[]web-managerenable開(kāi)啟webweb界面：默認(rèn) untrustdmz firewallzonetrust gi1/0/0將接口加入trust允許接口被pingintgi1/0/0service-managepingrulenamesource-zonelocaldestination-zoneanyactionpermitip nat配置rulenametrust_ISPsource-zonetrustegress-interfaceGigabitEthernet1/0/2actionnateasy-ipdefaultactionuser-interfacevty04authentication-modepassworduserprivilegelevel3setauthenticationpasswordsimple基于會(huì)話（狀態(tài)）session首包：建立會(huì)話的過(guò)程去包disfirewallsessiontablerulenametrust_dmzsource-zonetrustdestination-zonedmzactionpermitrulenametrust_dmzsource-zonetrustdestination-zonedmzsource-address192.168.1.0destination-address172.16.1.232servicetelnetserviceicmpaction源NAT端口映射（nat172.16.1.223址202.1.1.1的23端口。命令行：natserver aa0zoneuntrustprotocoltcpglobal202.1.1.123inside 23no-[FW]rsalocal-key-paircreate產(chǎn)生用于加密的intgiservice-managesshpermituser-interfacevty04authentication-modeaaaprotocolinboundsshmanager-userxiaogepasswordcipherXiaoge123service-typesshlevelssh服務(wù)并指定用戶名和密碼stelnetserverenablesshusersshuserxiaogeauthentication-typesshuserxiaogeservice-typestelnet后會(huì)被踢出然后1ssh只能使用用戶名和密碼的方式登2 x.x.x.x用于探測(cè)去往某目標(biāo)經(jīng)過(guò)的三層tracert原理：發(fā)送探測(cè)報(bào)文ttl=1（第一跳）ttl=2（第二跳）因此tracert時(shí)，會(huì)有* *出現(xiàn)是多數(shù)是防配置防火墻允許tracerticmpttl-exceededsendintgi portlink-typeaccesstelnetuser-interfacevty04authentication-modenoneuserprivilegelevel3vlanintgi link-typeaccess defaultvlantrust1<---->trust2telnet然后可以基于svi1svi2ip放行l(wèi)ocal_to_anyvrrpvrrp需要解決的兩個(gè)問(wèn)題：vrrp（VGMP加入vgmp組，多個(gè)vrrp（HRP)VRRP配置：intvrrpvrid1virtual-ip192.168.1.1activeintgi1/0/1vrrpvrid2virtual-ip202.1.1.1activeintgivrrpvrid1virtual-ip192.168.1.1standbyintgi1/0/1vrrpvrid2vritual-ip202.1.1.1HRPhrphrpinterfacegi1/0/6remote172.16.1.253hrphrpstandby-hrpintgi1/0/6remotestandbytrust_to_untrust+BFW1rulenametrust_to_untrustsource-zonetrustdestination-zoneuntrustactionpermit測(cè)試1：R1pingR2通信??！可以做冗余性測(cè)試！！測(cè)試2：去掉HRP看看配置安全策略是否還同步（HRP切換需要1分鐘時(shí)間有standby--->master）3R1telnetR2FWstandbytrust_to_untrust+B表示配置已經(jīng)同步到備設(shè)備上面。FW1：rulenametrust_to_untrustsource-zonetrustdestination-zoneuntrustactionpermit測(cè)試