2019防火墻在校園出口安全方案中的應用

0101(2019-06- 典型組 業(yè)務規(guī) 注意事 配置步 結果驗 配置腳 典型組 業(yè)務規(guī) 注意事 配置步 結果驗 配置腳 110101(2019-06-基于USG6000&USG9500V500R005C00版本寫作，可供V500R005C00、USG6000EV600R006C00及后續(xù)版本參考。不同版本之間可能存在差220101(2019-06-2-1FW33IP0101(2019-06-如圖3-所示，W作為安全網關部署在校園網出口，為校內用戶提供寬帶服務，為校外用戶提供服務器訪問服務。由于校園網絡是逐步、分期發(fā)展起來的，所以出口鏈路的帶寬并不均衡，其中教育網的鏈路帶寬為1G，的條鏈路帶寬分別為、1G和，的條鏈路帶寬均為1G。3-1IP為了保證內網用戶的上網體驗，充分利用多條P鏈路，學校希望訪問特定P網絡的流量優(yōu)先從該對應的出接口轉發(fā)出去，例如訪問教育網的流量優(yōu)先從1轉發(fā)，訪問的流量優(yōu)先從或轉發(fā)。同時，對屬于同一P的多條鏈路，可以按照鏈路帶寬或權重的比例進行流量負載分擔。為提高轉發(fā)的可靠性，防止單條鏈路流量過大導致丟包，各鏈路間還要實現(xiàn)鏈路備份。由于校內用戶自動獲得的是同一個服務器地址，所以流量將從同一條鏈路轉發(fā)出去。學校希望充分利用其他鏈路資源，所以要分流部分請求報文到其他P鏈路上。如果只是改變了報文的出接口，還是無法解決后續(xù)上網流量集中在一條鏈路上的問題。所以要將報文發(fā)送到不同P的上，這樣解析后的地址就屬于不同的P，達到了分流的目的。學校內部署了服務器提供域名解析服務，不同P的用戶訪問學校網站時，可以解析到屬于自己P的地址，不會解析到其他質量。能夠防御常見的DDoS攻擊（例如SYNflood攻擊）和單包攻擊（例如Land攻（如百度影音、愛奇藝、搜狐影音）FW（例如FTP協(xié)議）的正常通信，還需要開啟ASPF3-1IPIPIPIPIPIPIPFW連接校園內網的接口，加入3-2缺省情況下，同一安全區(qū)域內的設備也不能互訪，必須配置一條安全策略指定源安全區(qū)域或目的安全區(qū)域。例如，源安全區(qū)域指定為，目的安全區(qū)域指定為，表示域內的設備即可互訪；源安全區(qū)域指定為，目的安全區(qū)域指定為an，表示可以訪問任意安全域；源安全區(qū)域指定為any，目的安全區(qū)域指定為，表示任意安全域內的設備可以訪問域。

3-3DNSDNS

透明代理功能可以修改請求報文的目的地址，實現(xiàn)服務器的重定向。本例中結合策略路由智能選路，可以使請求報文按照鏈路帶寬比例進行轉發(fā)，由于解析后的服務器地址也屬于不同的，所以后續(xù)的訪問流量也會分擔到不同的上。3-4DNS–首選DNS–備用DNS–首選DNS–備用DNS–首選DNS–備用DNS–首選DNS–備用DNS–首選DNS–備用DNS–首選DNS–備用DNSDNS源IP目的IP服務：dns，dns-––––––此條策略路由必須置于所有策略路由之前，通過服務類型（使用P議或P協(xié)議的）匹配到請求報文，并根據(jù)鏈路帶寬進行負載分擔。當校內用戶獲得解析地址后，后續(xù)的業(yè)務報文會匹配其他策略路由并進行選路。

3-5ISPISP1ISPISP2ISP策略路由的目的地址設置為地址集，這樣當流量匹配策略路由的所有條件后，W將優(yōu)先使用對應的鏈路轉發(fā)該流量。如果同一擁有多條鏈路，W將隨機使用其中一條鏈路轉發(fā)流量，當流量較大時，各鏈路轉發(fā)流量的比例約等于鏈路帶寬比，即實現(xiàn)了按照帶寬負載分例如，當流量匹配策略路由的所有條件時，表示流量的目的地址屬于。由于連接1的個出接口、、的優(yōu)先級最高，所以W將從這個接口中隨機選擇一個轉發(fā)該流量。當、、都過載后，如果新的流量仍然匹配了策略路由1，那么已建立會話的流量仍從原接口轉發(fā)，但是新流量不再通過這個接口轉發(fā)，而是通過優(yōu)先級第二高的轉發(fā)。當也過載后，再使用優(yōu)先級第三高的和轉發(fā)。如果所有鏈路都已過載，那么W將按照各鏈路的帶寬比例分配新建立會話的流量，不再根據(jù)鏈路優(yōu)先級分配。–GE1/0/5，優(yōu)先級為–GE1/0/6，優(yōu)先級為探測方式：簡單探測間隔：33-6虛擬服務器對應教育網的對應ISP1的對應ISP2的實服務器組rserverrserver配置服務器負載均衡功能后，W會針對虛擬服務器的洞路由，防止產生路由環(huán)路。刪除虛擬服務器的務器和實服務器組的綁定關系后，黑洞路由自動刪除。

例如，學校內網有一臺DNS服務器，上面存放了Portal當教育網下的用戶訪問ortal服務器地址時，由于接口沒有配置智能功能，因此最終用戶得到的ortal服務器地址就是其原本教育網分配的公網地址5。當下的用戶訪問ortal服務器地址時，服務器返回給用戶的響應消息到達的2接口時，會把響應消息中原始的教育網地址5替換成分配的公網地址5，下的用戶收到響應消息后，就會和5這個地址進行通信。當然，在上還需要配置一條TSerer映射，將ortal服務器的私網地址0和5進行綁定，從而實現(xiàn)下的用戶通過的地址5和ortal服務器進行通信。3-7DNS原始服務器由于原始服務器IP出接口及映射后–智能DNS映射，只要針對ISP1和––––原始服務器出接口及映射后–––––

NAT為保證各個ISP的用戶能夠訪問內網服務器，需要在FW上部署NATServer功能，3-8NATServer私網NATServer公網––對應ISP1：5–對應ISP2：5私網公網––對應ISP1：02–對應ISP2：02為保證大量內網用戶能夠利用有限的公網IP地址訪問外網，需要在FWNAT功能，將報文的私網IP地址轉換成公網IP3-9NAT–地址段–NAT–地址段NAT–地址段NATNAT內網用戶訪問ISP1IP地址轉換為ISP1的公網IP–地址段NAT–地址段NAT內網用戶訪問ISP2IP地址轉換為ISP2的公網IP–地址段–NATNAT啟該協(xié)議對應的NATALG功能，保證多通道協(xié)議報文可以順利的進行地址轉換。本案例中以FTP、QQ和RTSP協(xié)議為例，開啟這些協(xié)議對應的NATALG功能。

3-10DDoS攻擊類型：SYN對于SYNFlood攻擊防范，建議GE接LandSmurfFraggleWinNuke帶源路由選項的IP帶路由記錄項的IP帶時間戳選項的IPPingofDeath

3-11HTTPURL訪問：記錄所有WebBBSHTTPHTTP

3-123-13IPPSNMPSNMPv3溯源功能即查看地址信息。開啟安全策略下的會話日志記錄功能后，W將匹配安全策略規(guī)則的會話的日志輸出到日志主機上，通過日志主機即可查看到這些日志信息，其中部分會話日志即包含了轉換前后的地址信息。ReversePathForwarding，單播逆向路徑轉發(fā)）功能一起使用。如果開啟IP欺騙服務器負載均衡功能的虛擬服務器的IP地址不能和下列IPNATServer的公網IP地址（globalNAT地址池中的IP網關的IPFW的接口IP服務器負載均衡功能的實服務器的IP地址不能和下列IP虛擬服務器的IPNATServer的公網IP（globalNATServer的內網服務器IP地址（insideIP地址進行配置，而不是虛擬服務器的IP配置NAT地址池和NATServer后，需要針對地址池中的地址和NATServer的公網只有支持安裝硬盤且硬盤在位的設備才能在Web步驟1<FW>system-[FW]interfaceGigabitEthernet[FW-GigabitEthernet1/0/1]description[FW-GigabitEthernet1/0/1]redirect-reversenext-hop[FW-GigabitEthernet1/0/1]bandwidthingress1000000threshold[FW-GigabitEthernet1/0/1]bandwidthegress1000000threshold[FW-GigabitEthernet1/0/1][FW]interfaceGigabitEthernet[FW-GigabitEthernet1/0/2]description[FW-GigabitEthernet1/0/2]redirect-reversenext-hop[FW-GigabitEthernet1/0/2]bandwidthingress200000threshold[FW-GigabitEthernet1/0/2]bandwidthegress200000threshold[FW-GigabitEthernet1/0/2][FW]interfaceGigabitEthernet[FW-GigabitEthernet1/0/3]description[FW-GigabitEthernet1/0/3]redirect-reversenext-hop[FW-GigabitEthernet1/0/3]bandwidthingress1000000threshold[FW-GigabitEthernet1/0/3]bandwidthegress1000000threshold[FW-GigabitEthernet1/0/3][FW]interfaceGigabitEthernet[FW-GigabitEthernet1/0/4]description[FW-GigabitEthernet1/0/4]redirect-reversenext-hop[FW-GigabitEthernet1/0/4]bandwidthingress200000threshold[FW-GigabitEthernet1/0/4]bandwidthegress200000threshold[FW-GigabitEthernet1/0/4][FW]interfaceGigabitEthernet[FW-GigabitEthernet1/0/5]description[FW-GigabitEthernet1/0/5]redirect-reversenext-hop[FW-GigabitEthernet1/0/5]bandwidthingress1000000threshold[FW-GigabitEthernet1/0/5]bandwidthegress1000000threshold[FW-GigabitEthernet1/0/5][FW]interfaceGigabitEthernet[FW-GigabitEthernet1/0/6]description[FW-GigabitEthernet1/0/6]redirect-reversenext-hop[FW-GigabitEthernet1/0/6]bandwidthingress1000000threshold[FW-GigabitEthernet1/0/6]bandwidthegress1000000threshold[FW-GigabitEthernet1/0/6][FW]interfaceGigabitEthernet[FW-GigabitEthernet1/0/7]descriptionconnect_to_campus[FW-GigabitEthernet1/0/7]quit步驟2分別為教育網、ISP1、ISP2[FW][FW]firewallzonename[FW-zone-edu_zone]setpriority[FW-zone-edu_zone]addinterfaceGigabitEthernet[FW-zone-edu_zone][FW]firewallzonename[FW-zone-isp1_zone1]setpriority[FW-zone-isp1_zone1]addinterfaceGigabitEthernet[FW-zone-isp1_zone1][FW]firewallzonename[FW-zone-isp1_zone2][FW-zone-isp1_zone2]setpriority[FW-zone-isp1_zone2]addinterfaceGigabitEthernet[FW-zone-isp1_zone2][FW]firewallzonename[FW-zone-isp1_zone3]setpriority[FW-zone-isp1_zone3]addinterfaceGigabitEthernet[FW-zone-isp1_zone3][FW]firewallzonename[FW-zone-isp2_zone1]setpriority[FW-zone-isp2_zone1]addinterfaceGigabitEthernet[FW-zone-isp2_zone1][FW]firewallzonename[FW-zone-isp2_zone2]setpriority[FW-zone-isp2_zone2]addinterfaceGigabitEthernet[FW-zone-isp2_zone2][FW]firewallzone[FW-zone-trust]addinterfaceGigabitEthernet[FW-zone-trust][FW][FW]security-[FW-policy-security]rulename[FW-policy-security-rule-user_inside]source-zonetrust[FW-policy-security-rule-user_inside]actionpermit[FW-policy-security-rule-user_inside]profileipsdefault[FW-policy-security-rule-user_inside]quit[FW-policy-security]rulename[FW-policy-security-rule-user_outside]source-zoneedu_zoneisp1_zone1isp1_zone2isp1_zone3isp2_zone1isp2_zone2[FW-policy-security-rule-user_outside]destination-address[FW-policy-security-rule-user_outside]actionpermit[FW-policy-security-rule-user_outside]profileipsdefault[FW-policy-security-rule-user_outside]quit[FW-policy-security]rulename[FW-policy-security-rule-local_to_any]source-zonelocal[FW-policy-security-rule-local_to_any]destination-zoneany[FW-policy-security-rule-local_to_any]actionpermit[FW-policy-security-rule-local_to_any][FW-policy-security]說明[FW]updateserverdomain [FW][FW]dns[FW]dnsserver[FW][FW]updatescheduleips-sdbenable[FW]updateschedulesa-sdbenable[FW]updatescheduleips-sdbdaily02:30[FW]updateschedulesa-sdbdaily02:30步驟3配置IP-Link功能，探測各ISP說明IP-Link的配置命令在USG6000和USG9500上略有差異，此處使用的是USG6000[FW][FW]ip-linkcheck[FW]ip-linkname[FW-iplink-edu_ip_link]destinationinterfaceGigabitEthernet1/0/1mode[FW-iplink-edu_ip_link][FW-iplink-edu_ip_link][FW]ip-linkname[FW-iplink-isp1_ip_link]destinationinterfaceGigabitEthernet1/0/2modeicmp[FW-iplink-isp1_ip_link]destinationinterfaceGigabitEthernet1/0/3modeicmp[FW-iplink-isp1_ip_link]destinationinterfaceGigabitEthernet1/0/4modeicmp[FW-iplink-isp1_ip_link]quit[FW]ip-linkname[FW-iplink-isp2_ip_link]destinationinterfaceGigabitEthernet1/0/5modeicmp[FW-iplink-isp2_ip_link]destinationinterfaceGigabitEthernet1/0/6modeicmp[FW-iplink-isp2_ip_link]quit步驟4配置靜態(tài)路由，目的地址為內網網段，下一跳為內網交換機的地址，保證外網的流步驟5配置DNS#配置各接口綁定DNS服務器的IP[FW][FW]dns-transparent-[FW-policy-dns]dnstransparent-proxy[FW-policy-dns]dnsserverbindinterfaceGigabitEthernet1/0/1preferred2alternate3[FW-policy-dns]dnsserverbindinterfaceGigabitEthernet1/0/2preferred2alternate3[FW-policy-dns]dnsserverbindinterfaceGigabitEthernet1/0/3preferred4alternate5[FW-policy-dns]dnsserverbindinterfaceGigabitEthernet1/0/4preferred6alternate7[FW-policy-dns]dnsserverbindinterfaceGigabitEthernet1/0/5preferred2alternate3[FW-policy-dns]dnsserverbindinterfaceGigabitEthernet1/0/6preferred4alternate#[FW-policy-dns][FW-policy-dns]dnstransparent-proxyexcludedomainserverpreferred#配置DNS[FW-policy-dns][FW-policy-dns]rulename[FW-policy-dns-rule-dns_trans_rule]action[FW-policy-dns-rule-dns_trans_rule][FW-policy-dns]#為DNS[FW][FW]policy-based-[FW-policy-pbr]rulename[FW-policy-pbr-rule-pbr_dns_trans]source-zone[FW-policy-pbr-rule-pbr_dns_trans]servicednsdns-[FW-policy-pbr-rule-pbr_dns_trans]actionpbregress-interfacemulti-interface[FW-policy-pbr-rule-pbr_dns_trans-multi-inter]modeproportion-of-bandwidth[FW-policy-pbr-rule-pbr_dns_trans-multi-inter]addinterfaceGigabitEthernet1/0/1[FW-policy-pbr-rule-pbr_dns_trans-multi-inter]addinterfaceGigabitEthernet1/0/2[FW-policy-pbr-rule-pbr_dns_trans-multi-inter]addinterfaceGigabitEthernet1/0/3[FW-policy-pbr-rule-pbr_dns_trans-multi-inter]addinterfaceGigabitEthernet1/0/4[FW-policy-pbr-rule-pbr_dns_trans-multi-inter]addinterfaceGigabitEthernet1/0/5[FW-policy-pbr-rule-pbr_dns_trans-multi-inter]addinterfaceGigabitEthernet1/0/6[FW-policy-pbr-rule-pbr_dns_trans-multi-inter]quit[FW-policy-pbr-rule-pbr_dns_trans][FW-policy-pbr]步驟6#配置ISP上傳ISP地址文件到FW，可以使用SFTP為教育網、ISP1和ISP2分別創(chuàng)建運營商名稱，并關聯(lián)對應的ISP[FW][FW]ispnameedu_addresssetfilenameedu_address.csv[FW]ispnameisp1_addresssetfilenameisp1_address.csv[FW]ispnameisp2_addresssetfilename[FW]ispnameother_edu_server_addresssetfilename新建對應遠程教學系統(tǒng)軟件的應用，并在策略路由中引用，使遠程教學系統(tǒng)軟件的說明請確保FW[FW][FW][FW-sa]user-defined-applicationname[FW-sa-user-defined-app-UD_dis_edu_sys_app]categoryBusiness_Systemssub-category[FW-sa-user-defined-app-UD_dis_edu_sys_app]data-modelclient-[FW-sa-user-defined-app-UD_dis_edu_sys_app]labelEncrypted-CommunicationsBusiness-[FW-sa-user-defined-app-UD_dis_edu_sys_app]rulename[FW-sa-user-defined-app-UD_dis_edu_sys_app-rule-1]ip-address0[FW-sa-user-defined-app-UD_dis_edu_sys_app-rule-1]port[FW-sa-user-defined-app-UD_dis_edu_sys_app-rule-1][FW-sa-user-defined-app-UD_dis_edu_sys_app][FW-sa][FW]policy-based-[FW-policy-pbr]rulename[FW-policy-pbr-rule-dis_edu_sys]source-zone[FW-policy-pbr-rule-dis_edu_sys]applicationapp[FW-policy-pbr-rule-dis_edu_sys]actionpbregress-interfacemulti-interface[FW-policy-pbr-rule-dis_edu_sys-multi-inter]modeproportion-of-bandwidth[FW-policy-pbr-rule-dis_edu_sys-multi-inter]addinterfaceGigabitEthernet1/0/1[FW-policy-pbr-rule-dis_edu_sys-multi-inter]addinterfaceGigabitEthernet1/0/5[FW-policy-pbr-rule-dis_edu_sys-multi-inter]addinterfaceGigabitEthernet1/0/6[FW-policy-pbr-rule-dis_edu_sys-multi-inter]quit[FW-policy-pbr-rule-dis_edu_sys]#配置策略路由智能選路，使P2P流量從ISP1說明請確保FW上存在相應的路由配置，使P2P[FW-policy-pbr][FW-policy-pbr]rulename[FW-policy-pbr-rule-p2p_traffic]applicationcategoryEntertainmentsub-categoryPeerCasting[FW-policy-pbr-rule-p2p_traffic]applicationcategoryGeneral_Internetsub-categoryFileShare_P2P[FW-policy-pbr-rule-p2p_traffic]actionpbregress-interfacemulti-interface[FW-policy-pbr-rule-p2p_traffic-multi-inter]modeproportion-of-bandwidth[FW-policy-pbr-rule-p2p_traffic-multi-inter]addinterfaceGigabitEthernet1/0/2[FW-policy-pbr-rule-p2p_traffic-multi-inter]addinterfaceGigabitEthernet1/0/3[FW-policy-pbr-rule-p2p_traffic-multi-inter]addinterfaceGigabitEthernet1/0/4[FW-policy-pbr-rule-p2p_traffic-multi-inter]quit#[FW-policy-pbr][FW-policy-pbr]rulename[FW-policy-pbr-rule-other_edu_server]source-zone[FW-policy-pbr-rule-other_edu_server]destination-addressisp[FW-policy-pbr-rule-other_edu_server]actionpbregress-interfaceGigabitEthernet1/0/1next-hop[FW-policy-pbr]rulename[FW-policy-pbr-rule-lib_internet]actionpbregress-interfaceGigabitEthernet1/0/1next-#[FW-policy-pbr][FW-policy-pbr]rulename[FW-policy-pbr-rule-pbr_edu]source-zone[FW-policy-pbr-rule-pbr_edu]destination-addressisp[FW-policy-pbr-rule-pbr_edu]actionpbregress-interfacemulti-[FW-policy-pbr-rule-pbr_edu-multi-inter]modepriority-of-[FW-policy-pbr-rule-pbr_edu-multi-inter]addinterfaceGigabitEthernet1/0/1priority8[FW-policy-pbr-rule-pbr_edu-multi-inter]addinterfaceGigabitEthernet1/0/2priority5[FW-policy-pbr-rule-pbr_edu-multi-inter]addinterfaceGigabitEthernet1/0/3priority5[FW-policy-pbr-rule-pbr_edu-multi-inter]addinterfaceGigabitEthernet1/0/4priority5[FW-policy-pbr-rule-pbr_edu-multi-inter]addinterfaceGigabitEthernet1/0/5priority1[FW-policy-pbr-rule-pbr_edu-multi-inter]addinterfaceGigabitEthernet1/0/6priority1[FW-policy-pbr-rule-pbr_edu-multi-inter]quit[FW-policy-pbr-rule-pbr_edu]流量的目的地址屬于ISP1地址集時，優(yōu)先使用ISP1[FW-policy-pbr][FW-policy-pbr]rulename[FW-policy-pbr-rule-pbr_isp1]source-zone[FW-policy-pbr-rule-pbr_isp1]destination-addressisp[FW-policy-pbr-rule-pbr_isp1]actionpbregress-interfacemulti-[FW-policy-pbr-rule-pbr_isp1-multi-inter]modepriority-of-[FW-policy-pbr-rule-pbr_isp1-multi-inter]addinterfaceGigabitEthernet1/0/1priority5[FW-policy-pbr-rule-pbr_isp1-multi-inter]addinterfaceGigabitEthernet1/0/2priority8[FW-policy-pbr-rule-pbr_isp1-multi-inter]addinterfaceGigabitEthernet1/0/3priority8[FW-policy-pbr-rule-pbr_isp1-multi-inter]addinterfaceGigabitEthernet1/0/4priority8[FW-policy-pbr-rule-pbr_isp1-multi-inter]addinterfaceGigabitEthernet1/0/5priority1[FW-policy-pbr-rule-pbr_isp1-multi-inter]addinterfaceGigabitEthernet1/0/6priority1[FW-policy-pbr-rule-pbr_isp1-multi-inter]quit[FW-policy-pbr-rule-pbr_isp1]流量的目的地址屬于ISP2地址集時，優(yōu)先使用ISP2[FW-policy-pbr][FW-policy-pbr]rulename[FW-policy-pbr-rule-pbr_isp2]source-zone[FW-policy-pbr-rule-pbr_isp2]destination-addressisp[FW-policy-pbr-rule-pbr_isp2]actionpbregress-interfacemulti-[FW-policy-pbr-rule-pbr_isp2-multi-inter]modepriority-of-[FW-policy-pbr-rule-pbr_isp2-multi-inter]addinterfaceGigabitEthernet1/0/1priority5[FW-policy-pbr-rule-pbr_isp2-multi-inter]addinterfaceGigabitEthernet1/0/2priority1[FW-policy-pbr-rule-pbr_isp2-multi-inter]addinterfaceGigabitEthernet1/0/3priority1[FW-policy-pbr-rule-pbr_isp2-multi-inter]addinterfaceGigabitEthernet1/0/4priority1[FW-policy-pbr-rule-pbr_isp2-multi-inter]addinterfaceGigabitEthernet1/0/5priority8[FW-policy-pbr-rule-pbr_isp2-multi-inter]addinterfaceGigabitEthernet1/0/6priority8[FW-policy-pbr-rule-pbr_isp2-multi-inter]quit[FW-policy-pbr-rule-pbr_isp2]沒有匹配到任何ISP地址集的流量，通過策略路由pbr_rest選擇鏈路質量最好的鏈路[FW-policy-pbr][FW-policy-pbr]rulename[FW-policy-pbr-rule-pbr_rest]source-zone[FW-policy-pbr-rule-pbr_rest]actionpbregress-interfacemulti-[FW-policy-pbr-rule-pbr_rest-multi-inter]modepriority-of-link-[FW-policy-pbr-rule-pbr_rest-multi-inter]addinterfaceGigabitEthernet1/0/1[FW-policy-pbr-rule-pbr_rest-multi-inter]addinterfaceGigabitEthernet1/0/2[FW-policy-pbr-rule-pbr_rest-multi-inter]addinterfaceGigabitEthernet1/0/3[FW-policy-pbr-rule-pbr_rest-multi-inter]addinterfaceGigabitEthernet1/0/4[FW-policy-pbr-rule-pbr_rest-multi-inter]addinterfaceGigabitEthernet1/0/5[FW-policy-pbr-rule-pbr_rest-multi-inter]addinterfaceGigabitEthernet[FW-policy-pbr-rule-pbr_rest-multi-inter]priority-of-link-qualityprotocoltcp-[FW-policy-pbr-rule-pbr_rest-multi-inter]priority-of-link-qualityparameterdelayjitter[FW-policy-pbr-rule-pbr_rest-multi-inter]priority-of-link-qualityinterval3times[FW-policy-pbr-rule-pbr_rest][FW-policy-pbr]步驟7#[FW]slb #[FW][FW][FW-slb]group1#[FW-slb-group-1][FW-slb-group-1]rserver1rip[FW-slb-group-1]rserver2rip[FW-slb-group-1]#配置虛擬服務器的IP[FW-slb][FW-slb]vserver1[FW-slb-vserver-1]vip1[FW-slb-vserver-1]vip2[FW-slb-vserver-1]vip3#[FW-slb-vserver-1][FW-slb-vserver-1]group[FW-slb-vserver-1][FW-slb]步驟8配置智能DNS#啟用智能DNS[FW]dns-smart #創(chuàng)建智能DNS組，并在組中配置智能DNS[FW][FW]dns-smartgroup1type[FW-dns-smart-group-1]real-server-ip[FW-dns-smart-group-1]out-interfaceGigabitEthernet1/0/2map5[FW-dns-smart-group-1]out-interfaceGigabitEthernet1/0/3map6[FW-dns-smart-group-1]out-interfaceGigabitEthernet1/0/4map7[FW-dns-smart-group-1]out-interfaceGigabitEthernet1/0/5map5[FW-dns-smart-group-1]out-interfaceGigabitEthernet1/0/6map6[FW-dns-smart-group-1]quit[FW]dns-smartgroup2type[FW-dns-smart-group-2]real-server-ip[FW-dns-smart-group-2]out-interfaceGigabitEthernet1/0/2map02[FW-dns-smart-group-2]out-interfaceGigabitEthernet1/0/3map03[FW-dns-smart-group-2]out-interfaceGigabitEthernet1/0/4map04[FW-dns-smart-group-2]out-interfaceGigabitEthernet1/0/5map02[FW-dns-smart-group-2]out-interfaceGigabitEthernet1/0/6map03[FW-dns-smart-group-2]quit步驟9配置基于安全區(qū)域的NATServer，使不同ISP的用戶通過對應的公網IP訪問內網服務#為Portal服務器配置NATServer[FW][FW]natserverportal_server01zoneedu_zoneglobal5inside[FW]natserverportal_server02zoneisp1_zone1global5inside0no-reverse[FW]natserverportal_server03zoneisp1_zone2global6inside0no-reverse[FW]natserverportal_server04zoneisp1_zone3global7inside0no-[FW][FW]natserverportal_server05zoneisp2_zone1global5inside0no-[FW]natserverportal_server06zoneisp2_zone2global6inside0no-為DNS服務器配置NATServer[FW][FW]natserverdns_server01zoneedu_zoneglobal01inside[FW]natserverdns_server02zoneisp1_zone1global02inside0no-reverse[FW]natserverdns_server03zoneisp1_zone2global03inside0no-reverse[FW]natserverdns_server04zoneisp1_zone3global04inside0no-reverse[FW]natserverdns_server05zoneisp2_zone1global02inside0no-reverse[FW]natserverdns_server06zoneisp2_zone2global03inside0no-#為NATServer[FW][FW]iproute-static532NULL[FW]iproute-static532NULL[FW]iproute-static632NULL[FW]iproute-static732NULL[FW]iproute-static532NULL[FW]iproute-static632NULL[FW]iproute-static0132NULL[FW]iproute-static0232NULL[FW]iproute-static0332NULL[FW]iproute-static0432NULL[FW]iproute-static0232NULL[FW]iproute-static0332NULL步驟10配置源NAT#為訪問教育網的流量配置源NAT[FW][FW]nataddress-group[FW-address-group-edu_nat_address_pool]mode[FW-address-group-edu_nat_address_pool]section01[FW-address-group-edu_nat_address_pool][FW]nat-[FW-policy-nat]rulename[FW-policy-nat-rule-edu_nat_policy]source-zone[FW-policy-nat-rule-edu_nat_policy]destination-zone[FW-policy-nat-rule-edu_nat_policy]actionsource-nataddress-group[FW-policy-nat-rule-edu_nat_policy][FW-policy-nat]#配置域內源NAT[FW][FW]nat-[FW-policy-nat]rulename[FW-policy-nat-rule-inner_nat_policy]source-zone[FW-policy-nat-rule-inner_nat_policy]destination-zone[FW-policy-nat-rule-inner_nat_policy]actionsource-nataddress-group[FW-policy-nat-rule-inner_nat_policy][FW-policy-nat]#為訪問ISP1的流量配置源NAT，地址池中為ISP1[FW][FW]nataddress-group[FW-address-group-isp1_nat_address_pool1]mode[FW-address-group-isp1_nat_address_pool1]section0[FW-address-group-isp1_nat_address_pool1][FW]nat-[FW-policy-nat]rulename[FW-policy-nat-rule-isp1_nat_policy1]source-zone[FW-policy-nat-rule-isp1_nat_policy1]destination-zone[FW-policy-nat-rule-isp1_nat_policy1]actionsource-nataddress-group[FW-policy-nat-rule-isp1_nat_policy1][FW-policy-nat][FW]nataddress-group[FW-address-group-isp1_nat_address_pool2][FW-address-group-isp1_nat_address_pool2]mode[FW-address-group-isp1_nat_address_pool2]section0[FW-address-group-isp1_nat_address_pool2][FW]nat-[FW-policy-nat]rulename[FW-policy-nat-rule-isp1_nat_policy2]source-zone[FW-policy-nat-rule-isp1_nat_policy2]destination-zone[FW-policy-nat-rule-isp1_nat_policy2]actionsource-nataddress-group[FW-policy-nat-rule-isp1_nat_policy2][FW-policy-nat][FW]nataddress-group[FW-address-group-isp1_nat_address_pool3]mode[FW-address-group-isp1_nat_address_pool3]section0[FW-address-group-isp1_nat_address_pool3][FW]nat-[FW-policy-nat]rulename[FW-policy-nat-rule-isp1_nat_policy3]source-zone[FW-policy-nat-rule-isp1_nat_policy3]destination-zone[FW-policy-nat-rule-isp1_nat_policy3]actionsource-nataddress-group[FW-policy-nat-rule-isp1_nat_policy3][FW-policy-nat]#為訪問ISP2的流量配置源NAT，地址池中為ISP2[FW][FW]nataddress-group[FW-address-group-isp2_nat_address_pool1]mode[FW-address-group-isp2_nat_address_pool1]section0[FW-address-group-isp2_nat_address_pool1][FW]nat-[FW-policy-nat]rulename[FW-policy-nat-rule-isp2_nat_policy1]source-zone[FW-policy-nat-rule-isp2_nat_policy1]destination-zone[FW-policy-nat-rule-isp2_nat_policy1]actionsource-nataddress-group[FW-policy-nat-rule-isp2_nat_policy1][FW-policy-nat][FW]nataddress-group[FW-address-group-isp2_nat_address_pool2]mode[FW-address-group-isp2_nat_address_pool2]section0[FW-address-group-isp2_nat_address_pool2][FW]nat-[FW-policy-nat]rulename[FW-policy-nat-rule-isp2_nat_policy2]source-zone[FW-policy-nat-rule-isp2_nat_policy2]destination-zone[FW-policy-nat-rule-isp2_nat_policy2]actionsource-nataddress-group[FW-policy-nat-rule-isp2_nat_policy2][FW-policy-nat]#為NAT[FW][FW]iproute-static132NULL[FW]iproute-static232NULL[FW]iproute-static332NULL[FW]iproute-static32NULL[FW]iproute-static32NULL[FW]iproute-static32NULL[FW]iproute-static32NULL[FW]iproute-static32NULL[FW]iproute-static32NULL[FW]iproute-static32NULL[FW]iproute-static32NULL[FW]iproute-static32NULL[FW]iproute-static32NULL[FW]iproute-static32NULL[FW]iproute-static32NULL[FW]iproute-static32NULL[FW][FW]iproute-static32NULL[FW]iproute-static32NULL[FW]firewallinterzonetrustedu_zone[FW-interzone-trust-edu_zone]detectftp[FW-interzone-trust-edu_zone]detectqq[FW-interzone-trust-edu_zone]detectrtsp[FW-interzone-trust-edu_zone]quit[FW]firewallinterzonetrustisp1_zone1[FW-interzone-trust-isp1_zone1]detectftp[FW-interzone-trust-isp1_zone1]detectqq[FW-interzone-trust-isp1_zone1]detectrtsp[FW-interzone-trust-isp1_zone1][FW]firewallinterzonetrustedu_zone[FW-interzone-trust-edu_zone]detectftp[FW-interzone-trust-edu_zone]detectqq[FW-interzone-trust-edu_zone]detectrtsp[FW-interzone-trust-edu_zone]quit[FW]firewallinterzonetrustisp1_zone1[FW-interzone-trust-isp1_zone1]detectftp[FW-interzone-trust-isp1_zone1]detectqq[FW-interzone-trust-isp1_zone1]detectrtsp[FW-interzone-trust-isp1_zone1]quit[FW]firewallinterzonetrustisp1_zone2[FW-interzone-trust-isp1_zone2]detectftp[FW-interzone-trust-isp1_zone2]detectqq[FW-interzone-trust-isp1_zone2]detectrtsp[FW-interzone-trust-isp1_zone2]quit[FW]firewallinterzonetrustisp1_zone3[FW-interzone-trust-isp1_zone3]detectftp[FW-interzone-trust-isp1_zone3]detectqq[FW-interzone-trust-isp1_zone3]detectrtsp[FW-interzone-trust-isp1_zone3]quit[FW]firewallinterzonetrustisp2_zone1[FW-interzone-trust-isp2_zone1]detectftp[FW-interzone-trust-isp2_zone1]detectqq[FW-interzone-trust-isp2_zone1]detectrtsp[FW-interzone-trust-isp2_zone1]quit[FW]firewallinterzonetrustisp2_zone2[FW-interzone-trust-isp2_zone2]detectftp[FW-interzone-trust-isp2_zone2]detectqq[FW-interzone-trust-isp2_zone2]detectrtsp[FW-interzone-trust-isp2_zone2]quit步驟12[FW][FW]firewalldefendlandenable[FW]firewalldefendsmurfenable[FW]firewalldefendfraggleenable[FW]firewalldefendip-fragmentenable[FW]firewalldefendtcp-flagenable[FW]firewalldefendwinnukeenable[FW]firewalldefendteardropenable[FW]firewalldefendtime-stamp[FW]firewalldefendping-of-death[FW]profiletype[FW]profiletypeauditname[FW-profile-audit-trust_to_internet_audit]http-auditfiledirectionboth[FW-profile-audit-trust_to_internet_audit]ftp-auditfiledirectionboth[FW-profile-audit-trust_to_internet_audit]quit[FW]audit-[FW-policy-audit]rulename[FW-policy-audit-rule-trust_to_internet_audit_policy]destination-zoneedu_zoneisp1_zone1isp1_zone2isp1_zone3isp2_zone1isp2_zone2[FW-policy-audit-rule-trust_to_internet_audit_policy]actionauditprofile[FW-policy-audit]步驟14對GE1/0/2接口鏈路的P2P[FW-policy-traffic]profile[FW-policy-traffic-profile-isp1_p2p_profile_01]bandwidthmaximum-bandwidthwholeboth100000[FW-policy-traffic-profile-isp1_p2p_profile_01]bandwidthmaximum-bandwidthper-ipboth500[FW-policy-traffic-profile-isp1_p2p_profile_01]quit[FW-policy-traffic]rulename[FW-policy-traffic-rule-isp1_p2p_01]ingress-interfaceGigabitEthernet[FW-policy-traffic-rule-isp1_p2p_01]egress-interfaceGigabitEthernet[FW-policy-traffic-rule-isp1_p2p_01]applicationcategoryEntertainmentsub-categoryPeerCasting[FW-policy-traffic-rule-isp1_p2p_01]applicationcategoryGeneral_Internetsub-categoryFileShare_P2P[FW-policy-traffic-rule-isp1_p2p_01]actionqosprofileisp1_p2p_profile_01[FW-policy-traffic-rule-isp1_p2p_01]對GE1/0/3接口鏈路的P2P[FW-policy-traffic][FW-policy-traffic]profile[FW-policy-traffic-profile-isp1_p2p_profile_02]bandwidthmaximum-bandwidthwholeboth300000[FW-policy-traffic-profile-isp1_p2p_profile_02]bandwidthmaximum-bandwidthper-ipboth1000[FW-policy-traffic-profile-isp1_p2p_profile_02]quit[FW-policy-traffic]rulename[FW-policy-traffic-rule-isp1_p2p_02]ingress-interfaceGigabitEthernet[FW-policy-traffic-rule-isp1_p2p_02]egress-interfaceGigabitEthernet[FW-policy-traffic-rule-isp1_p2p_02]applicationcategoryEntertainmentsub-categoryPeerCasting[FW-policy-traffic-rule-isp1_p2p_02]applicationcategoryGeneral_Internetsub-categoryFileShare_P2P[FW-policy-traffic-rule-isp1_p2p_02]actionqosprofileisp1_p2p_profile_02[FW-policy-traffic-rule-isp1_p2p_02]對GE1/0/4接口鏈路的P2P[FW-policy-traffic][FW-policy-traffic]profile[FW-policy-traffic-profile-isp1_p2p_profile_03]bandwidthmaximum-bandwidthwholeboth700000[FW-policy-traffic-profile-isp1_p2p_profile_03]bandwidthmaximum-bandwidthper-ipboth2000[FW-policy-traffic-profile-isp1_p2p_profile_03]quit[FW-policy-traffic]rulename[FW-policy-traffic-rule-isp1_p2p_03]ingress-interfaceGigabitEthernet[FW-policy-traffic-rule-isp1_p2p_03]egress-interfaceGigabitEthernet[FW-policy-traffic-rule-isp1_p2p_03]applicationcategoryEntertainmentsub-categoryPeerCasting[FW-policy-traffic-rule-isp1_p2p_03]applicationcategoryGeneral_Internetsub-categoryFileShare_P2P[FW-policy-traffic-rule-isp1_p2p_03]actionqosprofileisp1_p2p_profile_03[FW-policy-traffic-rule-isp1_p2p_03]步驟15配置系統(tǒng)日志和NAT溯源功能，在網管系統(tǒng)eSight配置向日志主機（0）發(fā)送系統(tǒng)日志（本案例發(fā)送IPS日志和攻擊防范日[FW][FW]info-center[FW]enginelogips[FW]info-centersourceIPSchannelloghostloglevel[FW]info-centersourceANTIATTACKchannel[FW]info-centerloghost#[FW][FW]security-[FW-policy-security]rulename[FW-policy-security-rule-trust_edu_zone]destination-zone[FW-policy-security-rule-trust_edu_zone]actionpermit[FW-policy-security-rule-trust_edu_zone]sessionlogging[FW-policy-security-rule-trust_edu_zone]quit[FW-policy-security]rulename[FW-policy-security-rule-trust_isp1_zone]destination-zoneisp1_zone1isp1_zone2[FW-policy-security-rule