object-group ip address test
0 network subnet 192.168.1.0 255.255.255.0
0 network subnet 192.168.2.0 255.255.255.0
0 network subnet 192.168.3.0 255.255.255.0
安全策略是想只能访问
object-group test的目的地址其他都是拒绝
不涉及
(0)
最佳答案
(1) 配置接口IP地址
# 根据组网图中规划的信息,配置各接口的IP地址,具体配置步骤如下。
<Device> system-view
[Device] interface gigabitethernet 1/0/1
[Device-GigabitEthernet1/0/1] ip address 192.168.0.1 255.255.255.0
[Device-GigabitEthernet1/0/1] quit
请参考以上步骤配置其他接口的IP地址,具体配置步骤略。
(2) 配置接口加入安全域
# 请根据组网图中规划的信息,创建安全域,并将接口加入对应的安全域,具体配置步骤如下。
[Device] security-zone name database
[Device-security-zone-database] import interface gigabitethernet 1/0/1
[Device-security-zone-database] quit
[Device] security-zone name president
[Device-security-zone-president] import interface gigabitethernet 1/0/2
[Device-security-zone-president] quit
[Device] security-zone name finance
[Device-security-zone-finance] import interface gigabitethernet 1/0/3
[Device-security-zone-finance] quit
[Device] security-zone name market
[Device-security-zone-market] import interface gigabitethernet 1/0/4
[Device-security-zone-market] quit
(3) 配置时间段
# 创建名为work的时间段,其时间范围为每周工作日的8点到18点,具体配置步骤如下。
[Device] time-range work 08:00 to 18:00 working-day
(4) 配置安全策略
# 配置名称为president-database的安全策略规则,允许总裁办在任意时间通过HTTP协议访问财务数据库服务器,具体配置步骤如下。
[Device] security-policy ip
[Device-security-policy-ip] rule name president-database
[Device-security-policy-ip-0-president-database] source-zone president
[Device-security-policy-ip-0-president-database] destination-zone database
[Device-security-policy-ip-0-president-database] source-ip-subnet 192.168.1.0 24
[Device-security-policy-ip-0-president-database] destination-ip-subnet 192.168.0.0 24
[Device-security-policy-ip-0-president-database] service http
[Device-security-policy-ip-0-president-database] action pass
[Device-security-policy-ip-0-president-database] quit
# 配置名称为finance-database的安全策略规则,只允许财务部在工作时间通过HTTP协议访问财务数据库服务器,具体配置步骤如下。
[Device-security-policy-ip] rule name finance-database
[Device-security-policy-ip-1-finance-database] source-zone finance
[Device-security-policy-ip-1-finance-database] destination-zone database
[Device-security-policy-ip-1-finance-database] source-ip-subnet 192.168.2.0 24
[Device-security-policy-ip-1-finance-database] destination-ip-subnet 192.168.0.0 24
[Device-security-policy-ip-1-finance-database] service-port tcp destination eq 80
[Device-security-policy-ip-1-finance-database] action pass
[Device-security-policy-ip-1-finance-database] time-range work
[Device-security-policy-ip-1-finance-database] quit
# 配置名称为market-database的安全策略规则,禁止市场部在任何时间通过HTTP协议访问财务数据库服务器,具体配置步骤如下。
[Device-security-policy-ip] rule name market-database
[Device-security-policy-ip-2-market-database] source-zone market
[Device-security-policy-ip-2-market-database] destination-zone database
[Device-security-policy-ip-2-market-database] source-ip-subnet 192.168.3.0 24
[Device-security-policy-ip-2-market-database] destination-ip-subnet 192.168.0.0 24
[Device-security-policy-ip-2-market-database] service http
[Device-security-policy-ip-2-market-database] action drop
[Device-security-policy-ip-2-market-database] quit
# 激活安全策略规则的加速功能,具体配置步骤如下。
[Device-security-policy-ip] accelerate enhanced enable
[Device-security-policy-ip] quit
(0)
在目的地址里调用test 就可以了呀,web 页面操作 在这里选择你创建的test地址组
命令行
security-policy ip rule 10
name t-u
action pass
source-zone Trust
destination-zone Untrust
destination-ip test
在创建一个默认拒绝的策略就可以了
(0)
决绝所有 rule 100 acti drop
大佬命令行该怎么配置啊
拒绝的策略是这么写吗 security-policy ip rule 15 name t-u action deny source-zone Trust destination-zone Untrust
决绝所有 rule 100 acti drop
很简单 比如你的目的安全域是trust 源安全域是untrust , 目的地址组为你配置的test
需要放通的服务为http 、https 、ping ,如果没有明确的服务,就不配置service ,就是any
security-policy ip
rule 10 name test
source-zone untrust
destination-zone trust
destination-ip test
service http
service https
service ping
action pass
(1)
命令行该怎么配置啊
命令行该怎么配置啊
亲~登录后才可以操作哦!
确定你的邮箱还未认证,请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
抄袭了我的内容
×
原文链接或出处
诽谤我
×
对根叔社区有害的内容
×
不规范转载
×
举报说明