW1-policy-security-rule-trust_untrust_web]service protocol tcp destination-por
t 80
[FW1-policy-security-rule-trust_untrust_web]action permit 
[FW1-policy-security-rule-trust_untrust_web]q
[FW1-policy-security]q
[FW1]

公司员工访问dmz Web服务

[FW1]security-policy 
[FW1-policy-security]rule name trust_dmz_web
[FW1-policy-security-rule-trust_dmz_web]source-zone trust
[FW1-policy-security-rule-trust_dmz_web]destination-zone dmz
[FW1-policy-security-rule-trust_dmz_web]source-address 192.168.10.0 24
[FW1-policy-security-rule-trust_dmz_web]service protocol tcp destination-port 80
[FW1-policy-security-rule-trust_dmz_web]action permit 
[FW1-policy-security-rule-trust_dmz_web]q
[FW1-policy-security]

外网用户访问fmz Ftp服务

[FW1]security-policy 
[FW1-policy-security]rule name trust_dmz_ftp
[FW1-policy-security-rule-trust_dmz_ftp]source-zone trust
[FW1-policy-security-rule-trust_dmz_ftp]destination-zone dmz
[FW1-policy-security-rule-trust_dmz_ftp]source-address 192.168.10.0 24
[FW1-policy-security-rule-trust_dmz_ftp]service protocol tcp destination-port 21
[FW1-policy-security-rule-trust_dmz_ftp]action permit
[FW1-policy-security-rule-trust_dmz_ftp]q	

外网用户访问dmz Web服务

[FW1]security-policy 
[FW1-policy-security]rule name untrust_dmz_web
[FW1-policy-security-rule-untrust_dmz_web]source-zone untrust
[FW1-policy-security-rule-untrust_dmz_web]destination-zone dmz	
[FW1-policy-security-rule-untrust_dmz_web]destination-address 192.168.20.10 32
[FW1-policy-security-rule-untrust_dmz_web]service protocol tcp destination-port 
 80	
[FW1-policy-security-rule-untrust_dmz_web]action permit 
[FW1-policy-security-rule-untrust_dmz_web]q
[FW1-policy-security]q
[FW1]

外网用户访问dmz Ftp服务

[FW1]security-policy 
[FW1-policy-security]rule name untrust_dmz_ftp
[FW1-policy-security-rule-untrust_dmz_ftp]source-zone untrust
[FW1-policy-security-rule-untrust_dmz_ftp]destination-zone dmz	
[FW1-policy-security-rule-untrust_dmz_ftp]destination-address 192.168.20.20 32	
[FW1-policy-security-rule-untrust_dmz_ftp]service protocol tcp destination-port 
21
[FW1-policy-security-rule-untrust_dmz_ftp]action permit 
[FW1-policy-security-rule-untrust_dmz_ftp]q
[FW1-policy-security]q
[FW1]

配置Easy-IP

公司员工可以访问公网
[FW1]nat-policy 
[FW1-policy-nat]rule name trust_internet
[FW1-policy-nat-rule-trust_internet]source-zone trust
[FW1-policy-nat-rule-trust_internet]destination-zone untrust	
[FW1-policy-nat-rule-trust_internet]source-address 192.168.10.0 24	
[FW1-policy-nat-rule-trust_internet]action source-nat easy-ip 
[FW1-policy-nat-rule-trust_internet]q
[FW1-policy-nat]
公司员工可以访问dmz区域服务器群
[FW1-policy-nat]rule name trust_dmz
[FW1-policy-nat-rule-trust_dmz]source-zone trust
[FW1-policy-nat-rule-trust_dmz]destination-zone dmz
[FW1-policy-nat-rule-trust_dmz]source-address 192.168.10.0 24
[FW1-policy-nat-rule-trust_dmz]action source-nat easy-ip 
[FW1-policy-nat-rule-trust_dmz]q
[FW1-policy-nat]

配置NAT server 发布DMZ区域web站点和ftp站点

[FW1]nat server company_web_server protocol tcp global 202.116.64.1 www inside 1
92.168.20.10 www
[FW1]nat server company_ftp_server protocol tcp global 202.116.64.1 ftp inside 1
92.168.20.20 ftp
[FW1]

任务验证

在server1发布web站点，ftp站点

主机1可以访问公司web server和ftp server

主机1可以访问baidu web服务器

主机3可以访问公司web server和ftpserver

入侵实战（任务扩展）

企业员工要ping通服务器群

[FW1]security-policy 
[FW1-policy-security]rule name trust_dmz_icmp
[FW1-policy-security-rule-trust_dmz_icmp]source-zone trust	
[FW1-policy-security-rule-trust_dmz_icmp]destination-zone dmz
[FW1-policy-security-rule-trust_dmz_icmp]source-address 192.168.10.0 24	
[FW1-policy-security-rule-trust_dmz_icmp]service icmp
[FW1-policy-security-rule-trust_dmz_icmp]action permit 
[FW1-policy-security-rule-trust_dmz_icmp]q
[FW1-policy-security]

企业员工要ping通Internet

[FW1]security-policy 
[FW1-policy-security]rule name trust_untrust_icmp
[FW1-policy-security-rule-trust_untrust_icmp]source-zone trust	
[FW1-policy-security-rule-trust_untrust_icmp]destination-zone untrust
[FW1-policy-security-rule-trust_untrust_icmp]source-address 192.168.10.0 24
[FW1-policy-security-rule-trust_untrust_icmp]service icmp
[FW1-policy-security-rule-trust_untrust_icmp]action permit 
[FW1-policy-security-rule-trust_untrust_icmp]q
[FW1-policy-security]

企业员工要ping通防火墙

[FW1]int  g1/0/0
[FW1-GigabitEthernet1/0/0]serv	
[FW1-GigabitEthernet1/0/0]service-mana	
[FW1-GigabitEthernet1/0/0]service-manage ping permit
[FW1-GigabitEthernet1/0/0]q
[FW1]

任务总结

对于防火墙来说原则上默认禁止所有区域访问。假如配置安全策略，如允许Trust区域访问UnTrust区域，UnTrust区域默认不允许访问Trust区域，则：

• Trust区域主机可以主动向UnTrust区域主机发起连接，UnTrust返回的应答报文也能正常
• UnTrust区域主机不能主动向Trust区域主机发起连接，但是可以被动响应Trust区域主机发起的连接

补充

如何删除NAT Server

[FW1]undo nat server name [nat server名字]
[FW1]undo nat server ID 0
第一个基于名字的删除
第二个是基于ID号删除
在系统视图 使用dis this 然后翻到最后，可以看到name及ID号