華為防火牆安全區域及安全策略配置舉例
場景
你是公司的網路管理員。公司總部的網路分成了三個區域，包括內部區域（Trust）、外部區域（Untrust）和伺服器區域（DMZ）。你設計通過防火牆來實現對資料的控制，確保公司內部網路安全，並通過DMZ區域對外網提供服務。
拓撲圖
步驟一. 基本配置與IP編址
給路由器和防火牆配置地址，並配置靜態路由，在交換機上配置VLAN。
＜Huawei＞system-view
[Huawei]sysname R1
[R1]interface GigabitEthernet 0/0/1
[R1-GigabitEthernet0/0/1]ip address 10.0.10.1 24
[R1-GigabitEthernet0/0/1]quit
[R1-LoopBack0]ip address 10.0.1.1 24
＜Huawei＞system-view
[Huawei]sysname R2
[R2]interface GigabitEthernet0/0/1
[R2-GigabitEthernet0/0/1]ip address 10.0.20.1 24
[R2-GigabitEthernet0/0/1]quit
[R2]interface loopback 0
[R2-LoopBack0]ip address 10.0.2.2 24
＜Huawei＞system-view
[Huawei]sysname R3
[R3]interface GigabitEthernet 0/0/1
[R3-GigabitEthernet0/0/1]quit
[R3]interface loopback 0
[R3-LoopBack0]ip address 10.0.3.3 24
防火牆預設會啟用GigabitEthernet0/0/0介面的ip地址，為避免干擾，可以刪除。
＜Huawei＞system-view
[USG6300]sysname FW
[FW]int GigabitEthernet 0/0/0
[FW-GigabitEthernet0/0/0]undo ip address
[FW-GigabitEthernet0/0/0]quit
[FW]interface GigabitEthernet 1/0/0
[FW-GigabitEthernet1/0/0]quit
[FW]interface GigabitEthernet 1/0/1
[FW-GigabitEthernet1/0/1]ip address 10.0.20.254 24
[FW-GigabitEthernet1/0/1]quit
[FW]interface GigabitEthernet 1/0/2
[FW-GigabitEthernet1/0/2]ip address 10.0.30.254 24
[FW-GigabitEthernet1/0/2]quit
交換機上需要按照需求定義VLAN。
[Quidway]sysname S1
[S1]vlan batch 11 to 13
[S1]interface GigabitEthernet 0/0/1
[S1-GigabitEthernet0/0/1]port link-type access
[S1-GigabitEthernet0/0/1]port default vlan 11
[S1-GigabitEthernet0/0/1]quit
[S1]interface GigabitEthernet 0/0/2
[S1-GigabitEthernet0/0/2]port link-type access
[S1-GigabitEthernet0/0/2]port default vlan 12
[S1-GigabitEthernet0/0/2]quit
[S1]interface GigabitEthernet 0/0/3
[S1-GigabitEthernet0/0/3]port link-type access
[S1-GigabitEthernet0/0/3]port default vlan 13
[S1-GigabitEthernet0/0/3]quit
[S1]interface GigabitEthernet 0/0/21
[S1-GigabitEthernet0/0/21]port link-type access
[S1-GigabitEthernet0/0/21]port default vlan 11
[S1-GigabitEthernet0/0/21]quit
[S1]interface GigabitEthernet 0/0/22
[S1-GigabitEthernet0/0/22]port link-type access
[S1-GigabitEthernet0/0/22]port default vlan 12
[S1-GigabitEthernet0/0/22]quit
[S1]interface GigabitEthernet 0/0/23
[S1-GigabitEthernet0/0/23]port link-type access
[S1-GigabitEthernet0/0/23]port default vlan 13
在R1、R2和R3上配置預設路由，在FW上配置明確的靜態路由，實現三個Loopback0介面連線的網段之間路由暢通。
[R1]ip route-static 0.0.0.0 0 10.0.10.254
[R2]ip route-static 0.0.0.0 0 10.0.20.254
[R3]ip route-static 0.0.0.0 0 10.0.30.254
[FW]ip route-static 10.0.1.0 24 10.0.10.1
[FW]ip route-static 10.0.2.0 24 10.0.20.1
[FW]ip route-static 10.0.3.0 24 10.0.30.1
配置完成後檢查防火牆路由資訊。
[FW]display ip routing-table
步驟二.配置防火牆區域
防火牆上預設有四個區域，分別是“local“、”trust“、”untrust“、”dmz“。實驗中我們使用到“trust“、”untrust“和”dmz“三個區域，分別將對應介面加入各安全區域，由於預設配置將GE0/0/0加入了“trust”區域，為避免干擾，將其刪除。
[FW]firewall zone dmz
[FW-zone-dmz]add interface GigabitEthernet 1/0/2
[FW-zone-dmz]quit
[FW]firewall zone trust
[FW-zone-trust]add interface GigabitEthernet 1/0/1
[FW-zone-trust]undo add interface GigabitEthernet 0/0/0
[FW-zone-trust]quit
[FW]firewall zone untrust
[FW-zone-untrust]add interface GigabitEthernet 1/0/0
[FW-zone-untrust]quit
檢查各介面所在的區域：
[FW]display zone interface
local
trust
interface of the zone is (1):
GigabitEthernet1/0/1
untrust
interface of the zone is (1):
GigabitEthernet1/0/0
dmz
interface of the zone is (1):
GigabitEthernet1/0/2
檢查各區域的優先順序：
[FW]display zone
local
priority is 100
trust
priority is 85
interface of the zone is (1):
GigabitEthernet1/0/1
untrust
priority is 5
interface of the zone is (1):
GigabitEthernet1/0/0
dmz
priority is 50
interface of the zone is (1):
GigabitEthernet1/0/2
可以看到三個介面已經被劃分到相應的區域內，預設情況下不同區域間是不可互通的。因此，此時各路由器之間流量是無法通過的，需要配置區域間的安全策略放行允許通過的流量。
步驟三.配置安全策略
如果防火牆域間沒有配置安全策略，或查詢安全策略時，所有的安全策略都沒有命中，則預設執行域間的預設包過濾動作（拒絕通過）。配置安全策略，僅允許Trust區域訪問其他區域，不允許其他區域之間的訪問。
[FW]security-policy
[FW-policy-security]rule name policy_sec_1
[FW-policy-security-rule-policy_sec_1]source-zone trust
[FW-policy-security-rule-policy_sec_1]destination-zone untrust
[FW-policy-security-rule-policy_sec_1]action permit
[FW-policy-security-rule-policy_sec_1]quit
[FW-policy-security]rule name policy_sec_2
[FW-policy-security-rule-policy_sec_2]source-zone trust
[FW-policy-security-rule-policy_sec_2]destination-zone dmz
[FW-policy-security-rule-policy_sec_2]action permit
[FW-policy-security-rule-policy_sec_2]quit
[FW-policy-security]quit
檢查配置結果：
[FW]display security-policy rule policy_sec_1
(0 times matched)
rule name policy_sec_1
source-zone trust
destination-zone untrust
action permit
[FW]display security-policy rule policy_sec_2
(0 times matched)
rule name policy_sec_2
source-zone trust
destination-zone dmz
action permit
檢查從trust到untrust和dmz的連通性：
[R2]ping -a 10.0.2.2 10.0.1.1
PING 10.0.1.1: 56 data bytes, press CTRL_C to break
Reply from 10.0.1.1: bytes=56 Sequence=1 ttl=254 time=1 ms
Reply from 10.0.1.1: bytes=56 Sequence=2 ttl=254 time=1 ms
Reply from 10.0.1.1: bytes=56 Sequence=3 ttl=254 time=1 ms
Reply from 10.0.1.1: bytes=56 Sequence=4 ttl=254 time=1 ms
Reply from 10.0.1.1: bytes=56 Sequence=5 ttl=254 time=1 ms
— 10.0.1.1 ping statistics —
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 1/1/1 ms
[R2]ping -a 10.0.2.2 10.0.3.3
PING 10.0.3.3: 56 data bytes, press CTRL_C to break
Reply from 10.0.3.3: bytes=56 Sequence=1 ttl=254 time=1 ms
Reply from 10.0.3.3: bytes=56 Sequence=2 ttl=254 time=1 ms
Reply from 10.0.3.3: bytes=56 Sequence=3 ttl=254 time=1 ms
Reply from 10.0.3.3: bytes=56 Sequence=4 ttl=254 time=1 ms
Reply from 10.0.3.3: bytes=56 Sequence=5 ttl=254 time=1 ms
— 10.0.3.3 ping statistics —
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 1/1/1 ms
檢查從untrust到trust和dmz的連通性：
[R1]ping -a 10.0.1.1 10.0.2.2
PING 10.0.2.2: 56 data bytes, press CTRL_C to break
Request time out
Request time out
Request time out
Request time out
Request time out
— 10.0.2.2 ping statistics —
5 packet(s) transmitted
0 packet(s) received
100.00% packet loss
[R1]ping -a 10.0.1.1 10.0.3.3
PING 10.0.3.3: 56 data bytes, press CTRL_C to break
Request time out
Request time out
Request time out
Request time out
Request time out
— 10.0.3.3 ping statistics —
5 packet(s) transmitted
0 packet(s) received
100.00% packet loss
檢查從dmz到untrust和trust的連通性：
[R3]ping -a 10.0.3.3 10.0.1.1
PING 10.0.1.1: 56 data bytes, press CTRL_C to break
Request time out
Request time out
Request time out
Request time out
Request time out
— 10.0.1.1 ping statistics —
5 packet(s) transmitted
0 packet(s) received
100.00% packet loss
[R3]ping -a 10.0.3.3 10.0.2.2
PING 10.0.2.2: 56 data bytes, press CTRL_C to break
Request time out
Request time out
Request time out
Request time out
Request time out
— 10.0.2.2 ping statistics —
5 packet(s) transmitted
0 packet(s) received
100.00% packet loss
經過驗證，以trust區域為源的資料可以訪問untrust和dmz，但以其他區域為源的資料不能互訪。
配置域間包過濾策略，允許Untrust區域訪問DMZ區域的特定伺服器。
DMZ區域有一臺伺服器，IP地址為10.0.3.3，需要對Untrust區域開放Telnet服務。同時為了測試網路，需要開放ICMP Ping測試功能。
[FW]security-policy
[FW-policy-security]rule name policy_sec_3
[FW-policy-security-rule-policy_sec_3]source-zone untrust
[FW-policy-security-rule-policy_sec_3]destination-zone dmz
[FW-policy-security-rule-policy_sec_3]destination-address 10.0.3.3 mask 255.255.255.255
（注：若是不配置以上這條命令，則10.0.3.3和10.0.30.1都可以訪問；配置這條命令，就只能訪問這個地址。）
[FW-policy-security-rule-policy_sec_3]service icmp
[FW-policy-security-rule-policy_sec_3]service telnet
[FW-policy-security-rule-policy_sec_3]action permit
為了能在進行Telnet測試，在R3上開啟Telnet功能。
[R3]telnet server enable
[R3]aaa
[R3-aaa]local-user test password irreversible-cipher [email protected]
[R3-aaa]local-user test service-type telnet
[R3-aaa]quit
[R3]user-interface vty 0 4
[R3-ui-vty0-4]authentication-mode aaa
[R3-ui-vty0-4]protocol inbound telnet
測試從R1(untrust)到R3(dmz)的ping和telnet：
ping 10.0.3.3
PING 10.0.3.3: 56 data bytes, press CTRL_C to break
Reply from 10.0.3.3: bytes=56 Sequence=1 ttl=254 time=1 ms
Reply from 10.0.3.3: bytes=56 Sequence=2 ttl=254 time=1 ms
Reply from 10.0.3.3: bytes=56 Sequence=3 ttl=254 time=1 ms
Reply from 10.0.3.3: bytes=56 Sequence=4 ttl=254 time=1 ms
Reply from 10.0.3.3: bytes=56 Sequence=5 ttl=254 time=1 ms
— 10.0.3.3 ping statistics —
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 1/1/1 ms
ping 10.0.30.1
PING 10.0.30.1: 56 data bytes, press CTRL_C to break
Request time out
Request time out
Request time out
Request time out
Request time out
— 10.0.30.1 ping statistics —
5 packet(s) transmitted
0 packet(s) received
100.00% packet loss
telnet 10.0.3.3
<R1＞telnet 10.0.30.1
Press CTRL_] to quit telnet mode
Trying 10.0.30.1 …
Error: Can’t connect to the remote host
根據驗證可知，只有訪問指定地址的ICMP和telnet可以通過，其他流量全部禁止。