電子發(fā)燒友App
實(shí)驗(yàn)拓?fù)?/p>
防火墻的工作模式
透明網(wǎng)橋模式：可以理解成二層交換機(jī)，對三層的IP、路由沒有任何影響。透明模式仍然可以抵御外部入侵，但是不能發(fā)揮防火墻的全部功能
例如下圖：前期IP地址都已經(jīng)規(guī)劃好了，組網(wǎng)都已經(jīng)結(jié)束了。突然領(lǐng)導(dǎo)說要加個(gè)防火墻，那基本就用透明模式。
路由模式：可以理解成三層路由器
防火墻的區(qū)域(zone)
防火墻默認(rèn)區(qū)域的介紹
優(yōu)先級代表著可信程度，優(yōu)先級越高表示越信任，即數(shù)字越大越信任
[SRG]dis?zone? 2249??2020/11/18 local??#本地區(qū)域 ?priority?is?100??#默認(rèn)優(yōu)先級100 ? # trust?#內(nèi)網(wǎng)用戶 ?priority?is?85???#默認(rèn)優(yōu)先級85 ?interface?of?the?zone?is?(1): ????GigabitEthernet0/0/0 ???? # untrust?#外網(wǎng)用戶 ?priority?is?5??#默認(rèn)優(yōu)先級5 ?interface?of?the?zone?is?(0): ? # dmz??#dmz區(qū)域 ?priority?is?50???#默認(rèn)優(yōu)先級50 ?interface?of?the?zone?is?(0): #
接下來我們按照拓?fù)浒逊阑饓Φ?a target="_blank">端口劃分到相應(yīng)的區(qū)域。
[SRG]firewall?zone?? ??dmz???????????Indicate?the?DMZ ??local?????????Indicate?the?Local?zone ??name??????????Indicate?the?security?zone?name ??trust?????????Indicate?the?Trust?zone ??untrust???????Indicate?the?Untrust?zone ??vpn-instance??Indicate?VPN?instance? [SRG]firewall?zone?trust? [SRG-zone-trust]add?interface?g0/0/1 [SRG-zone-trust]q [SRG]firewall?zone?dmz? [SRG-zone-dmz]add?int?g0/0/3 [SRG-zone-dmz]q [SRG]firewall?zone?untrust? [SRG-zone-untrust]add?interface?g0/0/2 [SRG-zone-untrust]q
接口只有劃分了區(qū)域才可以使用。
這樣做完之后，只有trust區(qū)域才能訪問防火墻。內(nèi)網(wǎng)也不能訪問外網(wǎng)。
[R1]ip?route-static?0.0.0.0?0?12.1.1.2
[R2]ip?route-static?0.0.0.0?0?23.1.1.1?? #這里應(yīng)該用nat地址轉(zhuǎn)換的，但我們還沒有接觸到防火墻nat轉(zhuǎn)換，所以先用靜態(tài)路由代替，本篇后面會講到。
[SRG]ip?route-static?0.0.0.0?0?23.1.1.2???????#到外網(wǎng)的路由 [SRG]ip?route-static?192.168.1.0?24?12.1.1.1??#到內(nèi)網(wǎng)的路由
雖然我們加入了2條路由，但是由于還沒有配置策略，所以內(nèi)網(wǎng)用戶還是不能訪問外網(wǎng)。
防火墻策略概念
防火墻策略的方向
outbound：高優(yōu)先級訪問低優(yōu)先級
inbound：低優(yōu)先級訪問高優(yōu)先級
注意：“訪問”僅指的是出包即主動發(fā)起的第一個(gè)報(bào)文，即建立會話（session）的過程。
默認(rèn)高優(yōu)先級可以訪問低優(yōu)先級，但是低優(yōu)先級無法回包，相當(dāng)于回執(zhí)路由回不來。所以無法ping通。但是我的確是訪問了，防火墻就會記錄這一條信息。
防火墻默認(rèn)可以訪問任何一個(gè)區(qū)域
ping?192.168.254.2 2306??2020/11/18 ??PING?192.168.254.2:?56??data?bytes,?press?CTRL_C?to?break ????Reply?from?192.168.254.2:?bytes=56?Sequence=1?ttl=255?time=220?ms ????Reply?from?192.168.254.2:?bytes=56?Sequence=2?ttl=255?time=50?ms ????Reply?from?192.168.254.2:?bytes=56?Sequence=3?ttl=255?time=170?ms ????Reply?from?192.168.254.2:?bytes=56?Sequence=4?ttl=255?time=100?ms ????Reply?from?192.168.254.2:?bytes=56?Sequence=5?ttl=255?time=140?ms ??---?192.168.254.2?ping?statistics?--- ????5?packet(s)?transmitted ????5?packet(s)?received ????0.00%?packet?loss ????round-trip?min/avg/max?=?50/136/220?ms from wljsghq ping?192.168.1.2 2314??2020/11/18 ??PING?192.168.1.2:?56??data?bytes,?press?CTRL_C?to?break ????Request?time?out ????Reply?from?192.168.1.2:?bytes=56?Sequence=2?ttl=127?time=80?ms ????Reply?from?192.168.1.2:?bytes=56?Sequence=3?ttl=127?time=80?ms ????Reply?from?192.168.1.2:?bytes=56?Sequence=4?ttl=127?time=80?ms ????Reply?from?192.168.1.2:?bytes=56?Sequence=5?ttl=127?time=270?ms ??---?192.168.1.2?ping?statistics?--- ????5?packet(s)?transmitted ????4?packet(s)?received ????20.00%?packet?loss ????round-trip?min/avg/max?=?80/127/270?ms ping?23.1.1.2 2328??2020/11/18 ??PING?23.1.1.2:?56??data?bytes,?press?CTRL_C?to?break ????Reply?from?23.1.1.2:?bytes=56?Sequence=1?ttl=255?time=160?ms ????Reply?from?23.1.1.2:?bytes=56?Sequence=2?ttl=255?time=70?ms ????Reply?from?23.1.1.2:?bytes=56?Sequence=3?ttl=255?time=70?ms ????Reply?from?23.1.1.2:?bytes=56?Sequence=4?ttl=255?time=90?ms ????Reply?from?23.1.1.2:?bytes=56?Sequence=5?ttl=255?time=110?ms ??---?23.1.1.2?ping?statistics?--- ????5?packet(s)?transmitted ????5?packet(s)?received ????0.00%?packet?loss ????round-trip?min/avg/max?=?70/100/160?ms ping?34.1.1.2 2338??2020/11/18 ??PING?34.1.1.2:?56??data?bytes,?press?CTRL_C?to?break ????Request?time?out ????Reply?from?34.1.1.2:?bytes=56?Sequence=2?ttl=127?time=80?ms ????Reply?from?34.1.1.2:?bytes=56?Sequence=3?ttl=127?time=100?ms ????Reply?from?34.1.1.2:?bytes=56?Sequence=4?ttl=127?time=80?ms ????Reply?from?34.1.1.2:?bytes=56?Sequence=5?ttl=127?time=220?ms ??---?34.1.1.2?ping?statistics?--- ????5?packet(s)?transmitted ????4?packet(s)?received ????20.00%?packet?loss ????round-trip?min/avg/max?=?80/120/220?ms
為什么防火墻默認(rèn)就可以訪問任何區(qū)域呢？這是和防火墻的默認(rèn)策略有關(guān)。
防火墻的默認(rèn)策略
dis?cu ... ?firewall?packet-filter?default?permit?interzone?local?trust?direction?inbound??? ?#permit允許，local本地區(qū)域，trust內(nèi)網(wǎng)區(qū)域，inbound：優(yōu)先級由低——>高 ?上面的意思就是：local本地區(qū)域，trust內(nèi)網(wǎng)區(qū)域，這兩個(gè)區(qū)域默認(rèn)允許低——>高 ? ?firewall?packet-filter?default?permit?interzone?local?trust?direction?outbound ?上面的意思就是：local本地區(qū)域，trust內(nèi)網(wǎng)區(qū)域，這兩個(gè)區(qū)域默認(rèn)允許高——>低 ? ?firewall?packet-filter?default?permit?interzone?local?untrust?direction?outboun ?上面的意思就是：local本地區(qū)域，untrust外網(wǎng)區(qū)域，這兩個(gè)區(qū)域默認(rèn)允許高——>低 ...
三條默認(rèn)策略組合起來意思就是：
默認(rèn)防火墻和內(nèi)網(wǎng)區(qū)域允許進(jìn)和出，即相互通信；
防火墻和外網(wǎng)區(qū)域之間，只能出，不能進(jìn)。即防火墻可以ping通外網(wǎng)，外網(wǎng)無法ping通防火墻；
同樣防火墻訪問DMZ也是只能出，不能進(jìn)。即防火墻可以ping通DMZ的server，但server無法ping通防火墻。
防火墻的策略配置
1、內(nèi)網(wǎng)用戶訪問外網(wǎng)
[SRG]firewall?packet-filter?default?permit?interzone?trust?untrust?direction?out bound? 2321??2020/11/18 Warning:Setting?the?default?packet?filtering?to?permit?poses?security?risks.?You ?are?advised?to?configure?the?security?policy?based?on?the?actual?data?flows.?Ar e?you?sure?you?want?to?continue?[Y/N]y [R1]ping?23.1.1.2??#R1?ping?R2 ??PING?23.1.1.2:?56??data?bytes,?press?CTRL_C?to?break ????Reply?from?23.1.1.2:?bytes=56?Sequence=1?ttl=254?time=50?ms ????Reply?from?23.1.1.2:?bytes=56?Sequence=2?ttl=254?time=50?ms ????Reply?from?23.1.1.2:?bytes=56?Sequence=3?ttl=254?time=30?ms ????Reply?from?23.1.1.2:?bytes=56?Sequence=4?ttl=254?time=30?ms ????Reply?from?23.1.1.2:?bytes=56?Sequence=5?ttl=254?time=40?ms PC>ping?34.1.1.2??#pc1?PING?pc2 Ping?34.1.1.2:?32?data?bytes,?Press?Ctrl_C?to?break Request?timeout! From?34.1.1.2:?bytes=32?seq=2?ttl=125?time=62?ms From?34.1.1.2:?bytes=32?seq=3?ttl=125?time=63?ms From?34.1.1.2:?bytes=32?seq=4?ttl=125?time=31?ms From?34.1.1.2:?bytes=32?seq=5?ttl=125?time=31?ms ---?34.1.1.2?ping?statistics?--- ??5?packet(s)?transmitted ??4?packet(s)?received ??20.00%?packet?loss ??round-trip?min/avg/max?=?0/46/63?ms PC>
2、內(nèi)網(wǎng)用戶訪問DMZ區(qū)域的服務(wù)器
[SRG]firewall?packet-filter?default?permit?interzone?trust?dmz?direction?outboun d? 2300??2020/11/18 Warning:Setting?the?default?packet?filtering?to?permit?poses?security?risks.?You ?are?advised?to?configure?the?security?policy?based?on?the?actual?data?flows.?Ar e?you?sure?you?want?to?continue?[Y/N]y PC>ping?34.1.1.2 Ping?34.1.1.2:?32?data?bytes,?Press?Ctrl_C?to?break Request?timeout! From?34.1.1.2:?bytes=32?seq=2?ttl=125?time=62?ms From?34.1.1.2:?bytes=32?seq=3?ttl=125?time=63?ms From?34.1.1.2:?bytes=32?seq=4?ttl=125?time=31?ms From?34.1.1.2:?bytes=32?seq=5?ttl=125?time=31?ms ---?34.1.1.2?ping?statistics?--- ??5?packet(s)?transmitted ??4?packet(s)?received ??20.00%?packet?loss ??round-trip?min/avg/max?=?0/46/63?ms PC>
3、外網(wǎng)用戶訪問DMZ服務(wù)器
[SRG]firewall?packet-filter?default?permit?interzone?untrust?dmz?direction?inbou nd? 0011??2020/11/19 Warning:Setting?the?default?packet?filtering?to?permit?poses?security?risks.?You ?are?advised?to?configure?the?security?policy?based?on?the?actual?data?flows.?Ar e?you?sure?you?want?to?continue?[Y/N]y [SRG] PC>ping?192.168.254.2 Ping?192.168.254.2:?32?data?bytes,?Press?Ctrl_C?to?break From?192.168.254.2:?bytes=32?seq=1?ttl=253?time=15?ms From?192.168.254.2:?bytes=32?seq=2?ttl=253?time=63?ms From?192.168.254.2:?bytes=32?seq=3?ttl=253?time=47?ms From?192.168.254.2:?bytes=32?seq=4?ttl=253?time=31?ms From?192.168.254.2:?bytes=32?seq=5?ttl=253?time=47?ms ---?192.168.254.2?ping?statistics?--- ??5?packet(s)?transmitted ??5?packet(s)?received ??0.00%?packet?loss ??round-trip?min/avg/max?=?15/40/63?ms
防火墻上的NAT
防火墻上的NAT的基本配置
[R2]undo?ip?route-static?0.0.0.0?0?23.1.1.1???#刪除之前R2上面的靜態(tài)路由
[SRG]nat-policy?interzone?trust?untrust?outbound? [SRG-nat-policy-interzone-trust-untrust-outbound]policy?1??#1策略ID [SRG-nat-policy-interzone-trust-untrust-outbound-1]action?? ??no-nat??????Indicate?that?no?NAT?action?is?configured ??source-nat??Indicate?that?the?source?NAT?action?is?configured [SRG-nat-policy-interzone-trust-untrust-outbound-1]action?source-nat?? [SRG-nat-policy-interzone-trust-untrust-outbound-1]easy-ip?g0/0/2
驗(yàn)證結(jié)果
PC>ping?34.1.1.2 Ping?34.1.1.2:?32?data?bytes,?Press?Ctrl_C?to?break Request?timeout! From?34.1.1.2:?bytes=32?seq=2?ttl=125?time=32?ms From?34.1.1.2:?bytes=32?seq=3?ttl=125?time=31?ms From?34.1.1.2:?bytes=32?seq=4?ttl=125?time=62?ms From?34.1.1.2:?bytes=32?seq=5?ttl=125?time=63?ms ---?34.1.1.2?ping?statistics?--- ??5?packet(s)?transmitted ??4?packet(s)?received ??20.00%?packet?loss ??round-trip?min/avg/max?=?0/47/63?ms
抓包看看
防火墻NAT端口映射
端口映射
映射服務(wù)器server1的80端口到外網(wǎng)的23.1.1.3:80
[SRG]nat?server?protocol?tcp?global?23.1.1.3?80?inside?192.168.254.2?80
說明：外網(wǎng)IP有很多：23.1.1.0/24 整個(gè)段都可以用。
驗(yàn)證結(jié)果
如果要驗(yàn)證，拓?fù)渚托枰囊幌?，如下圖：
?
?
查看防火墻NAT轉(zhuǎn)換表
[SRG]display?firewall?session?table?nat 0016??2020/11/19 ?Current?Total?Sessions?:?1 ??http??VPN:public?-->?public?34.1.1.2:2050-->23.1.1.3:80[192.168.254.2:80] [SRG]
抓包看看
編輯：黃飛
?
工商網(wǎng)監(jiān)
評論