实验环境
xxx公司的环境，内部有若干客户机，一台服务器，提供FTP 服务，通过防火墙连接互联网。
需求描述
内网客户端可以访问互联网服务器 (ping通即可)
互联网客户端可以访问内网服务器 （通过FTP访问）
内网服务器可以访问互联网服务器 （ping通即可）
配置网络参数及路由
[F1]ip route-static 0.0.0.0 0.0.0.0 202.96.1.2
配置NAT NO-NAT
将内网接口加入指定区域
[F1]firewall zone trust
[F1-zone-trust]add interface GigabitEthernet 1/0/2
[F1-zone-trust]add interface GigabitEthernet 1/0/1
将外网接口加入指定区域
[F1]firewall zone untrust
[F1-zone-untrust]add interface GigabitEthernet 1/0/0
配置安全策略
[F1]security-policy
[F1-policy-security]rule name natnonat
[F1-policy-security-rule-natnonat]source-zone trust
[F1-policy-security-rule-natnonat]destination-zone untrust
[F1-policy-security-rule-natnonat]source-address 192.168.1.0 24
[F1-policy-security-rule-natnonat]source-address 192.168.2.0 24
[F1-policy-security-rule-natnonat]action permit
配置地址池
[F1]nat address-group natnonat
[F1-address-group-natnonat]section 0 202.96.1.3 202.96.1.4
[F1-address-group-natnonat]mode no-pat local
配置NAT策略
[F1]nat-policy
[F1-policy-nat]rule name natnonat
[F1-policy-nat-rule-natnonat]source-zone trust
[F1-policy-nat-rule-natnonat]destination-zone untrust
[F1-policy-nat-rule-natnonat]source-address 192.168.1.0 24
[F1-policy-nat-rule-natnonat]source-address 192.168.2.0 24
[F1-policy-nat-rule-natnonat]action nat address-group natnonat
配置防止路由黑洞
[F1]ip route-static 202.96.1.3 32 NULL 0
[F1]ip route-static 202.96.1.4 32 NULL 0
验证
[F1]display firewall session table
Current Total Sessions : 1
icmp ***: public --> public 192.168.2.3:256[202.96.1.3:256] --> 202.96.2.2:20
48
[F1]display firewall session table
Current Total Sessions : 1
icmp ***: public --> public 192.168.1.10:256[202.96.1.4:256] --> 202.96.2.2:2
048
NATServer
配置安全策略
[F1]security-policy
[F1-policy-security]rule name sec_1
[F1-policy-security-rule-sec_1]source-zone untrust
[F1-policy-security-rule-sec_1]destination-zone trust
[F1-policy-security-rule-sec_1]destination-address 192.168.1.0 24
[F1-policy-security-rule-sec_1]service ftp
[F1-policy-security-rule-sec_1]action permit
配置NATServer
[F1]nat server natsever_ftp protocol tcp global 202.96.11.11 21 inside 192.168.1
.10 21
配置防止路由黑洞
[F1]ip route-static 202.96.11.11 32 NULL 0
配置静态路由
[R1]ip route-static 202.96.11.0 24 202.96.1.1
验证
[F1]display firewall session table
Current Total Sessions : 1
ftp ***: public --> public 202.96.3.4:2051 ±> 202.96.11.11:21[192.168.1.10:2
1]