实验目的：
掌握简单配置防火墙路由模式的操作方法
网络地址及拓扑结构：
配置要求：
1、lan可以访问wan、dmz；
2、wan可以访问dmz，不能访问lan；
配置操作
一、PC1
二、SERVER1
三、AR1
<Huawei>sys //进入系统视图
Enter system view, return user view with Ctrl+Z.
[Huawei]un in en //取消命令提示说明
Info: Information center is disabled.
[Huawei]sysname AR1 //修改路由器的设备名称
[AR1]int gi 0/0/0 //进入接口视图
[AR1-GigabitEthernet0/0/0]ip addr 10.1.1.2 24 //配置接口IP
[AR1-GigabitEthernet0/0/0]q //返回系统视图
[AR1]ip route-static 0.0.0.0 0.0.0.0 10.1.1.1 //配置缺省静态路由
四、防火墙FW配置
<USG6000V1>sys
Enter system view, return user view with Ctrl+Z.
[USG6000V1]un in en
Info: Saving log files...
Info: Information center is disabled.
[USG6000V1]sysname FW
[FW]int gi 1/0/2 //进入dmz接口配置
[FW-GigabitEthernet1/0/2]ip addr 10.1.1.1 24 //设置IP及子网
[FW-GigabitEthernet1/0/2]service-manage ping permit //此接口允许ping通过
[FW-GigabitEthernet1/0/2]int gi 1/0/0 //进入trust接口配置
[FW-GigabitEthernet1/0/0]ip addr 192.168.10.1 24 //设置IP及子网
[FW-GigabitEthernet1/0/0]service-manage ping permit //此接口允许ping通过
<FW>sys
Enter system view, return user view with Ctrl+Z.
[FW]int gi 1/0/1 //进入untrust接口配置
[FW-GigabitEthernet1/0/1]ip addr 10.10.10.1 24 //设置IP及子网
[FW-GigabitEthernet1/0/1]service-manage ping permit //此接口允许ping通过
[FW-GigabitEthernet1/0/1]q
[FW]firewall zone trust //进入安全域配置
[FW-zone-trust]add int gi 1/0/0 //把接口加入到该安全域中
[FW-zone-trust]q
[FW]firewall zone dmz
[FW-zone-dmz]add int gi 1/0/1
[FW-zone-dmz]q
[FW]firewall zone untrust
[FW-zone-untrust]add int gi 1/0/2
[FW-zone-untrust]q
[FW]security-policy //进入安全策略配置
[FW-policy-security]rule name lan_wan_dmz //创建名为lan——wan——dmz的策略规则
[FW-policy-security-rule-lan_wan_dmz]source-zone trust //策略中的源安全域
[FW-policy-security-rule-lan_wan_dmz]destination-zone dmz //策略中的目标安全域
[FW-policy-security-rule-lan_wan_dmz]destination-zone untrust
[FW-policy-security-rule-lan_wan_dmz]action permit //启动策略规则
[FW-policy-security-rule-lan_wan_dmz]q
[FW-policy-security]rule name wan_dmz
[FW-policy-security-rule-wan_dmz]source-zone untrust
[FW-policy-security-rule-wan_dmz]destination-zone dmz
[FW-policy-security-rule-wan_dmz]action permit
[FW-policy-security-rule-wan_dmz]q
[FW-policy-security]q
[FW]ip route-static 192.168.10.0 24 192.168.10.2 //配置到LAN的静态路由
[FW]ip route-static 10.10.10.0 24 10.10.10.2 //配置到DMZ的静态路由
[FW]ip route-static 10.1.1.0 24 10.1.1.2 //配置到WAN的静态路由
测试配置结果：
用PC1pingWAN、DMZ
用AR ping PC1和DMZ
