配置IP地址
[FW4-GigabitEthernet1/0/1]ip add 40.1.1.1 24
[FW4-GigabitEthernet1/0/0]ip add 10.1.1.1 24
[FW5-GigabitEthernet1/0/1]ip add 40.1.1.2 24
[FW5-GigabitEthernet1/0/0]ip add 10.1.2.2 24
将接口加入相关区域
[FW4]firewall zone trust
[FW4-zone-trust]add interface GigabitEthernet 1/0/0
[FW4]firewall zone untrust
[FW4-zone-untrust]add interface GigabitEthernet 1/0/1
[FW4]firewall zone dmz
[FW4-zone-dmz]add interface Tunnel 1
[FW5]firewall zone trust
[FW5-zone-trust]add interface GigabitEthernet1/0/0
[FW5]firewall zone untrust
[FW5-zone-untrust]add interface GigabitEthernet 1/0/1
[FW5]firewall zone dmz
[FW5-zone-dmz]add interface Tunnel 1
放行相关服务
[FW4-GigabitEthernet1/0/1]service-manage ping permit
[FW4-GigabitEthernet1/0/0]service-manage ping permit
[FW5-GigabitEthernet1/0/1]service-manage ping permit
[FW5-GigabitEthernet1/0/0]service-manage ping permit
配置GRE隧道接口
[FW4]int Tunnel 1
[FW4-Tunnel1]ip add 172.16.2.1 30
[FW4-Tunnel1]tunnel-protocol gre
[FW4-Tunnel1]source 40.1.1.1
[FW4-Tunnel1]destination 40.1.1.2
[FW5]interface Tunnel 1
[FW5-Tunnel1]ip add 172.16.2.2 30
[FW5-Tunnel1]tunnel-protocol gre
[FW5-Tunnel1]source 40.1.1.2
[FW5-Tunnel1]destination 40.1.1.1
配置到对端的路由
[FW4]ip route-static 10.1.2.0 24 Tunnel 1
[FW5]ip route-static 10.1.1.0 24 Tunnel 1
配置安全策略
[FW4]security-policy
[FW4-policy-security]rule name gre1 //允许网段互访
[FW4-policy-security-rule-gre1]source-zone trust
[FW4-policy-security-rule-gre1]destination-zone dmz
[FW4-policy-security-rule-gre1]source-address 10.1.1.0 24
[FW4-policy-security-rule-gre1]destination-address 10.1.2.0 24
[FW4-policy-security-rule-gre1]action permit
[FW4-policy-security-rule-gre]rule name gre2
[FW4-policy-security-rule-gre2]source-zone dmz
[FW4-policy-security-rule-gre2]destination-zone trust
[FW4-policy-security-rule-gre2]source-address 10.1.2.0 24
[FW4-policy-security-rule-gre2]destination-address 10.1.1.0 24
[FW4-policy-security-rule-gre2]action permit
[FW4-policy-security]rule name gre3 //放行封装后的gre报文
[FW4-policy-security-rule-gre3]source-zone
[FW4-policy-security-rule-gre3]source-zone local untrust
[FW4-policy-security-rule-gre3]destination-zone local untrust
[FW4-policy-security-rule-gre3]service gre
[FW4-policy-security-rule-gre3]action permit
[FW5]security-policy
[FW5-policy-security]rule name gre1
[FW5-policy-security-rule-gre1]source-zone trust
[FW5-policy-security-rule-gre1]destination-zone dmz
[FW5-policy-security-rule-gre1]source-address 10.1.2.0 24
[FW5-policy-security-rule-gre1]destination-address 10.1.1.0 24
[FW5-policy-security-rule-gre1]action permit
[FW5-policy-security]rule name gre2
[FW5-policy-security-rule-gre2]source-zone dmz
[FW5-policy-security-rule-gre2]destination-zone trust
[FW5-policy-security-rule-gre2]source-address 10.1.1.0 24
[FW5-policy-security-rule-gre2]destination-address 10.1.2.0 24
[FW5-policy-security-rule-gre2]action permit
[FW5-policy-security]rule name gre3
[FW5-policy-security-rule-gre3]source-zone local untrust
[FW5-policy-security-rule-gre3]destination-zone local untrust
[FW5-policy-security-rule-gre3]service gre
[FW5-policy-security-rule-gre3]action permit
验证
PC1 ping server1时在FW4的G1/0/1口抓包
