基于IP地址和端口的安全策略
通过配置安全策略,实现基于IP地址、时间段以及服务的访问控制。配置接口IP地址和安全区域,完成网络基本参数配置。配置GigabitEthernet0/0/1接口IP地址,将接口加入dmz域
system-view
[FW] interface GigabitEthernet 1/0/1
[FW-GigabitEthernet1/0/1] ip address 10.2.0.1 24
[FW-GigabitEthernet1/0/1] quit
[FW] firewall zone dmz
[FW-zone-dmz] add interface GigabitEthernet 1/0/1
[FW-zone-dmz] quit
配置GigabitEthernet1/0/2接口IP地址,将接口加入trust域。
[FW] interface GigabitEthernet 1/0/2
[FW-GigabitEthernet1/0/2] ip address 10.1.1.1 24
[FW-GigabitEthernet1/0/2] quit
[FW] firewall zone trust
[FW-zone-trust] add interface GigabitEthernet 1/0/2
[FW-zone-trust] quit
配置GigabitEthernet1/0/3接口IP地址,将接口加入trust域。
[FW] interface GigabitEthernet 1/0/3
[FW-GigabitEthernet0/0/3] ip address 10.2.1.1 24
[FW-GigabitEthernet0/0/3] quit
[FW] firewall zone trust
[FW-zone-trust] add interface GigabitEthernet 1/0/3
[FW-zone-trust] quit
配置名称为server_deny的地址集,将几个不允许访问服务器的IP地址加入地址集。
[FW] ip address-set server_deny type object
[FW-object-address-set-server_deny] address 10.1.1.2 mask 32
[FW-object-address-set-server_deny] address 10.2.1.2 mask 32
[FW-object-address-set-server_deny] quit
配置名称为time_deny的时间段,指定PC不允许访问服务器的时间
[FW] time-range time_deny
[FW-time-range-time_deny] period-range 08:00:00 to 17:00:00 mon tue wed thu fri sat sun
[FW-time-range-time_deny] quit
分别为Server1和Server2配置自定义服务集server1_port和server2_port,将服务器的非知名端口加入服务集
[FW] ip service-set server1_port type object
[FW-object-service-set-server1_port] service protocol TCP source-port 0 to 65535 destination-port 8888
[FW-object-service-set-server1_port] quit
[FW] ip service-set server2_port type object
[FW-object-service-set-server2_port] service protocol UDP source-port 0 to 65535 destination-port 6666
[FW-object-service-set-server2_port] quit
配置安全策略规则,引用之前配置的地址集、时间段及服务集限制PC使用Server1对外提供的服务的安全策略
[FW] security-policy
[FW-policy-security] rule name policy_sec_deny1
[FW-policy-security-rule-policy_sec_deny1] source-zone trust
[FW-policy-security-rule-policy_sec_deny1] destination-zone dmz
[FW-policy-security-rule-policy_sec_deny1] source-address address-set server_deny
[FW-policy-security-rule-policy_sec_deny1] destination-address 10.2.0.10 32
[FW-policy-security-rule-policy_sec_deny1] service server1_port
[FW-policy-security-rule-policy_sec_deny1] time-range time_deny
[FW-policy-security-rule-policy_sec_deny1] action deny
[FW-policy-security-rule-policy_sec_deny1] quit
允许PC使用Server1对外提供的服务的安全策略
[FW-policy-security] rule name policy_sec_permit3
[FW-policy-security-rule-policy_sec_permit3] source-zone trust
[FW-policy-security-rule-policy_sec_permit3] destination-zone dmz
[FW-policy-security-rule-policy_sec_permit3] destination-address 10.2.0.10 32
[FW-policy-security-rule-policy_sec_permit3] service server1_port
[FW-policy-security-rule-policy_sec_permit3] action permit
[FW-policy-security-rule-policy_sec_permit3] quit
允许PC使用Server2对外提供的服务的安全策略
PC设置
文章为作者独立观点,不代表 股票程序化软件自动交易接口观点