防火墙ACL控制与NAT转换

1、NAT转换

[SRG]firewall p d p interzone trust untrust direction outbound

[SRG]firewall p d p interzone trust dmz dir out

[SRG]firewall p d p interzone dmz untrust dir out

[SRG]ip route-s 0.0.0.0 0.0.0.0 1.1.1.2

设置trust到untrust区域的NAT策略：

[SRG]nat-policy interzone trust untrust outbound

策略ID号：

[SRG-nat-policy-interzone-trust-untrust-outbound]policy 1

设置源地址：

[SRG-nat-policy-interzone-trust-untrust-outbound-1]policy source any

启用原地址转换功能：

[SRG-nat-policy-interzone-trust-untrust-outbound-1]action source-nat

设置转换类型为easy-ip，指定转换目标接口：

[SRG-nat-policy-interzone-trust-untrust-outbound-1]easy-ip GigabitEthernet0/0/3

[SRG-nat-policy-interzone-trust-untrust-outbound-1]quit

[SRG-nat-policy-interzone-trust-untrust-outbound]quit

2、防火墙控制策略

[SRG]policy interzone trust untrust outbound

[SRG-policy-interzone-trust-untrust-outbound]policy 1

[SRG-policy-interzone-trust-untrust-outbound-1]policy source 192.168.10.2 0

[SRG-policy-interzone-trust-untrust-outbound-1]policy destination any

[SRG-policy-interzone-trust-untrust-outbound-1]action permit

[SRG-policy-interzone-trust-untrust-outbound-1]quit

[SRG-policy-interzone-trust-untrust-outbound]policy 2

[SRG-policy-interzone-trust-untrust-outbound-2]policy source 192.168.10.3 0

[SRG-policy-interzone-trust-untrust-outbound-2]policy destination 2.1.1.2 0

[SRG-policy-interzone-trust-untrust-outbound-2]action deny

[SRG-policy-interzone-trust-untrust-outbound-2]quit

[SRG-policy-interzone-trust-untrust-outbound]quit

3、防火墙配置服务器发布

[SRG]firewall packet-filter default permit all

[SRG]nat server protocol tcp global interface g0/0/3 80 inside 192.168.20.2 80

4、防火墙单臂+聚合+双出口策略路由

防火墙配置：

[SRG]int eth1

[SRG-Eth-Trunk1] undo portswitch

[SRG-Eth-Trunk1]int eth1.1

[SRG-Eth-Trunk1.1]description vlan10

[SRG-Eth-Trunk1.1]vlan-type dot1q 10

[SRG-Eth-Trunk1.1]ip add 192.168.10.1 24

[SRG-Eth-Trunk1.1]int eth1.2

[SRG-Eth-Trunk1.2]description vlan20

[SRG-Eth-Trunk1.2]vlan-type dot1q 20

[SRG-Eth-Trunk1.2]ip add 192.168.20.1 24

[SRG-Eth-Trunk1.2]quit

[SRG]firewall zone trust

[SRG-zone-trust]add int eth1.1

[SRG-zone-trust]add int eth1.2

[SRG-zone-trust]firewall zone untrust

[SRG-zone-untrust]add int g0/0/2

[SRG-zone-untrust]add interface GigabitEthernet0/0/3

[SRG-zone-untrust]quit

[SRG]policy interzone trust untrust outbound

[SRG-policy-interzone-trust-untrust-outbound]policy 1

[SRG-policy-interzone-trust-untrust-outbound-1]policy source 192.168.10.0 0.0.0.255

[SRG-policy-interzone-trust-untrust-outbound-2]policy source 192.168.20.0 0.0.0.255

[SRG-policy-interzone-trust-untrust-outbound-1]action permit

[SRG-policy-interzone-trust-untrust-outbound-1]quit

[SRG]nat-policy interzone trust untrust outbound

[SRG-nat-policy-interzone-trust-untrust-outbound]policy 1

[SRG-nat-policy-interzone-trust-untrust-outbound-1]policy source 192.168.10.0 0.0.0.255

[SRG-nat-policy-interzone-trust-untrust-outbound-1]action source-nat

[SRG-nat-policy-interzone-trust-untrust-outbound-1]easy-ip g0/0/2

[SRG-nat-policy-interzone-trust-untrust-outbound-1]quit

[SRG-nat-policy-interzone-trust-untrust-outbound]policy 2

[SRG-nat-policy-interzone-trust-untrust-outbound-2]policy source 192.168.20.0 0.0.0.255

[SRG-nat-policy-interzone-trust-untrust-outbound-2]action source-nat

[SRG-nat-policy-interzone-trust-untrust-outbound-2]easy-ip g0/0/3

[SRG-nat-policy-interzone-trust-untrust-outbound-2]quit

[SRG-nat-policy-interzone-trust-untrust-outbound]quit

[SRG]acl number 3001

[SRG-acl-adv-3001]rule permit ip source 192.168.10.0 0.0.0.255

[SRG-acl-adv-3001]quit

[SRG]acl number 3002

[SRG-acl-adv-3002]rule permit ip source 192.168.20.0 0.0.0.255

[SRG-acl-adv-3002]quit

[SRG]policy-based-route hehe permit node 5

[SRG-policy-based-route-hehe-5]if-match acl 3001

[SRG-policy-based-route-hehe-5]apply ip-address next-hop 1.1.1.2

[SRG-policy-based-route-hehe-5]quit

[SRG]policy-based-route hehe permit node 10

[SRG-policy-based-route-hehe-10]if-match acl 3002

[SRG-policy-based-route-hehe-10]apply ip-address next-hop 2.1.1.2

[SRG-policy-based-route-hehe-10]quit

[SRG]ip-link check enable

[SRG]ip-link 1 destination 1.1.1.2 interface g0/0/2

[SRG]ip-link 2 destination 2.1.1.2 interface g0/0/3

[SRG]display ip-link

[SRG]ip route-static 0.0.0.0 0.0.0.0 1.1.1.2 track ip-link 1

[SRG]ip route-static 0.0.0.0 0.0.0.0 2.1.1.2 track ip-link 2

路由器配置接口地址与路由表

防火墙ACL控制与NAT转换相关推荐

ACL实现包过滤 NAT网络地址转换
这系列文章为计算机网络理论的学习笔记,学习笔记基于老师给的的PPT.他人学习笔记和维基百科.百度百科等一系列权威资料.学习笔记仅个人学习用,便于记录和复习,无广泛传播之意,若有侵权,请 ...
DZ先生怪谈国标28181之监控系统防火墙控制和NAT
1. 自述关于监控,可能我们用到防火墙的案例并不多,甚至少之又少,在公安网中有网闸,在政府网中可能会有单独的防火墙或者网闸,但在这里DZ先生建议,只要厂家的平台是基于linux系统,我建议您还是了解 ...
五、防火墙NAT转换
网络地址转换原理 NAT技术的基本原理 NAT是将数据报文头中的一种地址转换成另一种ip地址的过程,主要是使用在内网地址访问公网地址,每一个NAT的设备都会有一个地址转换表,通过这个地址转换表可以实现 ...
华为防火墙NAT转换
化为防火墙NAT转换拓扑如下实现使用Easy-IP访问外网 Nat-server外网访问内部服务器ftp服务 1. 配置图中各借口和主机ip掩码都为24 2. 分区域左边trust 右边unt ...
【防火墙静态NAT转换】
防火墙静态NAT转换一.网络拓扑二.需求描述内部webserver 192.168.1.100通过USG访问外网时映射成200.1.1.2/24. 外部人员访问200.1.1.2时可以访问到内部 ...
【防火墙源NAT转换-多对多】
防火墙源NAT转换-多对多一.网络拓扑二.需求描述内网用户能够通过USG访问Internet,且在出外网时使用地址池中的地址进行转换. 实验步骤: 1.在USG上配置相关NAT策略并调试. 将接 ...
思科三层交换机 NAT转换 ACL 实验
思科三层交换机 NAT转换 ACL 实验拓扑图实验文件 ACL要求: 1.允许pc0访问server1 禁止ping 2.禁止pc1 访问server1 允许ping 3.禁止server1 访 ...
【防火墙源NAT转换-多对一】
防火墙源NAT转换-多对一一.网络拓扑二.需求描述 USG内网段192.168.1.0/24可以通过防火墙NAT转换访问Internet. 实验步骤: 1.在USG上配置NAT相关策略并调试. 将 ...
Ubuntu 20.04防火墙 UFW做NAT转换，IP伪装，端口重定向，端口映射
参考文档: <Ubuntu 防火墙IP转发做NAT,内网集群共享网络(简单)> <focal (8) ufw-framework.8.gz手册> 项目需要一台路由器以实现NAT ...

防火墙ACL控制与NAT转换

防火墙ACL控制与NAT转换相关推荐

最新文章

热门文章