組網及規劃：

華為USG6000作為邊界網關實現企業内部網絡出口，防火牆實現内部網絡nat功能實現訪問Internet功能

實現公司财務部門訪問内網服務器。

辦公網絡不能訪問内網服務器，

辦公室及财務部均可以訪問外網。

外部網絡可以通過NatServer實現外部網絡通過8080端口訪問内網服務器80端口。

網絡規劃：辦公網地址段：192.168.10.0/24 VLAN：10

财務地址段：192.168.20.0/24 Vlan：20

服務器地址段：192.168.200.0/24

運營商固定ip地址：202.1.1.1/24

網絡組網見下圖：

辦公接入交換機配置：

sysname BanGong

#

vlan batch 10

#

interface Eth-Trunk1

port link-type trunk

port trunk allow-pass vlan 10

#

interface GigabitEthernet0/0/1

port link-type access

port default vlan 10

interface GigabitEthernet0/0/23

eth-trunk 1

#

interface GigabitEthernet0/0/24

eth-trunk 1

财務接入交換機配置：

sysname CaiWu

#

vlan batch 20

interface Eth-Trunk1

port link-type trunk

port trunk allow-pass vlan 20

#

interface GigabitEthernet0/0/1

port link-type access

port default vlan 20

interface GigabitEthernet0/0/23

eth-trunk 1

#

interface GigabitEthernet0/0/24

eth-trunk 1

#

核心交換機配置：

sysname SW

#

undo info-center enable

#

vlan batch 10 20 100

#

interface Vlanif10

ip address 192.168.10.254 255.255.255.0

#

interface Vlanif20

ip address 192.168.20.254 255.255.255.0

#

interface Vlanif100

ip address 192.168.100.1 255.255.255.0

#

interface Eth-Trunk1

port link-type trunk

port trunk allow-pass vlan 10

#

interface Eth-Trunk2

port link-type trunk

port trunk allow-pass vlan 20

#

interface GigabitEthernet0/0/1

port link-type access

port default vlan 100

#

interface GigabitEthernet0/0/21

eth-trunk 2

#

interface GigabitEthernet0/0/22

eth-trunk 2

#

interface GigabitEthernet0/0/23

eth-trunk 1

#

interface GigabitEthernet0/0/24

eth-trunk 1

#

ip route-static 0.0.0.0 0.0.0.0 192.168.100.2

#

防火牆配置：

acl number 2000

rule 5 permit source 192.168.10.0 0.0.0.255

#

interface GigabitEthernet0/0/0

undo shutdown

ip address 202.1.1.1 255.255.255.0

#

interface GigabitEthernet1/0/0

undo shutdown

ip address 192.168.100.2 255.255.255.0

#

interface GigabitEthernet1/0/1

undo shutdown

ip address 192.168.200.254 255.255.255.0

#

firewall zone local

set priority 100

#

firewall zone trust

set priority 85

add interface GigabitEthernet1/0/0

#

firewall zone untrust

set priority 5

add interface GigabitEthernet0/0/0

#

firewall zone dmz

set priority 50

add interface GigabitEthernet1/0/1

#

ip route-static 0.0.0.0 0.0.0.0 GigabitEthernet0/0/0 202.1.1.2

ip route-static 192.168.10.0 255.255.255.0 192.168.100.1

ip route-static 192.168.20.0 255.255.255.0 192.168.100.1

#

nat server 0 protocol tcp global 202.1.1.1 8080 inside 192.168.200.1 www

#

security-policy

rule name policy_ses_1

source-zone trust

destination-zone untrust

source-address 192.168.10.0 mask 255.255.255.0

action permit

rule name policy_ses_2

source-zone trust

destination-zone dmz

source-address 192.168.20.0 mask 255.255.255.0

action permit

rule name policy_ses_3

source-zone trust

destination-zone untrust

source-address 192.168.20.0 mask 255.255.255.0

action permit

rule name Untrust_DMA

source-zone untrust

destination-zone dmz

destination-address 192.168.200.1 mask 255.255.255.255

action permit

#

nat-policy

rule name policy_nat_1

source-zone trust

egress-interface GigabitEthernet0/0/0

source-address 192.168.10.0 mask 255.255.255.0

action source-nat easy-ip

rule name policy_nat_2

source-zone trust

egress-interface GigabitEthernet0/0/0

source-address 192.168.20.0 mask 255.255.255.0

action source-nat easy-ip

驗證配置：辦公PC可以訪問Internet，不能訪内網問服務器。

财務PC:可以訪問Internet，也可以訪問内網服務器。

外網PC可以通過NATSERVER實現訪問内網服務器：

更多精彩资讯请关注tft每日頭條，我们将持续为您更新最新资讯!