電子發燒友App
實驗拓撲
防火墻的工作模式
透明網橋模式：可以理解成二層交換機，對三層的IP、路由沒有任何影響。透明模式仍然可以抵御外部入侵，但是不能發揮防火墻的全部功能
例如下圖：前期IP地址都已經規劃好了，組網都已經結束了。突然領導說要加個防火墻，那基本就用透明模式。
路由模式：可以理解成三層路由器
防火墻的區域(zone)
防火墻默認區域的介紹
優先級代表著可信程度，優先級越高表示越信任，即數字越大越信任
[SRG]dis?zone? 2249??2020/11/18 local??#本地區域 ?priority?is?100??#默認優先級100 ? # trust?#內網用戶 ?priority?is?85???#默認優先級85 ?interface?of?the?zone?is?(1): ????GigabitEthernet0/0/0 ???? # untrust?#外網用戶 ?priority?is?5??#默認優先級5 ?interface?of?the?zone?is?(0): ? # dmz??#dmz區域 ?priority?is?50???#默認優先級50 ?interface?of?the?zone?is?(0): #
接下來我們按照拓撲把防火墻的端口劃分到相應的區域。
[SRG]firewall?zone?? ??dmz???????????Indicate?the?DMZ ??local?????????Indicate?the?Local?zone ??name??????????Indicate?the?security?zone?name ??trust?????????Indicate?the?Trust?zone ??untrust???????Indicate?the?Untrust?zone ??vpn-instance??Indicate?VPN?instance? [SRG]firewall?zone?trust? [SRG-zone-trust]add?interface?g0/0/1 [SRG-zone-trust]q [SRG]firewall?zone?dmz? [SRG-zone-dmz]add?int?g0/0/3 [SRG-zone-dmz]q [SRG]firewall?zone?untrust? [SRG-zone-untrust]add?interface?g0/0/2 [SRG-zone-untrust]q
接口只有劃分了區域才可以使用。
這樣做完之后，只有trust區域才能訪問防火墻。內網也不能訪問外網。
[R1]ip?route-static?0.0.0.0?0?12.1.1.2
[R2]ip?route-static?0.0.0.0?0?23.1.1.1?? #這里應該用nat地址轉換的，但我們還沒有接觸到防火墻nat轉換，所以先用靜態路由代替，本篇后面會講到。
[SRG]ip?route-static?0.0.0.0?0?23.1.1.2???????#到外網的路由 [SRG]ip?route-static?192.168.1.0?24?12.1.1.1??#到內網的路由
雖然我們加入了2條路由，但是由于還沒有配置策略，所以內網用戶還是不能訪問外網。
防火墻策略概念
防火墻策略的方向
outbound：高優先級訪問低優先級
inbound：低優先級訪問高優先級
注意：“訪問”僅指的是出包即主動發起的第一個報文，即建立會話（session）的過程。
默認高優先級可以訪問低優先級，但是低優先級無法回包，相當于回執路由回不來。所以無法ping通。但是我的確是訪問了，防火墻就會記錄這一條信息。
防火墻默認可以訪問任何一個區域
ping?192.168.254.2 2306??2020/11/18 ??PING?192.168.254.2:?56??data?bytes,?press?CTRL_C?to?break ????Reply?from?192.168.254.2:?bytes=56?Sequence=1?ttl=255?time=220?ms ????Reply?from?192.168.254.2:?bytes=56?Sequence=2?ttl=255?time=50?ms ????Reply?from?192.168.254.2:?bytes=56?Sequence=3?ttl=255?time=170?ms ????Reply?from?192.168.254.2:?bytes=56?Sequence=4?ttl=255?time=100?ms ????Reply?from?192.168.254.2:?bytes=56?Sequence=5?ttl=255?time=140?ms ??---?192.168.254.2?ping?statistics?--- ????5?packet(s)?transmitted ????5?packet(s)?received ????0.00%?packet?loss ????round-trip?min/avg/max?=?50/136/220?ms from wljsghq ping?192.168.1.2 2314??2020/11/18 ??PING?192.168.1.2:?56??data?bytes,?press?CTRL_C?to?break ????Request?time?out ????Reply?from?192.168.1.2:?bytes=56?Sequence=2?ttl=127?time=80?ms ????Reply?from?192.168.1.2:?bytes=56?Sequence=3?ttl=127?time=80?ms ????Reply?from?192.168.1.2:?bytes=56?Sequence=4?ttl=127?time=80?ms ????Reply?from?192.168.1.2:?bytes=56?Sequence=5?ttl=127?time=270?ms ??---?192.168.1.2?ping?statistics?--- ????5?packet(s)?transmitted ????4?packet(s)?received ????20.00%?packet?loss ????round-trip?min/avg/max?=?80/127/270?ms ping?23.1.1.2 2328??2020/11/18 ??PING?23.1.1.2:?56??data?bytes,?press?CTRL_C?to?break ????Reply?from?23.1.1.2:?bytes=56?Sequence=1?ttl=255?time=160?ms ????Reply?from?23.1.1.2:?bytes=56?Sequence=2?ttl=255?time=70?ms ????Reply?from?23.1.1.2:?bytes=56?Sequence=3?ttl=255?time=70?ms ????Reply?from?23.1.1.2:?bytes=56?Sequence=4?ttl=255?time=90?ms ????Reply?from?23.1.1.2:?bytes=56?Sequence=5?ttl=255?time=110?ms ??---?23.1.1.2?ping?statistics?--- ????5?packet(s)?transmitted ????5?packet(s)?received ????0.00%?packet?loss ????round-trip?min/avg/max?=?70/100/160?ms ping?34.1.1.2 2338??2020/11/18 ??PING?34.1.1.2:?56??data?bytes,?press?CTRL_C?to?break ????Request?time?out ????Reply?from?34.1.1.2:?bytes=56?Sequence=2?ttl=127?time=80?ms ????Reply?from?34.1.1.2:?bytes=56?Sequence=3?ttl=127?time=100?ms ????Reply?from?34.1.1.2:?bytes=56?Sequence=4?ttl=127?time=80?ms ????Reply?from?34.1.1.2:?bytes=56?Sequence=5?ttl=127?time=220?ms ??---?34.1.1.2?ping?statistics?--- ????5?packet(s)?transmitted ????4?packet(s)?received ????20.00%?packet?loss ????round-trip?min/avg/max?=?80/120/220?ms
為什么防火墻默認就可以訪問任何區域呢？這是和防火墻的默認策略有關。
防火墻的默認策略
dis?cu ... ?firewall?packet-filter?default?permit?interzone?local?trust?direction?inbound??? ?#permit允許，local本地區域，trust內網區域，inbound：優先級由低——>高 ?上面的意思就是：local本地區域，trust內網區域，這兩個區域默認允許低——>高 ? ?firewall?packet-filter?default?permit?interzone?local?trust?direction?outbound ?上面的意思就是：local本地區域，trust內網區域，這兩個區域默認允許高——>低 ? ?firewall?packet-filter?default?permit?interzone?local?untrust?direction?outboun ?上面的意思就是：local本地區域，untrust外網區域，這兩個區域默認允許高——>低 ...
三條默認策略組合起來意思就是：
默認防火墻和內網區域允許進和出，即相互通信；
防火墻和外網區域之間，只能出，不能進。即防火墻可以ping通外網，外網無法ping通防火墻；
同樣防火墻訪問DMZ也是只能出，不能進。即防火墻可以ping通DMZ的server，但server無法ping通防火墻。
防火墻的策略配置
1、內網用戶訪問外網
[SRG]firewall?packet-filter?default?permit?interzone?trust?untrust?direction?out bound? 2321??2020/11/18 Warning:Setting?the?default?packet?filtering?to?permit?poses?security?risks.?You ?are?advised?to?configure?the?security?policy?based?on?the?actual?data?flows.?Ar e?you?sure?you?want?to?continue?[Y/N]y [R1]ping?23.1.1.2??#R1?ping?R2 ??PING?23.1.1.2:?56??data?bytes,?press?CTRL_C?to?break ????Reply?from?23.1.1.2:?bytes=56?Sequence=1?ttl=254?time=50?ms ????Reply?from?23.1.1.2:?bytes=56?Sequence=2?ttl=254?time=50?ms ????Reply?from?23.1.1.2:?bytes=56?Sequence=3?ttl=254?time=30?ms ????Reply?from?23.1.1.2:?bytes=56?Sequence=4?ttl=254?time=30?ms ????Reply?from?23.1.1.2:?bytes=56?Sequence=5?ttl=254?time=40?ms PC>ping?34.1.1.2??#pc1?PING?pc2 Ping?34.1.1.2:?32?data?bytes,?Press?Ctrl_C?to?break Request?timeout! From?34.1.1.2:?bytes=32?seq=2?ttl=125?time=62?ms From?34.1.1.2:?bytes=32?seq=3?ttl=125?time=63?ms From?34.1.1.2:?bytes=32?seq=4?ttl=125?time=31?ms From?34.1.1.2:?bytes=32?seq=5?ttl=125?time=31?ms ---?34.1.1.2?ping?statistics?--- ??5?packet(s)?transmitted ??4?packet(s)?received ??20.00%?packet?loss ??round-trip?min/avg/max?=?0/46/63?ms PC>
2、內網用戶訪問DMZ區域的服務器
[SRG]firewall?packet-filter?default?permit?interzone?trust?dmz?direction?outboun d? 2300??2020/11/18 Warning:Setting?the?default?packet?filtering?to?permit?poses?security?risks.?You ?are?advised?to?configure?the?security?policy?based?on?the?actual?data?flows.?Ar e?you?sure?you?want?to?continue?[Y/N]y PC>ping?34.1.1.2 Ping?34.1.1.2:?32?data?bytes,?Press?Ctrl_C?to?break Request?timeout! From?34.1.1.2:?bytes=32?seq=2?ttl=125?time=62?ms From?34.1.1.2:?bytes=32?seq=3?ttl=125?time=63?ms From?34.1.1.2:?bytes=32?seq=4?ttl=125?time=31?ms From?34.1.1.2:?bytes=32?seq=5?ttl=125?time=31?ms ---?34.1.1.2?ping?statistics?--- ??5?packet(s)?transmitted ??4?packet(s)?received ??20.00%?packet?loss ??round-trip?min/avg/max?=?0/46/63?ms PC>
3、外網用戶訪問DMZ服務器
[SRG]firewall?packet-filter?default?permit?interzone?untrust?dmz?direction?inbou nd? 0011??2020/11/19 Warning:Setting?the?default?packet?filtering?to?permit?poses?security?risks.?You ?are?advised?to?configure?the?security?policy?based?on?the?actual?data?flows.?Ar e?you?sure?you?want?to?continue?[Y/N]y [SRG] PC>ping?192.168.254.2 Ping?192.168.254.2:?32?data?bytes,?Press?Ctrl_C?to?break From?192.168.254.2:?bytes=32?seq=1?ttl=253?time=15?ms From?192.168.254.2:?bytes=32?seq=2?ttl=253?time=63?ms From?192.168.254.2:?bytes=32?seq=3?ttl=253?time=47?ms From?192.168.254.2:?bytes=32?seq=4?ttl=253?time=31?ms From?192.168.254.2:?bytes=32?seq=5?ttl=253?time=47?ms ---?192.168.254.2?ping?statistics?--- ??5?packet(s)?transmitted ??5?packet(s)?received ??0.00%?packet?loss ??round-trip?min/avg/max?=?15/40/63?ms
防火墻上的NAT
防火墻上的NAT的基本配置
[R2]undo?ip?route-static?0.0.0.0?0?23.1.1.1???#刪除之前R2上面的靜態路由
[SRG]nat-policy?interzone?trust?untrust?outbound? [SRG-nat-policy-interzone-trust-untrust-outbound]policy?1??#1策略ID [SRG-nat-policy-interzone-trust-untrust-outbound-1]action?? ??no-nat??????Indicate?that?no?NAT?action?is?configured ??source-nat??Indicate?that?the?source?NAT?action?is?configured [SRG-nat-policy-interzone-trust-untrust-outbound-1]action?source-nat?? [SRG-nat-policy-interzone-trust-untrust-outbound-1]easy-ip?g0/0/2
驗證結果
PC>ping?34.1.1.2 Ping?34.1.1.2:?32?data?bytes,?Press?Ctrl_C?to?break Request?timeout! From?34.1.1.2:?bytes=32?seq=2?ttl=125?time=32?ms From?34.1.1.2:?bytes=32?seq=3?ttl=125?time=31?ms From?34.1.1.2:?bytes=32?seq=4?ttl=125?time=62?ms From?34.1.1.2:?bytes=32?seq=5?ttl=125?time=63?ms ---?34.1.1.2?ping?statistics?--- ??5?packet(s)?transmitted ??4?packet(s)?received ??20.00%?packet?loss ??round-trip?min/avg/max?=?0/47/63?ms
抓包看看
防火墻NAT端口映射
端口映射
映射服務器server1的80端口到外網的23.1.1.3:80
[SRG]nat?server?protocol?tcp?global?23.1.1.3?80?inside?192.168.254.2?80
說明：外網IP有很多：23.1.1.0/24 整個段都可以用。
驗證結果
如果要驗證，拓撲就需要更改一下，如下圖：
?
?
查看防火墻NAT轉換表
[SRG]display?firewall?session?table?nat 0016??2020/11/19 ?Current?Total?Sessions?:?1 ??http??VPN:public?-->?public?34.1.1.2:2050-->23.1.1.3:80[192.168.254.2:80] [SRG]
抓包看看
編輯：黃飛
?
工商網監
評論