注：此篇为上篇的内容扩展；
上一篇:构建小型局域网+内网和互联网实现互联通信
需求分析
在已构建完成的小型局域网中,内网和互联网已实现互联通信,为增加内网访问外网安全性,在总路由器与外网之间添加访问防火墙，设置防火墙访问策略，限制内网与外网通信规则。防火墙设置动态路由协议,自动学习内网中路由策略。
拓扑图：
注：防火墙为USG5500
拓扑描述：
配置路由器与防火墙之间互联地址为192.168.5.2/24在路由器OSPF中发布与防火墙互联网段。配置防火墙与路由器互联地址为192.168.5.1/24。配置与外网通信地址为192.168.10.9/24,设置访问外网默认路由。配置内网访问外网NAT规则,保护内网地址。设置访问策略，部门1、部门2设置可以访问外网，部门3设置为不能访问外网。
关闭Win10防火墙，以免影响到实验结果。
1.防火墙配置
<SRG>sys
[SRG]firewall zone trust
[SRG-zone-trust]add interface GigabitEthernet 0/0/2
[SRG-zone-trust]quit
[SRG]firewall zone untrust
[SRG-zone-untrust]add interface GigabitEthernet 0/0/1
[SRG-zone-untrust]quit
[SRG]interface GigabitEthernet 0/0/2
[SRG-GigabitEthernet0/0/2]ip address 192.168.5.1 24
[SRG-GigabitEthernet0/0/2]quit
[SRG]interface GigabitEthernet 0/0/1
[SRG-GigabitEthernet0/0/1]ip address 192.168.88.9 24
[SRG-GigabitEthernet0/0/1]quit
[SRG]ip route-static 0.0.0.0 0 192.168.88.1
[SRG]policy interzone trust untrust outbound
[SRG-policy-interzone-trust-untrust-outbound]policy 0
[SRG-policy-interzone-trust-untrust-outbound-0]action permit
[SRG-policy-interzone-trust-untrust-outbound-0]policy source 172.16.0.0 0.0.255.255
[SRG-policy-interzone-trust-untrust-outbound-0]quit
[SRG-policy-interzone-trust-untrust-outbound]quit
[SRG]nat-policy interzone trust untrust outbound
[SRG-nat-policy-interzone-trust-untrustoutbound]policy 1
[SRG-nat-policy-interzone-trust-untrust-outbound-1]action source-nat
[SRG-nat-policy-interzone-trust-untrust-outbound-1]policy source 172.16.0.0 0.0.255.255
[SRG-nat-policy-interzone-trust-untrust-outbound-1]easy-ip GigabitEthernet 0/0/1
[SRG-nat-policy-interzone-trust-untrust-outbound-1]quit
[SRG-nat-policy-interzone-trust-untrust-outbound]quit
[SRG]ospf 1
[SRG-ospf-1]area 0
[SRG-ospf-1-area-0.0.0.0]network 192.168.5.0 0.0.0.255
[SRG-ospf-1-area-0.0.0.0]qu
[SRG-ospf-1]default-route-advertise always cost 200 type 1
2.配置R1路由器
[R1]interface GigabitEthernet 0/0/2
[R1-GigabitEthernet0/0/2]ip address 192.168.5.2 24
[R1-GigabitEthernet0/0/2]quit
[R1] ip route-static 0.0.0.0 0 192.168.5.1
[R1]ospf 1
[R1-ospf-1]area 0
[R1-ospf-1-area-0.0.0.0]network 192.168.5.0 0.0.0.255
3.测试连通性
PC1 Ping 外网网关
PC3 Ping 外网网关
PC1为172.16网段，可以ping通到外网。而PC3为10.0.5网段，无法访问到外网。
