網絡拓撲:
配置思路:
配置下聯接口;配置上聯接口;配置端口區域;配置域間策略;配置靜態路由;配置NAT
操作步驟:
一、防火牆
1、配置下聯接口
<usg>system-view
[usg]sysname FW1
[FW1]interface GigabitEthernet 0/0/1
[FW1-GigabitEthernet0/0/1]ip address 192.168.7.254 255.255.255.0
[FW1-GigabitEthernet0/0/1]description connecct to SW1
[FW1-GigabitEthernet0/0/1]quit
[FW1]interface GigabitEthernet 0/0/2
[FW1-GigabitEthernet0/0/2]ip address 192.168.6.254 255.255.255.0
[FW1-GigabitEthernet0/0/2]description connecct to SW2
[FW1-GigabitEthernet0/0/2]quit
2、配置上聯接口
[FW1]interface GigabitEthernet 0/0/0
[FW1-GigabitEthernet0/0/0]ip address 100.1.1.1 255.255.255.248
[FW1-GigabitEthernet0/0/0]description connect to ISP1
[FW1-GigabitEthernet0/0/0]quit
3、配置端口區域
trust區域
[FW1]firewall zone trust
[FW1-zone-trust]set priority 85
[FW1-zone-trust]add interface GigabitEthernet 0/0/1
[FW1-zone-trust]add interface GigabitEthernet 0/0/2
[FW1-zone-trust]quit
untrust區域
[FW1]firewall zone untrust
[FW1-zone-untrust]set priority 5
[FW1-zone-untrust]add interface GigabitEthernet 0/0/0
[FW1-zone-untrust]quit
4、配置域間策略(生產環境根據實際情況選擇)
[FW1]firewall packet-filter default permit all
5、配置靜態路由
[FW1]ip route-static 192.168.0.0 255.255.0.0 192.168.7.253
[FW1]ip route-static 192.168.0.0 255.255.0.0 192.168.6.253
[FW1]ip route-static 0.0.0.0 0.0.0.0 100.1.1.5
6、配置NAT
[FW1]nat-policy interzone trust untrust outbound
[FW1-nat-policy-interzone-trust-untrust-outbound]policy 1
[FW1-nat-policy-interzone-trust-untrust-outbound]action source-nat
[FW1-nat-policy-interzone-trust-untrust-outbound]policy source 192.168.0.0 mask 16
[FW1-nat-policy-interzone-trust-untrust-outbound]easy-ip GigabitEthernet0/0/0
[FW1-nat-policy-interzone-trust-untrust-outbound-1]quit
[FW1-nat-policy-interzone-trust-untrust-outbound]quit
二、客戶端測試
1、PC端口設置自動獲取IP
2、相互ping測試
3、內網訪問ISP,查看防火牆NAT轉發記錄