在配置zone安全策略是信任区无法访问dmz区和非信任区??
2014-04-24 来自:Nov.23 0 人回应

Router>en
Router#conft
Enterconfiguration commands, one per line. End with CNTL/Z.
Router(config)#access-list111 permit tcp 192.1.1.0 0.0.0.255 host 192.1.2.2
Router(config)#class-maptype inspect match-all trust-dmz-http
Router(config-cmap)#matchaccess-group 111
Router(config-cmap)#matchprotocol http
Router(config-cmap)#exit
Router(config)#policy-maptype inspect trust-dmz
Router(config-pmap)#classtype inspect trust-dmz-http
Router(config-pmap-c)#inspect
%Nospecific protocol configured in class trust-dmz-http for inspection. Allprotocols will be inspected
Router(config-pmap-c)#exit
Router(config)#access-list121 permit tcp 192.1.1.0 0.0.0.255 host 192.1.3.2
Router(config)#class-maptype inspect match-all trust-notrust
Router(config-cmap)#matchaccess-group 121
Router(config-cmap)#matchprotocol http
Router(config-cmap)#exit
Router(config)#policy-maptype inspect trust-notrust
Router(config-pmap)#classtype inspect trust-notrust
Router(config-pmap-c)#inspect
%Nospecific protocol configured in class trust-notrust for inspection. Allprotocols will be inspected
Router(config-pmap-c)#exit
Router(config-pmap)#exit
Router(config)#access-list131 permit tcp 192.1.2.0 0.0.0.255 host192.1.3.2
Router(config)#class-maptype inspect match-all dmz-notrust
Router(config-cmap)#matchaccess-group 131
Router(config-cmap)#matchprotocol http
Router(config-cmap)#exit
Router(config)#policy-maptype inspect dmz-notrust
Router(config-pmap)#classtype inspect dmz-notrust
Router(config-pmap-c)#inspect
%Nospecific protocol configured in class dmz-notrust for inspection. All protocolswill be inspected
Router(config-pmap-c)#exit
Router(config-pmap)#exit
Router(config)#access-list141 permit tcp 192.1.3.0 0.0.0.255 host192.1.2.2
Router(config)#class-maptype inspect match-all notrust-dmz
Router(config-cmap)#matchaccess-group 141
Router(config-cmap)#matchprotocol http
Router(config-cmap)#exit
Router(config-pmap)#policy-maptype inspect notrust-dmz
Router(config-pmap)#classtype inspect notrust-dmz
Router(config-pmap-c)#inspect
%Nospecific protocol configured in class notrust-dmz for inspection. All protocolswill be inspected
Router(config-pmap-c)#exit
Router(config-pmap)#exit
Router(config)#zonesecurity trust
Router(config-sec-zone)#exit
Router(config)#zonesecurity notrust
Router(config-sec-zone)#exit
Router(config)#zonesecurity dmz
Router(config-sec-zone)#exit
Router(config)#interfacefa 0/0
Router(config-if)#zone-membersecurity trust
Router(config-if)#exit
Router(config)#interfacefa 0/1
Router(config-if)#zone-membersecurity notrust
Router(config-if)#exit
Router(config)#interfacefa 1/0
Router(config-if)#zone-membersecurity dmz
Router(config-if)#exit
Router(config)#zone-pairsecurity trust-dmz source trust destination dmz
Router(config-sec-zone-pair)#service-policytype inspect trust-dmz
Router(config-sec-zone-pair)#exit
Router(config)#zone-pairsecurity trust-notrust source trust destination notrust
Router(config-sec-zone-pair)#service-policytype inspect trust-notrust
Router(config-sec-zone-pair)#exit
Router(config)#zone-pairsecurity notrust-dmz source notrust destination dmz
Router(config-sec-zone-pair)#service-policytype inspect notrust-dmz
Router(config-sec-zone-pair)#exit
Router(config)#zone-pairsecurity dmz-notrust source dmz destination notrust
Router(config-sec-zone-pair)#service-policytype inspect dmz-notrust
Router(config-sec-zone-pair)#exit
Router(config)#

还没有人回应!

您的回应

你还未登陆,不能回应!登陆