实验目的
了解防火墙（ENSP中的USG5500）域间转发策略配置、NAT（与路由器NAT配置命令不同）配置。
网络拓扑
两个防火墙连接分别连接一个内网，中间通过路由器连接。配置NAT之后，内网PC可以ping公网，client可以获取server提供的服务（ftp和http）。服务器在dmz域，PC和client在trust域。
配置内容
右侧交换机配置vlan区分业务。交换机和防火墙的连接应该可以使用链路聚合实现，但我没有配置成功，干脆直接用一条链路。
域间安全策略
左侧防火墙配置：
# 接口配置
interface GigabitEthernet0/0/0
alias GE0/MGMT
ip address 192.168.55.254 255.255.255.0
#
interface GigabitEthernet0/0/1
ip address 22.22.22.22 255.255.255.0
# 接口加入安全域
firewall zone trust
add interface GigabitEthernet0/0/0
#
firewall zone untrust
add interface GigabitEthernet0/0/1
#
policy interzone trust untrust outbound
policy 10
action permit
policy source 192.168.55.0 0.0.0.255
右侧防火墙配置：
# 接口配置
interface GigabitEthernet0/0/0
alias GE0/MGMT
ip address 33.33.33.3 255.255.255.0
#
interface GigabitEthernet0/0/1
# 子接口配置对应的vlan
interface GigabitEthernet0/0/1.10
vlan-type dot1q 10
alias GigabitEthernet0/0/1.10
ip address 192.168.9.254 255.255.255.0
#
interface GigabitEthernet0/0/1.20
vlan-type dot1q 20
alias GigabitEthernet0/0/1.20
ip address 192.168.8.254 255.255.255.0
# 接口加入安全域
firewall zone trust
set priority 85
add interface GigabitEthernet0/0/1.10
#
firewall zone untrust
set priority 5
add interface GigabitEthernet0/0/0
#
firewall zone dmz
set priority 50
add interface GigabitEthernet0/0/1.20
# 域间安全策略
# 访问公网
policy interzone trust untrust outbound
policy 10
action permit
policy source 192.168.9.0 0.0.0.255
# 公网访问内网提供的服务
policy interzone dmz untrust inbound
policy 10
action permit
policy service service-set ftp
policy service service-set http
policy destination 192.168.8.0 0.0.0.255
ospf
路由器ospf配置：
# 通告直连IP和静态路由
ospf 1 router-id 2.2.2.2
import-route static
area 0.0.0.0
network 22.22.22.0 0.0.0.255
network 33.33.33.0 0.0.0.255
# 到左侧nat地址池的路由
ip route-static 220.220.220.0 255.255.255.0 22.22.22.22
由于nat地址池与左侧防火墙的外网接口不在同一网段，需要通告一条静态路由。
nat配置
左侧防火墙：
- 源nat
#
nat address-group 1 220.220.220.220 220.220.220.230
#
nat-policy interzone trust untrust outbound
policy 10
action source-nat
policy source 192.168.55.0 0.0.0.255
address-group 1 no-pat
基于域间安全策略配置，再配置源nat后，左侧PC可以ping通在左侧防火墙路由表内的公网IP。
右侧防火墙：
- easyip
#
nat-policy interzone trust untrust outbound
policy 1
action source-nat
policy source 192.168.9.0 0.0.0.255
easy-ip GigabitEthernet0/0/0
基于上面的配置，再配置easyip后，右侧PC可以ping通在右侧防火墙路由表内的公网IP。
- natserver
#
nat server 0 protocol tcp global 33.33.33.3 ftp inside 192.168.8.111 ftp
nat server 1 protocol tcp global 33.33.33.3 www inside 192.168.8.111 www
基于上面的配置，再配置natserver后，左侧client可以获取在右侧服务器的http服务。
- aspf
#
firewall interzone dmz untrust
detect ftp
aspf与nat alg实现功能类似，使防火墙支持多端口协议服务
基于上面的配置，再配置natserver后，左侧client可以获取在右侧服务器的ftp服务。
实验效果
ping公网
左侧主机ping通：
PC>ping 33.33.33.33
Ping 33.33.33.33: 32 data bytes, Press Ctrl_C to break
From 33.33.33.33: bytes=32 seq=1 ttl=254 time=78 ms
From 33.33.33.33: bytes=32 seq=2 ttl=254 time=47 ms
From 33.33.33.33: bytes=32 seq=3 ttl=254 time=63 ms
From 33.33.33.33: bytes=32 seq=4 ttl=254 time=47 ms
From 33.33.33.33: bytes=32 seq=5 ttl=254 time=47 ms
--- 33.33.33.33 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 47/56/78 ms
防火墙会话表：
[F1]display firewall session table
19:53:05 2025/05/10
Current Total Sessions : 5
icmp VPN:public --> public 192.168.55.2:3390[220.220.220.220:3390]-->33.33.33
.33:2048
icmp VPN:public --> public 192.168.55.2:3646[220.220.220.220:3646]-->33.33.33
.33:2048
icmp VPN:public --> public 192.168.55.2:3902[220.220.220.220:3902]-->33.33.33
.33:2048
icmp VPN:public --> public 192.168.55.2:4158[220.220.220.220:4158]-->33.33.33
.33:2048
icmp VPN:public --> public 192.168.55.2:4414[220.220.220.220:4414]-->33.33.33
.33:2048
右侧主机ping通：
PC>ping 22.22.22.2
Ping 22.22.22.2: 32 data bytes, Press Ctrl_C to break
From 22.22.22.2: bytes=32 seq=1 ttl=254 time=46 ms
From 22.22.22.2: bytes=32 seq=2 ttl=254 time=47 ms
From 22.22.22.2: bytes=32 seq=3 ttl=254 time=32 ms
From 22.22.22.2: bytes=32 seq=4 ttl=254 time=31 ms
From 22.22.22.2: bytes=32 seq=5 ttl=254 time=31 ms
--- 22.22.22.2 ping statistics ---
5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 31/37/47 ms
右侧防火墙会话表：
[F2]display firewall session table
19:56:13 2025/05/10
Current Total Sessions : 5
icmp VPN:public --> public 192.168.9.2:52542[33.33.33.3:2053]-->22.22.22.2:20
48
icmp VPN:public --> public 192.168.9.2:52798[33.33.33.3:2054]-->22.22.22.2:20
48
icmp VPN:public --> public 192.168.9.2:53054[33.33.33.3:2055]-->22.22.22.2:20
48
icmp VPN:public --> public 192.168.9.2:53310[33.33.33.3:2056]-->22.22.22.2:20
48
icmp VPN:public --> public 192.168.9.2:53566[33.33.33.3:2057]-->22.22.22.2:20
48
ftp服务
左侧防火墙会话表：
[F1]display firewall session table
20:01:20 2025/05/10
Current Total Sessions : 3
ftp VPN:public --> public 192.168.55.10:2057[220.220.220.221:2057]-->33.33.33
.3:21
ftp VPN:public --> public 192.168.55.10:2059[220.220.220.221:2059]-->33.33.33
.3:21
tcp VPN:public --> public 192.168.55.10:2060[220.220.220.221:2060]-->33.33.33
.3:2053
右侧防火墙会话表：
[F2]display firewall session table
20:02:01 2025/05/10
Current Total Sessions : 4
ftp VPN:public --> public 220.220.220.221:2057+->33.33.33.3:21[192.168.8.111:
21]
ftp VPN:public --> public 220.220.220.221:2059+->33.33.33.3:21[192.168.8.111:
21]
ftp VPN:public --> public 220.220.220.221:2061+->33.33.33.3:21[192.168.8.111:
21]
ftp-data VPN:public --> public 220.220.220.221:2062-->33.33.33.3:2054[192.168
.8.111:2054]