拓扑图
地址表
|
Device |
Interface |
IP Address |
Subnet Mask |
Default Gateway |
|
R1 |
Fa0/0 |
10.26.11.1 |
255.255.255.0 |
N/A |
| S0/0/0000 |
10.26.1.1 |
255.255.255.0 |
N/A |
|
|
R2 |
S0/0/0100 |
10.26.1.2 |
255.255.255.0 |
N/A |
| S0/0/1 |
10.26.2.2 |
255.255.255.0 |
N/A |
|
|
R3 |
Fa0/0 |
10.26.13.1 |
255.255.255.0 |
N/A |
| S0/0/1 |
10.26.2.3 |
255.255.255.0 |
N/A |
|
| PC-A |
NIC |
10.26.11.3 |
255.255.255.0 |
10.26.11.1 |
| PC-C |
NIC |
10.26.13.3 |
255.255.255.0 |
10.26.13.1 |
配置静态路由使其能ping通
Router1(config)#ip route 10.26.2.0 255.255.255.0 10.26.1.2
Router1(config)#ip route 10.26.13.0 255.255.255.0 10.26.1.2
Router2(config)#ip route 10.26.13.0 255.255.255.0 10.26.2.3
Router2(config)#ip route 10.26.11.0 255.255.255.0 10.26.1.1
Router3(config)#ip route 10.26.1.0 255.255.255.0 10.26.2.2
Router3(config)#ip route 10.26.11.0 255.255.255.0 10.26.2.2
网络ping通测试
PC-A ping通PC-C。
PC-C ping 通PC-A
PC-C telnet到s0/0/1接口
PC-C登到PC-A的网页
在R3创建区域防火墙
Router3(config)#zone security IN-ZONE
Router3(config-sec-zone)#zone security OUT-ZONE
Router3(config-sec-zone)#ex
Router3(config)#access-list 101 permit ip 10.26.13.0 0.0.0.255 any
Router3(config)#class-map type inspect match-all IN-NET-CLASS-MAP
Router3(config-cmap)#match access-group 101
Router3(config-cmap)#ex
Router3(config)#policy-map type inspect IN-2-OUT-PMAP
Router3(config-pmap)#class type inspect IN-NET-CLASS-MAP
Router3(config-pmap-c)#inspect
%No specific protocol configured in class IN-NET-CLASS-MAP for inspection. All protocols will be inspected
Router3(config-pmap-c)#
Router3(config-pmap-c)#ex
Router3(config-pmap)#ex
Router3(config)#zone-pair security IN-2-OUT-ZPAIR source IN-ZONE destination OUT-ZONE
Router3(config-sec-zone-pair)#service-policy type inspect IN-2-OUT-PMAP
Router3(config-sec-zone-pair)#ex
Router3(config)#int f0/0
Router3(config-if)#zone-member security IN-ZONE
Router3(config-if)#ex
Router3(config)#int s0/0/1
Router3(config-if)#zone-member security OUT-ZONE
Router3(config-if)#ex
Router3(config)#ex
Router3#
%SYS-5-CONFIG_I: Configured from console by console
Router3#show policy-map type inspect zone-pair sessions
Zone-pair: IN-2-OUT-ZPAIR
PC-C能成功ping到PC-A
然后登陆pc-ad的网页的同时查看R3的命令
R3# show policy-map type inspect zone-pair sessions
Zone-pair: IN-ZONE-OUT-ZONE
Service-policy inspect : IN-2-OUT-PMAP
Class-map: IN-NET-CLASS-MAP (match-all)
Match: access-group 101
Inspect
Established Sessions
Session 139142400 (10.26.13.3:1027)=>(10.26.11.3:80)
http:tcp SIS_OPEN