防火墙的安全策略

1.VLAN 2属于办公区;VLAN 3属于生产区,创建时间段

复制代码
[FW]ip address-set BG type object 
[FW-object-address-set-BG]address 192.168.1.0 mask 25
[FW]ip address-set SC type object 	
[FW-object-address-set-SC]address 192.168.1.129 mask 25
[FW]ip address-set OA_Server type object 
[FW-object-address-set-OA_Server]address 10.0.0.1 mask 32
[FW]ip address-set  Web_Server type object 	
[FW-object-address-set-Web_Server]address 10.0.0.2 mask 32
[FW]time-range working_time
[FW-time-range-working_time]period-range 08:00:00 to 18:00:00 working-day
[FW]time-range update_time
[FW-time-range-update_time]period-range 10:00:00 to 11:00:00 Mon 

2、办公区PC在工作日时间(周一至周五,早8到晚6)可以正常访问0A server,其他时间不允许

3,办公区PC可以在任意时刻访问wed server,生产区PC可以在任意时刻访问0A Server,但是不能访问web server

复制代码
[FW]security-policy 
[FW-policy-security]rule name policy_2	
[FW-policy-security-rule-policy_2]description BG to Web
[FW-policy-security-rule-policy_2]source-zone trust 
[FW-policy-security-rule-policy_2]destination-zone dmz 
[FW-policy-security-rule-policy_2]source-address address-set BG
[FW-policy-security-rule-policy_2]destination-address address-set Web_Server
[FW-policy-security-rule-policy_2]action permit
[FW]security-policy 
[FW-policy-security]rule name policy_3
[FW-policy-security-rule-policy_3]description SC to OA
[FW-policy-security-rule-policy_3]source-zone trust 
[FW-policy-security-rule-policy_3]destination-zone dmz 
[FW-policy-security-rule-policy_3]source-address address-set  SC	
[FW-policy-security-rule-policy_3]destination-address address-set OA_Server 
[FW-policy-security-rule-policy_3]action permit 

5、特例:生产区PC3可以在每周一早10到早11访问Web server,用来更新企业最新产品信息

复制代码
[FW]security-policy 
[FW-policy-security]rule name policy_4
[FW-policy-security-rule-policy_4]description SC to Web_Server
[FW-policy-security-rule-policy_4]source-zone trust 
[FW-policy-security-rule-policy_4]destination-zone dmz
[FW-policy-security-rule-policy_4]source-address address-set SC
[FW-policy-security-rule-policy_4]destination-address address-set Web_Server 
[FW-policy-security-rule-policy_4]time-range update_time
[FW-policy-security-rule-policy_4]action permit 

pc1ping网关测通

pc1pingOA与web

相关推荐
椅子哥23 分钟前
MyBatis操纵数据库-XML实现(补充)
xml·java·数据库·spring·mybatis·springboot
一匹电信狗41 分钟前
【Linux我做主】基础命令完全指南下篇
linux·运维·服务器·c++·开源·centos·unix
!chen1 小时前
查询修改ORACLE的server、客户端和导出dmp文件 字符集编码
数据库·oracle
wanhengidc1 小时前
海外服务器的网络带宽该如何进行选择?
运维·服务器
是懒羊羊吖~1 小时前
【sql靶场】第15、16关-post提交盲注保姆级教程
数据库·笔记·sql·时间盲注·布尔盲注·sql靶场
小安同学iter1 小时前
SpringMVC(七)数据校验+VO++脱敏
java·服务器·spring·java-ee·intellij-idea
嵌入式-老费3 小时前
Linux上位机开发实战(qt编译之谜)
linux·运维·服务器
翱翔-蓝天3 小时前
CentOS 上扩展 Swap 分区的大小
linux·运维·centos
ahisky3 小时前
Centos内核升级
linux·运维·centos
Pandaconda3 小时前
【后端开发面试题】每日 3 题(十二)
数据库·后端·面试·负载均衡·高并发·后端开发·acid