防火墙的安全策略

1.VLAN 2属于办公区;VLAN 3属于生产区,创建时间段

复制代码
[FW]ip address-set BG type object 
[FW-object-address-set-BG]address 192.168.1.0 mask 25
[FW]ip address-set SC type object 	
[FW-object-address-set-SC]address 192.168.1.129 mask 25
[FW]ip address-set OA_Server type object 
[FW-object-address-set-OA_Server]address 10.0.0.1 mask 32
[FW]ip address-set  Web_Server type object 	
[FW-object-address-set-Web_Server]address 10.0.0.2 mask 32
[FW]time-range working_time
[FW-time-range-working_time]period-range 08:00:00 to 18:00:00 working-day
[FW]time-range update_time
[FW-time-range-update_time]period-range 10:00:00 to 11:00:00 Mon 

2、办公区PC在工作日时间(周一至周五,早8到晚6)可以正常访问0A server,其他时间不允许

3,办公区PC可以在任意时刻访问wed server,生产区PC可以在任意时刻访问0A Server,但是不能访问web server

复制代码
[FW]security-policy 
[FW-policy-security]rule name policy_2	
[FW-policy-security-rule-policy_2]description BG to Web
[FW-policy-security-rule-policy_2]source-zone trust 
[FW-policy-security-rule-policy_2]destination-zone dmz 
[FW-policy-security-rule-policy_2]source-address address-set BG
[FW-policy-security-rule-policy_2]destination-address address-set Web_Server
[FW-policy-security-rule-policy_2]action permit
[FW]security-policy 
[FW-policy-security]rule name policy_3
[FW-policy-security-rule-policy_3]description SC to OA
[FW-policy-security-rule-policy_3]source-zone trust 
[FW-policy-security-rule-policy_3]destination-zone dmz 
[FW-policy-security-rule-policy_3]source-address address-set  SC	
[FW-policy-security-rule-policy_3]destination-address address-set OA_Server 
[FW-policy-security-rule-policy_3]action permit 

5、特例:生产区PC3可以在每周一早10到早11访问Web server,用来更新企业最新产品信息

复制代码
[FW]security-policy 
[FW-policy-security]rule name policy_4
[FW-policy-security-rule-policy_4]description SC to Web_Server
[FW-policy-security-rule-policy_4]source-zone trust 
[FW-policy-security-rule-policy_4]destination-zone dmz
[FW-policy-security-rule-policy_4]source-address address-set SC
[FW-policy-security-rule-policy_4]destination-address address-set Web_Server 
[FW-policy-security-rule-policy_4]time-range update_time
[FW-policy-security-rule-policy_4]action permit 

pc1ping网关测通

pc1pingOA与web

相关推荐
java叶新东老师5 分钟前
Linux /proc/目录详解
linux·运维·服务器
····懂···7 分钟前
开源数据库PostgreSQL专家技术
数据库·postgresql·开源
Asu520216 分钟前
思途SQL学习 0729
数据库·sql·学习
都给我27 分钟前
服务器中涉及节流(Throttle)的硬件组件及其应用注意事项
服务器·网络·express
北亚数据恢复34 分钟前
服务器数据恢复—RAID上层部署的oracle数据库数据恢复案例
数据库·oracle·服务器数据恢复·北亚数据恢复
long_mingyue1 小时前
CVE-2022-46169漏洞复现
linux
不辉放弃1 小时前
kafka的消息存储机制和查询机制
数据库·kafka·pyspark·大数据开发
吹个口哨写代码1 小时前
防止包含 XSS 攻击风险的内容提交成功
java·服务器·前端
默|笙2 小时前
【Linux】基本指令(2)
linux·运维·服务器
ZY小袁2 小时前
MGRE综合实验
服务器·网络·笔记·网络安全·学习方法·信息与通信·p2p