一、实验拓扑:
2-华为防火墙:安全策略分类_第1张图片
二、实验要求:
ASA中只能定义个主机或者一个范围,SRG可以同时定义主机、范围;
从虚拟防火墙的到物理防火墙也是Inbound,华为里管理类型防火墙就是思科的管理子防火墙;
三、命令部署:
1、R1、R2、R3地址省略,部署默认路由到USG:
[R1]ip route-static 0.0.0.0 0.0.0.0 202.100.1.10
[R2]ip route-static 0.0.0.0 0.0.0.0 192.168.1.10
[R3]ip route-static 0.0.0.0 0.0.0.0 10.1.1.10
2、USG部署:
[SRG]ip service-set aaa type object
[SRG-object-service-set-aaa]service protocol icmp
[SRG]policy interzone trust untrust outbound
[SRG-policy-interzone-trust-untrust-outbound]policy 0
[SRG-policy-interzone-trust-untrust-outbound-0]policy source 192.168.1.0 mask 24
[SRG-policy-interzone-trust-untrust-outbound-0]policy destination 202.100.1.0 mask 24
[SRG-policy-interzone-trust-untrust-outbound-0]policy service service-set aaa
[SRG-policy-interzone-trust-untrust-outbound-0]action permit

[SRG]display current-configuration configuration object-service-set
ip service-set aaa type object
service 0 protocol icmp
[SRG]display current-configuration configuration policy-interzone
policy interzone trust untrust outbound
policy 0
action permit
policy service service-set aaa
policy source 192.168.1.0 mask 24
policy destination 202.100.1.0 mask 24
测试:
[R2]ping 202.100.1.1
Reply from 202.100.1.1: bytes=56 Sequence=1 ttl=254 time=50 ms
Reply from 202.100.1.1: bytes=56 Sequence=2 ttl=254 time=50 ms
Reply from 202.100.1.1: bytes=56 Sequence=3 ttl=254 time=40 ms
Reply from 202.100.1.1: bytes=56 Sequence=4 ttl=254 time=30 ms
Reply from 202.100.1.1: bytes=56 Sequence=5 ttl=254 time=30 ms

[R1]ping 192.168.1.1
Request time out
Request time out
Request time out
Request time out
Request time out