?
欢迎关注微信公众号【厦门微思网络】。www.xmws.cn专业IT认证培训19周年
主要课程：思科、华为、红帽、ORACLE、VMware、CISP、PMP等认证培训及考证
配置需求
配置CISCO IOS基于区域的防火墙
A. 使得Inside的网络可以访问Outside所用服务B. 使得Inside的网络可以访问Dmz（只能访问Dmz的telnet服务）C. 使得Outside网络可以访问Dmz（只能访问Dmz的telnet服务）
１．配置设备IP地址和路由(使用EIGRP动态路由协议使得整个网络互通)
interface FastEthernet0/0
ip address 15.1.1.1 255.255.255.0
no sh
router eigrp 100
network 15.1.1.0 0.0.0.255
no auto-summary
- 配置R２
interface Serial2/0
ip address 25.1.1.2 255.255.255.0
no sh
router eigrp 100
network 25.1.1.0 0.0.0.255
no auto-summary配置R３：
interface Serial2/0
ip address 35.1.1.3 255.255.255.0
no sh
router eigrp 100
network 35.1.1.0 0.0.0.255
no auto-summary配置R４：
interface Serial2/0
ip address 45.1.1.4 255.255.255.0
no sh
router eigrp 100
network 45.1.1.0 0.0.0.255
no auto-summary配置R５：
interface FastEthernet0/0
description ###conn to R1 F0/0###
ip address 15.1.1.5 255.255.255.0
no sh
interface Serial2/0
description ###conn to R2 S2/0###
ip address 25.1.1.5 255.255.255.0
no sh
interface Serial2/1
description ###conn to R3 S2/0###
ip address 35.1.1.5 255.255.255.0
no sh
interface Serial2/2
description ###conn to R4 S2/0###
ip address 45.1.1.5 255.255.255.0
no sh
router eigrp 100
network 15.1.1.0 0.0.0.255
network 25.1.1.0 0.0.0.255
network 35.1.1.0 0.0.0.255
network 45.1.1.0 0.0.0.255
no auto-summary2．按需求在R5上配置基于区域的防火墙
实现需求A：使得Inside的网络可以访问Outside所用服务
配置安全区域
zone security Inside
zone security Dmz
zone security Outside配置class map
ip access-list extended In_to_Out_Acl
permit ip any any
class-map type inspect match-all Inside_to_Outside_Cmap
match access-group name In_to_Out_Acl配置policy map
policy-map type inspect In_to_Out_Pmap
class type inspect Inside_to_Outside_Cmap
inspect配置区域对
zone-pair security mypair1 source Inside destination Outside
service-policy type inspect In_to_Out_Pmap把接口分配到区域
interface FastEthernet0/0
zone-member security Outside
interface Serial2/0
zone-member security Inside
interface Serial2/１
zone-member security Inside实现求B：
使得Inside的网络可以访问Dmz（只能访问Dmz的telnet服务）
class-map type inspect match-all Inside_to_Dmz_Cmap
match protocol telnet.
policy-map type inspect In_to_Dmz_Pmap
class type inspect Inside_to_Dmz_Cmap
inspect
zone-pair security mypair3 source Inside destination Dmz
service-policy type inspect In_to_Dmz_Pmap
interface Serial2/2
zone-member security Dmz实现需求C：
使得Outside网络可以访问Dmz（只能访问Dmz的telnet服务）
class-map type inspect match-all Outside_to_Dmz_Cmap
match protocol telnet
policy-map type inspect Out_to_Dmz_Pmap
class type inspect Outside_to_Dmz_Cmap
inspect
zone-pair security mypair2 source Outside destination Dmz
service-policy type inspect Out_to_Dmz_Pmap检查命令：
?