防火墙的安全策略

1.VLAN 2属于办公区;VLAN 3属于生产区,创建时间段

复制代码
[FW]ip address-set BG type object 
[FW-object-address-set-BG]address 192.168.1.0 mask 25
[FW]ip address-set SC type object 	
[FW-object-address-set-SC]address 192.168.1.129 mask 25
[FW]ip address-set OA_Server type object 
[FW-object-address-set-OA_Server]address 10.0.0.1 mask 32
[FW]ip address-set  Web_Server type object 	
[FW-object-address-set-Web_Server]address 10.0.0.2 mask 32
[FW]time-range working_time
[FW-time-range-working_time]period-range 08:00:00 to 18:00:00 working-day
[FW]time-range update_time
[FW-time-range-update_time]period-range 10:00:00 to 11:00:00 Mon 

2、办公区PC在工作日时间(周一至周五,早8到晚6)可以正常访问0A server,其他时间不允许

3,办公区PC可以在任意时刻访问wed server,生产区PC可以在任意时刻访问0A Server,但是不能访问web server

复制代码
[FW]security-policy 
[FW-policy-security]rule name policy_2	
[FW-policy-security-rule-policy_2]description BG to Web
[FW-policy-security-rule-policy_2]source-zone trust 
[FW-policy-security-rule-policy_2]destination-zone dmz 
[FW-policy-security-rule-policy_2]source-address address-set BG
[FW-policy-security-rule-policy_2]destination-address address-set Web_Server
[FW-policy-security-rule-policy_2]action permit
[FW]security-policy 
[FW-policy-security]rule name policy_3
[FW-policy-security-rule-policy_3]description SC to OA
[FW-policy-security-rule-policy_3]source-zone trust 
[FW-policy-security-rule-policy_3]destination-zone dmz 
[FW-policy-security-rule-policy_3]source-address address-set  SC	
[FW-policy-security-rule-policy_3]destination-address address-set OA_Server 
[FW-policy-security-rule-policy_3]action permit 

5、特例:生产区PC3可以在每周一早10到早11访问Web server,用来更新企业最新产品信息

复制代码
[FW]security-policy 
[FW-policy-security]rule name policy_4
[FW-policy-security-rule-policy_4]description SC to Web_Server
[FW-policy-security-rule-policy_4]source-zone trust 
[FW-policy-security-rule-policy_4]destination-zone dmz
[FW-policy-security-rule-policy_4]source-address address-set SC
[FW-policy-security-rule-policy_4]destination-address address-set Web_Server 
[FW-policy-security-rule-policy_4]time-range update_time
[FW-policy-security-rule-policy_4]action permit 

pc1ping网关测通

pc1pingOA与web

相关推荐
星期天要睡觉35 分钟前
MySQL 综合练习
数据库·mysql
Y40900140 分钟前
数据库基础知识——聚合函数、分组查询
android·数据库
snowfoootball41 分钟前
(自用)Linux 常用命令自查文档
linux·运维·服务器
Web极客码43 分钟前
在Ubuntu 20.04的服务器上查找的服务器的IP地址
服务器·tcp/ip·ubuntu
墨染 殇雪1 小时前
webshell及冰蝎双击无法打开?
运维·服务器·webshell·webshell管理工具
R-G-B1 小时前
Linux常见命令总结 合集二:基本命令、目录操作命令、文件操作命令、压缩文件操作、查找命令、权限命令、其他命令
linux·基本命令·目录操作命令·linux常见命令·压缩文件操作·权限命令·查找命令
Chukai1231 小时前
Windows 和 Linux 系统下修改防火墙机制开放端口
linux·运维·windows
JosieBook2 小时前
【数据库】MySQL 数据库创建存储过程及使用场景详解
数据库·mysql