HCL模拟器

# 向安全域Trust中添加接口GigabitEthernet1/0/1。

<Device> system-view

[Device] security-zone name trust

[Device-security-zone-Trust] import interface gigabitethernet 1/0/1

[Device-security-zone-Trust] quit

# 向安全域DMZ中添加接口GigabitEthernet1/0/2。

[Device] security-zone name dmz

[Device-security-zone-DMZ] import interface gigabitethernet 1/0/2

[Device-security-zone-DMZ] quit

# 向安全域Untrust中添加接口GigabitEthernet1/0/3。

[Device] security-zone name untrust

[Device-security-zone-Untrust] import interface gigabitethernet 1/0/3

[Device-security-zone-Untrust] quit

# 配置ACL 3500，定义规则：允许IP流量。

[Device] acl advanced 3500

[Device-acl-ipv4-adv-3500] rule permit ip

[Device-acl-ipv4-adv-3500] quit

# 创建ASPF策略1，配置检测应用层协议FTP（FTP仅为示例，若要检测其它应用协议，可根据需要配置）。

[Device] aspf policy 1

[Device-aspf-policy-1] detect ftp

[Device-aspf-policy-1] quit

# 创建源安全域Trust到目的安全域Untrust的安全域间实例，并在该安全域间实例上应用ASPF策略和包过滤策略，可以拒绝Untrust域用户对Trust的访问，但Trust域用户访问Untrust域以及返回的报文可以通过。

[Device] zone-pair security source trust destination untrust

[Device-zone-pair-security-Trust-Untrust] aspf apply policy 1

[Device-zone-pair-security-Trust-Untrust] packet-filter 3500

[Device-zone-pair-security-Trust-Untrust] quit

# 创建源安全域Trust到目的安全域DMZ的安全域间实例，并在该安全域间实例上开启ASPF检测功能，可以拒绝DMZ域用户对Trust的访问，但Trust域用户访问DMZ域以及返回的报文可以通过。

[Device] zone-pair security source trust destination dmz

[Device-zone-pair-security-Trust-DMZ] aspf apply policy 1

[Device-zone-pair-security-Trust-DMZ] packet-filter 3500

[Device-zone-pair-security-Trust-DMZ] quit