HCL上的防火墙1060

需要两条域间策略，local--trust和trust--local。以下是我学习时做的实验，可以参考

配置思路：正常表示上图            加粗表示下图

1、在FW上划分区域，并加入接口：

[fw-security-zone-Trust]import interface GigabitEthernet1/0/0

[fw-security-zone-DMZ]import interface GigabitEthernet1/0/1

[DHCP-security-zone-Trust]import interface GigabitEthernet1/0/0

2、配置ACL匹配业务流：

[dhcpServer-acl-ipv4-basic-2000] rule 10 permit source 0.0.0.0 0

[dhcpServer-acl-ipv4-basic-2001] rule 10 permit source 192.168.1.0 0.0.0.255

[dhcpServer-acl-ipv4-basic-2002] rule 10 permit source 192.168.2.0 0.0.0.255

[DHCP-acl-ipv4-basic-2002] rule 10 permit source 192.168.2.0 0.0.0.255

3、配置DHCP服务：

[dhcpServer]dhcp enable

[dhcpServer-dhcp-pool-1]gateway-list 192.168.1.254

[dhcpServer-dhcp-pool-1]network 192.168.1.0 24

[dhcpServer]ip route-static 0.0.0.0 0 192.168.2.1

[fw]dhcp enable

[fw-GigabitEthernet1/0/1]dhcp select relay

[fw-GigabitEthernet1/0/0]dhcp relay source-address 192.168.2.254

[DHCP]dhcp enable

[DHCP-dhcp-pool-1]gateway-list 192.168.1.254

[DHCP-dhcp-pool-1]network 192.168.1.0 24

[DHCP]ip route-static 0.0.0.0 0 192.168.2.1

[relay]dhcp enable

[relay-GigabitEthernet0/0]dhcp select relay

[relay-GigabitEthernet0/0]dhcp relay source-address 192.168.2.254

4、配置域间策略：

[dhcpServer-zone-pair-security-Trust-Local]packet-filter 2000

[dhcpServer-zone-pair-security-Local-Trust]packet-filter 2001

[dhcpServer-zone-pair-security-DMZ-Local]packet-filter 2002

[dhcpServer-zone-pair-security-Local-DMZ]packet-filter 2002

[DHCP-zone-pair-security-Trust-Local]packet-filter 2002

[DHCp-zone-pair-security-Local-Trust]packet-filter 2002