华为模拟器eNSP将防火墙配置成三层核心交换机末初-

命令行

首先配置PC1、PC2、PC3、PC4、R1、R2、R3的接口，IP地址，掩码，网关

PC1：

PC2：

PC3：

R1: sys un in en sysname R1 int e0/0/0 ip address 192.168.70.7 24 dis this quit 

R2: sys un in en sysname R2 int e0/0/0 ip address 192.168.77.7 24 dis this quit 

R3: sys un in en sysname R3 int e0/0/0 ip address 177.7.7.7 24 dis this quit  

接下来配置两个交换机的接口，连接PC的那些接口设置成Access口，通往防火墙的接口设置成Trunk口，以及创建vlan区并把接口划分到对应的vlan区

LSW1: sys un in en sysname LSW1 vlan batch 7 17 int e0/0/2 port link-type access port de vlan 7 dis this int e0/0/3 port link-type access port de vlan 7 dis this int e0/0/4 port link-type access port de vlan 17 quit dis port vlan int e0/0/1 port link-type trunk port trunk allow-pass vlan 7 17 dis this quit dis port vlan 

LSW2: sys un in en sysname LSW2 vlan 10 int e0/0/2 port link-type access port de vlan 10 dis this int e0/0/1 port link-type trunk port trunk allow-pass vlan 10 dis this quit dis port vlan 

在防火墙上创建vlan，接着对防火墙上的接口进行设置配置，GE 1/0/0、GE 1/0/1口配置成Trunk口，GE 1/0/2、GE 1/0/3配置成Access口并允许对应vlan通过，然后新建逻辑接口并分入对应的vlan

FW: sys un in en vlan batch 7 10 17 70 77 dis port vlan int g1/0/0 portswitch port link-type trunk port trunk allow-pass vlan 7 17 dis this int g1/0/1 portswitch port link-type trunk port trunk allow-pass vlan 10 dis this int g1/0/2 portswitch port link-type access port de vlan 70 dis this int g1/0/3 portswitch port link-type access port de vlan 77 dis this quit dis ip int brief interface vlanif 7 ip address 192.168.7.1 24 service-manage ping permit dis this quit interface vlanif 10 ip address 192.168.10.1 24 service-manage ping permit dis this quit interface vlanif 17 ip address 192.168.17.1 24 service-manage ping permit dis this quit interface vlanif 70 ip address 192.168.70.1 24 service-manage ping permit dis this quit interface vlanif 77 ip address 192.168.70.1 24 service-manage ping permit dis this quit dis port vlan 

把每个vlan都建立对应的区域，并把对应的逻辑接口划分到对应的区域，以实现精细化管控

FW: sys firewall zone name vlan7 set priority 75 add int Vlanif7 dis this quit firewall zone name vlan10 set priority 77 add int Vlanif10 dis this quit firewall zone name vlan17 set priority 76 add int Vlanif17 dis this quit firewall zone name vlan70 set priority 78 add int Vlanif70 dis this quit firewall zone name vlan77 set priority 79 add int Vlanif77 dis this quit 

配置到这里，每个vlan的PC就可以访问各自的网关了，验证结果如下：
vlan7-PC1:

vlan17-PC3:

vlan10-PC4:

vlan70-R1:

vlan77-R2:

相同区域可以访问，不同区域不能访问，验证结果如下：

接下来只需要对不同区域设置对应需求的安全策略即可实现精细化管控

FW; sys security-policy rule name vlan7_to_vlan17 source-zone vlan7 destination-zone vlan17 service icmp action permit dis this 

验证结果如下：

其他的就不演示了，不同区域的设置对应的安全策略即可实现精细化管控

如果是内网的PC想要访问外网的地址，做个NAT源地址转换，做个策略，再在外网口上设置一条缺省路由即可

FW: sys firewall zone trust add int g1/0/0 add int g1/0/1 add int g1/0/2 add int g1/0/3 dis this quit firewall zone untrust add int g1/0/4 dis this quit int g1/0/4 ip address 177.7.7.1 24 dis this quit ip route-static 0.0.0.0 0 177.7.7.7 nat-policy rule bane vlan7_nat_untrust source-zone vlan7 egress-int g1/0/4 action nat easy-ip dis this quit quit 

验证结果：

防火墙web端配置