局域网用户要开放微软更新网站,安全策略里目的地地址需要使用域名,找不到地方设置域名对像组
客户电话: 18096323108
设备款型: NS-F1000-AI-25
设备序列号: 210235A2H6B235000059
(0)
某公司内的各部门之间通过Device实现互连,公司内网中部署了域名为***.***的Web服务器用于公司财务管理,该域名已在内网DNS服务器中注册。通过配置安全策略,实现如下需求:
· 允许财务部通过HTTP协议访问财务管理Web服务器。
· 禁止市场部在任何时间通过HTTP协议访问财务管理Web服务器。
图1-7 基于域名的安全策略配置组网图
(1) 配置接口IP地址
# 根据组网图中规划的信息,配置各接口的IP地址,具体配置步骤如下。
<Device> system-view
[Device] interface gigabitethernet 1/0/1
[Device-GigabitEthernet1/0/1] ip address 10.0.13.1 255.255.255.0
[Device-GigabitEthernet1/0/1] quit
请参考以上步骤配置其他接口的IP地址,具体配置步骤略。
(2) 配置接口加入安全域
# 请根据组网图中规划的信息,创建安全域,并将接口加入对应的安全域,具体配置步骤如下。
[Device] security-zone name web
[Device-security-zone-web] import interface gigabitethernet 1/0/1
[Device-security-zone-web] quit
[Device] security-zone name market
[Device-security-zone-market] import interface gigabitethernet 1/0/2
[Device-security-zone-market] quit
[Device] security-zone name finance
[Device-security-zone-finance] import interface gigabitethernet 1/0/3
[Device-security-zone-finance] quit
[Device] security-zone name dns
[Device-security-zone-dns] import interface gigabitethernet 1/0/4
[Device-security-zone-dns] quit
(3) 配置对象
# 创建名为web的IP地址对象组,并定义其主机名称为***.***,具体配置步骤如下。
[Device] object-group ip address web
[Device-obj-grp-ip-web] network host name ***.***
[Device-obj-grp-ip-web] quit
(4) 配置DNS服务器地址
# 指定DNS服务器的IP地址为10.10.10.10,确保Device可以获取到主机名对应的IP地址,具体配置步骤如下。
[Device] dns server 10.10.10.10
(5) 配置安全策略
# 配置名称为dnslocalout的安全策略规则,允许Device访问DNS服务器,具体配置步骤如下。
[Device] security-policy ip
[Device-security-policy-ip] rule name dnslocalout
[Device-security-policy-ip-0-dnslocalout] source-zone local
[Device-security-policy-ip-0-dnslocalout] destination-zone dns
[Device-security-policy-ip-0-dnslocalout] destination-ip-host 10.10.10.10
[Device-security-policy-ip-0-dnslocalout] action pass
[Device-security-policy-ip-0-dnslocalout] quit
# 配置名称为host-dns的安全策略规则,允许内网主机访问DNS服务器,具体配置步骤如下。
[Device-security-policy-ip] rule name host-dns
[Device-security-policy-ip-1-host-dns] source-zone finance
[Device-security-policy-ip-1-host-dns] source-zone market
[Device-security-policy-ip-1-host-dns] destination-zone dns
[Device-security-policy-ip-1-host-dns] source-ip-subnet 10.0.11.0 24
[Device-security-policy-ip-1-host-dns] source-ip-subnet 10.0.12.0 24
[Device-security-policy-ip-1-host-dns] destination-ip-host 10.10.10.10
[Device-security-policy-ip-1-host-dns] service dns-udp
[Device-security-policy-ip-1-host-dns] action pass
[Device-security-policy-ip-1-host-dns] quit
# 配置名称为finance-web的安全策略规则,允许财务部通过HTTP协议访问财务管理Web服务器,具体配置步骤如下。
[Device-security-policy-ip] rule name finance-web
[Device-security-policy-ip-2-finance-web] source-zone finance
[Device-security-policy-ip-2-finance-web] destination-zone web
[Device-security-policy-ip-2-finance-web] source-ip-subnet 10.0.11.0 24
[Device-security-policy-ip-2-finance-web] destination-ip web
[Device-security-policy-ip-2-finance-web] service http
[Device-security-policy-ip-2-finance-web] action pass
[Device-security-policy-ip-2-finance-web] quit
# 配置名称为market-web的安全策略规则,禁止市场部在任何时间通过HTTP协议访问财务管理Web服务器,具体配置步骤如下。
[Device-security-policy-ip] rule name market-web
[Device-security-policy-ip-3-market-web] source-zone market
[Device-security-policy-ip-3-market-web] destination-zone web
[Device-security-policy-ip-3-market-web] source-ip-subnet 10.0.12.0 24
[Device-security-policy-ip-3-market-web] destination-ip web
[Device-security-policy-ip-3-market-web] service http
[Device-security-policy-ip-3-market-web] action drop
[Device-security-policy-ip-3-market-web] quit
# 激活安全策略规则的加速功能,具体配置步骤如下。
[Device-security-policy-ip] accelerate enhanced enable
[Device-security-policy-ip] quit
配置完成后,财务部可以访问财务管理服务器的Web服务,市场部任何时间均不可以访问财务管理服务器的Web服务。
某公司内的各部门之间通过Device实现互连,公司内网中部署了域名为***.***、***.***、***.***等多个Web服务器,这些域名已在内网DNS服务器中注册。通过配置安全策略,实现如下需求:
· 基于模糊域名允许财务部通过HTTP协议访问所有Web服务器。
· 基于精确域名允许市场部通过HTTP协议访问***.***服务器。
图1-8 基于模糊域名的安全策略配置组网图
(1) 配置内网主机的DNS服务器地址为Device的IP地址
(2) 配置接口IP地址
# 根据组网图中规划的信息,配置各接口的IP地址,具体配置步骤如下。
<Device> system-view
[Device] interface gigabitethernet 1/0/1
[Device-GigabitEthernet1/0/1] ip address 10.0.13.1 255.255.255.0
[Device-GigabitEthernet1/0/1] quit
请参考以上步骤配置其他接口的IP地址,具体配置步骤略。
(3) 配置接口加入安全域
# 请根据组网图中规划的信息,创建安全域,并将接口加入对应的安全域,具体配置步骤如下。
[Device] security-zone name web
[Device-security-zone-web] import interface gigabitethernet 1/0/1
[Device-security-zone-web] quit
[Device] security-zone name market
[Device-security-zone-market] import interface gigabitethernet 1/0/2
[Device-security-zone-market] quit
[Device] security-zone name finance
[Device-security-zone-finance] import interface gigabitethernet 1/0/3
[Device-security-zone-finance] quit
[Device] security-zone name dns
[Device-security-zone-dns] import interface gigabitethernet 1/0/4
[Device-security-zone-dns] quit
(4) 配置对象组
# 创建名为web的IP地址对象组,并定义其主机名称为*.***.***,即匹配所有包含“.***.***”的域名地址。具体配置步骤如下。
[Device] object-group ip address web
[Device-obj-grp-ip-web] network host name *.***.***
[Device-obj-grp-ip-web] quit
# 创建名为bbs的IP地址对象组,并定义其主机名称为***.***。具体配置步骤如下。
[Device] object-group ip address bbs
[Device-obj-grp-ip-bbs] network host name ***.***
[Device-obj-grp-ip-bbs] quit
(5) 配置DNS
# 开启DNS代理功能。
[Device] dns proxy enable
# 指定DNS服务器的IP地址为10.10.10.10,确保Device可以获取到主机名对应的IP地址,具体配置步骤如下。
[Device] dns server 10.10.10.10
(6) 配置安全策略
# 配置名称为local-dns的安全策略规则,允许Device访问DNS服务器,具体配置步骤如下。
[Device] security-policy ip
[Device-security-policy-ip] rule name local-dns
[Device-security-policy-ip-0-local-dns] source-zone local
[Device-security-policy-ip-0-local-dns] destination-zone dns
[Device-security-policy-ip-0-local-dns] destination-ip-host 10.10.10.10
[Device-security-policy-ip-0-local-dns] service dns-udp
[Device-security-policy-ip-0-local-dns] service dns-tcp
[Device-security-policy-ip-0-local-dns] action pass
[Device-security-policy-ip-0-local-dns] quit
# 配置名称为host-localdns的安全策略规则,允许内网主机访问设备DNS代理,具体配置步骤如下。
[Device-security-policy-ip] rule name host-localdns
[Device-security-policy-ip-1-host-localdns] source-zone finance
[Device-security-policy-ip-1-host-localdns] source-zone market
[Device-security-policy-ip-1-host-localdns] destination-zone local
[Device-security-policy-ip-1-host-localdns] source-ip-subnet 10.0.11.0 24
[Device-security-policy-ip-1-host-localdns] source-ip-subnet 10.0.12.0 24
[Device-security-policy-ip-1-host-localdns] service dns-udp
[Device-security-policy-ip-1-host-localdns] service dns-tcp
[Device-security-policy-ip-1-host-localdns] action pass
[Device-security-policy-ip-1-host-dns] quit
# 配置名称为finance-web的安全策略规则,允许财务部通过HTTP协议访问所有Web服务器,具体配置步骤如下。
[Device-security-policy-ip] rule name finance-web
[Device-security-policy-ip-2-finance-web] source-zone finance
[Device-security-policy-ip-2-finance-web] destination-zone web
[Device-security-policy-ip-2-finance-web] source-ip-subnet 10.0.11.0 24
[Device-security-policy-ip-2-finance-web] destination-ip web
[Device-security-policy-ip-2-finance-web] service http
[Device-security-policy-ip-2-finance-web] action pass
[Device-security-policy-ip-2-finance-web] quit
# 配置名称为market-web的安全策略规则,允许市场部通过HTTP协议访问***.***服务器,具体配置步骤如下。
[Device-security-policy-ip] rule name market-web
[Device-security-policy-ip-3-market-web] source-zone market
[Device-security-policy-ip-3-market-web] destination-zone web
[Device-security-policy-ip-3-market-web] source-ip-subnet 10.0.12.0 24
[Device-security-policy-ip-3-market-web] destination-ip bbs
[Device-security-policy-ip-3-market-web] service http
[Device-security-policy-ip-3-market-web] action pass
[Device-security-policy-ip-3-market-web] quit
# 激活安全策略规则的加速功能,具体配置步骤如下。
[Device-security-policy-ip] accelerate enhanced enable
[Device-security-policy-ip] quit
配置完成后,财务部可以通过HTTP协议访问所有Web服务器,市场部仅可以通过HTTP协议访问***.***服务器。
(0)
亲~登录后才可以操作哦!
确定你的邮箱还未认证,请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
抄袭了我的内容
×
原文链接或出处
诽谤我
×
对根叔社区有害的内容
×
不规范转载
×
举报说明
暂无评论