一、拓扑图及需求二、需求分析通过防火墙FW1划分Trust内网区域与DMZ服务器区域Trust区域内部局域网依靠交换机LSW1划分两个业务VLANVLAN 2办公区终端PC1VLAN 3生产区终端PC2、PC3DMZ区域放置对外业务服务器OA Server10.0.0.1/24Web Server10.0.0.2/24办公区PCVLAN2访问控制 办公PC仅允许周一至周五 08:00–18:00访问OA服务器其余时间段禁止访问OA服务器办公PC任何时间均可访问Web服务器。生产区PCVLAN3通用访问控制 生产区所有终端任意时间能够访问OA服务器生产区特例PC3特殊权限 生产区PC3作为特殊终端增加例外策略允许每周一 10:00–11:00访问Web服务器用于定期更新企业产品信息其余时间依旧禁止访问Web服务器。三、具体分步骤配置体现重点配置即可1、进入WEB界面2、创建划分VLAN[sw1]vlan batch 2 3[sw1]int g 0/0/2[sw1-GigabitEthernet0/0/2]port link-type access[sw1-GigabitEthernet0/0/2]port default vlan 2[sw1]int g 0/0/3[sw1-GigabitEthernet0/0/3]port link-type access[sw1-GigabitEthernet0/0/3]port default vlan 3[sw1]int g 0/0/4[sw1-GigabitEthernet0/0/4]port link-type access[sw1-GigabitEthernet0/0/4]port default vlan 3[sw1]int g 0/0/1[sw1-GigabitEthernet0/0/1]port link-type trunk[sw1-GigabitEthernet0/0/1]port trunk allow-pass vlan 2 3配置IP地址[FW1]int g 1/0/0[FW1-GigabitEthernet1/0/0]ip add 10.0.0.254 24[FW1]int g 1/0/1.2[FW1-GigabitEthernet1/0/1.2]ip add 192.168.1.126 25[FW1-GigabitEthernet1/0/1.2]vlan-type dot1q 2[FW1]int g 1/0/1.3[FW1-GigabitEthernet1/0/1.3]ip add 192.168.1.254 25[FW1-GigabitEthernet1/0/1.3]vlan-type dot1q 3划分安全区域[FW1]firewall zone dmz[FW1-zone-dmz]add int g 1/0/0[FW1]firewall zone trust[FW1-zone-trust]add int g 1/0/1.2[FW1-zone-trust]add int g 1/0/1.3配置安全策略创建时间段[FW1]time-range working-time[FW1-time-range-working-time]period-range 08:00:00 to 18:00:00 working-day[FW1]time-range time[FW1-time-range-time]period-range 10:00:00 to 11:00:00 Mon创建地址[FW1]ip address-set BG type object[FW1-object-address-set-BG]address 192.168.1.0 mask 25[FW1]ip address-set OA-Server type object[FW1-object-address-set-OA-Server]address 10.0.0.1 mask 32[FW1]ip address-set Web-Server type object[FW1-object-address-set-Web-Server]address 10.0.0.2 mask 32[FW1]ip address-set SC type object[FW1-object-address-set-SC]address 192.168.1.128 mask 25ip address-set SC3 type objectaddress 192.168.1.130 mask 25编写安全策略[FW1]security-policy[FW1-policy-security]rule name BG_to_OA-Server[FW1-policy-security-rule-BG_to_OA]source-zone trust[FW1-policy-security-rule-BG_to_OA]destination-zone dmz[FW1-policy-security-rule-BG_to_OA]source-address address-set BG[FW1-policy-security-rule-BG_to_OA]destination-address address-set OA-Server[FW1-policy-security-rule-BG_to_OA-Server]time-range working-time[FW1-policy-security-rule-BG_to_OA-Server]action permit[FW1-policy-security]rule name BG_to_Web-Server[FW1-policy-security-rule-BG_to_Web-Server]source-zone trust[FW1-policy-security-rule-BG_to_Web-Server]destination-zone dmz[FW1-policy-security-rule-BG_to_Web-Server]source-address address-set BG[FW1-policy-security-rule-BG_to_Web-Server]destination-address address-set Web-Server[FW1-policy-security-rule-BG_to_Web-Server]action permit[FW1-policy-security]rule name SC_to_OA-Server[FW1-policy-security-rule-SC_to_OA-Server]source-zone trust[FW1-policy-security-rule-SC_to_OA-Server]destination-zone dmz[FW1-policy-security-rule-SC_to_OA-Server]source-address address-set SC[FW1-policy-security-rule-SC_to_OA-Server]destination-address address-set OA-Server[FW1-policy-security-rule-SC_to_OA-Server]action permit[FW1-policy-security]rule name SC3_to_Web-Server[FW1-policy-security-rule-SC3_to_Web-Server]source-zone trust[FW1-policy-security-rule-SC3_to_Web-Server]destination-zone dmz[FW1-policy-security-rule-SC3_to_Web-Server]source-address address-set SC3[FW1-policy-security-rule-SC3_to_Web-Server]destination-address address-set Web-Server[FW1-policy-security-rule-SC3_to_Web-Server]action permit四、测试结果办公区PC在工作日时间(周一至周五早8到晚6)可以正常访问OA Server其他时间不允许办公区PC可以在任意时刻访问Web Server生产区PC可以在任意时刻访问OA Server但是不能访问Web Server特例生产区PC3可以在每周一早10到早11访问Web Server用来更新企业最新产品信息