AR1220实现防火墙的功能

置ACL包过滤防火墙典型示例ACL包过滤防火墙在具体组网中的应用。根据数据流的源、目的IP地址，源、目的端口号，协议类型五元组过滤数据流，提高数据流的安全性。组网需求如图1所示，Router的接口Ethernet0/0/0连接一个高安全优先级的内部网络，接口GE0/0/1连接低安全优先级的外部网络，需要对内部网络和外部网络之间的通信实施包过滤。具体要求如下：外部特定主机（202.39.2.3）允许访问内部网络中的服务器。其余的访问均不允许。图1配置ACL包过滤组网图配置思路采用如下思路配置ACL包过滤防火墙：1.配置安全区域和安全域间。2.将接口加入安全区域。3.配置ACL。4.在安全域间配置基于ACL的包过滤。操作步骤1.在Router上配置安全区域和安全域间。2.Huaweisystem-view3.[Huawei]firewallzonetrust4.[Huawei-zone-trust]priority155.[Huawei-zone-trust]quit6.[Huawei]firewallzoneuntrust7.[Huawei-zone-untrust]priority18.[Huawei-zone-untrust]quit9.[Huawei]firewallinterzonetrustuntrust10.[Huawei-interzone-trust-untrust]firewallenable11.[Huawei-interzone-trust-untrust]quit12.在Router上将接口加入安全区域。13.[Huawei]vlan10014.[Huawei-vlan100]quit15.[Huawei]interfacevlanif10016.[Huawei-Vlanif100]ipaddress129.38.1.12417.[Huawei-Vlanif100]quit18.[Huawei]interfaceEthernet0/0/019.[Huawei-Ethernet0/0/0]portlink-typeaccess20.[Huawei-Ethernet0/0/0]portdefaultvlan10021.[Huawei-Ethernet0/0/0]quit22.[Huawei]interfacevlanif10023.[Huawei-Vlanif100]zonetrust24.[Huawei-Vlanif100]quit25.[Huawei]interfacegigabitethernet0/0/126.[Huawei-GigabitEthernet0/0/1]ipaddress202.39.2.12427.[Huawei-GigabitEthernet0/0/1]zoneuntrust[Huawei-GigabitEthernet0/0/1]quit28.在Router上配置ACL。29.[Huawei]acl310230.[Huawei-acl-adv-3102]rulepermittcpsource202.39.2.30.0.0.0destination129.38.1.20.0.0.031.[Huawei-acl-adv-3102]rulepermittcpsource202.39.2.30.0.0.0destination129.38.1.30.0.0.032.[Huawei-acl-adv-3102]rulepermittcpsource202.39.2.30.0.0.0destination129.38.1.40.0.0.033.[Huawei-acl-adv-3102]ruledenyip34.[Huawei-acl-adv-3102]quit35.在Router上配置包过滤。36.[Huawei]firewallinterzonetrustuntrust37.[Huawei-interzone-trust-untrust]packet-filter3102inbound38.[Huawei-interzone-trust-untrust]quit39.检查配置结果。配置成功后，仅特定主机（202.39.2.3）可以访问内部服务器。在Router上执行displayfirewallinterzone[zone-name1zone-name2]操作，结果如下。[Huawei]displayfirewallinterzonetrustuntrustinterzonetrustuntrustfirewallenablepacket-filterdefaultdenyinboundpacket-filterdefaultpermitoutboundpacket-filter3102inbound配置文件#vlan100#aclnumber3102rule5permittcpsource202.39.2.30destination129.38.1.20rule10permittcpsource202.39.2.30destination129.38.1.30rule15permittcpsource202.39.2.30destination129.38.1.40rule20denyip#interfaceVlanif100ipaddress129.38.1.1255.255.255.0zonetrust#firewallzonetrustpriority15#firewallzoneuntrustpriority1#firewallinterzonetrustuntrustfirewallenablepacket-filter3102inbound#interfaceEthernet0/0/0portlink-typeaccessportdefaultvlan100#interfaceGigabitEthernet0/0/1ipaddress202.39.2.1255.255.255.0zoneuntrust