华为防火墙的策略路由

1.配置内网及DMZ区域的IP地址
[FW1-GigabitEthernet1/0/1]ip add 10.1.1.1 24
[FW1-GigabitEthernet1/0/3]ip add 10.1.2.1 24
[FW2-GigabitEthernet1/0/1]ip add 10.1.1.2 24
[FW2-GigabitEthernet1/0/3]ip add 10.1.2.2 24

2.配置外网的IP地址及其连通性
[FW1-GigabitEthernet1/0/2]ip add 20.1.1.1 24
[FW1-GigabitEthernet1/0/4]ip add 30.1.1.1 24
[FW2-GigabitEthernet1/0/2]ip add 30.1.2.2 24
[FW2-GigabitEthernet1/0/4]ip add 20.1.2.2 24
[ISP1-GigabitEthernet0/0/0]ip add 20.1.1.3 24
[ISP1-GigabitEthernet0/0/1]ip add 20.1.5.3 24
[ISP1-GigabitEthernet0/0/2]ip add 20.1.2.3 24
[ISP2-GigabitEthernet0/0/0]ip add 30.1.2.4 24
[ISP2-GigabitEthernet0/0/1]ip add 20.1.5.4 24
[ISP2-GigabitEthernet0/0/2]ip add 30.1.1.4 24

[ISP1-GigabitEthernet0/0/1]vrrp vrid 1 virtual-ip 20.1.5.254
[ISP2-GigabitEthernet0/0/1]vrrp vrid 1 virtual-ip 20.1.5.254

[ISP1]ospf
[ISP1-ospf-1]area 0
[ISP1-ospf-1-area-0.0.0.0]net 20.1.1.0 0.0.0.255
[ISP1-ospf-1-area-0.0.0.0]net 20.1.2.0 0.0.0.255
[ISP1-ospf-1-area-0.0.0.0]net 20.1.5.0 0.0.0.255
[ISP2]ospf
[ISP2-ospf-1]area 0
[ISP2-ospf-1-area-0.0.0.0]net 30.1.1.0 0.0.0.255
[ISP2-ospf-1-area-0.0.0.0]net 30.1.2.0 0.0.0.255
[ISP2-ospf-1-area-0.0.0.0]net 20.1.5.0 0.0.0.255
3.防火墙接口加入各自区域并放行ping命令，便于测试
[FW1]firewall zone trust
[FW1-zone-trust]add interface g1/0/1
[FW1]firewall zone untrust
[FW1-zone-untrust]add interface g1/0/2
[FW1-zone-untrust]add interface g1/0/4
[FW1]firewall zone dmz
[FW1-zone-dmz]add interface g1/0/3
[FW1-GigabitEthernet1/0/1]service-manage ping permit
[FW1-GigabitEthernet1/0/2]service-manage ping permit
[FW1-GigabitEthernet1/0/3]service-manage ping permit
[FW1-GigabitEthernet1/0/4]service-manage ping permit
[FW2]firewall zone trust
[FW2-zone-trust]add interface g1/0/1
[FW2]firewall zone untrust
[FW2-zone-untrust]add interface g1/0/2
[FW2-zone-untrust]add interface g1/0/4
[FW2]firewall zone dmz
[FW2-zone-dmz]add interface g1/0/3
[FW2-GigabitEthernet1/0/1]service-manage ping permit
[FW2-GigabitEthernet1/0/2]service-manage ping permit
[FW2-GigabitEthernet1/0/3]service-manage ping permit
[FW2-GigabitEthernet1/0/4]service-manage ping permit
4.配置默认出口路由
[FW1]ip route-static 0.0.0.0 0.0.0.0 20.1.1.3
[FW1]ip route-static 0.0.0.0 0.0.0.0 30.1.1.4 preference 100
[FW2]ip route-static 0.0.0.0 0.0.0.0 20.1.2.3
[FW2]ip route-static 0.0.0.0 0.0.0.0 30.1.2.4 preference 100
5.配置源NAT,使内网能够访问外网
[FW1]nat address-group nat_fw1
[FW1-address-group-nat_fw1]section 20.1.1.100 20.1.1.200
[FW1]nat-policy
[FW1-policy-nat-rule-source_fw1]source-zone trust local
[FW1-policy-nat-rule-source_fw1]destination-zone untrust
[FW1-policy-nat-rule-source_fw1]action source-nat address-group nat_fw1
[FW2]nat address-group nat_fw2
[FW2-address-group-nat_fw2]section 30.1.1.100 30.1.1.200
[FW2]nat-policy
[FW2-policy-nat]rule name source_fw2
[FW2-policy-nat-rule-source_fw2]source-zone local trust
[FW2-policy-nat-rule-source_fw2]destination-zone untrust
[FW2-policy-nat-rule-source_fw2]action source-nat address-group nat_fw2
6.配置IP-link功能
[FW1]ip-link check enable
[FW1] ip-link name ip_link1
[FW1-iplink-ip_link1]destination 20.1.1.3 interface GigabitEthernet 1/0/2 mode icmp
[FW1-iplink-ip_link1]destination 30.1.1.4 interface GigabitEthernet 1/0/3 mode icmp
[FW2]ip-link check enable
[FW2] ip-link name ip_link2
[FW2-iplink-ip_link2]destination 30.1.2.4 interface GigabitEthernet 1/0/2 mode icmp
[FW2-iplink-ip_link2]destination 20.1.2.3 interface GigabitEthernet 1/0/4 mode icmp
7.配置健康检查功能
[FW1]healthcheck enable
[FW1]healthcheck name isp1_health
[FW1-healthcheck-isp1_health]destination 20.1.1.3 interface g1/0/2 protocol icmp
[FW1]healthcheck name isp2_health
[FW1-healthcheck-isp2_health]destination 30.1.1.4 interface g1/0/4 protocol icmp

[FW2]healthcheck enable
[FW2]healthcheck name isp1_health
[FW2-healthcheck-isp1_health]destination 20.1.2.3 interface g1/0/4 protocol icmp
[FW2]healthcheck name isp2_health
[FW2-healthcheck-isp2_health]destination 30.1.2.4 interface g1/0/2 protocol icmp
8.配置接口带宽
[FW1-GigabitEthernet1/0/2]healthcheck isp1_health
[FW1-GigabitEthernet1/0/2]gateway 20.1.1.3
[FW1-GigabitEthernet1/0/2]bandwidth ingress 50000 threshold 90
[FW1-GigabitEthernet1/0/2]bandwidth egress 50000 threshold 90
[FW1-GigabitEthernet1/0/4]healthcheck isp2_health
[FW1-GigabitEthernet1/0/4]gateway 30.1.1.4
[FW1-GigabitEthernet1/0/4]bandwidth ingress 50000 threshold 90
[FW1-GigabitEthernet1/0/4]bandwidth egress 50000 threshold 90
[FW2-GigabitEthernet1/0/4]healthcheck isp1_health
[FW2-GigabitEthernet1/0/4]gateway 20.1.2.3
[FW2-GigabitEthernet1/0/4]bandwidth ingress 50000 threshold 90
[FW2-GigabitEthernet1/0/4]bandwidth egress 50000 threshold 90
[FW2-GigabitEthernet1/0/2]healthcheck isp2_health
[FW1-GigabitEthernet1/0/2]gateway 30.1.2.4
[FW1-GigabitEthernet1/0/2]bandwidth ingress 50000 threshold 90
[FW1-GigabitEthernet1/0/2]bandwidth egress 50000 threshold 90
9.配置全局选路策略
[FW1]link-interface 0 name ISP1
[FW1-linkif-0]interface g1/0/2 next-hop 20.1.1.3
[FW1-linkif-0]healthcheck isp1_health
[FW1]link-interface 1 name ISP2
[FW1-linkif-1]interface g1/0/4 next-hop 30.1.1.3
[FW1-linkif-1]healthcheck isp2_health
[FW1]multi-linkif
[FW1-multi-linkif]mode priority-of-link-quality
[FW1-multi-linkif]priority-of-link-quality parameter loss
[FW1-multi-linkif]priority-of-link-quality protocol tcp-simple
[FW1-multi-linkif]add linkif ISP1
[FW1-multi-linkif]add linkif ISP2

[FW2]link-interface 0 name ISP1
[FW2-linkif-0]interface g1/0/4 next-hop 20.1.2.3
[FW2-linkif-0]healthcheck isp1_health
[FW2]link-interface 1 name ISP2
[FW2-linkif-1]interface g1/0/2 next-hop 30.1.2.4
[FW2-linkif-1]healthcheck isp2_health
[FW2]multi-linkif
[FW2-multi-linkif]mode priority-of-link-quality
[FW2-multi-linkif]priority-of-link-quality parameter loss
[FW2-multi-linkif]priority-of-link-quality protocol tcp-simple
[FW2-multi-linkif]add linkif ISP1
[FW2-multi-linkif]add linkif ISP2
10.配置防火墙双机热备并联动IP-LINK
[FW1-GigabitEthernet1/0/1]vrrp vrid 1 virtual-ip 10.1.1.254 active
[FW1-GigabitEthernet1/0/1]vrrp virtual-mac enable
[FW1]hrp enable
HRP_S[FW1]hrp interface g1/0/3 remote 10.1.2.2
HRP_M[FW1]hrp track ip-link ip_link1
[FW2-GigabitEthernet1/0/1]vrrp vrid 1 virtual-ip 10.1.1.254 standby
[FW2-GigabitEthernet1/0/1]vrrp virtual-mac enable
[FW2]hrp enable
HRP_S[FW2]hrp interface g1/0/3 remote 10.1.2.1
HRP_S[FW2]hrp track ip-link ip_link2
11.配置策略路由
[FW1]policy-based-route
[FW1-policy-pbr]rule name to_ISP1
[FW1-policy-pbr-rule-to_ISP1]source-zone trust
[FW1-policy-pbr-rule-to_ISP1]source-address 10.1.1.10 32
[FW1-policy-pbr-rule-to_ISP1]action pbr egress-interface g 1/0/2 next-hop 20.1.1.3
[FW1-policy-pbr]rule name to_ISP2
[FW1-policy-pbr-rule-to_ISP2]source-zone trust
[FW1-policy-pbr-rule-to_ISP2]source-zone trust
[FW1-policy-pbr-rule-to_ISP2]source-address 10.1.1.20 32
[FW1-policy-pbr-rule-to_ISP2]action pbr egress-interface g1/0/4 next-hop 30.1.1.4
[FW2]policy-based-route
[FW2-policy-pbr]rule name to_ISP1
[FW2-policy-pbr-rule-to_ISP1]source-zone trust
[FW2-policy-pbr-rule-to_ISP1]source-address 10.1.1.10 32
[FW2-policy-pbr-rule-to_ISP1]action pbr egress-interface g1/0/4 next-hop 20.1.2.3
[FW2-policy-pbr]rule name to_ISP2
[FW2-policy-pbr-rule-to_ISP2]source-zone trust
[FW2-policy-pbr-rule-to_ISP2]source-address 10.1.1.20 32
[FW2-policy-pbr-rule-to_ISP2]action pbr egress-interface g1/0/2 next-hop 30.1.2.4
12.配置安全策略
[FW1]security-policy
[FW1-policy-security]rule name OUT
[FW1-policy-security-rule-OUT]source-zone trust local
[FW1-policy-security-rule-OUT]destination-zone untrust
[FW1-policy-security-rule-OUT]action permit
[FW2]security-policy
[FW2-policy-security]rule name OUT
[FW2-policy-security-rule-OUT]source-zone trust local
[FW2-policy-security-rule-OUT]destination-zone untrust
[FW2-policy-security-rule-OUT]action permit
13.验证
PC1和PC2都可以ping通服务器

在FW1的g1/0/2上可以抓到PC1 ping 服务器的流量，也可以看到nat转换

 在FW1的g1/0/4上可以抓到PC2 ping 服务器的流量，也可以看到nat转换

华为防火墙的策略路由相关推荐

华为防火墙配置策略路由实现多个ISP出接口的智能选路
1.基本IP地址及连通性配置 (1)内网IP地址配置 (2)配置外网IP地址 [ISP1-GigabitEthernet0/0/0]ip add 20.1.1.2 24 [ISP1-GigabitEt ...
华为防火墙笔记-出口选路
文章整理自<华为防火墙技术漫谈> 出口选路总述就近选路就近选路是由缺省路由与明细路由配合完成的选路方式,这种方式比较简单,也是最常用的.通过缺省路由可以保证企业用户数据流量都能够匹配到 ...
华为防火墙笔记-报文处理流程
文章整理自<华为防火墙技术漫谈> 全系列状态检测防火墙报文处理流程状态检测与会话机制是华为防火墙对报文处理的关键环节,即防火墙收到报文后,何时.如何创建会话,命中会话表的报文如何被转发. ...
华为防火墙配置（防火墙NAT）
目录前言一.防火墙NAT概述 1.防火墙NAT策略介绍 2.NAT策略分类 (1)NAT No-PAT (2)NAPT (3)Easy-IP (4)Smart NAT (5)三元组NAT 3.NA ...
华为防火墙USG6000系列多ISP上网（通过WEB界面设置）
需求: 1.客户华为防火墙USG6305E有2条宽带接入,一条PPPoE,一条专线(固定IP),要求:服务器区域(DMZ)通过专线连接外网,客户机区域(trust)通过PPPoE上网. 2.客户有用到 ...
华为防火墙安全区域介绍
1. 安全区域介绍防火墙通俗讲是用于控网络之间的隔离,专业讲是用于保护一个安全区域免受另外一个安全区域的网络攻击和入击行为.从防火墙的定义中可以看出防火墙是基于安全区域的,其它厂商(Cisco,Ju ...
华为防火墙查看日志命令_防火墙接入互联网方式，到底有哪些呢？5分钟学会防火墙入网...
通过静态IP接入互联网局域网内部所有的PC都不是在10.3.0.0/24网段,均通过DHCP动态获取IP地址.企业从运营商处获取固定的IP地址为1.1.1.1/24.企业需要利用防火墙接入互联网. ...
华为防火墙Edumon1000E配置
华为防火墙Edumon1000E,配置有四个光电互斥接口,为千兆状态防火墙.默认情况下所有区域之间不允许有流量经过. 本文为Edumon1000E的基本配置,该基本配置适用一般企业级单机接入情况. 配 ...
华为防火墙USG6320透明模式配置
拓扑图 system-view 进入系统视图,键入Ctrl+Z退回到用户视图. 配置GigabitEthernet 0/0/1工作在交换模式. [USG6300]interface GigabitEt ...

华为防火墙的策略路由

华为防火墙的策略路由相关推荐

最新文章

热门文章