SR66 + secblade FW数据流规划和配置

红色线条为访问internet流量转发，需经过防火墙，避免遭到来自internet的攻击。

蓝色线条为访问省级内网流量。

访问internet出口在secblade fw的G0/2上，这样SR66上就只要2个业务口就够了。

Secblade 防火墙关键配置

 ip route-static 0.0.0.0 0.0.0.0 202.100.100.1          //所有从SR66上收到的报文都将被转发到internet

 ip route-static 10.0.0.0 255.0.0.0 192.168.100.1     //所有从internet回程的报文都将被转发至SR66上

SR66上关键配置

 ip route-static 0.0.0.0 0.0.0.0 192.168.100.2       //所有去往internet的流量都将被引到防火墙板卡上

 ip route-static 10.0.0.0 255.0.0.0 192.168.0.1     //所有回程数据（包括internet和内网）都将被转到县级

  方式2

SR66将县级流量全转发给FW，过滤完成后发回SR66，在SR66上完成NAT和数据分流。

Secblade 防火墙关键配置

#                                                                              

interface Ten-GigabitEthernet0/0.1                                                 

 vlan-type dot1q vid 100                                                       

 ip address 192.168.100.2 255.255.255.0                                          

#                                                                               

interface Ten-GigabitEthernet0/0.2                                                 

 vlan-type dot1q vid 200                                                       

 ip address 192.168.200.2 255.255.255.0

#                                                                              

 ip route-static 0.0.0.0 0.0.0.0 192.168.100.1                                     //上行数据流转发给SR66                             

 ip route-static 10.0.0.0 255.255.0.0 192.168.200.1                                        //下行数据流转发给SR66

注意通过wed登录secblade，将Ten-GigabitEthernet0/0.2划入trust, Ten-GigabitEthernet0/0.1划入untrust

SR66上关键配置

#                                                                               

acl number 3000                                                                

 rule 0 permit ip source 10.0.0.0 0.255.255.255                                 

acl number 3001                                                                

 rule 0 permit ip destination 10.0.0.0 0.255.255.255

#                                                                              

interface Ten-GigabitEthernet3/0/0.1                                                  

 vlan-type dot1q vid 100                                                       

 ip address 192.168.100.1 255.255.255.0                                          

#                                                                               

interface Ten-GigabitEthernet3/0/0.2                                                 

 vlan-type dot1q vid 200                                                       

 ip address 192.168.200.1 255.255.255.0                                           

#                                                                              

interface GigabitEthernet1/1/0                                                   

  ip address 10.7.0.2 255.255.255.252

 ip policy-based-route 1                                                        

#                                                                              

interface GigabitEthernet1/1/1                                                   

 ip address 172.16.39.130 255.255.255.240

 ip policy-based-route 2

interface GigabitEthernet1/1/2                                                  

 ip address 202.100.100.12 255.255.255.252

 ip policy-based-route 2

#                                                                              

policy-based-route 1 permit node 10          //将所有从县级来的数据转发到secblade FW                                

   if-match acl 3000                                                           

   apply ip-address next-hop 192.168.200.2 direct                                

#                                                                               

policy-based-route 2 permit node 10        //将去往县级的数据转发到secblade FW                                   

   if-match acl 3001                                                           

   apply ip-address next-hop 192.168.100.2 direct