[]web-managerenable開啟webweb界面：默認 untrustdmz firewallzonetrust gi1/0/0將接口加入trust允許接口被pingintgi1/0/0service-managepingrulenamesource-zonelocaldestination-zoneanyactionpermitip nat配置rulenametrust_ISPsource-zonetrustegress-interfaceGigabitEthernet1/0/2actionnateasy-ipdefaultactionuser-interfacevty04authentication-modepassworduserprivilegelevel3setauthenticationpasswordsimple基于會話（狀態）session首包：建立會話的過程去包disfirewallsessiontablerulenametrust_dmzsource-zonetrustdestination-zonedmzactionpermitrulenametrust_dmzsource-zonetrustdestination-zonedmzsource-address192.168.1.0destination-address172.16.1.232servicetelnetserviceicmpaction源NAT端口映射（nat172.16.1.223址202.1.1.1的23端口。命令行：natserver aa0zoneuntrustprotocoltcpglobal202.1.1.123inside 23no-[FW]rsalocal-key-paircreate產生用于加密的intgiservice-managesshpermituser-interfacevty04authentication-modeaaaprotocolinboundsshmanager-userxiaogepasswordcipherXiaoge123service-typesshlevelssh服務并指定用戶名和密碼stelnetserverenablesshusersshuserxiaogeauthentication-typesshuserxiaogeservice-typestelnet后會被踢出然后1ssh只能使用用戶名和密碼的方式登2 x.x.x.x用于探測去往某目標經過的三層tracert原理：發送探測報文ttl=1（第一跳）ttl=2（第二跳）因此tracert時，會有* *出現是多數是防配置防火墻允許tracerticmpttl-exceededsendintgi portlink-typeaccesstelnetuser-interfacevty04authentication-modenoneuserprivilegelevel3vlanintgi link-typeaccess defaultvlantrust1<---->trust2telnet然后可以基于svi1svi2ip放行local_to_anyvrrpvrrp需要解決的兩個問題：vrrp（VGMP加入vgmp組，多個vrrp（HRP)VRRP配置：intvrrpvrid1virtual-ip192.168.1.1activeintgi1/0/1vrrpvrid2virtual-ip202.1.1.1activeintgivrrpvrid1virtual-ip192.168.1.1standbyintgi1/0/1vrrpvrid2vritual-ip202.1.1.1HRPhrphrpinterfacegi1/0/6remote172.16.1.253hrphrpstandby-hrpintgi1/0/6remotestandbytrust_to_untrust+BFW1rulenametrust_to_untrustsource-zonetrustdestination-zoneuntrustactionpermit測試1：R1pingR2通信！！可以做冗余性測試！！測試2：去掉HRP看看配置安全策略是否還同步（HRP切換需要1分鐘時間有standby--->master）3R1telnetR2FWstandbytrust_to_untrust+B表示配置已經同步到備設備上面。FW1：rulenametrust_to_untrustsource-zonetrustdestination-zoneuntrustactionpermit測試