一、实验目的及拓扑
实验目的：防火墙FW1及虚拟墙VFR_A和VRF_B分别连接外网、内网服务器端和内网客户端，将内网服务器通过nat server向外网宣告，使外网能够访问服务器端，同时内网也能够访问服务器，网络拓扑及接口地址规划如下：
二、基本配置
1、接口地址配置：防火墙接口地址外网为.12，内网虚拟墙侧均为.254，内网PC1和server均为.10，外网PC为.105，如图所示配置相应接口地址及终端地址
2、新建虚拟系统并将防火墙各接口分配规划如下：
vsys enable
resource-class r0
#
#
vsys name VFR_A 1
assign interface GigabitEthernet1/0/1
assign resource-class r0
#
vsys name VRF_B 2
assign interface GigabitEthernet1/0/2
#
[FW1]dis ip vpn-instance int
Total VPN-Instances configured : 4
VPN-Instance Name and ID : VFR_A, 1
Interface Number : 2
Interface list : GigabitEthernet1/0/1,
Virtual-if1
VPN-Instance Name and ID : VFR_B, 3
Interface Number : 1
Interface list : Virtual-if3
VPN-Instance Name and ID : VRF_B, 2
Interface Number : 2
Interface list : GigabitEthernet1/0/2,
Virtual-if2
VPN-Instance Name and ID : default, 21
Interface Number : 1
Interface list : GigabitEthernet0/0/0
3、防火墙各接口区域规划如下：
[FW1]dis zone
local
priority is 100
interface of the zone is (0):
#
trust
priority is 85
interface of the zone is (2):
GigabitEthernet0/0/0
Virtual-if0
#
untrust
priority is 5
interface of the zone is (1):
GigabitEthernet1/0/0
#
dmz
priority is 50
interface of the zone is (0):
#
vpn-instance VFR_A local
priority is 100
interface of the zone is (0):
#
vpn-instance VFR_A trust
priority is 85
interface of the zone is (0):
#
vpn-instance VFR_A untrust
priority is 5
interface of the zone is (1):
Virtual-if1
#
vpn-instance VFR_A dmz
priority is 50
interface of the zone is (1):
GigabitEthernet1/0/1
#
vpn-instance VRF_B local
priority is 100
interface of the zone is (0):
#
vpn-instance VRF_B trust
priority is 85
interface of the zone is (1):
GigabitEthernet1/0/2
#
vpn-instance VRF_B untrust
priority is 5
interface of the zone is (1):
Virtual-if2
#
vpn-instance VRF_B dmz
priority is 50
interface of the zone is (0):
#
vpn-instance VFR_B local
priority is 100
interface of the zone is (0):
#
vpn-instance VFR_B trust
priority is 85
interface of the zone is (0):
#
vpn-instance VFR_B untrust
priority is 5
interface of the zone is (0):
#
vpn-instance VFR_B dmz
priority is 50
interface of the zone is (0):
#
三、详细配置
1、路由配置：
在根系统上配置路由使外网能够访问内网服务器端、使内网客户端访问内网服务器端，使内网能够访问外网
#
ip route-static 0.0.0.0 0.0.0.0 100.1.121.1
ip route-static 192.168.13.0 255.255.255.0 vpn-instance VFR_A
ip route-static 192.168.14.0 255.255.255.0 vpn-instance VRF_B
#
在两个虚拟系统设置路由使其能够访问根系统
#
ip route-static 0.0.0.0 0.0.0.0 public
#
2、安全策略配置
根系统
[FW1-policy-security]dis th
#
security-policy
rule name LOCAL_TO_ANY
source-zone local
action permit
rule name INT_TO_SER
source-zone untrust
destination-zone trust
source-address 100.1.15.0 mask 255.255.255.0
destination-address 192.168.13.0 mask 255.255.255.0
action permit
#
虚拟系统连接服务器端
security-policy
rule name OUT_TO_DMZ
source-zone untrust
destination-zone dmz
source-address 192.168.14.0 mask 255.255.255.0
destination-address 192.168.13.0 mask 255.255.255.0
action permit
rule name INT_TO_SER
source-zone untrust
destination-zone dmz
source-address 100.1.15.0 mask 255.255.255.0
destination-address 192.168.13.0 mask 255.255.255.0
action permit
rule name LOCAL_TO_ANY
source-zone local
action permit
#
3、nat server配置
nat server 1 global 100.1.121.100 inside 192.168.13.10 no-reverse
四、结果验证
内网pc访问服务器
PC>tracert 192.168.13.10
traceroute to 192.168.13.10, 8 hops max
(ICMP), press Ctrl+C to stop
1 * * *
2 * * *
3 192.168.13.10 <1 ms <1 ms 16 ms
外网pc访问服务器
PC>tracert 100.1.121.100
traceroute to 100.1.121.100, 8 hops max
(ICMP), press Ctrl+C to stop
1 100.1.15.1 32 ms 47 ms 46 ms
2 100.1.121.12 63 ms 62 ms 63 ms
3 * * *
4 100.1.121.100 78 ms 63 ms 62 ms