H3C F100 C G2 拨号上网 内网禁止访问 某些公网IP 怎么设置
(0)
最佳答案
您好,请知:
可以在NAT转换的ACL中指定哪些源禁止访问哪些公网IP,参考配置如下:
acl ad 3000
rule 0 deny ip source 10.1.1.1 0 destination 202.1.100.1 0
rule 1 permit source any destination any
quit
int gi 1/0/1
nat outbound 3000
quit
注意防火墙上涉及到的端口需加入安全域并放通安全策略或域间策略。
也可以在域间策略的使用引入该ACL
(0)
我也是这么配置的,但貌似没起作用,还是能ping通外网地址
安全策略实现
· 某公司内的各部门之间通过Device实现互连,该公司的工作时间为每周工作日的8点到18点。
· 通过配置安全策略规则,允许总裁办在任意时间、财务部在工作时间通过HTTP协议访问财务数据库服务器的Web服务,禁止其它部门在任何时间、财务部在非工作时间通过HTTP协议访问该服务器的Web服务。
图1-3 基于IP地址的安全策略配置组网图
(1) 配置接口IP地址
# 根据组网图中规划的信息,配置各接口的IP地址,具体配置步骤如下。
<Device> system-view
[Device] interface gigabitethernet 1/0/1
[Device-GigabitEthernet1/0/1] ip address 192.168.0.1 255.255.255.0
[Device-GigabitEthernet1/0/1] quit
请参考以上步骤配置其他接口的IP地址,具体配置步骤略。
(2) 配置接口加入安全域
# 请根据组网图中规划的信息,创建安全域,并将接口加入对应的安全域,具体配置步骤如下。
[Device] security-zone name database
[Device-security-zone-database] import interface gigabitethernet 1/0/1
[Device-security-zone-database] quit
[Device] security-zone name president
[Device-security-zone-president] import interface gigabitethernet 1/0/2
[Device-security-zone-president] quit
[Device] security-zone name finance
[Device-security-zone-finance] import interface gigabitethernet 1/0/3
[Device-security-zone-finance] quit
[Device] security-zone name market
[Device-security-zone-market] import interface gigabitethernet 1/0/4
[Device-security-zone-market] quit
(3) 配置时间段
# 创建名为work的时间段,其时间范围为每周工作日的8点到18点,具体配置步骤如下。
[Device] time-range work 08:00 to 18:00 working-day
(4) 配置安全策略
# 配置名称为president-database的安全策略规则,允许总裁办在任意时间通过HTTP协议访问财务数据库服务器,具体配置步骤如下。
[Device] security-policy ip
[Device-security-policy-ip] rule name president-database
[Device-security-policy-ip-0-president-database] source-zone president
[Device-security-policy-ip-0-president-database] destination-zone database
[Device-security-policy-ip-0-president-database] source-ip-subnet 192.168.1.0 24
[Device-security-policy-ip-0-president-database] destination-ip-subnet 192.168.0.0 24
[Device-security-policy-ip-0-president-database] service http
[Device-security-policy-ip-0-president-database] action pass
[Device-security-policy-ip-0-president-database] quit
# 配置名称为finance-database的安全策略规则,只允许财务部在工作时间通过HTTP协议访问财务数据库服务器,具体配置步骤如下。
[Device-security-policy-ip] rule name finance-database
[Device-security-policy-ip-1-finance-database] source-zone finance
[Device-security-policy-ip-1-finance-database] destination-zone database
[Device-security-policy-ip-1-finance-database] source-ip-subnet 192.168.2.0 24
[Device-security-policy-ip-1-finance-database] destination-ip-subnet 192.168.0.0 24
[Device-security-policy-ip-1-finance-database] service-port tcp destination eq 80
[Device-security-policy-ip-1-finance-database] action pass
[Device-security-policy-ip-1-finance-database] time-range work
[Device-security-policy-ip-1-finance-database] quit
# 配置名称为market-database的安全策略规则,禁止市场部在任何时间通过HTTP协议访问财务数据库服务器,具体配置步骤如下。
[Device-security-policy-ip] rule name market-database
[Device-security-policy-ip-2-market-database] source-zone market
[Device-security-policy-ip-2-market-database] destination-zone database
[Device-security-policy-ip-2-market-database] source-ip-subnet 192.168.3.0 24
[Device-security-policy-ip-2-market-database] destination-ip-subnet 192.168.0.0 24
[Device-security-policy-ip-2-market-database] service http
[Device-security-policy-ip-2-market-database] action drop
[Device-security-policy-ip-2-market-database] quit
# 激活安全策略规则的加速功能,具体配置步骤如下。
[Device-security-policy-ip] accelerate enhanced enable
[Device-security-policy-ip] quit
(0)
亲~登录后才可以操作哦!
确定你的邮箱还未认证,请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
抄袭了我的内容
×
原文链接或出处
诽谤我
×
对根叔社区有害的内容
×
不规范转载
×
举报说明
我也是这么配置的,但貌似没起作用,还是能ping通外网地址