一、实验拓补图

二、实验需求

安全策略要求：

1.只存在一个公网IP地址，公司内网所有部门都需要借用同一个接口访问外网

2、财务部禁止访问Internet，研发部门只有部分员工可以访问Internet，行政部门全部可以访问互联网

3、为三个部门的虚拟系统分配相同的资源类

三、配置思路

1、由根系统管理员创建虚拟系统abc并且为其分配资源以及配置管理员

2、根系统管理员为内网用户创建安全策略和NAT策略

3、由abc三个虚拟系统各自完成IP、路由、安全策略配置 

四、实验配置

1.FW1，R1

[FW1]interface GigabitEthernet 1/0/1
[FW1-GigabitEthernet1/0/1]ip address 10.3.0.254 24
[FW1]interface GigabitEthernet 1/0/2
[FW1-GigabitEthernet1/0/2]ip address 10.3.1.254 24
[FW1]interface GigabitEthernet 1/0/3
[FW1-GigabitEthernet1/0/3]ip address 10.3.2.254 24
[FW1]interface GigabitEthernet 1/0/0
[FW1-GigabitEthernet1/0/0]ip address 11.1.1.1 24

[R1]interface GigabitEthernet 0/0/0
[R1-GigabitEthernet0/0/0]ip address 11.1.1.2 24
[R1]interface LoopBack 0
[R1-LoopBack0]ip address 100.1.1.1 24

2.开启虚拟系统

[FW1]vsys enable 

3.配置资源类

[FW1]resource-class r1
[FW1-resource-class-r1]resource-item-limit session reserved-number 500 maximum 1000

 4.创建虚拟系统

[FW1]vsys name vsysa
[FW1-vsys-vsysa]assign resource-class r1
[FW1-vsys-vsysa]assign interface GigabitEthernet 1/0/1

5.管理员配置

[FW1]switch vsys vsysa
<FW1-vsysa>system-view 
[FW1-vsysa]aaa
[FW1-vsysa-aaa]manager-user admin@@vsysa
[FW1-vsysa-aaa-manager-user-admin@@vsysa]password 

Enter Password:

Confirm Password:
[FW1-vsysa-aaa-manager-user-admin@@vsysa]level 15
[FW1-vsysa-aaa-manager-user-admin@@vsysa]service-type web telnet ssh 
[FW1-vsysa-aaa]bind manager-user admin@@vsysa role system-admin 

6.配置安全策略和NAT策略

安全策略：
[FW1]security-policy
[FW1-policy-security]rule name to_internet
[FW1-policy-security-rule-to_internet]source-zone trust 
[FW1-policy-security-rule-to_internet]destination-zone trust
[FW1-policy-security-rule-to_internet]action permit 

NAT策略：
[FW1]nat-policy
[FW1-policy-nat]rule name nat1
[FW1-policy-nat-rule-nat1]source-zone trust 
[FW1-policy-nat-rule-nat1]egress-interface GigabitEthernet 1/0/0
[FW1-policy-nat-rule-nat1]source-address 10.3.0.0 16
[FW1-policy-nat-rule-nat1]action source-nat easy-ip 

 7.配置虚拟系统

[FW1]switch vsys vsysa
<FW1-vsysa>system-view 
[FW1-vsysa]interface GigabitEthernet 1/0/1
[FW1-vsysa-GigabitEthernet1/0/1]ip address 10.3.0.254 24
[FW1-vsysa]interface Virtual-if 1
[FW1-vsysa-Virtual-if1]ip address 172.16.1.1 24

[FW1-vsysa]firewall zone trust 
[FW1-vsysa-zone-trust]add interface GigabitEthernet 1/0/1
[FW1-vsysa]firewall zone untrust 
[FW1-vsysa-zone-untrust]add interface Virtual-if 1

[FW1-vsysa]ip route-static 0.0.0.0 0 public 

[FW1-vsysa]ip address-set ip_add01 type object 
[FW1-vsysa-object-address-set-ip_add01]address range 10.3.0.1 10.3.0.10

[FW1-vsysa]security-policy
[FW1-vsysa-policy-security]rule name to_internet
[FW1-vsysa-policy-security-rule-to_internet]source-zone trust 
[FW1-vsysa-policy-security-rule-to_internet]destination-zone untrust 
[FW1-vsysa-policy-security-rule-to_internet]source-address address-set ip_add01 
[FW1-vsysa-policy-security-rule-to_internet]action permit 

[FW1]switch vsys vsysb
<FW1-vsysb>system-view 
[FW1-vsysb]interface GigabitEthernet 1/0/2
[FW1-vsysb-GigabitEthernet1/0/2]ip address 10.3.1.254 24
[FW1-vsysb]interface Virtual-if 2
[FW1-vsysb-Virtual-if2]ip address 172.16.2.1 24

[FW1-vsysb]firewall zone untrust 
[FW1-vsysb-zone-untrust]add interface Virtual-if 2
[FW1-vsysb]firewall zone trust 
[FW1-vsysb-zone-trust]add interface GigabitEthernet 1/0/2

[FW1-vsysb]ip route-static 0.0.0.0 0 public 

[FW1]switch vsys vsysc
<FW1-vsysc>system-view 
[FW1-vsysc]interface GigabitEthernet 1/0/3
[FW1-vsysc-GigabitEthernet1/0/3]ip address 10.3.2.254 24
[FW1-vsysc]interface Virtual-if 3
[FW1-vsysc-Virtual-if3]ip address 172.16.3.1 24

[FW1-vsysc]firewall zone untrust 
[FW1-vsysc-zone-untrust]add interface Virtual-if 3
[FW1-vsysc]firewall zone trust 
[FW1-vsysc-zone-trust]add interface GigabitEthernet 1/0/3

[FW1-vsysc]ip route-static 0.0.0.0 0 public 

[FW1-vsysc]security-policy
[FW1-vsysc-policy-security]rule name to_internet
[FW1-vsysc-policy-security-rule-to_internet]source-zone trust 
[FW1-vsysc-policy-security-rule-to_internet]destination-zone untrust
[FW1-vsysc-policy-security-rule-to_internet]source-address 10.3.2.0 24
[FW1-vsysc-policy-security-rule-to_internet]action permit 

[FW1-vsysc-policy-security-rule-to_internet]action permit 

五、实验验证

1.研发部访问Internet

2.财务部不能访问Internet；行政部能访问Internet