温馨提示×

温馨提示×

您好,登录后才能下订单哦!

密码登录×
登录注册×
其他方式登录
点击 登录注册 即表示同意《亿速云用户服务条款》

USG防火墙修改默认规则及放行telnet 流量实验

发布时间:2020-07-16 18:48:57 来源:网络 阅读:1899 作者:老赵网络 栏目:安全技术

USG防火墙修改默认规则及放行telnet 流量实验
R1在的配置 :
[R1]inter
[R1]interface e0/0/0
[R1-Ethernet0/0/0]ip add
[R1-Ethernet0/0/0]ip address 192.168.2.2 24
[R1]ip route-static 192.168.1.0 255.255.255.0 192.168.2.1 静态路由

开启虚拟终端服务

[R1]user-interface vty 0 4
[R1-ui-vty0-4]set authentication password
[R1-ui-vty0-4]set authentication password cipher 666
[R1-ui-vty0-4]user privilege level 3

R2的配置
[R2]interface e0/0/0
[R2-Ethernet0/0/0]ip add 192.168.1.2 24
[R2-Ethernet0/0/0]q
[R2]ip route-static 192.168.2.0 24 192.168.1.1

[R2]user-interface vty 0 4
[R2-ui-vty0-4]authentication-mode password
[R2-ui-vty0-4]set authentication password cipher 666
[R2-ui-vty0-4]user privilege level 3

防火墙配置
配置接口地址:
interface GigabitEthernet0/0/0
ip address 192.168.2.1 255.255.255.0

interface GigabitEthernet0/0/1
ip address 192.168.1.1 255.255.255.0

创建区域outside,设置优先级30, 并把接口G0/0/1加入到该区域
firewall zone name outside
set priority 30
add interface GigabitEthernet0/0/1

查看区域默认策略
[SRG]display policy interzone local outside outbound
policy interzone local outside outbound
firewall default packet-filter is permit

检测能否ping 通外部的路由器。是可以的。

更改默认策略

[SRG]firewall packet-filter default deny interzone local outside direction outbound

检测能否ping 通外部的路由器。是不可以的,
还原默认策略
[SRG]firewall packet-filter default permit interzone local outside direction outbound

检验 R1和R2能否 telnet 和ping 通 ,结果应该是不通。
怎么可以让R1telnet到R2上 并且ping 通,要放行trust 和outside 之间outbound方向流量 ,如下 :
放行outbound 方向telnet 和ICMP的流量
[SRG]policy interzone trust outside outbound

[SRG-policy-interzone-trust-outside-outbound]policy 1

[SRG-policy-interzone-trust-outside-outbound-1]policy source 192.168.2.2 0

[SRG-policy-interzone-trust-outside-outbound-1]policy destination 192.168.1.2 0
[SRG-policy-interzone-trust-outside-outbound-1]policy service service-set icmp telnet
[SRG-policy-interzone-trust-outside-outbound-1]action permit

[SRG-policy-interzone-trust-outside-outbound-1]q
[SRG-policy-interzone-trust-outside-outbound]q

用R1 去telnet R2,成功登录后来 在防火墙上查看会话表
[SRG]display firewall session table
Current Total Sessions : 1
icmp ×××:public --> public 192.168.2.2:53419-->192.168.1.2:2048
[SRG]display firewall session table
09:46:55 2018/05/11
Current Total Sessions : 0

请思考如何放行outside的主机telnet 到内部的路由器上????

向AI问一下细节

免责声明:本站发布的内容(图片、视频和文字)以原创、转载和分享为主,文章观点不代表本网站立场,如果涉及侵权请联系站长邮箱:is@yisu.com进行举报,并提供相关证据,一经查实,将立刻删除涉嫌侵权内容。

AI