你知道吗？路由器也有防火墙功能

欢迎关注微信公众号【厦门微思网络】。www.xmws专业IT认证培训19周年主要课程：思科、华为、红帽、ORACLE、VMware、CISP、PMP等认证培训及考证

配置需求

配置CISCO IOS基于区域的原耽防火诺和灵墙

A. 使得Inside的网络可以访问Outside所用服务B. 使得Inside的网络可以访问Dmz（魏彦妮只能访问Dmz的telnet服务）C. 使得Outside网络可以访问Dmz（只能访问Dmz的telnet服务）

１．配置设备IP地址和路由(使用EIGRP动态路由协议使得整个网络互通)

interface FastEthernet0/0 ip address 15.1.1.1 255.255.255.0 no shrou十三陵长陵ter eigrp 100 network 15.1.1.0 0.0.0.255 no auto-summary配置R２interface Serial2/0ip 安装打印机驱动address 25.1.1.2 255.255.255.0no shrouter eigrp 100network 25.1.1.0 0.0.0.255no auto-summary

配置R３：

interface Serial2/0 ip address 35.1.1.3 255.255.255.0no shrouter eigrp 100 network 35.1.1.0 0.0.0.255no auto日本海淘-summary

配电脑怎么样置R４：

interface Ser公差符号ial2/0 ip address 45.1.1.4 255.255.255.0no shrouter eigrp 100 network 45.1.1.0 0.0.0.255no auto-summary

配置R５：

interface FastEthernet0/0 description ###conn to R1 F0/0### ip address 15.1.1.5 255.255.255.0no shinterface Serial2/0 description ###conn to R2 S2/0### ip address 25.1.1.5 255.255.255.0no shinterface Serial2/1 description ###conn to R3 S2/协方差0### ip address 35.1.1.5 255.255男人三从四德.255.0no shinterface Serial2/2 description ###conn to R4 S2/0### ip address 45.1.1.5 255.255.255.0no shrouter eigrp 100 network 15.1.1.0 0.0.0.255network 25.1.1.0 0.0.0.255network 35.1.1.0 0.0.0.255network 45.1.1.0 0.0.0.255no auto-summary

2．按需求在R5上配置基于区域的防火墙

实现需求A：使得Inside的网络可以访问Outside所用服务

配置安全区域

zone security Insidezone security Dmzzone security Outside

配置class map

ip access-list extended In_to_Out_Acl permit ip any anyclass-map type inspect match-all Inside_to_Outside_Cmap match access-group name In_to_Out_Acl

配置policy map

policy-map type inspec漫漫归途t In_to_Out_Pmap class type inspect Inside_to_Outside_Cmap inspect

配置区域对

zone-pair security孔雀石化学式 mypair1 source Inside destination Outside service-policy type inspect In_to_Out_Pmap

把接口分配到区域

interface FastEthernet0/0zone-member security Outsideinterface Serial2/0zone-member security Insideinterface Serial2/１zone-member security Inside

实现求B：

使得Insid高中生物e的网络可以访问Dmz（只能访问Dmz的telnet服务）class-map type inspect match-all Inside_to_Dmz_Cmap match protocol telnet

.

policy-map type inspect In_to_Dmz_Pmap class type inspect Inside_to_Dmz_Cmap inspect 天津好玩吗zone-pair security mypair3 source Inside destination Dmz service-policy type inspect In_to_Dmz_Pmap interface Serial2/2zone-member security 玻璃鳗Dmz

实现需求C：

使得Outside网络可以访问Dmz（只能访问Dmz的telnet服务）class-map type inspect match-all Outside_to_Dmz_Cmap match protocol telnetpolicy-map type inspect Out_to_Dmz_Pmapclass type inspect Outside中海油工资_to_Dmz_Cmap inspectzone-pair security mypair2 source Outside destination Dmz servic王一婷e-policy type inspect Out_to_Dmz_Pmap

检查命令：

Inside:ping 15.1.1.1te双重身份lnet 15.1.1.1telnet 45.1.1.4Outside:telnet 45.1.1.4show zone securitysbeamerhow zone-pair securityshow policy-map 煤气化技术type inspectshow policy-map type inspect zone-pair sessionsshow class-map type inspect