防火墙配置日志推送

如下图所示，用户通过在设备Device上配置会话Flow日志功能，实现将内网用户User访问网络产生的会话日志信息发送至日志服务器，便于网络管理员进行跟踪和分析用户访问网络的情况。

图-1 会话Flow日志配置组网图

配置步骤

1. ‍配置接口IP地址

   # 根据组网图中规划的信息，配置各接口的IP地址，具体配置步骤如下。

   <Device> system-view

   [Device] interface loopback 0

   [Device-LoopBack0] ip address 2.2.2.2 255.255.255.0

   [Device-LoopBack0] quit

   [Device] interface gigabitethernet 1/0/1

   [Device-GigabitEthernet1/0/1] ip address 169.1.1.1 255.255.255.0

   [Device-GigabitEthernet1/0/1] quit

   请参考以上步骤配置其他接口的IP地址，具体配置步骤略。

2. 配置静态路由

   本举例仅以静态路由方式配置路由信息。实际组网中，请根据具体情况选择相应的路由配置方式。

   # 请根据组网图中规划的信息，配置静态路由，本举例假设到日志主机和Internet的下一跳IP地址为和1.1.1.2和3.3.3.1，实际使用中请以具体组网情况为准，具体配置步骤如下。

   [Device] ip route-static 1.2.3.0 24 1.1.1.2

   [Device] ip route-static 0.0.0.0 0 3.3.3.1

3. 配置接口加入安全域。

   # 请根据组网图中规划的信息，将接口加入对应的安全域，具体配置步骤如下。

   [Device] security-zone name trust

   [Device-security-zone-Trust] import interface gigabitethernet 1/0/1

   [Device-security-zone-Trust] quit

   [Device] security-zone name dmz

   [Device-security-zone-DMZ] import interface gigabitethernet 1/0/2

   [Device-security-zone-DMZ] quit

   [Device] security-zone name untrust

   [Device-security-zone-Untrust] import interface gigabitethernet 1/0/3

   [Device-security-zone-Untrust] quit

4. 配置安全策略

   # 配置名称为loglocalout的安全策略规则，使Device可以向日志主机发送日志信息报文，具体配置步骤如下。

   [Device] security-policy ip

   [Device-security-policy-ip] rule name loglocalout

   [Device-security-policy-ip-1-loglocalout] source-zone local

   [Device-security-policy-ip-1-loglocalout] destination-zone dmz

   [Device-security-policy-ip-1-loglocalout] source-ip-host 2.2.2.2

   [Device-security-policy-ip-1-loglocalout] destination-ip-host 1.2.3.6

   [Device-security-policy-ip-1-loglocalout] action pass

   [Device-security-policy-ip-1-loglocalout] quit

   # 配置名称为trust-untrust的安全策略规则，使用户User可以正常访问Internet，具体配置步骤如下。

   [Device-security-policy-ip] rule name trust-untrust

   [Device-security-policy-ip-2-trust-untrust] source-zone trust

   [Device-security-policy-ip-2-trust-untrust] destination-zone untrust

   [Device-security-policy-ip-2-trust-untrust] source-ip-subnet 169.1.1.0 24

   [Device-security-policy-ip-2-trust-untrust] action pass

   [Device-security-policy-ip-2-trust-untrust] quit

   [Device-security-policy-ip] quit

5. 配置Flow日志

   # 开启新建会话、删除会话的日志功能，具体配置步骤如下。

   [Device] interface gigabitethernet 1/0/1

   [Device-GigabitEthernet1/0/1] session log enable ipv4 inbound

   [Device] session log flow-begin

   [Device] session log flow-end

   [Device] userlog flow export version 3

   # 配置将Flow日志信息发送给Flow日志主机，将2.2.2.2配置为承载Flow日志的UDP报文的源IP地址，具体配置步骤如下。

   [Device] userlog flow export host 1.2.3.6 port 2000

   [Device] userlog flow export source-ip 2.2.2.2

验证配置结果

# 查看Flow日志的配置和统计信息。

[Device] display userlog export

Flow:

Export flow log as UDP Packet.

Version: 3.0

Source ipv4 address: 2.2.2.2

Log load balance function: Disabled

Local time stamp: Disabled

Number of log hosts: 1

Log host 1:

Host/Port: 1.2.3.6/2000

Total logs/UDP packets exported: 112/87