策略路由实验

wgh6532026-08-11 13:56

拓扑图及需求

FW接口IP与安全区域配置

复制代码 
# ========== 子接口==========
interface GigabitEthernet1/0/0.10
 vlan-type dot1q 10
 ip address 192.168.1.254 255.255.255.0
 service-manage ping permit
#
interface GigabitEthernet1/0/0.1
 vlan-type dot1q 1
 ip address 192.168.2.254 255.255.255.0
 service-manage ping permit
#
interface GigabitEthernet1/0/0.2
 vlan-type dot1q 2
 ip address 192.168.3.254 255.255.255.0
 service-manage ping permit

# ========== 外网物理接口配置 ==========
interface GigabitEthernet1/0/1
 ip address 14.0.0.1 255.255.255.0
 service-manage ping permit
#
interface GigabitEthernet1/0/2
 ip address 12.0.0.1 255.255.255.0
 service-manage ping permit

# ========== 安全区域划分 ==========
firewall zone trust
 add interface GigabitEthernet1/0/0.10
 add interface GigabitEthernet1/0/0.1
 add interface GigabitEthernet1/0/0.2
#
firewall zone untrust
 add interface GigabitEthernet1/0/1
 add interface GigabitEthernet1/0/2

SW交换机VLAN与接口配置

复制代码 
# ========== 创建VLAN ==========
vlan batch 10 1 2

# ========== 连接FW的接口配置为Trunk ==========
interface GigabitEthernet0/0/1
 port link-type trunk
 port trunk allow-pass vlan 10 1 2

# ========== 连接Client1（财务部）的接口 ==========
interface GigabitEthernet0/0/2
 port link-type access
 port default vlan 10

# ========== 连接Client2（研发部）的接口 ==========
interface GigabitEthernet0/0/3
 port link-type access
 port default vlan 1

# ========== 连接Web-Server的接口 ==========
interface GigabitEthernet0/0/4
 port link-type access
 port default vlan 2

地址对象、用户组与认证配置

复制代码 
# ========== 地址对象（eNSP USG6000V语法）==========
address 财务部
 net-address 192.168.1.0 mask 24
#
address 研发部
 net-address 192.168.2.0 mask 24
#
address Web服务器
 host-address 192.168.3.10
#
address FTP服务器
 host-address 200.0.0.10

# ========== 用户组 ==========
user-group 财务部组
user-group 研发部组

# ========== 认证策略：财务部免认证，研发部匿名认证 ==========
authentication
 access-type free user-group 财务部组
 access-type anonymous user-group 研发部组

IP-Link链路探测配置

复制代码 
ip-link check enable
#
ip-link 1
 destination 14.0.0.2 interface GigabitEthernet1/0/1
#
ip-link 2
 destination 12.0.0.2 interface GigabitEthernet1/0/2

策略路由PBR配置

复制代码 
# ========== 定义ACL匹配不同部门访问FTP的流量 ==========
acl 3000
 rule 5 permit ip source 192.168.1.0 0.0.0.255 destination 200.0.0.10 0
#
acl 3001
 rule 5 permit ip source 192.168.2.0 0.0.0.255 destination 200.0.0.10 0

# ========== 定义流分类（匹配ACL）==========
traffic classifier finance_ftp
 if-match acl 3000
#
traffic classifier rd_ftp
 if-match acl 3001

# ========== 定义流行为（重定向下一跳+IP-Link联动）==========
traffic behavior to_telecom
 redirect ip-nexthop 14.0.0.2 track ip-link 1
#
traffic behavior to_unicom
 redirect ip-nexthop 12.0.0.2 track ip-link 2

# ========== 定义流策略（绑定分类与行为）==========
traffic policy PBR
 classifier finance_ftp behavior to_telecom
 classifier rd_ftp behavior to_unicom

# ========== 在内网子接口入方向应用策略路由 ==========
interface GigabitEthernet1/0/0.10
 traffic-policy PBR inbound
#
interface GigabitEthernet1/0/0.1
 traffic-policy PBR inbound

NAT策略配置

复制代码 
# ========== 内网Easy-IP源NAT（出站）==========
nat-policy
 rule name trust_to_internet
  source-zone trust
  destination-zone untrust
  action source-nat easy-ip

# ========== NAT Server外网发布Web服务器（双线映射）==========
nat server Web_tele protocol tcp global 14.0.0.100 www inside 192.168.3.10 www
nat server Web_unicom protocol tcp global 12.0.0.100 www inside 192.168.3.10 www

路由配置

复制代码 
# ========== 导入电信、联通ISP网段明细路由 ==========
ip route-static 101.1.1.0 255.255.255.0 14.0.0.2
ip route-static 102.1.1.0 255.255.255.0 12.0.0.2

# ========== 双线缺省路由（主备模式 + IP-Link联动）==========
ip route-static 0.0.0.0 0.0.0.0 14.0.0.2 preference 70 track ip-link 1
ip route-static 0.0.0.0 0.0.0.0 12.0.0.2 preference 80

精准安全策略配置

复制代码 
security-policy
 rule name finance_internet
  source-zone trust
  source-address 192.168.1.0 24
  destination-zone untrust
  action permit
#
 rule name rd_internet
  source-zone trust
  source-address 192.168.2.0 24
  destination-zone untrust
  authentication user-group 研发部组
  action permit
#
 rule name internet_to_web
  source-zone untrust
  destination-zone trust
  destination-address 192.168.3.10 32
  service http
  action permit
#
 rule name local_to_untrust
  source-zone local
  destination-zone untrust
  service icmp
  action permit
#
 rule name trust_internal
  source-zone trust
  destination-zone trust
  action permit

R4电信路由器完整配置

复制代码 
# ========== 接口IP配置 ==========
interface GigabitEthernet0/0/0
 ip address 14.0.0.2 255.255.255.0
 description TO-FW-GE1/0/1
#
interface GigabitEthernet0/0/1
 ip address 200.0.0.1 255.255.255.0
 description TO-公网FTP服务器方向
#
interface LoopBack0
 ip address 101.1.1.1 255.255.255.0
 description 电信ISP网段

# ========== OSPF协议配置 ==========
ospf 1 router-id 4.4.4.4
 area 0.0.0.0
  network 14.0.0.0 0.0.0.255
  network 101.1.1.0 0.0.0.255
  network 200.0.0.0 0.0.0.255

# ========== 回程路由指向内网 ==========
ip route-static 192.168.0.0 255.255.252.0 14.0.0.1

R2联通路由器完整配置

复制代码 
# ========== 接口IP配置 ==========
interface GigabitEthernet0/0/0
 ip address 12.0.0.2 255.255.255.0
 description TO-FW-GE1/0/2
#
interface GigabitEthernet0/0/1
 ip address 200.0.0.2 255.255.255.0
 description TO-公网FTP服务器方向
#
interface LoopBack0
 ip address 102.1.1.1 255.255.255.0
 description 联通ISP网段

# ========== OSPF协议配置 ==========
ospf 1 router-id 2.2.2.2
 area 0.0.0.0
  network 12.0.0.0 0.0.0.255
  network 102.1.1.0 0.0.0.255
  network 200.0.0.0 0.0.0.255

# ========== 回程路由指向内网 ==========
ip route-static 192.168.0.0 255.255.252.0 12.0.0.1

测试

相关推荐
虎头金猫21 小时前
4K 视频总卡在公网带宽？用 N1 + OpenList 把网盘播放链路重新理顺
运维·服务器·网络·python·容器·beautifulsoup·pandas
wuyk5551 天前
《WiFi 嵌入式物联网开发全套实战》| 第 16 章 ESP32 AP+STA 双模共存原理与工程坑点
网络·stm32·物联网
QYRdata1 天前
年均增速24.2%！机器人数据湖未来六年增长动能强劲
网络·机器人·服务发现
CHENKONG_CK1 天前
破解制鞋打磨痛点：RFID赋能去毛刺工序自动化升级
网络·单片机·嵌入式硬件·网络协议·tcp/ip
chshang19921 天前
工业路由器是什么？浅谈5G工业网络中的IR602
网络·物联网·5g·智能路由器
萧瑟余晖1 天前
Netty 核心组件与 Reactor 模型详解
网络·架构
ITxiaobing20231 天前
IP 定位服务选型指南：从准确率到工程落地的技术考察
linux·服务器·网络
wuyk5551 天前
【Socket 进阶之路】第 9 章 Linux 网络服务量产稳定性优化｜心跳保活、TIME_WAIT、SO_LINGER、内存池、断线重连、完整异常防护框架
linux·服务器·开发语言·网络·物联网
z落落1 天前
C#UDP+串口服务端+UDP 客户端（含 CRC16 校验）
网络·网络协议·udp
云运维笔记1 天前
华为设备IP地址配置全攻略
运维·网络·计算机网络·华为
热门推荐
01国内可直接用、免费额度/永久免费的大模型API清单（含 SiliconFlow、火山、阿里、智谱、百度、Kimi、DeepSeek、DMXAPI 等）02GitHub 镜像站点03历年考研数学一、数学二、数学三真题试卷及答案PDF04蜘蛛磁力 搜索引擎大全，如何使用蜘蛛磁力查找磁力链接05微信历史版本含下载地址（ Windows PC | 安卓 | MAC ）及设置微信不更新062026 国产 AI 大模型横评：DeepSeek、通义千问、Kimi、文心一言、星火、豆包谁更能打？07Telegram APK 下载安装完整指南 — 2026年最新082026 爱知・名古屋亚运会怎么看？直播平台+赛程安排分享09人工智能（AI）发展史：详细里程碑10昇腾910B系列芯片完全指南：四款型号对比、服务器选型与大模型部署实战