Regional Policy Firewall
Topology
1 Configure port address and account configuration
Pre-configured router follows:
- gg Password: 666
- Dynamic Routing
2 View Connectivity
Pc-a ping pc-c
Pc-c telnet R2
3 Configure firewall policy area
R3 (config) # zone security IN-ZONE // create a zone IN-ZONE
R3(config-sec-zone)# exit
R3 (config) # zone security OUT-ZONE // create regional OUT-ZONE
R3(config-sec-zone)# exit
R3 (config) # access-list 101 permit ip 192.168.3.0 0.0.0.255 any // create an extended ACL101 to allow access from all ...... source network address to any other address in the IP level with access-list
R3(config)# class-map type inspect match-all IN-NET-CLASS-MAP
R3(config-cmap)# match access-group 101
R3 (config-cmap) # exit // with the class map type inspect (match all) to create a named class map type inspect the class map, match by match access-group ACL
R3 (config) # policy-map type inspect IN-2-OUT-PMAP // Create a policy map IN-2-OUT-PMAP
R3 (config-pmap) # class type inspect IN-NET-CLASS-MAP // define a policy type and reference level detector FIG
R3 (config) # zone-pair security IN-2-OUT-ZPAIR source IN-ZONE destination OUT-ZONE // create a zone of regional IN-2-OUT-ZPAIR a task is created in the area defining the source and destination
R3(config-sec-zone-pair)# service-policy type inspect IN-2-OUT-PMAP
R3(config-sec-zone-pair)# exit
R3(config# interface fa0/1
R3(config-if)# zone-member security IN-ZONE
R3(config-if)# exit
R3(config)# interface s0/1/1
R3(config-if)# zone-member security OUT-ZONE
R3(config-if)# exit
测试
服务器 ping PC端（防火墙阻挡，外网无法ping通PC端）
PC端 ping 服务器
pc端可以ping通服务器