安全策略

内网流量会在核心上经过防火墙后在回到核心交换机上到外网去，而外网流量也会先到核心交换机上到防火墙后回到核心交换机进入内网。

要实现内网可以访问外网，外网不能访问内网，

防火墙和核心交换机之间做双链路聚合，

防火墙的聚合口配置为信任区域，

要让内网的两个网段访问外网，外网不能访问这两个网段。内网网段（10.204.124.0 24；10.204.125.0 24）

security-zone name Local
#
security-zone name Trust
 import interface Vlan-interface55
 import interface Bridge-Aggregation1 vlan 55
 import interface Ten-GigabitEthernet1/0/14 vlan 55
 import interface Ten-GigabitEthernet1/0/15 vlan 55
#
security-zone name DMZ
#
security-zone name Untrust
#
security-zone name Management
 import interface M-GigabitEthernet1/0/0
 import interface M-GigabitEthernet1/0/1

security-policy ip
 rule 0 name True-TO-True
  action pass  
  profile 0_IPv4
  source-zone Local
  source-zone Trust
  source-zone DMZ
  source-zone Untrust
  source-zone Management
  destination-zone Local
  destination-zone Trust
  destination-zone DMZ
  destination-zone Untrust
  destination-zone Management