VSYS虚拟防火墙-阿里云开发者社区

VSYS虚拟防火墙

2023-10-27 67

版权

本文内容由阿里云实名注册用户自发贡献，版权归原作者所有，阿里云开发者社区不拥有其著作权，亦不承担相应法律责任。具体规则请查看《阿里云开发者社区用户服务协议》和《阿里云开发者社区知识产权保护指引》。如果您发现本社区中有涉嫌抄袭的内容，填写侵权投诉表单进行举报，一经查实，本社区将立刻删除涉嫌侵权内容。

简介： VSYS虚拟防火墙

拓扑设计

拓扑介绍

LY集团山东分公司网络拓扑如上。现有财务部，研发部与服务器区域。为了保证内网安全需要为每个区域布置不同的流量检测或杀毒模块。所有到达区域的流量都需要经过杀毒检测区域检测流量是否安全合法才可进入区域，又因资金有限所以杀毒检测区域只有一台服务器，现需要合理配置FW实现为3个区域的流量进行检测。

数据配置

SW配置

vlan batch 10 20 30 40 50
#
ip vpn-instance vlan10    //创建实例
 ipv4-family
#
ip vpn-instance vlan20
 ipv4-family
#
interface Vlanif1
#
interface Vlanif10
 ip binding vpn-instance vlan10
 ip address 192.168.10.1 255.255.255.0
 ospf enable 1 area 0.0.0.0
#
interface Vlanif20
 ip binding vpn-instance vlan20
 ip address 192.168.20.1 255.255.255.0
 ospf enable 2 area 0.0.0.0
#
interface Vlanif30
 ip address 192.168.30.1 255.255.255.0
 ospf enable 3 area 0.0.0.0
#
interface Vlanif40
 ip address 192.168.40.1 255.255.255.0
 ospf enable 3 area 0.0.0.0
#
interface Vlanif50
 ip address 192.168.50.1 255.255.255.0
 ospf enable 3 area 0.0.0.0
interface GigabitEthernet0/0/1
 port link-type access
 port default vlan 10
#
interface GigabitEthernet0/0/2
 port link-type access
 port default vlan 20
#
interface GigabitEthernet0/0/3
 port link-type trunk
 port trunk allow-pass vlan 2 to 4094
#
interface GigabitEthernet0/0/4
 port link-type access
 port default vlan 50
#
ospf 1 vpn-instance vlan10
 area 0.0.0.0
#
ospf 2 vpn-instance vlan20
 area 0.0.0.0
#
ospf 3
 area 0.0.0.0

FW配置

vlan batch 10 20 30 40
int vlan 10
int vlan 20
int vlan 30
int vlan 40
#
vsys name vlan10    //创建虚拟防火墙并分配资源
 assign vlan 10
 assign vlan 30
#
vsys name vlan20
 assign vlan 20
 assign vlan 40
#
switch  vsys  vlan10
firewall zone trust
 set priority 85
 add interface Vlanif10
 add interface Vlanif30
#
security-policy
 rule name 1t2
  action permit
#
switch  vsys  vlan20
firewall zone trust
 set priority 85
 add interface Vlanif20
 add interface Vlanif40
#
security-policy
 rule name 1t2
  action permit
#
ospf 1 vpn-instance vlan10
area 0
#
ospf 1 vpn-instance vlan20
area 0
#
interface Vlanif10
 ip binding vpn-instance vlan10
 ip address 192.168.10.2 255.255.255.0
 ospf enable 1 area 0.0.0.0
service-manage all permit
#
interface Vlanif20
 ip binding vpn-instance vlan20
 ip address 192.168.20.2 255.255.255.0
 ospf enable 2 area 0.0.0.0
service-manage all permit
#
interface Vlanif30
 ip binding vpn-instance vlan10
 ip address 192.168.30.2 255.255.255.0
 ospf enable 1 area 0.0.0.0
service-manage all permit
#
interface Vlanif40
 ip binding vpn-instance vlan20
 ip address 192.168.40.2 255.255.255.0
 ospf enable 2 area 0.0.0.0
service-manage all permit
service-manage http permit
service-manage https permit
service-manage ping permit
service-manage ssh permit
service-manage telnet permit