使用ensp配置网络安全

拓扑图

在此基础上继续搭建

配置路由器与防火墙之间的互联地址为192.168.5.2/24，在路由器OSPF中发布与防火墙互联网段。
配置防火墙与路由器互联地址为192.168.5.1/24. 配置与外网互联地址为192.168.12.9/24，设置外网默认路由。
配置内网访问外网nat规则，保护内网地址。 设置访问策略，部门1、部门2设置可以访问外网，部门三设置为不能访问外网。
防火墙使用USG5500

配置cloud

配置防火墙

<SRG>sys
[SRG]firewall zone trust 
[SRG-zone-trust]add interface GigabitEthernet 0/0/2
[SRG-zone-trust]qu
[SRG]firewall zone untrust 
[SRG-zone-untrust]add interface GigabitEthernet 0/0/1
[SRG-zone-untrust]qu
[SRG]interface GigabitEthernet 0/0/2
[SRG-GigabitEthernet0/0/2]ip address 192.168.5.1 24
[SRG-GigabitEthernet0/0/2]qu
[SRG]interface GigabitEthernet 0/0/1
[SRG-GigabitEthernet0/0/1]ip address 192.168.12.9 24
[SRG-GigabitEthernet0/0/1]qu
[SRG]ip route-static 0.0.0.0 0 192.168.12.1
[SRG]policy interzone trust untrust outbound 
[SRG-policy-interzone-trust-untrust-outbound]policy 0
[SRG-policy-interzone-trust-untrust-outbound-0]action permit 
[SRG-policy-interzone-trust-untrust-outbound-0]policy source 172.16.0.0 0.0.255.255	
[SRG-policy-interzone-trust-untrust-outbound-0]quit 
[SRG-policy-interzone-trust-untrust-outbound]qu
[SRG]nat-policy interzone trust untrust outbound 	
[SRG-nat-policy-interzone-trust-untrustoutbound]policy 1
[SRG-nat-policy-interzone-trust-untrust-outbound-1]action source-nat 	
[SRG-nat-policy-interzone-trust-untrust-outbound-1]policy source 172.16.0.0 0.0.255.255
[SRG-nat-policy-interzone-trust-untrust-outbound-1]easy-ip GigabitEthernet 0/0/1
[SRG-nat-policy-interzone-trust-untrust-outbound-1]qu
[SRG-nat-policy-interzone-trust-untrust-outbound]qu
[SRG]ospf 1
[SRG-ospf-1]area 0
[SRG-ospf-1-area-0.0.0.0]network 192.168.5.0 0.0.0.255
[SRG-ospf-1-area-0.0.0.0]qu
[SRG-ospf-1]default-route-advertise always cost 200 type 1

配置R1

[R1]interface GigabitEthernet 0/0/2
[R1-GigabitEthernet0/0/2]ip address 192.168.5.2 24	
[R1-GigabitEthernet0/0/2]quit 
[R1]ospf 1
[R1-ospf-1]area 0
[R1-ospf-1-area-0.0.0.0]network 192.168.5.0 0.0.0.255

测试