SECPATH F100-C60-WiNet+基于端口上的访问控制

可以先创建服务对象组，添加对应的端口，然后在安全策略下只放通对应的服务

# 创建名为web的服务对象组，并定义其支持的服务为HTTP。

[Device] object-group service web

[Device-obj-grp-service-web] service 6 destination eq 80

[Device-obj-grp-service-web] quit

(5)       配置安全策略及规则

# 进入IPv4安全策略视图。

[Device] security-policy ip

# 制订允许总裁办在任意时间通过HTTP协议访问财务数据库服务器的安全策略规则，其规则名称为president-database。

[Device-security-policy-ip] rule 0 name president-database

[Device-security-policy-ip-0-president-database] source-zone president

[Device-security-policy-ip-0-president-database] destination-zone database

[Device-security-policy-ip-0-president-database] source-ip president

[Device-security-policy-ip-0-president-database] destination-ip database

[Device-security-policy-ip-0-president-database] service web

[Device-security-policy-ip-0-president-database] action pass

[Device-security-policy-ip-0-president-database] quit

# 制订只允许财务部在工作时间通过HTTP协议访问财务数据库服务器的安全策略规则，其规则名称为finance-database。

[Device-security-policy-ip] rule 1 name finance-database

[Device-security-policy-ip-1-finance-database] source-zone finance

[Device-security-policy-ip-1-finance-database] destination-zone database

[Device-security-policy-ip-1-finance-database] source-ip finance

[Device-security-policy-ip-1-finance-database] destination-ip database

[Device-security-policy-ip-1-finance-database] service web

[Device-security-policy-ip-1-finance-database] action pass

[Device-security-policy-ip-1-finance-database] time-range work

[Device-security-policy-ip-1-finance-database] quit

# 制订禁止市场部在任何时间通过HTTP协议访问财务数据库服务器的安全策略规则，其规则名称为market-database。

[Device-security-policy-ip] rule 2 name market-database

[Device-security-policy-ip-2-market-database] source-zone market

[Device-security-policy-ip-2-market-database] destination-zone database

[Device-security-policy-ip-2-market-database] source-ip market

[Device-security-policy-ip-2-market-database] destination-ip database

[Device-security-policy-ip-2-market-database] service web

[Device-security-policy-ip-2-market-database] action drop

[Device-security-policy-ip-2-market-database] quit