為什么防火墻默認就可以訪問任何區(qū)域？

實驗拓撲

防火墻的工作模式

透明網(wǎng)橋模式：可以理解成二層交換機，對三層的IP、路由沒有任何影響。透明模式仍然可以抵御外部入侵，但是不能發(fā)揮防火墻的全部功能
例如下圖：前期IP地址都已經(jīng)規(guī)劃好了，組網(wǎng)都已經(jīng)結(jié)束了。突然領(lǐng)導說要加個防火墻，那基本就用透明模式。

路由模式：可以理解成三層路由器

防火墻的區(qū)域(zone)

防火墻默認區(qū)域的介紹
優(yōu)先級代表著可信程度，優(yōu)先級越高表示越信任，即數(shù)字越大越信任

[SRG]dis?zone?
2249??2020/11/18
local??#本地區(qū)域
?priority?is?100??#默認優(yōu)先級100
?
#
trust?#內(nèi)網(wǎng)用戶
?priority?is?85???#默認優(yōu)先級85
?interface?of?the?zone?is?(1):
????GigabitEthernet0/0/0
????
#
untrust?#外網(wǎng)用戶
?priority?is?5??#默認優(yōu)先級5
?interface?of?the?zone?is?(0):
?
#
dmz??#dmz區(qū)域
?priority?is?50???#默認優(yōu)先級50
?interface?of?the?zone?is?(0):
#

接下來我們按照拓撲把防火墻的端口劃分到相應的區(qū)域。

[SRG]firewall?zone??
??dmz???????????Indicate?the?DMZ
??local?????????Indicate?the?Local?zone
??name??????????Indicate?the?security?zone?name
??trust?????????Indicate?the?Trust?zone
??untrust???????Indicate?the?Untrust?zone
??vpn-instance??Indicate?VPN?instance?

[SRG]firewall?zone?trust?
[SRG-zone-trust]add?interface?g0/0/1
[SRG-zone-trust]q

[SRG]firewall?zone?dmz?
[SRG-zone-dmz]add?int?g0/0/3
[SRG-zone-dmz]q

[SRG]firewall?zone?untrust?
[SRG-zone-untrust]add?interface?g0/0/2
[SRG-zone-untrust]q

接口只有劃分了區(qū)域才可以使用。
這樣做完之后，只有trust區(qū)域才能訪問防火墻。內(nèi)網(wǎng)也不能訪問外網(wǎng)。

[R1]ip?route-static?0.0.0.0?0?12.1.1.2

[R2]ip?route-static?0.0.0.0?0?23.1.1.1??
#這里應該用nat地址轉(zhuǎn)換的，但我們還沒有接觸到防火墻nat轉(zhuǎn)換，所以先用靜態(tài)路由代替，本篇后面會講到。

[SRG]ip?route-static?0.0.0.0?0?23.1.1.2???????#到外網(wǎng)的路由
[SRG]ip?route-static?192.168.1.0?24?12.1.1.1??#到內(nèi)網(wǎng)的路由

雖然我們加入了2條路由，但是由于還沒有配置策略，所以內(nèi)網(wǎng)用戶還是不能訪問外網(wǎng)。

防火墻策略概念

防火墻策略的方向

outbound：高優(yōu)先級訪問低優(yōu)先級

inbound：低優(yōu)先級訪問高優(yōu)先級
注意：“訪問”僅指的是出包即主動發(fā)起的第一個報文，即建立會話（session）的過程。

默認高優(yōu)先級可以訪問低優(yōu)先級，但是低優(yōu)先級無法回包，相當于回執(zhí)路由回不來。所以無法ping通。但是我的確是訪問了，防火墻就會記錄這一條信息。

防火墻默認可以訪問任何一個區(qū)域

ping?192.168.254.2
2306??2020/11/18
??PING?192.168.254.2:?56??data?bytes,?press?CTRL_C?to?break
????Reply?from?192.168.254.2:?bytes=56?Sequence=1?ttl=255?time=220?ms
????Reply?from?192.168.254.2:?bytes=56?Sequence=2?ttl=255?time=50?ms
????Reply?from?192.168.254.2:?bytes=56?Sequence=3?ttl=255?time=170?ms
????Reply?from?192.168.254.2:?bytes=56?Sequence=4?ttl=255?time=100?ms
????Reply?from?192.168.254.2:?bytes=56?Sequence=5?ttl=255?time=140?ms

??---?192.168.254.2?ping?statistics?---
????5?packet(s)?transmitted
????5?packet(s)?received
????0.00%?packet?loss
????round-trip?min/avg/max?=?50/136/220?ms from wljsghq

ping?192.168.1.2
2314??2020/11/18
??PING?192.168.1.2:?56??data?bytes,?press?CTRL_C?to?break
????Request?time?out
????Reply?from?192.168.1.2:?bytes=56?Sequence=2?ttl=127?time=80?ms
????Reply?from?192.168.1.2:?bytes=56?Sequence=3?ttl=127?time=80?ms
????Reply?from?192.168.1.2:?bytes=56?Sequence=4?ttl=127?time=80?ms
????Reply?from?192.168.1.2:?bytes=56?Sequence=5?ttl=127?time=270?ms

??---?192.168.1.2?ping?statistics?---
????5?packet(s)?transmitted
????4?packet(s)?received
????20.00%?packet?loss
????round-trip?min/avg/max?=?80/127/270?ms

ping?23.1.1.2
2328??2020/11/18
??PING?23.1.1.2:?56??data?bytes,?press?CTRL_C?to?break
????Reply?from?23.1.1.2:?bytes=56?Sequence=1?ttl=255?time=160?ms
????Reply?from?23.1.1.2:?bytes=56?Sequence=2?ttl=255?time=70?ms
????Reply?from?23.1.1.2:?bytes=56?Sequence=3?ttl=255?time=70?ms
????Reply?from?23.1.1.2:?bytes=56?Sequence=4?ttl=255?time=90?ms
????Reply?from?23.1.1.2:?bytes=56?Sequence=5?ttl=255?time=110?ms

??---?23.1.1.2?ping?statistics?---
????5?packet(s)?transmitted
????5?packet(s)?received
????0.00%?packet?loss
????round-trip?min/avg/max?=?70/100/160?ms

ping?34.1.1.2
2338??2020/11/18
??PING?34.1.1.2:?56??data?bytes,?press?CTRL_C?to?break
????Request?time?out
????Reply?from?34.1.1.2:?bytes=56?Sequence=2?ttl=127?time=80?ms
????Reply?from?34.1.1.2:?bytes=56?Sequence=3?ttl=127?time=100?ms
????Reply?from?34.1.1.2:?bytes=56?Sequence=4?ttl=127?time=80?ms
????Reply?from?34.1.1.2:?bytes=56?Sequence=5?ttl=127?time=220?ms

??---?34.1.1.2?ping?statistics?---
????5?packet(s)?transmitted
????4?packet(s)?received
????20.00%?packet?loss
????round-trip?min/avg/max?=?80/120/220?ms

為什么防火墻默認就可以訪問任何區(qū)域呢？這是和防火墻的默認策略有關(guān)。

防火墻的默認策略

dis?cu
...
?firewall?packet-filter?default?permit?interzone?local?trust?direction?inbound???
?#permit允許，local本地區(qū)域，trust內(nèi)網(wǎng)區(qū)域，inbound：優(yōu)先級由低——>高
?上面的意思就是：local本地區(qū)域，trust內(nèi)網(wǎng)區(qū)域，這兩個區(qū)域默認允許低——>高
?
?firewall?packet-filter?default?permit?interzone?local?trust?direction?outbound
?上面的意思就是：local本地區(qū)域，trust內(nèi)網(wǎng)區(qū)域，這兩個區(qū)域默認允許高——>低
?
?firewall?packet-filter?default?permit?interzone?local?untrust?direction?outboun
?上面的意思就是：local本地區(qū)域，untrust外網(wǎng)區(qū)域，這兩個區(qū)域默認允許高——>低
...

三條默認策略組合起來意思就是：

默認防火墻和內(nèi)網(wǎng)區(qū)域允許進和出，即相互通信；

防火墻和外網(wǎng)區(qū)域之間，只能出，不能進。即防火墻可以ping通外網(wǎng)，外網(wǎng)無法ping通防火墻；

同樣防火墻訪問DMZ也是只能出，不能進。即防火墻可以ping通DMZ的server，但server無法ping通防火墻。

防火墻的策略配置

1、內(nèi)網(wǎng)用戶訪問外網(wǎng)

[SRG]firewall?packet-filter?default?permit?interzone?trust?untrust?direction?out
bound?
2321??2020/11/18
Warning:Setting?the?default?packet?filtering?to?permit?poses?security?risks.?You
?are?advised?to?configure?the?security?policy?based?on?the?actual?data?flows.?Ar
e?you?sure?you?want?to?continue?[Y/N]y


[R1]ping?23.1.1.2??#R1?ping?R2
??PING?23.1.1.2:?56??data?bytes,?press?CTRL_C?to?break
????Reply?from?23.1.1.2:?bytes=56?Sequence=1?ttl=254?time=50?ms
????Reply?from?23.1.1.2:?bytes=56?Sequence=2?ttl=254?time=50?ms
????Reply?from?23.1.1.2:?bytes=56?Sequence=3?ttl=254?time=30?ms
????Reply?from?23.1.1.2:?bytes=56?Sequence=4?ttl=254?time=30?ms
????Reply?from?23.1.1.2:?bytes=56?Sequence=5?ttl=254?time=40?ms

PC>ping?34.1.1.2??#pc1?PING?pc2

Ping?34.1.1.2:?32?data?bytes,?Press?Ctrl_C?to?break
Request?timeout!
From?34.1.1.2:?bytes=32?seq=2?ttl=125?time=62?ms
From?34.1.1.2:?bytes=32?seq=3?ttl=125?time=63?ms
From?34.1.1.2:?bytes=32?seq=4?ttl=125?time=31?ms
From?34.1.1.2:?bytes=32?seq=5?ttl=125?time=31?ms

---?34.1.1.2?ping?statistics?---
??5?packet(s)?transmitted
??4?packet(s)?received
??20.00%?packet?loss
??round-trip?min/avg/max?=?0/46/63?ms

PC>

2、內(nèi)網(wǎng)用戶訪問DMZ區(qū)域的服務器

[SRG]firewall?packet-filter?default?permit?interzone?trust?dmz?direction?outboun
d?
2300??2020/11/18
Warning:Setting?the?default?packet?filtering?to?permit?poses?security?risks.?You
?are?advised?to?configure?the?security?policy?based?on?the?actual?data?flows.?Ar
e?you?sure?you?want?to?continue?[Y/N]y

PC>ping?34.1.1.2

Ping?34.1.1.2:?32?data?bytes,?Press?Ctrl_C?to?break
Request?timeout!
From?34.1.1.2:?bytes=32?seq=2?ttl=125?time=62?ms
From?34.1.1.2:?bytes=32?seq=3?ttl=125?time=63?ms
From?34.1.1.2:?bytes=32?seq=4?ttl=125?time=31?ms
From?34.1.1.2:?bytes=32?seq=5?ttl=125?time=31?ms

---?34.1.1.2?ping?statistics?---
??5?packet(s)?transmitted
??4?packet(s)?received
??20.00%?packet?loss
??round-trip?min/avg/max?=?0/46/63?ms

PC>

3、外網(wǎng)用戶訪問DMZ服務器

[SRG]firewall?packet-filter?default?permit?interzone?untrust?dmz?direction?inbou
nd?
0011??2020/11/19
Warning:Setting?the?default?packet?filtering?to?permit?poses?security?risks.?You
?are?advised?to?configure?the?security?policy?based?on?the?actual?data?flows.?Ar
e?you?sure?you?want?to?continue?[Y/N]y
[SRG]

PC>ping?192.168.254.2

Ping?192.168.254.2:?32?data?bytes,?Press?Ctrl_C?to?break
From?192.168.254.2:?bytes=32?seq=1?ttl=253?time=15?ms
From?192.168.254.2:?bytes=32?seq=2?ttl=253?time=63?ms
From?192.168.254.2:?bytes=32?seq=3?ttl=253?time=47?ms
From?192.168.254.2:?bytes=32?seq=4?ttl=253?time=31?ms
From?192.168.254.2:?bytes=32?seq=5?ttl=253?time=47?ms

---?192.168.254.2?ping?statistics?---
??5?packet(s)?transmitted
??5?packet(s)?received
??0.00%?packet?loss
??round-trip?min/avg/max?=?15/40/63?ms

防火墻上的NAT

防火墻上的NAT的基本配置

[R2]undo?ip?route-static?0.0.0.0?0?23.1.1.1???#刪除之前R2上面的靜態(tài)路由

[SRG]nat-policy?interzone?trust?untrust?outbound?
[SRG-nat-policy-interzone-trust-untrust-outbound]policy?1??#1策略ID
[SRG-nat-policy-interzone-trust-untrust-outbound-1]action??
??no-nat??????Indicate?that?no?NAT?action?is?configured
??source-nat??Indicate?that?the?source?NAT?action?is?configured

[SRG-nat-policy-interzone-trust-untrust-outbound-1]action?source-nat??
[SRG-nat-policy-interzone-trust-untrust-outbound-1]easy-ip?g0/0/2

驗證結(jié)果

PC>ping?34.1.1.2

Ping?34.1.1.2:?32?data?bytes,?Press?Ctrl_C?to?break
Request?timeout!
From?34.1.1.2:?bytes=32?seq=2?ttl=125?time=32?ms
From?34.1.1.2:?bytes=32?seq=3?ttl=125?time=31?ms
From?34.1.1.2:?bytes=32?seq=4?ttl=125?time=62?ms
From?34.1.1.2:?bytes=32?seq=5?ttl=125?time=63?ms

---?34.1.1.2?ping?statistics?---
??5?packet(s)?transmitted
??4?packet(s)?received
??20.00%?packet?loss
??round-trip?min/avg/max?=?0/47/63?ms

抓包看看

防火墻NAT端口映射

端口映射

映射服務器server1的80端口到外網(wǎng)的23.1.1.3:80

[SRG]nat?server?protocol?tcp?global?23.1.1.3?80?inside?192.168.254.2?80

說明：外網(wǎng)IP有很多：23.1.1.0/24 整個段都可以用。

驗證結(jié)果

如果要驗證，拓撲就需要更改一下，如下圖：

查看防火墻NAT轉(zhuǎn)換表

[SRG]display?firewall?session?table?nat
0016??2020/11/19
?Current?Total?Sessions?:?1
??http??VPN:public?-->?public?34.1.1.2:2050-->23.1.1.3:80[192.168.254.2:80]
[SRG]

抓包看看