防火墙的安全策略

1.VLAN 2属于办公区;VLAN 3属于生产区,创建时间段

复制代码
[FW]ip address-set BG type object 
[FW-object-address-set-BG]address 192.168.1.0 mask 25
[FW]ip address-set SC type object 	
[FW-object-address-set-SC]address 192.168.1.129 mask 25
[FW]ip address-set OA_Server type object 
[FW-object-address-set-OA_Server]address 10.0.0.1 mask 32
[FW]ip address-set  Web_Server type object 	
[FW-object-address-set-Web_Server]address 10.0.0.2 mask 32
[FW]time-range working_time
[FW-time-range-working_time]period-range 08:00:00 to 18:00:00 working-day
[FW]time-range update_time
[FW-time-range-update_time]period-range 10:00:00 to 11:00:00 Mon 

2、办公区PC在工作日时间(周一至周五,早8到晚6)可以正常访问0A server,其他时间不允许

3,办公区PC可以在任意时刻访问wed server,生产区PC可以在任意时刻访问0A Server,但是不能访问web server

复制代码
[FW]security-policy 
[FW-policy-security]rule name policy_2	
[FW-policy-security-rule-policy_2]description BG to Web
[FW-policy-security-rule-policy_2]source-zone trust 
[FW-policy-security-rule-policy_2]destination-zone dmz 
[FW-policy-security-rule-policy_2]source-address address-set BG
[FW-policy-security-rule-policy_2]destination-address address-set Web_Server
[FW-policy-security-rule-policy_2]action permit
[FW]security-policy 
[FW-policy-security]rule name policy_3
[FW-policy-security-rule-policy_3]description SC to OA
[FW-policy-security-rule-policy_3]source-zone trust 
[FW-policy-security-rule-policy_3]destination-zone dmz 
[FW-policy-security-rule-policy_3]source-address address-set  SC	
[FW-policy-security-rule-policy_3]destination-address address-set OA_Server 
[FW-policy-security-rule-policy_3]action permit 

5、特例:生产区PC3可以在每周一早10到早11访问Web server,用来更新企业最新产品信息

复制代码
[FW]security-policy 
[FW-policy-security]rule name policy_4
[FW-policy-security-rule-policy_4]description SC to Web_Server
[FW-policy-security-rule-policy_4]source-zone trust 
[FW-policy-security-rule-policy_4]destination-zone dmz
[FW-policy-security-rule-policy_4]source-address address-set SC
[FW-policy-security-rule-policy_4]destination-address address-set Web_Server 
[FW-policy-security-rule-policy_4]time-range update_time
[FW-policy-security-rule-policy_4]action permit 

pc1ping网关测通

pc1pingOA与web

相关推荐
嵌入式-老费1 小时前
Linux上位机开发实战(qt编译之谜)
linux·运维·服务器
翱翔-蓝天1 小时前
CentOS 上扩展 Swap 分区的大小
linux·运维·centos
ahisky1 小时前
Centos内核升级
linux·运维·centos
Pandaconda1 小时前
【后端开发面试题】每日 3 题(十二)
数据库·后端·面试·负载均衡·高并发·后端开发·acid
周Echo周2 小时前
2、操作系统之软件基础
linux·运维·服务器·c++·windows·ubuntu·centos
niuTaylor2 小时前
Linux驱动开发和FreeRTOS路线总体规划
linux·运维·服务器·驱动开发
zhouwhui2 小时前
【openGauss】物理备份恢复
数据库·gaussdb
神洛华2 小时前
PowerBI数据建模基础操作1:数据关系(基数、双向筛选、常规关系、有限关系)与星型架构(维度表、事实表)
数据库·powerbi
norsd2 小时前
一次Linux下 .net 调试经历
linux·.net
___波子 Pro Max.2 小时前
Linux mount和SSD分区
linux·mount