防火墙下的GRE

实验环境

实验目的

防火墙下使用GRE协议封装建立隧道，实现不同地域内网通信

具体步骤

1.规划网络、配置IP和配置路由

PC1

IP:192.168.1.1 掩码 24 网关：192.168.1.254

PC2

IP:192.168.2.1 掩码 24 网关：192.168.2.254

R1

<Huawei>sys
[Huawei]sys R1
[R1]int g0/0/1
[R1-GigabitEthernet0/0/1]ip add 200.1.1.2 24
[R1-GigabitEthernet0/0/1]int g0/0/2
[R1-GigabitEthernet0/0/2]ip add 200.1.2.2 24
[R1-GigabitEthernet0/0/2]q
[R1]ospf
[R1-ospf-1]area 0
[R1-ospf-1-area-0.0.0.0]network 200.1.1.0 0.0.0.255
[R1-ospf-1-area-0.0.0.0]network 200.1.2.0 0.0.0.255

FW1

<USG6000V1>sy
[USG6000V1]sy FW1
[FW1]int g1/0/1
[FW1-GigabitEthernet1/0/1]ip add 200.1.1.1 24
[FW1-GigabitEthernet1/0/1]int g1/0/0
[FW1-GigabitEthernet1/0/0]ip add 192.168.1.254 24
[FW1-GigabitEthernet1/0/0]q
[FW1]ospf
[FW1-ospf-1]area 0
[FW1-ospf-1-area-0.0.0.0]int g1/0/1
[FW1-GigabitEthernet1/0/1]os e a 0

FW2

<USG6000V1>sy
[USG6000V1]sy FW2
[FW2]int g1/0/1
[FW2-GigabitEthernet1/0/1]ip add 200.1.2.1 24
[FW2-GigabitEthernet1/0/1]int g1/0/0
[FW2-GigabitEthernet1/0/0]ip add 192.168.2.254 24
[FW2-GigabitEthernet1/0/0]q
[FW2]ospf	
[FW2-ospf-1]area 0
[FW2-ospf-1-area-0.0.0.0]int g1/0/1
[FW2-GigabitEthernet1/0/1]os e a 0

2.防火墙上配置GRE

FW1

[FW1]int Tunnel 0
[FW1-Tunnel0]ip add 1.1.1.1 24
[FW1-Tunnel0]tunnel-protocol gre	
[FW1-Tunnel0]source 200.1.1.1
[FW1-Tunnel0]destination 200.1.2.1
[FW1-Tunnel0]q
[FW1]ip route-static 192.168.2.0 24 Tunnel 0  //私网路由

FW2

[FW2]int Tunnel 0
[FW2-Tunnel0]ip add 1.1.1.2 24
[FW2-Tunnel0]tunnel-protocol gre
[FW2-Tunnel0]source 200.1.2.1
[FW2-Tunnel0]destination 200.1.1.1
[FW2-Tunnel0]q
[FW2]ip route-static 192.168.1.0 24 Tunnel 0  //私网路由

3.防火墙安全策略配置

FW1

[FW1]firewall zone untrust 
[FW1-zone-untrust]add int g1/0/1
[FW1-zone-untrust]q	
[FW1]firewall zone trust 
[FW1-zone-trust]add int g1/0/0
[FW1-zone-trust]q
[FW1]firewall zone dmz	
[FW1-zone-dmz]add int Tunnel 0
[FW1-zone-dmz]q

[FW1]security-policy
[FW1-policy-security]rule name u_l	
[FW1-policy-security-rule-u_l]source-zone untrust 	
[FW1-policy-security-rule-u_l]destination-zone local 
[FW1-policy-security-rule-u_l]destination-address 200.1.1.1 24
[FW1-policy-security-rule-u_l]source-address 200.1.2.1 24
[FW1-policy-security-rule-u_l]service gre
[FW1-policy-security-rule-u_l]action permit 
[FW1-policy-security-rule-u_l]q

[FW1-policy-security]rule name t_d	
[FW1-policy-security-rule-t_d]source-zone trust
[FW1-policy-security-rule-t_d]destination-zone dmz
[FW1-policy-security-rule-t_d]source-address 192.168.1.1 24
[FW1-policy-security-rule-t_d]destination-address 192.168.2.1 24	
[FW1-policy-security-rule-t_d]action permit 
[FW1-policy-security-rule-t_d]q
[FW1-policy-security]

FW2

[FW2]firewall zone untrust 
[FW2-zone-untrust]add int g1/0/1
[FW2-zone-untrust]q
[FW2]firewall zone trust 
[FW2-zone-trust]add int g1/0/0
[FW2-zone-trust]q
[FW2]firewall zone dmz	
[FW2-zone-dmz]add int Tunnel 0
[FW2-zone-dmz]q

[FW2]security-policy
[FW2-policy-security]rule name u_l	
[FW2-policy-security-rule-u_l]source-zone untrust
[FW2-policy-security-rule-u_l]destination-zone local
[FW2-policy-security-rule-u_l]source-address 200.1.1.1 24
[FW2-policy-security-rule-u_l]destination-address 200.1.2.1 24
[FW2-policy-security-rule-u_l]service gre
[FW2-policy-security-rule-u_l]action permit 
[FW2-policy-security-rule-u_l]q

[FW2-policy-security]rule name t_d
[FW2-policy-security-rule-t_d]source-zone dmz
[FW2-policy-security-rule-t_d]destination-zone trust
[FW2-policy-security-rule-t_d]source-address 192.168.1.1 24
[FW2-policy-security-rule-t_d]destination-address 192.168.2.1 24
[FW2-policy-security-rule-t_d]action permit 
[FW2-policy-security-rule-t_d]q
[FW2-policy-security]q

结果测试与分析

由PC1 ping PC2

在路由器g0/0/2处抓包

对分组四的包内容查看

通过以上结果可以看到防火墙下的GRE配置成功，报文出现两对IP，PC1可以访问PC2

以上配置仅可使PC1 ping 通PC2反之则无法通信，若要实现反向通信还需配置以下策略

FW1

[FW1-policy-security]rule name d_t
[FW1-policy-security-rule-d_t]source-zone dmz
[FW1-policy-security-rule-d_t]destination-zone trust 	
[FW1-policy-security-rule-d_t]source-address 192.168.2.1 24
[FW1-policy-security-rule-d_t]destination-address 192.168.1.0 24
[FW1-policy-security-rule-d_t]action permit 

FW2

[FW2]security-policy
[FW2-policy-security]rule name d_m
[FW2-policy-security-rule-d_m]source-zone trust	
[FW2-policy-security-rule-d_m]destination-zone dmz
[FW2-policy-security-rule-d_m]source-address 192.168.2.0 24
[FW2-policy-security-rule-d_m]destination-address 192.168.1.1 24
[FW2-policy-security-rule-d_m]action permit

由PC2 ping PC1

由上图结果可知，PC2可 ping 通PC1，实现了PC2访问PC1

总结

注意：

GRE流量封装后，往外发送时是不需要匹配策略的，防火墙直接放行，但接收时是需要匹配策略的。

欲实现PC1和PC2互访需要实现以下三个安全策略

• Trust到DMZ的安全策略，该策略使得内网请求可通过Tunnel口
• Untrust到Local的安全策略，该策略使得外网的回复可进入防火墙
• DMZ到Trust的安全策略，该策略使得外网的请求可到达内网主机

实现单向通信时，由于下一代防火墙的会话机制的存在，仅需配置第一、第二条安全策略可不用配置第三条安全策略。