防火墙D022之前版本(不包括D022版本)只能支持域间策略,最新版本防火墙即D022版本之后版本支持安全策略与域间策略共存。
查询防火墙版本方法:
1、查询到此台设备为D032版本:
<H3C>system-view
[H3C]probe
[H3C-probe]display system internal version
H3C SecPath F1070 V900R003B01D632SP20
Comware V700R001B64D032SP20
2、查询此板卡为D012版本:
[H3C-probe]display system internal version
H3C SecPath F1060 V900R003B01D612SP20
Comware V700R001B64D012SP20
安全策略与域间策略默认情况下只能一种生效,D022版本默认情况下域间策略生效,而在D032版本下则为安全策略生效。也可以通过命令查询当前设备生效的策略。
通过下面display命令查询:如果能查到命令“security-policy disable”则域间策略生效、没有查到任何命令则安全策略生效。
查询为域间策略生效:
[H3C]display current-configuration | include security-policy
security-policy disable
查询为安全策略生效:
[H3C]display current-configuration | include security-policy
1、
2、
3、
1、转换前一定要查看当前启动文件是否是需要转换的启动文件。
<H3C>dis startup
MainBoard:
Next main startup saved-configuration file: flash:/startup.cfg
2、配置对象策略到安全策略的转换命令
<H3C>system-view
[H3C]security-policy switch-from object-policy startup.cfg abc.cfg
Configuration switching begins...
Object policies in the specified configuration file have been switched to security policies.
Reboot the device to make the configuration take effect. Reboot now? [Y/N]:Y
注:startup.cfg为设备配置文件、abc.cfg为转换后的安全策略配置文件(其中abc可以自定义)
转换后设备会将包含安全策略的配置文件作为下次启动文件:
<H3C>dis startup
MainBoard:
Next main startup saved-configuration file: flash:/abc.cfg
<H3C>debugging packet-filter packet ip
<H3C>terminal debugging
<H3C>terminal monitor
举例:从设备本地Ping外部地址
<H3C>ping 1.1.1.2
Ping 1.1.1.2 (1.1.1.2): 56 data bytes, press CTRL_C to break
56 bytes from 1.1.1.2: icmp_seq=0 ttl=255 time=3.224 ms
56 bytes from 1.1.1.2: icmp_seq=1 ttl=255 time=3.056 ms
56 bytes from 1.1.1.2: icmp_seq=2 ttl=255 time=3.145 ms
56 bytes from 1.1.1.2: icmp_seq=3 ttl=255 time=3.068 ms
56 bytes from 1.1.1.2: icmp_seq=4 ttl=255 time=3.049 ms
原始Debugging信息:
*Aug 28 20:14:34:590 2019 H3C FILTER/7/PACKET: -COntext=1; The packet is permitted. Src-ZOne=Local, Dst-ZOne=Trust;If-In=InLoopBack0(132), If-Out=Reth1(134); Packet Info:Src-IP=1.1.1.1, Dst-IP=1.1.1.2, VPN-Instance=,Src-Port=8, Dst-Port=0, Protocol=ICMP(1), Application=ICMP(22742), ACL=3001, Rule-ID=5.
Debugging信息解释:
*Aug 28 20:14:34:590 2019 H3C FILTER/7/PACKET: -COntext=1; The packet is permitted. (这个包被放行)Src-ZOne=Local(源安全域为local), Dst-ZOne=Trust(目的安全域为trust);If-In=InLoopBack0(132), If-Out=Reth1(134)(从Reth1接口发出); Packet Info:Src-IP=1.1.1.1, Dst-IP=1.1.1.2,(报文的源地址与目的地址) VPN-Instance=,Src-Port=8, Dst-Port=0(报文源端口和目的端口), Protocol=ICMP(1), Application=ICMP(22742)(协议类型), ACL=3001, Rule-ID=5.(调用的ACL编号与规则ID)
<H3C>debugging aspf all
<H3C>terminal debugging
<H3C>terminal monitor
举例:从设备本地Ping外部地址
<H3C>ping 1.1.1.2
Ping 1.1.1.2 (1.1.1.2): 56 data bytes, press CTRL_C to break
56 bytes from 1.1.1.2: icmp_seq=0 ttl=255 time=3.224 ms
56 bytes from 1.1.1.2: icmp_seq=1 ttl=255 time=3.056 ms
56 bytes from 1.1.1.2: icmp_seq=2 ttl=255 time=3.145 ms
56 bytes from 1.1.1.2: icmp_seq=3 ttl=255 time=3.068 ms
56 bytes from 1.1.1.2: icmp_seq=4 ttl=255 time=3.049 ms
Debugging信息:
*Aug 28 20:24:39:791 2019 H3C FILTER/7/PACKET: -COntext=1; The packet is permitted. Src-ZOne=Local, Dst-ZOne=Trust;If-In=InLoopBack0(132), If-Out=Reth1(134); Packet Info:Src-IP=1.1.1.1, Dst-IP=1.1.1.2, VPN-Instance=,Src-Port=8, Dst-Port=0, Protocol=ICMP(1), Application=ICMP(22742), ObjectPolicy=1, Rule-ID=1.
<H3C>debugging security-policy all
<H3C>terminal debugging
<H3C>terminal monitor
举例:从设备本地Ping外部地址
<H3C>ping 1.1.1.2
Ping 1.1.1.2 (1.1.1.2): 56 data bytes, press CTRL_C to break
56 bytes from 1.1.1.2: icmp_seq=0 ttl=255 time=3.224 ms
56 bytes from 1.1.1.2: icmp_seq=1 ttl=255 time=3.056 ms
56 bytes from 1.1.1.2: icmp_seq=2 ttl=255 time=3.145 ms
56 bytes from 1.1.1.2: icmp_seq=3 ttl=255 time=3.068 ms
56 bytes from 1.1.1.2: icmp_seq=4 ttl=255 time=3.049 ms
Debugging信息:
*Aug 28 20:20:46:121 2019 H3C FILTER/7/PACKET: -COntext=1; The packet is permitted. Src-ZOne=Local, Dst-ZOne=Trust;If-In=InLoopBack0(132), If-Out=Reth1(134); Packet Info:Src-IP=1.1.1.1, Dst-IP=1.1.1.2, VPN-Instance=, Src-MacAddr=0000-0000-0000,Src-Port=8, Dst-Port=0, Protocol=ICMP(1), Application=ICMP(22742), SecurityPolicy=1, Rule-ID=1.
暂无评论
亲~登录后才可以操作哦!
确定你的邮箱还未认证,请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
抄袭了我的内容
×
原文链接或出处
诽谤我
×
对根叔社区有害的内容
×
不规范转载
×
举报说明
暂无评论