我在做F1030 的对象策略到安全策略的转换时遇到了如下配置,我看产品文档里说如果域间实例存在区域指定为any时,需要先手动更改被引用的对象策略,这种情况该如何更改对应的对象策略呢:
#
zone-pair security source Any destination Any
object-policy apply ip any
object-policy apply ipv6 any_ipv6
#
zone-pair security source Any destination Untrust
object-policy apply ip any
object-policy apply ipv6 any_ipv6
#
zone-pair security source Local destination Management
object-policy apply ip any
object-policy apply ipv6 any_ipv6
#
zone-pair security source Local destination Trust
object-policy apply ip any
object-policy apply ipv6 any_ipv6
#
(0)
亲~登录后才可以操作哦!
确定你的邮箱还未认证,请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
抄袭了我的内容
×
原文链接或出处
诽谤我
×
对根叔社区有害的内容
×
不规范转载
×
举报说明
这里这个ANY指的是被引用的对象策略吗
你现网的策略就是上面贴的这些吗?我看就是全通的策略,这种实际上你根本不用翻译,直接配个全通的安全策略就行了,配之前先把安全策略关了,security-policy disable 配完再undo 打开安全策略
还有一部分,全部如下,这个有部分加的有其他策略,这个应该是以前的办公区防火墙,我看它里面很多策略其实都没引用 zone-pair security source Any destination Any object-policy apply ip any object-policy apply ipv6 any_ipv6 aspf apply policy 1 # zone-pair security source Any destination Untrust object-policy apply ip any object-policy apply ipv6 any_ipv6 # zone-pair security source Local destination Management object-policy apply ip any object-policy apply ipv6 any_ipv6 # zone-pair security source Local destination Trust object-policy apply ip any object-policy apply ipv6 any_ipv6 # zone-pair security source Local destination Untrust object-policy apply ip any object-policy apply ipv6 any_ipv6 # zone-pair security source Trust destination Local object-policy apply ip any object-policy apply ipv6 any_ipv6 # zone-pair security source Trust destination Trust object-policy apply ip any object-policy apply ipv6 any_ipv6 # zone-pair security source Trust destination Untrust object-policy apply ip Trust-Untrust object-policy apply ipv6 any_ipv6 aspf apply policy 1 # zone-pair security source Untrust destination Any object-policy apply ip any object-policy apply ipv6 any_ipv6 # zone-pair security source Untrust destination DMZ # zone-pair security source Untrust destination Local object-policy apply ip VPN object-policy apply ipv6 any_ipv6 # zone-pair security source Untrust destination Trust object-policy apply ip any object-policy apply ipv6 any_ipv6