一、实验思路和网络拓扑
实验思路：
1、在防火墙上启动虚拟系统，设置相应的接口、路由，实现各系统互联；
2、并通过引流表对虚拟系统进行优化，节省根系统资源
二、基础配置
1、交换机配置
[SW1]vlan batch 10 20
[SW1]port-group group-member g0/0/1 g0/0/11
[SW1-port-group]port link-type access
[SW1-port-group]port default vlan 10
[SW1]port-group group-member g0/0/2 g0/0/12
[SW1-port-group]port link-type access
[SW1-port-group]port default vlan 20
2、防火墙配置
三、防火墙详细配置
（一）实现PC1与服务器，服务器与PC2互通
1、配置接口区域
2、在VRF_A上设置静态路由
[FW1]switch vsys VRF_A
[FW1-VRF_A]ip route-static 10.1.12.0 24 public
[FW1-VRF_A]dis ip routing-table
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Routing Tables: VRF_A
Destinations : 3 Routes : 3
Destination/Mask Proto Pre Cost Flags NextHop Interface
10.1.10.0/24 Direct 0 0 D 10.1.10.12 GigabitEthernet1/0/1
10.1.10.12/32 Direct 0 0 D 127.0.0.1 GigabitEthernet1/0/1
10.1.12.0/24 Static 60 0 D 0.0.0.0 Virtual-if0
3、在根系统上设置静态路由
[FW1]ip route-static 10.1.10.0 24 vpn-instance VRF_A
[FW1]dis ip routing-table
Route Flags: R - relay, D - download to fib
------------------------------------------------------------------------------
Routing Tables: Public
Destinations : 5 Routes : 5
Destination/Mask Proto Pre Cost Flags NextHop Interface
10.1.10.0/24 Static 60 0 D 0.0.0.0 Virtual-if1
4、设置安全策略
根系统上设置
#
security-policy
rule name LOCAL_TO_ANY
source-zone local
action permit
rule name UNTRST_TO_TRUST
source-zone untrust
destination-zone trust
source-address 10.1.10.0 mask 255.255.255.0
destination-address 10.1.12.0 mask 255.255.255.0
action permit
#
虚拟系统上设置
#
security-policy
rule name LOCAL_TO_ANY
source-zone local
action permit
rule name TRUST_TO_UNTRUST
source-zone trust
destination-zone untrust
source-address 10.1.10.0 mask 255.255.255.0
destination-address 10.1.12.0 mask 255.255.255.0
action permit
#
PC>ping 10.1.12.10
From 10.1.12.10: bytes=32 seq=1 ttl=253 time=32 ms
From 10.1.12.10: bytes=32 seq=2 ttl=253 time=47 ms
[FW1-VRF_A]dis firewall session table
icmp VPN: VRF_A --> public 10.1.10.10:27877 --> 10.1.12.10:2048
icmp VPN: VRF_A --> public 10.1.10.10:28645 --> 10.1.12.10:2048
[FW1]dis firewall session table
icmp VPN: public --> public 10.1.10.10:44005 --> 10.1.12.10:2048
icmp VPN: public --> public 10.1.10.10:44261 --> 10.1.12.10:2048
（二）引流表配置（为减少防火墙上的引流表，节约防火墙资源）
1、正向引流表（目的地址匹配，服务器访问虚拟系统B，节约根系统资源）
[FW1]firewall import-flow public 10.1.20.10 10.1.20.10 vpn-instance VRF_B
[FW1]dis firewall session table
Current Total Sessions : 1
tcp VPN: default --> default 192.168.31.1:4124 --> 192.168.31.100:8443
2、反向引流表（源地址匹配，虚拟系统访问服务器，节省根系统资源）
[FW1]firewall import-flow public 10.1.10.10 10.1.10.10 vpn-instance VRF_A
[FW1]dis firewall session table
tcp VPN: default --> default 192.168.31.1:6853 --> 192.168.31.100:8443
（三）实现PC1至PC2互通
PC>ping 10.1.20.10
Ping 10.1.20.10: 32 data bytes, Press Ctrl_C to break
From 10.1.20.10: bytes=32 seq=1 ttl=126 time=63 ms
From 10.1.20.10: bytes=32 seq=2 ttl=126 time=62 ms
[FW1]icmp ttl-exceeded send
PC>tracert 10.1.20.10
traceroute to 10.1.20.10, 8 hops max
(ICMP), press Ctrl+C to stop
1 10.1.10.12 47 ms 47 ms 15 ms
2 * * *
3 10.1.20.10 47 ms 63 ms 62 ms