《华为安全认证HCIE》学习笔记 | 配置域内安全策略

Posted 2021-07-08 COCOgsta

网络拓扑

关键配置及验证

OKLABFW删除DMZ接口，将其移至untrust区域中

firewall zone dmz 
 undo add interface GigabitEthernet0/0/1.4
firewall zone untrust 
 add interface GigabitEthernet0/0/1.4

OKLABFW配置域内安全策略

policy zone untrust
 policy 0 
  action permit 
  policy source 192.168.1.0 mask 24
  policy destination 202.100.1.0 mask 24

验证DMZ可以ping通Outside

<DMZ>ping 202.100.1.1
  PING 202.100.1.1: 56  data bytes, press CTRL_C to break
    Reply from 202.100.1.1: bytes=56 Sequence=1 ttl=254 time=160 ms
    Reply from 202.100.1.1: bytes=56 Sequence=2 ttl=254 time=90 ms
    Reply from 202.100.1.1: bytes=56 Sequence=3 ttl=254 time=110 ms
    Reply from 202.100.1.1: bytes=56 Sequence=4 ttl=254 time=80 ms
    Reply from 202.100.1.1: bytes=56 Sequence=5 ttl=254 time=120 ms

  --- 202.100.1.1 ping statistics ---
    5 packet(s) transmitted
    5 packet(s) received
    0.00% packet loss
    round-trip min/avg/max = 80/112/160 ms

<DMZ>