F1020防火墙域的区间策略

1.17  安全策略典型配置举例

1.17.1  基于IP地址的安全策略配置举例

1. 组网需求

·     某公司内的各部门之间通过Device实现互连，该公司的工作时间为每周工作日的8点到18点。

·     通过配置安全策略规则，允许总裁办在任意时间、财务部在工作时间通过HTTP协议访问财务数据库服务器的Web服务，禁止其它部门在任何时间、财务部在非工作时间通过HTTP协议访问该服务器的Web服务。

2. 组网图

图1-3 基于IP地址的安全策略配置组网图

‌

3. 配置步骤

(1)     配置接口IP地址

# 根据组网图中规划的信息，配置各接口的IP地址，具体配置步骤如下。

<Device> system-view

[Device] interface gigabitethernet 1/0/1

[Device-GigabitEthernet1/0/1] ip address 192.168.0.1 255.255.255.0

[Device-GigabitEthernet1/0/1] quit

请参考以上步骤配置其他接口的IP地址，具体配置步骤略。

(2)     配置接口加入安全域

# 请根据组网图中规划的信息，创建安全域，并将接口加入对应的安全域，具体配置步骤如下。

[Device] security-zone name database

[Device-security-zone-database] import interface gigabitethernet 1/0/1

[Device-security-zone-database] quit

[Device] security-zone name president

[Device-security-zone-president] import interface gigabitethernet 1/0/2

[Device-security-zone-president] quit

[Device] security-zone name finance

[Device-security-zone-finance] import interface gigabitethernet 1/0/3

[Device-security-zone-finance] quit

[Device] security-zone name market

[Device-security-zone-market] import interface gigabitethernet 1/0/4

[Device-security-zone-market] quit

(3)     配置时间段

# 创建名为work的时间段，其时间范围为每周工作日的8点到18点，具体配置步骤如下。

[Device] time-range work 08:00 to 18:00 working-day

(4)     配置安全策略

# 配置名称为president-database的安全策略规则，允许总裁办在任意时间通过HTTP协议访问财务数据库服务器，具体配置步骤如下。

[Device] security-policy ip

[Device-security-policy-ip] rule name president-database

[Device-security-policy-ip-0-president-database] source-zone president

[Device-security-policy-ip-0-president-database] destination-zone database

[Device-security-policy-ip-0-president-database] source-ip-subnet 192.168.1.0 24

[Device-security-policy-ip-0-president-database] destination-ip-subnet 192.168.0.0 24

[Device-security-policy-ip-0-president-database] service http

[Device-security-policy-ip-0-president-database] action pass

[Device-security-policy-ip-0-president-database] quit

# 配置名称为finance-database的安全策略规则，只允许财务部在工作时间通过HTTP协议访问财务数据库服务器，具体配置步骤如下。

[Device-security-policy-ip] rule name finance-database

[Device-security-policy-ip-1-finance-database] source-zone finance

[Device-security-policy-ip-1-finance-database] destination-zone database

[Device-security-policy-ip-1-finance-database] source-ip-subnet 192.168.2.0 24

[Device-security-policy-ip-1-finance-database] destination-ip-subnet 192.168.0.0 24

[Device-security-policy-ip-1-finance-database] service-port tcp destination eq 80

[Device-security-policy-ip-1-finance-database] action pass

[Device-security-policy-ip-1-finance-database] time-range work

[Device-security-policy-ip-1-finance-database] quit

# 配置名称为market-database的安全策略规则，禁止市场部在任何时间通过HTTP协议访问财务数据库服务器，具体配置步骤如下。

[Device-security-policy-ip] rule name market-database

[Device-security-policy-ip-2-market-database] source-zone market

[Device-security-policy-ip-2-market-database] destination-zone database

[Device-security-policy-ip-2-market-database] source-ip-subnet 192.168.3.0 24

[Device-security-policy-ip-2-market-database] destination-ip-subnet 192.168.0.0 24

[Device-security-policy-ip-2-market-database] service http

[Device-security-policy-ip-2-market-database] action drop

[Device-security-policy-ip-2-market-database] quit

# 激活安全策略规则的加速功能，具体配置步骤如下。

[Device-security-policy-ip] accelerate enhanced enable

[Device-security-policy-ip] quit

4. 验证配置

配置完成后，总裁办可以在任意时间访问财务数据库服务器的Web服务，财务部仅可以在工作时间访问财务数据库服务器的Web服务，其他部门任何时间均不可以访问财务数据库服务器的Web服务。