防火墙入侵防御实验

一、实验目的及拓扑

实验目的：在防火墙上配置入侵防御（跨站脚本攻击）策略并在安全策略应用，通过虚拟机访问进行验证

二、基本配置

1、如图所示配置接口地址（省略）

2、配置区域接口

[FW1]dis zone 
local
 priority is 100
 interface of the zone is (0):
#
trust
 priority is 85
 interface of the zone is (2):
    GigabitEthernet0/0/0
    GigabitEthernet1/0/1
#
untrust
 priority is 5
 interface of the zone is (1):
    GigabitEthernet1/0/0
#
dmz
 priority is 50
 interface of the zone is (1):
    GigabitEthernet1/0/2
#

3、配置安全策略

[FW1-policy-security]dis th
#
security-policy
 rule name LOCAL_TO_ANY
  source-zone local
  action permit
 rule name OUT_TO_DMZ
  source-zone untrust
  destination-zone dmz
  destination-address 10.0.0.10 mask 255.255.255.255
  service protocol tcp destination-port 80
  profile ips IPS_PRO
  action permit
#

4、配置nat server

nat server 0 protocol tcp global 155.1.121.10 www inside 10.0.0.10 www no-rever

5、配置静态路由

ip route-static 0.0.0.0 0.0.0.0 155.1.121.1

三、详细配置

配置IPS策略

在安全策略中应用入侵防御策略

四、结果验证

输入：http://155.1.121.10/id=1<script>aler("XSS")</script>