1.拓扑图与实验需求实现思路在防火墙 FW1 配置安全策略 时间段对象基于区域、源地址、目的地址、时间进行精细化访问控制交换机负责 VLAN 划分、网关防火墙配置区域、接口 IP、静态路由保证全网互通。2.需求分析1.vlan2和vlan各需要一个IP2由于办公区PC访问OA Server 的时间限制工作日早8到晚6需要配置基于时间的ACL访问控制列表即在该时间范围内从vlan2到OA Server 的访问而在其他时间则禁止访问3.对于生产区PC访问Web Server的限制除PC3外不能访问可以通过配置基于MAC地址的ACL来实现。先允许所有生产区PC访问Web Server然后针对生产区PC3配置特殊的时间策略允许其在每周一早10到早11访问Web Server4.办公区PC访问OA Server的ACL配置创建一个标准ACL允许VLAN 2的主机访问OA Server的IP地址再创建一个时间范围定义工作日早8到晚6为允许访问的时间将该ACL应用到连接办公区PC的接口上并关联上述时间范围5.生产区PC访问Web Server的ACL配置创建一个扩展ACL禁止生产区VLAN 3的所有主机访问Web Server的IP地址然后针对生产区PC3的MAC地址创建一个允许访问Web Server的permit语句并将其加入到上述ACL中最后将该ACL应用到连接生产区PC的接口上6.路由配置在三层交换机上配置不同VLAN的接口IP地址并启用路由功能以确保不同VLAN之间能够进行通信。同时要为OA Server和Web Server配置相应的IP地址和网关使它们能够在网络中被正确识别和访问。防火墙默认拒绝所有跨区域流量所有放行流量必须显式配置安全策略。3.分步详细配置安全策略命令行配置 1.创建地址命令行创建 [FW]ip address-set AD type object [FW-object-address-set-AD]address 192.168.1.0 mask 25 [FW]ip address-set OA type object [FW-object-address-set-OA]address 10.0.0.1 mask 32 [FW]ip address-set Web type object [FW-object-address-set-Web]address 10.0.0.2 mask 32 [FW]ip address-set PR type object [FW-object-address-set-PR]address 192.168.1.128 mask 25 [FW]ip address-set PC3 type object [FW-object-address-set-PC3]address 192.168.1.130 mask 25 2.创建时间集 [FW]time-range working-time [FW-time-range-working-time]period-range 08:00:00 to 18:00:00 working-day [FW]time-range special-time [FW-time-range-special-time]period-range 10:00:00 to 11:00:00 Mon办公区PC在工作日时间周一至周五早8到晚6可以正常访问OA Server其他时间不允许 [FW]security-policy [FW-policy-security]rule name policy_1 [FW-policy-security-rule-police_1]description AD_to_OA [FW-policy-security-rule-police_1]source-zone trust [FW-policy-security-rule-police_1]destination-zone dmz [FW-policy-security-rule-policy_1]source-address address-set AD [FW-policy-security-rule-police_1]destination-address address-set OA [FW-policy-security-rule-police_1]time-range working-time [FW-policy-security-rule-police_1]action permit办公区PC可以在任意时刻访问Web server [FW]security-policy [FW-policy-security]rule name policy_2 [FW-policy-security-rule-policy_2]description AD_to_Web [FW-policy-security-rule-policy_2]source-zone trust [FW-policy-security-rule-policy_2]destination-zone dmz [FW-policy-security-rule-policy_2]source-address address-set AD [FW-policy-security-rule-policy_2]destination-address address-set Web [FW-policy-security-rule-policy_2]action permit生产区PC可以在任意时刻访问OA Server但是不能访问Web Server [FW]security-policy [FW-policy-security]rule name policy_3 [FW-policy-security-rule-policy_3]description PR_to_OA [FW-policy-security-rule-policy_3]source-zone trust [FW-policy-security-rule-policy_3]destination-zone dmz [FW-policy-security-rule-policy_3]source-address address-set PR [FW-policy-security-rule-policy_3]destination-address address-set OA [FW-policy-security-rule-policy_3]action permit [FW]security-policy [FW-policy-security]rule name policy_4 [FW-policy-security-rule-policy_4]description PR_to_Web [FW-policy-security-rule-policy_4]source-zone trust [FW-policy-security-rule-policy_4]destination-zone dmz [FW-policy-security-rule-policy_4]source-address address-set PR [FW-policy-security-rule-policy_4]destination-address address-set Web [FW-policy-security-rule-policy_4]action deny生产区PC3可以在每周一早上10点到早上11点访问Web Server用来更新企业最新产品信息 [FW]security-policy [FW-policy-security]rule name policy_5 [FW-policy-security-rule-policy_5]description PC3_to_Web [FW-policy-security-rule-policy_5]source-zone trust [FW-policy-security-rule-policy_5]destination-zone dmz [FW-policy-security-rule-policy_5]source-address address-set PC3 [FW-policy-security-rule-policy_5]destination-address address-set Web [FW-policy-security-rule-policy_5]time-range special-time [FW-policy-security-rule-policy_5]action permit4.测试结果PC3pingserverPC1访问serverPC2访问server
安全策略配置
1.拓扑图与实验需求实现思路在防火墙 FW1 配置安全策略 时间段对象基于区域、源地址、目的地址、时间进行精细化访问控制交换机负责 VLAN 划分、网关防火墙配置区域、接口 IP、静态路由保证全网互通。2.需求分析1.vlan2和vlan各需要一个IP2由于办公区PC访问OA Server 的时间限制工作日早8到晚6需要配置基于时间的ACL访问控制列表即在该时间范围内从vlan2到OA Server 的访问而在其他时间则禁止访问3.对于生产区PC访问Web Server的限制除PC3外不能访问可以通过配置基于MAC地址的ACL来实现。先允许所有生产区PC访问Web Server然后针对生产区PC3配置特殊的时间策略允许其在每周一早10到早11访问Web Server4.办公区PC访问OA Server的ACL配置创建一个标准ACL允许VLAN 2的主机访问OA Server的IP地址再创建一个时间范围定义工作日早8到晚6为允许访问的时间将该ACL应用到连接办公区PC的接口上并关联上述时间范围5.生产区PC访问Web Server的ACL配置创建一个扩展ACL禁止生产区VLAN 3的所有主机访问Web Server的IP地址然后针对生产区PC3的MAC地址创建一个允许访问Web Server的permit语句并将其加入到上述ACL中最后将该ACL应用到连接生产区PC的接口上6.路由配置在三层交换机上配置不同VLAN的接口IP地址并启用路由功能以确保不同VLAN之间能够进行通信。同时要为OA Server和Web Server配置相应的IP地址和网关使它们能够在网络中被正确识别和访问。防火墙默认拒绝所有跨区域流量所有放行流量必须显式配置安全策略。3.分步详细配置安全策略命令行配置 1.创建地址命令行创建 [FW]ip address-set AD type object [FW-object-address-set-AD]address 192.168.1.0 mask 25 [FW]ip address-set OA type object [FW-object-address-set-OA]address 10.0.0.1 mask 32 [FW]ip address-set Web type object [FW-object-address-set-Web]address 10.0.0.2 mask 32 [FW]ip address-set PR type object [FW-object-address-set-PR]address 192.168.1.128 mask 25 [FW]ip address-set PC3 type object [FW-object-address-set-PC3]address 192.168.1.130 mask 25 2.创建时间集 [FW]time-range working-time [FW-time-range-working-time]period-range 08:00:00 to 18:00:00 working-day [FW]time-range special-time [FW-time-range-special-time]period-range 10:00:00 to 11:00:00 Mon办公区PC在工作日时间周一至周五早8到晚6可以正常访问OA Server其他时间不允许 [FW]security-policy [FW-policy-security]rule name policy_1 [FW-policy-security-rule-police_1]description AD_to_OA [FW-policy-security-rule-police_1]source-zone trust [FW-policy-security-rule-police_1]destination-zone dmz [FW-policy-security-rule-policy_1]source-address address-set AD [FW-policy-security-rule-police_1]destination-address address-set OA [FW-policy-security-rule-police_1]time-range working-time [FW-policy-security-rule-police_1]action permit办公区PC可以在任意时刻访问Web server [FW]security-policy [FW-policy-security]rule name policy_2 [FW-policy-security-rule-policy_2]description AD_to_Web [FW-policy-security-rule-policy_2]source-zone trust [FW-policy-security-rule-policy_2]destination-zone dmz [FW-policy-security-rule-policy_2]source-address address-set AD [FW-policy-security-rule-policy_2]destination-address address-set Web [FW-policy-security-rule-policy_2]action permit生产区PC可以在任意时刻访问OA Server但是不能访问Web Server [FW]security-policy [FW-policy-security]rule name policy_3 [FW-policy-security-rule-policy_3]description PR_to_OA [FW-policy-security-rule-policy_3]source-zone trust [FW-policy-security-rule-policy_3]destination-zone dmz [FW-policy-security-rule-policy_3]source-address address-set PR [FW-policy-security-rule-policy_3]destination-address address-set OA [FW-policy-security-rule-policy_3]action permit [FW]security-policy [FW-policy-security]rule name policy_4 [FW-policy-security-rule-policy_4]description PR_to_Web [FW-policy-security-rule-policy_4]source-zone trust [FW-policy-security-rule-policy_4]destination-zone dmz [FW-policy-security-rule-policy_4]source-address address-set PR [FW-policy-security-rule-policy_4]destination-address address-set Web [FW-policy-security-rule-policy_4]action deny生产区PC3可以在每周一早上10点到早上11点访问Web Server用来更新企业最新产品信息 [FW]security-policy [FW-policy-security]rule name policy_5 [FW-policy-security-rule-policy_5]description PC3_to_Web [FW-policy-security-rule-policy_5]source-zone trust [FW-policy-security-rule-policy_5]destination-zone dmz [FW-policy-security-rule-policy_5]source-address address-set PC3 [FW-policy-security-rule-policy_5]destination-address address-set Web [FW-policy-security-rule-policy_5]time-range special-time [FW-policy-security-rule-policy_5]action permit4.测试结果PC3pingserverPC1访问serverPC2访问server
