防御保护综合实验

一、实验拓扑二、实验需求1、Client1属于财务部Client2属于研发部2、企业内网存在一个web-server服务器3、FW上通过ISP路由将电信和联通的路由网段进行导入并补充缺省路由公网路由器运行OSPF协议实现公网环境网络可达4、公网用户1通过电信DNS解析web-server服务器地址要求通过FW的GE1/0/1接口进入访问公网用户2通过联通DNS解析web-server服务器地址要求通过FW的GE1/0/2接口进入访问5、财务部访问FTP服务器时通过电信网络通行研发部访问FTP服务器时通过联通网络通行使用策略路由选路机制并开启IP-LINK检测策略路由需要基于源IP和用户的认证方式6、财务部采用免认证方式研发部采用匿名认证方式添加用户组和地址组信息7、外网访问内网采用NAT Server技术进行映射内网访问外网采用esay-ip方式进行数据访问通信8、安全策略要求编写精准策略三、实验配置LSW1[LSW1]vlan batch 10 20 30 [LSW1]interface GigabitEthernet 0/0/1 [LSW1-GigabitEthernet0/0/1]port link-type access [LSW1-GigabitEthernet0/0/1]port default vlan 10 [LSW1-GigabitEthernet0/0/1]quit [LSW1]interface GigabitEthernet 0/0/2 [LSW1-GigabitEthernet0/0/2]port link-type access [LSW1-GigabitEthernet0/0/2]port default vlan 20 [LSW1-GigabitEthernet0/0/2]quit [LSW1]interface GigabitEthernet 0/0/3 [LSW1-GigabitEthernet0/0/3]port link-type access [LSW1-GigabitEthernet0/0/3]port default vlan 30 [LSW1-GigabitEthernet0/0/3]quit [LSW1]interface Vlanif 10 [LSW1-Vlanif10]ip address 192.168.1.254 255.255.255.0 [LSW1-Vlanif10]quit [LSW1]interface Vlanif 20 [LSW1-Vlanif20]ip address 192.168.2.254 255.255.255.0 [LSW1-Vlanif20]quit [LSW1]interface Vlanif 30 [LSW1-Vlanif30]ip address 192.168.3.254 255.255.255.0 [LSW1-Vlanif30]quit [LSW1]interface GigabitEthernet 0/0/24 [LSW1-GigabitEthernet0/0/24]port link-type trunk [LSW1-GigabitEthernet0/0/24]port trunk allow-pass vlan all [LSW1-GigabitEthernet0/0/24]quit [LSW1]ip route-static 0.0.0.0 0 192.168.0.1R4[R4]interface GigabitEthernet 0/0/0 [R4-GigabitEthernet0/0/0]ip address 14.0.0.2 255.255.255.0 [R4-GigabitEthernet0/0/0]quit [R4]interface LoopBack 0 [R4-LoopBack0]ip address 100.1.1.1 255.255.255.0 [R4-LoopBack0]quit [R4]interface GigabitEthernet 0/0/1 [R4-GigabitEthernet0/0/1]ip address 101.1.1.1 255.255.255.0 [R4-GigabitEthernet0/0/1]quit [R4]interface GigabitEthernet 0/0/2 [R4-GigabitEthernet0/0/2]ip address 34.0.0.1 255.255.255.0 [R4-GigabitEthernet0/0/2]quit [R4]ospf 1 router-id 4.4.4.4 [R4-ospf-1]area 0 [R4-ospf-1-area-0.0.0.0]network 14.0.0.0 0.0.0.255 [R4-ospf-1-area-0.0.0.0]network 34.0.0.0 0.0.0.255 [R4-ospf-1-area-0.0.0.0]network 100.1.1.0 0.0.0.255 [R4-ospf-1-area-0.0.0.0]network 101.1.1.0 0.0.0.255 [R4-ospf-1-area-0.0.0.0]quit [R4]ip route-static 192.168.0.0 255.255.252.0 14.0.0.1R2[R2]interface GigabitEthernet 0/0/0 [R2-GigabitEthernet0/0/0]ip address 12.0.0.2 255.255.255.0 [R2-GigabitEthernet0/0/0]quit [R2]interface LoopBack 0 [R2-LoopBack0]ip address 200.1.1.1 255.255.255.0 [R2-LoopBack0]quit [R2]interface GigabitEthernet 0/0/1 [R2-GigabitEthernet0/0/1]ip address 102.1.1.1 255.255.255.0 [R2-GigabitEthernet0/0/1]quit [R2]interface GigabitEthernet 0/0/2 [R2-GigabitEthernet0/0/2]ip address 23.0.0.1 255.255.255.0 [R2-GigabitEthernet0/0/2]quit [R2]ospf 1 router-id 2.2.2.2 [R2-ospf-1]area 0 [R2-ospf-1-area-0.0.0.0]network 12.0.0.0 0.0.0.255 [R2-ospf-1-area-0.0.0.0]network 23.0.0.0 0.0.0.255 [R2-ospf-1-area-0.0.0.0]network 200.1.1.0 0.0.0.255 [R2-ospf-1-area-0.0.0.0]network 102.1.1.0 0.0.0.255 [R2-ospf-1-area-0.0.0.0]quit [R2]ip route-static 192.168.0.0 255.255.252.0 12.0.0.1R3[R3]interface GigabitEthernet 0/0/0 [R3-GigabitEthernet0/0/0]ip address 34.0.0.2 255.255.255.0 [R3-GigabitEthernet0/0/0]quit [R3]interface GigabitEthernet 0/0/1 [R3-GigabitEthernet0/0/1]ip address 23.0.0.2 255.255.255.0 [R3-GigabitEthernet0/0/1]quit [R3]interface LoopBack 0 [R3-LoopBack0]ip address 50.0.0.1 255.255.255.0 [R3-LoopBack0]quit [R3]ospf 1 router-id 3.3.3.3 [R3-ospf-1]area 0 [R3-ospf-1-area-0.0.0.0]network 34.0.0.0 0.0.0.255 [R3-ospf-1-area-0.0.0.0]network 23.0.0.0 0.0.0.255 [R3-ospf-1-area-0.0.0.0]network 50.0.0.0 0.0.0.255 [R3-ospf-1-area-0.0.0.0]quitFW