F1000-AK1010防火牆如何設置端口掃描攔截

• 如下圖所示，某公司內的各部門之間通過Device實現互連，該公司的工作時間為每周工作日的8點到18點。

• 通過配置安全策略規則，允許總裁辦在任意時間、財務部在工作時間通過HTTP協議訪問財務數據庫服務器的Web服務，禁止其它部門在任何時間、財務部在非工作時間通過HTTP協議訪問該服務器的Web服務。

圖-1 基於IP地址的安全策略配置組網圖

‌

配置步驟

1. 配置接口IP地址

# 根據組網圖中規劃的信息，配置各接口的IP地址，具體配置步驟如下。

<Device> system-view

[Device] interface gigabitethernet 1/0/1

[Device-GigabitEthernet1/0/1] ip address 192.168.0.1 255.255.255.0

[Device-GigabitEthernet1/0/1] quit

請參考以上步驟配置其他接口的IP地址，具體配置步驟略。

2. 配置接口加入安全域

# 請根據組網圖中規劃的信息，創建安全域，並將接口加入對應的安全域，具體配置步驟如下。

[Device] security-zone name database

[Device-security-zone-database] import interface gigabitethernet 1/0/1

[Device-security-zone-database] quit

[Device] security-zone name president

[Device-security-zone-president] import interface gigabitethernet 1/0/2

[Device-security-zone-president] quit

[Device] security-zone name finance

[Device-security-zone-finance] import interface gigabitethernet 1/0/3

[Device-security-zone-finance] quit

[Device] security-zone name market

[Device-security-zone-market] import interface gigabitethernet 1/0/4

[Device-security-zone-market] quit

3. 配置時間段

# 創建名為work的時間段，其時間範圍為每周工作日的8點到18點，具體配置步驟如下。

[Device] time-range work 08:00 to 18:00 working-day

4. 配置安全策略

# 配置名稱為president-database的安全策略規則，允許總裁辦在任意時間通過HTTP協議訪問財務數據庫服務器，具體配置步驟如下。

[Device] security-policy ip

[Device-security-policy-ip] rule name president-database

[Device-security-policy-ip-0-president-database] source-zone president

[Device-security-policy-ip-0-president-database] destination-zone database

[Device-security-policy-ip-0-president-database] source-ip-subnet 192.168.1.0 24

[Device-security-policy-ip-0-president-database] destination-ip-subnet 192.168.0.0 24

[Device-security-policy-ip-0-president-database] service http

[Device-security-policy-ip-0-president-database] action pass

[Device-security-policy-ip-0-president-database] quit

# 配置名稱為finance-database的安全策略規則，隻允許財務部在工作時間通過HTTP協議訪問財務數據庫服務器，具體配置步驟如下。

[Device-security-policy-ip] rule name finance-database

[Device-security-policy-ip-1-finance-database] source-zone finance

[Device-security-policy-ip-1-finance-database] destination-zone database

[Device-security-policy-ip-1-finance-database] source-ip-subnet 192.168.2.0 24

[Device-security-policy-ip-1-finance-database] destination-ip-subnet 192.168.0.0 24

[Device-security-policy-ip-1-finance-database] service-port tcp destination eq 80

[Device-security-policy-ip-1-finance-database] action pass

[Device-security-policy-ip-1-finance-database] time-range work

[Device-security-policy-ip-1-finance-database] quit

# 配置名稱為market-database的安全策略規則，禁止市場部在任何時間通過HTTP協議訪問財務數據庫服務器，具體配置步驟如下。

[Device-security-policy-ip] rule name market-database

[Device-security-policy-ip-2-market-database] source-zone market

[Device-security-policy-ip-2-market-database] destination-zone database

[Device-security-policy-ip-2-market-database] source-ip-subnet 192.168.3.0 24

[Device-security-policy-ip-2-market-database] destination-ip-subnet 192.168.0.0 24

[Device-security-policy-ip-2-market-database] service http

[Device-security-policy-ip-2-market-database] action drop

[Device-security-policy-ip-2-market-database] quit

# 激活安全策略規則的加速功能，具體配置步驟如下。

[Device-security-policy-ip] accelerate enhanced enable

[Device-security-policy-ip] quit