aspf_4389535

参考：

(4)     配置DPI应用profile并激活IPS策略配置

# 创建名为sec的DPI应用profile，在sec中引用名称为default的缺省IPS策略，并指定该IPS策略的模式为protect。

[Device] app-profile sec

[Device-app-profile-sec] ips apply policy default mode protect

[Device-app-profile-sec] quit

# 激活IPS策略配置。

[Device] inspect activate

(5)     配置安全策略

# 配置名称为trust-untrust的安全策略规则，使内网用户可以访问外网，并对交互报文进行IPS防御。具体配置步骤如下。

[Device] security-policy ip

[Device-security-policy-ip] rule name trust-untrust

[Device-security-policy-ip-10-trust-untrust] source-zone trust

[Device-security-policy-ip-10-trust-untrust] source-ip-subnet 192.168.1.0 24

[Device-security-policy-ip-10-trust-untrust] destination-zone untrust

[Device-security-policy-ip-10-trust-untrust] action pass

[Device-security-policy-ip-10-trust-untrust] profile sec

[Device-security-policy-ip-10-trust-untrust] quit

# 激活安全策略配置。

[Device-security-policy-ip] accelerate enhanced enable

[Device-security-policy-ip] quit