【实验】配置CISCO IOS基于区域的防火墙

欢迎关注微信公众号【厦门微思网络】。www.xmws.cn专业IT认证培训19周年
主要课程：思科、华为、红帽、ORACLE、VMware、CISP、PMP等认证培训及考证

配置需求

配置CISCO IOS基于区域的防火墙

A. 使得Inside的网络可以访问Outside所用服务B. 使得Inside的网络可以访问Dmz（只能访问Dmz的telnet服务）C. 使得Outside网络可以访问Dmz（只能访问Dmz的telnet服务）

扫描二维码关注公众号，回复： 13176037 查看本文章

１．配置设备IP地址和路由(使用EIGRP动态路由协议使得整个网络互通)

interface FastEthernet0/0
 ip address 15.1.1.1 255.255.255.0
 no sh
router eigrp 100
 network 15.1.1.0 0.0.0.255
 no auto-summary

• 配置R２

interface Serial2/0
ip address 25.1.1.2 255.255.255.0
no sh
router eigrp 100
network 25.1.1.0 0.0.0.255
no auto-summary

配置R３：

interface Serial2/0
 ip address 35.1.1.3 255.255.255.0
no sh
router eigrp 100
 network 35.1.1.0 0.0.0.255
no auto-summary

配置R４：

interface Serial2/0
 ip address 45.1.1.4 255.255.255.0
no sh
router eigrp 100
 network 45.1.1.0 0.0.0.255
no auto-summary

配置R５：

interface FastEthernet0/0
 description ###conn to R1 F0/0###
 ip address 15.1.1.5 255.255.255.0
no sh
interface Serial2/0
 description ###conn to R2 S2/0###
 ip address 25.1.1.5 255.255.255.0
no sh
interface Serial2/1
 description ###conn to R3 S2/0###
 ip address 35.1.1.5 255.255.255.0
no sh
interface Serial2/2
 description ###conn to R4 S2/0###
 ip address 45.1.1.5 255.255.255.0
no sh
router eigrp 100
 network 15.1.1.0 0.0.0.255
network 25.1.1.0 0.0.0.255
network 35.1.1.0 0.0.0.255
network 45.1.1.0 0.0.0.255
no auto-summary

2．按需求在R5上配置基于区域的防火墙

实现需求A：使得Inside的网络可以访问Outside所用服务

配置安全区域

zone security Inside
zone security Dmz
zone security Outside

配置class map

ip access-list extended In_to_Out_Acl
 permit ip any any

class-map type inspect match-all Inside_to_Outside_Cmap
 match access-group name In_to_Out_Acl

配置policy map

policy-map type inspect In_to_Out_Pmap
 class type inspect Inside_to_Outside_Cmap
  inspect

配置区域对

zone-pair security mypair1 source Inside destination Outside
 service-policy type inspect In_to_Out_Pmap

把接口分配到区域

interface FastEthernet0/0
zone-member security Outside

interface Serial2/0
zone-member security Inside
interface Serial2/１
zone-member security Inside

实现求B：

使得Inside的网络可以访问Dmz（只能访问Dmz的telnet服务）
class-map type inspect match-all Inside_to_Dmz_Cmap
 match protocol telnet

.

policy-map type inspect In_to_Dmz_Pmap
 class type inspect Inside_to_Dmz_Cmap
  inspect
 
zone-pair security mypair3 source Inside destination Dmz
 service-policy type inspect In_to_Dmz_Pmap
 
interface Serial2/2
zone-member security Dmz

实现需求C：

使得Outside网络可以访问Dmz（只能访问Dmz的telnet服务）

class-map type inspect match-all Outside_to_Dmz_Cmap
 match protocol telnet

policy-map type inspect Out_to_Dmz_Pmap
class type inspect Outside_to_Dmz_Cmap
  inspect

zone-pair security mypair2 source Outside destination Dmz
 service-policy type inspect Out_to_Dmz_Pmap

检查命令：