SLTechnology News&Howtos › Network Security ›

2-Huawei Firewall: security Policy Classification

Shulou Source: shulou.com Published: 2022-06-01 05:07:08 10月04日 Update

1. Experimental topology:

2. Experimental requirements:

Only one host or scope can be defined in ASA, and SRG can define host and scope at the same time.

From virtual firewall to physical firewall is also Inbound, and Huawei's management firewall is Cisco's management sub-firewall.

III. Order deployment:

1. R1, R2, R3 addresses are omitted and default routes are deployed to USG:

[R1] ip route-static 0.0.0.0 0.0.0.0 202.100.1.10

[R2] ip route-static 0.0.0.0 0.0.0.0 192.168.1.10

[R3] ip route-static 0.0.0.0 0.0.0.0 10.1.1.10

2. USG deployment:

[SRG] ip service-set aaa type object

[SRG-object-service-set-aaa] service protocol icmp

[SRG] policy interzone trust untrust outbound

[SRG-policy-interzone-trust-untrust-outbound] policy 0

[SRG-policy-interzone-trust-untrust-outbound-0] policy source 192.168.1.0 mask 24

[SRG-policy-interzone-trust-untrust-outbound-0] policy destination 202.100.1.0 mask 24

[SRG-policy-interzone-trust-untrust-outbound-0] policy service service-set aaa

[SRG-policy-interzone-trust-untrust-outbound-0] action permit

[SRG] display current-configuration configuration object-service-set

Ip service-set aaa type object

Service 0 protocol icmp

[SRG] display current-configuration configuration policy-interzone

Policy interzone trust untrust outbound

Policy 0

Action permit

Policy service service-set aaa

Policy source 192.168.1.0 mask 24

Policy destination 202.100.1.0 mask 24

Test:

[R2] ping 202.100.1.1

Reply from 202.100.1.1: bytes=56 Sequence=1 ttl=254 time=50 ms

Reply from 202.100.1.1: bytes=56 Sequence=2 ttl=254 time=50 ms

Reply from 202.100.1.1: bytes=56 Sequence=3 ttl=254 time=40 ms

Reply from 202.100.1.1: bytes=56 Sequence=4 ttl=254 time=30 ms

Reply from 202.100.1.1: bytes=56 Sequence=5 ttl=254 time=30 ms

[R1] ping 192.168.1.1

Request time out