H3C防火墙透明模式部署

现实需求

某公司机房因考虑办公安全问题,增购一台防火墙.但是又不想改变现有的网络架构.现场考虑通过防火墙透明模式部署

配置思路

1. 第一步 将防火墙接口划分到安全区域内
2. 第二步 创建对象策略 配置对象策略规则
3. 第三步 创建安全域策略或者安全策略 应用对象策略

安全策略功能与对象策略功能在设备上不能同时使用，开启安全策略功能后，对象策略功能立即失效；当安全策略与包过滤策略同时配置时，由于安全策略对报文的处理在包过滤策略之前，报文与安全策略规则匹配成功后，不再进行包过滤处理。

防火墙配置命令

# 透明模式需要把接口改为bridge
[FWA]interface GigabitEthernet 1/0/1
[FWA-GigabitEthernet1/0/1]port link-mode bridge
[FWA-GigabitEthernet1/0/1]quit

# 将接口划分到安全区域内
[FWA]security-zone name Trust 
[FWA-security-zone-Trust]import interface GigabitEthernet1/0/2 vlan 1 to 4094
[FWA]security-zone name Untrust 
[FWA-security-zone-Untrust]import interface GigabitEthernet1/0/1 vlan 1 to 4094
[FWA-security-zone-Untrust]quit

# 创建名称为pass的对象策略
[FWA]object-policy ip pass
[FWA-object-policy-ip-pass]rule 5 pass
[FWA-object-policy-ip-pass]quit

# 创建安全域策略
[FWA]zone-pair security source Trust destination Untrust
[FWA-zone-pair-security-Trust-Untrust]object-policy apply ip pass
[FWA-zone-pair-security-Trust-Untrust]quit

[FWA]zone-pair security source Trust destination Local
[FWA-zone-pair-security-Trust-Local]object-policy apply ip pass
[FWA-zone-pair-security-Trust-Local]quit

[FWA]zone-pair security source Local destination Trust
[FWA-zone-pair-security-Local-Trust]object-policy apply ip pass
[FWA-zone-pair-security-Local-Trust]quit

[FWA]zone-pair security source Local destination Untrust
[FWA-zone-pair-security-Local-Untrust]object-policy apply ip pass
[FWA-zone-pair-security-Local-Untrust]quit

# 新版安全策略[多对多]
[FWA]security-policy ip 
[FWA-security-policy-ip]rule 5 name policy_rule
[FWA-security-policy-ip-5-policy_rule]action pass     // pass通过 drop丢弃
[FWA-security-policy-ip-5-policy_rule]source-zone Trust
[FWA-security-policy-ip-5-policy_rule]source-zone local
[FWA-security-policy-ip-5-policy_rule]destination-zone local
[FWA-security-policy-ip-5-policy_rule]destination-zone Trust
[FWA-security-policy-ip-5-policy_rule]destination-zone Untrust

配置验证

Trust ping Untrust

Untrust ping Trust

猜想

透明模式配置管理地址

[FWA]security-zone name Trust
[FWA-security-zone-Trust]import interface Vlan-interface1
[FWA]interface vlan 1
[FWA-Vlan-interface1]ip address 192.168.0.252 255.255.255.0
[FWA-Vlan-interface1]quit