學習目的
掌握防火牆安全區域的配置方法
掌握對安全區域的參數配置
掌握在區域之間進行包過濾的方法
拓撲圖
場景
你是公司網絡管理者。公司總部的網絡分成了三個區域，包括内部區域（Trust）外部區域（Untrust）和伺服器區域（DMZ）。現在設計通過防火牆來實作對資料的控制。在交換機上将G0/0/1與G0/0/21接口定義到vlan11，将G0/0/2與G0/0/22接口定義到vlan12，将G0/0/3與G0/0/23接口定義到vlan13.分别規劃了三個網段。
現在滿足一下要求：
“Trust”區域的使用者可以通路“Untrust”的使用者；
“Trust”和“Untrust”區域的使用者可以通路“DMZ”區域的使用者；
“Untrust”區域使用者不能直接通路“Trust”區域使用者；
“DMZ”區域使用者不能直接通路“Trust”和“Untrust”區域的使用者。
學習任務
步驟一.基本配置與IP編址
首先給三個路由器配置位址資訊
[Huawei]sysname R1
[R1]interface g0/0/1
[R1-GigabitEthernet0/0/1]ip add 10.0.10.124
[R1-GigabitEthernet0/0/1]desc this portconnect to S1-G0/0/1
[R1-GigabitEthernet0/0/1]interfaceloopback0
[R1-LoopBack0]ip add 10.0.1.1 24
[R1-LoopBack0]q
[Huawei]sysname R2
[R2]interface g0/0/1
[R2-GigabitEthernet0/0/1]ip add 10.0.20.224
[R2-GigabitEthernet0/0/1]desc this portconnect to S1-G0/0/2
[R2-GigabitEthernet0/0/1]interfaceloopback0
[R2-LoopBack0]ip add 10.0.2.2 24
[R2-LoopBack0]q
[Huawei]sysname R3
[R3]interface g0/0/1
[R3-GigabitEthernet0/0/1]ip add 10.0.30.324
[R3-GigabitEthernet0/0/1]desc this portconnect to S1-G0/0/3
[R3-GigabitEthernet0/0/1]interfaceloopback0
[R3-LoopBack0]ip add 10.0.3.3 24
[R3-LoopBack0]q
給防火牆配置位址，G0/0/1IP位址：10.0.20.254/24.作為Inside區域的網關。
[SRG]sysname FW
08:34:20 2014/07/05
[FW]interface g0/0/1
08:35:50 2014/07/05
[FW-GigabitEthernet0/0/1]ip add 10.0.20.25424
08:36:01 2014/07/05
[FW-GigabitEthernet0/0/1]description thisport connect to S1-G0/0/22
08:38:06 2014/07/05
[FW-GigabitEthernet0/0/1]interface g0/0/0
08:39:08 2014/07/05
[FW-GigabitEthernet0/0/0]ip add 10.0.10.25424
08:39:27 2014/07/05
Info: The DHCP server configuration on thisinterface will be deleted.
[FW-GigabitEthernet0/0/0]desc tihis portconnect to S1-G0/0/21
08:40:02 2014/07/05
[FW-GigabitEthernet0/0/0]interface G0/0/2
08:40:15 2014/07/05
[FW-GigabitEthernet0/0/2]ip add 10.0.30.25424
08:40:30 2014/07/05
[FW-GigabitEthernet0/0/2]desc this portconnect to S1-G0/0/23
08:41:05 2014/07/05
[FW-GigabitEthernet0/0/2]q
08:41:07 2014/07/05
在交換機上需要按照需求定義vlan。
[Huawei]sysname S1
[S1]vlan batch 11 to 13
Info: This operation may take a fewseconds. Please wait for a moment...done.
[S1]interface g0/0/1
[S1-GigabitEthernet0/0/1]port link-typeaccess
[S1-GigabitEthernet0/0/1]port default vlan11
[S1-GigabitEthernet0/0/1]interface g0/0/2
[S1-GigabitEthernet0/0/2]port link-typeaccess
[S1-GigabitEthernet0/0/2]port default vlan12
[S1]interface g0/0/3
[S1-GigabitEthernet0/0/3]port link-typeaccess
[S1-GigabitEthernet0/0/3]port default vlan13
[S1-GigabitEthernet0/0/3]interface g0/0/21
[S1-GigabitEthernet0/0/21]port link-typeaccess
[S1-GigabitEthernet0/0/21]port default vlan11
[S1-GigabitEthernet0/0/21]interface g0/0/22
[S1-GigabitEthernet0/0/22]port link-typeaccess
[S1-GigabitEthernet0/0/22]port default vlan12
[S1-GigabitEthernet0/0/22]interface g0/0/23
[S1-GigabitEthernet0/0/23]port link-typeaccess
[S1-GigabitEthernet0/0/23]port default vlan13
步驟二.将接口配置到安全區域
防火牆上預設有四個區域，分别是“local”、“trust”“untrust”、“dmz”。
試驗中我們用到“trust”“untrust”、“dmz”三個區域。G0/0/0加入untrust區域，G0/0/2加入DMZ區域，G0/0/1加入trust區域。
[FW]firewall zone trust
09:09:15 2014/07/05
[FW-zone-trust]dis this
09:09:19 2014/07/05
#
firewall zone trust
setpriority 85
addinterface GigabitEthernet0/0/0
return
[FW-zone-trust]undo add inter
[FW-zone-trust]undo add interface g0/0/0
09:09:35 2014/07/05
[FW-zone-trust]add interface g0/0/1
09:10:01 2014/07/05
[FW]firewall zone untrust
09:11:24 2014/07/05
[FW-zone-untrust]add interface g0/0/0
09:11:36 2014/07/05
[FW-zone-untrust]q
[FW]firewall zone dmz
09:12:07 2014/07/05
[FW-zone-dmz]add interface g0/0/2
09:12:16 2014/07/05
[FW-zone-dmz]q
預設情況下，防火請并不允許除local區域外的其他區域之間的通信。為了友善于驗證配置的正确性，我們首先将防火牆區域之間的預設規則配置為允許所有區域之間通訊。配置完成後在FW裝置上測試相同區域的連通性。
[FW]firewall packet-filter default permitall
09:17:33 2014/07/05
Warning:Setting the default packetfiltering to permit poses security risks. You
are advised to configure the securitypolicy based on the actual data flows. Are
you sure you want to continue?[Y/N]y
[FW]ping -c 1 10.0.10.1
09:18:04 2014/07/05
PING 10.0.10.1: 56 data bytes,press CTRL_C to break
Reply from 10.0.10.1: bytes=56 Sequence=1 ttl=255 time=180 ms
---10.0.10.1 ping statistics ---
1packet(s) transmitted
1packet(s) received
0.00% packet loss
round-trip min/avg/max = 180/180/180 ms
[FW]ping -c 1 10.0.20.2
09:18:11 2014/07/05
PING 10.0.20.2: 56 data bytes,press CTRL_C to break
Reply from 10.0.20.2: bytes=56 Sequence=1 ttl=255 time=120 ms
---10.0.20.2 ping statistics ---
1 packet(s) received
round-trip min/avg/max = 120/120/120 ms
[FW]ping -c 1 10.0.30.3
09:18:16 2014/07/05
PING 10.0.30.3: 56 data bytes,press CTRL_C to break
Reply from 10.0.30.3: bytes=56 Sequence=1 ttl=255 time=110 ms
---10.0.30.3 ping statistics ---
round-tripmin/avg/max = 110/110/110 ms
在R1、R2、R3上配置預設路由，在FW上配置明确的靜态路由。實作三個loopback0接口連接配接的網段之間的互通。
[R1]ip route-static 0.0.0.0 0.0.0.010.0.10.254
[R2]ip route-static 0.0.0.0 0.0.0.010.0.20.254
[R3]ip route-static 0.0.0.0 0.0.0.010.0.30.254
[FW]ip route-static 10.0.1.0 24 10.0.10.1
09:24:57 2014/07/05
[FW]ip route-static 10.0.2.0 24 10.0.20.2
09:25:14 2014/07/05
[FW]ip route-static 10.0.3.0 24 10.0.30.3
09:25:29 2014/07/05
[FW]
配置完成後，測試個路由器loopback0接口的網段之間的通訊情況。
[R1]ping -a 10.0.1.1 10.0.2.2
PING 10.0.2.2: 56 data bytes,press CTRL_C to break
Reply from 10.0.2.2: bytes=56 Sequence=1 ttl=254 time=110 ms
Reply from 10.0.2.2: bytes=56 Sequence=2 ttl=254 time=60 ms
Reply from 10.0.2.2: bytes=56 Sequence=3 ttl=254 time=100 ms
Reply from 10.0.2.2: bytes=56 Sequence=4 ttl=254 time=90 ms
Reply from 10.0.2.2: bytes=56 Sequence=5 ttl=254 time=50 ms
---10.0.2.2 ping statistics ---
5packet(s) transmitted
5packet(s) received
round-tripmin/avg/max = 50/82/110 ms
[R1]ping -a 10.0.1.1 10.0.3.3
PING 10.0.3.3: 56 data bytes,press CTRL_C to break
Reply from 10.0.3.3: bytes=56 Sequence=1 ttl=254 time=90 ms
Reply from 10.0.3.3: bytes=56 Sequence=2 ttl=254 time=40 ms
Reply from 10.0.3.3: bytes=56 Sequence=3 ttl=254 time=70 ms
Reply from 10.0.3.3: bytes=56 Sequence=4 ttl=254 time=50 ms
Reply from 10.0.3.3: bytes=56 Sequence=5 ttl=254 time=60 ms
---10.0.3.3 ping statistics ---
round-tripmin/avg/max = 40/62/90 ms
步驟四.配置區域安全政策
配置區域之間的政策，首先将防火牆的區域間預設過濾政策配置為拒絕所有通信，然後配置僅允許Trust區域通路其他區域，不允許其他區域之間通路。
[FW]firewall packet-filter default deny all
[FW]firewall packet-filter default permitinterzone trust untrust direction outbound
09:41:35 2014/07/05
[FW]firewall packet-filter default permitinterzone trust dmz direction outbound
Warning:Setting the default packet filteringto permit poses security risks. You
[FW]firewall session link-state check
09:43:20 2014/07/05
配置完成後，測試區域之間的連通性。
Untrust區域到Trust區域
<R1>ping -a 10.0.1.1 10.0.2.2
Request time out
0packet(s) received
100.00% packetloss
Untrust區域到DMZ區域
<R1>ping -a 10.0.1.1 10.0.3.3
Trust區域到Untrust區域
<R2>ping -a 10.0.2.2 10.0.1.1
PING 10.0.1.1: 56 data bytes,press CTRL_C to break
Reply from 10.0.1.1: bytes=56 Sequence=1 ttl=254 time=100 ms
Reply from 10.0.1.1: bytes=56 Sequence=2 ttl=254 time=70 ms
Reply from 10.0.1.1: bytes=56 Sequence=3 ttl=254 time=100 ms
Reply from 10.0.1.1: bytes=56 Sequence=4 ttl=254 time=80 ms
Reply from 10.0.1.1: bytes=56 Sequence=5 ttl=254 time=90 ms
---10.0.1.1 ping statistics ---
round-trip min/avg/max = 70/88/100 ms
Trust區域到DMZ區域
<R2>ping -a 10.0.2.2 10.0.3.3
Reply from 10.0.3.3: bytes=56 Sequence=1 ttl=254 time=70 ms
Reply from 10.0.3.3: bytes=56 Sequence=2 ttl=254 time=110 ms
Reply from 10.0.3.3: bytes=56 Sequence=3 ttl=254 time=50 ms
Reply from 10.0.3.3: bytes=56 Sequence=4 ttl=254 time=40 ms
round-trip min/avg/max = 40/66/110 ms
DMZ區域到Untrust區域
<R3>ping -a 10.0.3.3 10.0.1.1
100.00% packet loss
DMZ區域到Trust區域
<R3>ping -a 10.0.3.3 10.0.2.2
步驟五.配置允許Untrust區域通路DMZ區域的特定伺服器
DMZ區域有一台伺服器，IP位址為10.0.3.3。需要對Untrust區域開放Telnet服務，同時為了測試網絡，需要開放ICMP ping測試功能。
[FW]policy interzone dmz untrust inbound
09:54:29 2014/07/05
[FW-policy-interzone-dmz-untrust-inbound]policy1
09:54:39 2014/07/05
[FW-policy-interzone-dmz-untrust-inbound-1]policyservice service-set icmp
09:54:58 2014/07/05
[FW-policy-interzone-dmz-untrust-inbound-1]policydestination 10.0.3.3 0
09:55:19 2014/07/05
[FW-policy-interzone-dmz-untrust-inbound-1]actionpermit
09:55:29 2014/07/05
[FW-policy-interzone-dmz-untrust-inbound-1]q
09:55:30 2014/07/05
[FW-policy-interzone-dmz-untrust-inbound]policy2
09:55:38 2014/07/05
[FW-policy-interzone-dmz-untrust-inbound-2]policyservice service-set telnet
09:55:55 2014/07/05
[FW-policy-interzone-dmz-untrust-inbound-2]policydestination 10.0.3.3 0
09:56:05 2014/07/05
[FW-policy-interzone-dmz-untrust-inbound-2]actionpermit
09:56:25 2014/07/05
[FW-policy-interzone-dmz-untrust-inbound-2]q
09:56:27 2014/07/05
[FW-policy-interzone-dmz-untrust-inbound]policy3
09:56:30 2014/07/05
[FW-policy-interzone-dmz-untrust-inbound-3]actiondeny
09:56:37 2014/07/05
[FW-policy-interzone-dmz-untrust-inbound-3]
為了能進行telnet測試，在R3上開啟telnet功能。
[R3]user-interface vty 0 4
[R3-ui-vty0-4]auth
[R3-ui-vty0-4]authentication-mode pass
[R3-ui-vty0-4]authentication-mode password
Please configure the login password(maximum length 16):16
[R3-ui-vty0-4]set auth
[R3-ui-vty0-4]set authentication pass
[R3-ui-vty0-4]set authentication password ?
cipher Set the password withcipher text
[R3-ui-vty0-4]set authentication passwordcp
[R3-ui-vty0-4]set authentication passwordci
[R3-ui-vty0-4]set authentication passwordcipher huawei
[R3-ui-vty0-4]user pri
[R3-ui-vty0-4]user privilege lev
[R3-ui-vty0-4]user privilege level 3
[R3-ui-vty0-4]
測試網絡連通性
<R1>ping -c 1 10.0.3.3
Reply from 10.0.3.3: bytes=56 Sequence=1 ttl=254 time=60 ms
round-trip min/avg/max = 60/60/60 ms
<R1>ping -c 1 -a 10.0.1.1 10.0.3.3
PING10.0.3.3: 56 data bytes, press CTRL_C tobreak
round-trip min/avg/max = 70/70/70 ms
<R1>ping 10.0.30.3
<R1>telnet10.0.3.3
Press CTRL_] to quit telnet mode
Trying 10.0.3.3 ...
Connected to 10.0.3.3 ...
Loginauthentication
Password:
<R3>
如測試結果，顯示區域之間的過濾情況。除了特定放行的資料流外，其它資料流被過濾掉了。
本文轉自 zhuxtqw 51CTO部落格，原文連結：http://blog.51cto.com/1054054/1434997，如需轉載請自行聯系原作者
![nmap –script 使用：nmap-vulners 和 vulscan出現錯誤 ‘/usr/bin/../share/nmap/scripts/vulscan’ found, but will[圖]](data:image/gif;base64,R0lGODlhAQABAIAAAP///wAAACwAAAAAAQABAAACAkQBADs=)