日志审计设备nat日志审计

日志审计正常添加设备。

防火墙：

如下图所示，用户通过在设备Device上配置Flow日志功能，实现在日志主机上（Log Host）对用户User的上网活动进行监控。

图-1 Flow日志配置组网图

‌

配置步骤

1. 配置接口IP地址

# 根据组网图中规划的信息，配置各接口的IP地址，具体配置步骤如下。

<Device> system-view

[Device] interface loopback 0

[Device-LoopBack0] ip address 2.2.2.2 255.255.255.0

[Device-LoopBack0] quit

[Device] interface gigabitethernet 1/0/1

[Device-GigabitEthernet1/0/1] ip address 169.1.1.1 255.255.255.0

[Device-GigabitEthernet1/0/1] quit

请参考以上步骤配置其他接口的IP地址，具体配置步骤略。

2. 配置静态路由

本举例仅以静态路由方式配置路由信息。实际组网中，请根据具体情况选择相应的路由配置方式。

# 请根据组网图中规划的信息，配置静态路由，本举例假设到日志主机和Internet的下一跳IP地址为和1.1.1.2和3.3.3.1，实际使用中请以具体组网情况为准，具体配置步骤如下。

[Device] ip route-static 1.2.3.0 24 1.1.1.2

[Device] ip route-static 0.0.0.0 0 3.3.3.1

3. 配置接口加入安全域。

# 请根据组网图中规划的信息，将接口加入对应的安全域，具体配置步骤如下。

[Device] security-zone name trust

[Device-security-zone-Trust] import interface gigabitethernet 1/0/1

[Device-security-zone-Trust] quit

[Device] security-zone name dmz

[Device-security-zone-DMZ] import interface gigabitethernet 1/0/2

[Device-security-zone-DMZ] quit

[Device] security-zone name untrust

[Device-security-zone-Untrust] import interface gigabitethernet 1/0/3

[Device-security-zone-Untrust] quit

4. 配置安全策略

# 配置名称为loglocalout的安全策略规则，使Device可以向日志主机发送日志信息报文，具体配置步骤如下。

[Device] security-policy ip

[Device-security-policy-ip] rule name loglocalout

[Device-security-policy-ip-1-loglocalout] source-zone local

[Device-security-policy-ip-1-loglocalout] destination-zone dmz

[Device-security-policy-ip-1-loglocalout] source-ip-host 2.2.2.2

[Device-security-policy-ip-1-loglocalout] destination-ip-host 1.2.3.6

[Device-security-policy-ip-1-loglocalout] action pass

[Device-security-policy-ip-1-loglocalout] quit

# 配置名称为trust-untrust的安全策略规则，使用户User可以正常访问Internet，具体配置步骤如下。

[Device-security-policy-ip] rule name trust-untrust

[Device-security-policy-ip-2-trust-untrust] source-zone trust

[Device-security-policy-ip-2-trust-untrust] destination-zone untrust

[Device-security-policy-ip-2-trust-untrust] source-ip-subnet 169.1.1.0 24

[Device-security-policy-ip-2-trust-untrust] action pass

[Device-security-policy-ip-2-trust-untrust] quit

[Device-security-policy-ip] quit

5. 配置Flow日志

# 开启NAT新建、删除会话和活跃流的日志功能，具体配置步骤如下。

[Device] nat log enable

[Device] nat log flow-begin

[Device] nat log flow-end

[Device] nat log flow-active 10

[Device] userlog flow export version 3

# 配置将Flow日志信息发送给Flow日志主机，将2.2.2.2配置为承载Flow日志的UDP报文的源IP地址，具体配置步骤如下。

[Device] userlog flow export host 1.2.3.6 port 2000

[Device] userlog flow export source-ip 2.2.2.2

验证配置结果

# 查看Flow日志的配置和统计信息。

[Device] display userlog export

Flow:

  Export flow log as UDP Packet.

  Version: 3.0

  Source ipv4 address: 2.2.2.2

  Log load balance function: Disabled

  Local time stamp: Disabled

  Number of log hosts: 1

  Log host 1:

    Host/Port: 1.2.3.6/2000

Total logs/UDP packets exported: 112/87

配置文件

Device

#

 nat log enable

 nat log flow-active 10

 nat log flow-begin

 nat log flow-end

#

interface LoopBack0

 ip address 2.2.2.2 255.255.255.0

#

interface GigabitEthernet1/0/1

 ip address 169.1.1.1 255.255.255.0

#

interface GigabitEthernet1/0/2

 ip address 1.1.1.1 255.255.255.0

#

interface GigabitEthernet1/0/3

 ip address 3.3.3.3 255.255.255.0

#

security-zone name Trust

 import interface GigabitEthernet1/0/1

#

security-zone name DMZ

 import interface GigabitEthernet1/0/2

#

security-zone name Untrust

 import interface GigabitEthernet1/0/3

#

 ip route-static 0.0.0.0 0 3.3.3.1

 ip route-static 1.2.3.0 24 1.1.1.2

#

 userlog flow export version 3

 userlog flow export source-ip 2.2.2.2

 userlog flow export host 1.2.3.6 port 2000

#

security-policy ip

 rule 1 name loglocalout

  action pass

  source-zone local

  destination-zone dmz

  source-ip-host 2.2.2.2

  destination-ip-host 1.2.3.6

 rule 2 name trust-untrust

  action pass

  source-zone trust

  destination-zone untrust

  source-ip-subnet 169.1.1.0 255.255.255.0