IP與安全區(qū)域配置interface GigabitEthernet1/0/0.10vlan-type dot1q 10ip address 192.168.1.254 255.255.255.0service-manage ping permitinterface GigabitEthernet1/0/0.1vlan-type dot1q 1ip address 192.168.2.254 255.255.255.0service-manage ping permitinterface GigabitEthernet1/0/0.2vlan-type dot1q 2ip address 192.168.3.254 255.255.255.0service-manage ping permitinterface GigabitEthernet1/0/1ip address 14.0.0.1 255.255.255.0service-manage ping permitinterface GigabitEthernet1/0/2ip address 12.0.0.1 255.255.255.0service-manage ping permitfirewall zone trustadd interface GigabitEthernet1/0/0.10add interface GigabitEthernet1/0/0.1add interface GigabitEthernet1/0/0.2firewall zone untrustadd interface GigabitEthernet1/0/1add interface GigabitEthernet1/0/2SW1vlan batch 10 1 2interface GigabitEthernet0/0/1port link-type trunkport trunk allow-pass vlan 10 1 2interface GigabitEthernet0/0/2port link-type accessport default vlan 10interface GigabitEthernet0/0/3port link-type accessport default vlan 1interface GigabitEthernet0/0/4port link-type accessport default vlan 2地址對(duì)象、用戶組與認(rèn)證配置address 財(cái)務(wù)部net-address 192.168.1.0 mask 24address 研發(fā)部net-address 192.168.2.0 mask 24address Web服務(wù)器host-address 192.168.3.10address FTP服務(wù)器host-address 200.0.0.10user-group 財(cái)務(wù)部組user-group 研發(fā)部組authenticationaccess-type free user-group 財(cái)務(wù)部組access-type anonymous user-group 研發(fā)部組策略路由PBR配置acl 3000rule 5 permit ip source 192.168.1.0 0.0.0.255 destination 200.0.0.10 0acl 3001rule 5 permit ip source 192.168.2.0 0.0.0.255 destination 200.0.0.10 0traffic classifier finance_ftpif-match acl 3000traffic classifier rd_ftpif-match acl 3001traffic behavior to_telecomredirect ip-nexthop 14.0.0.2 track ip-link 1traffic behavior to_unicomredirect ip-nexthop 12.0.0.2 track ip-link 2traffic policy PBRclassifier finance_ftp behavior to_telecomclassifier rd_ftp behavior to_unicominterface GigabitEthernet1/0/0.10traffic-policy PBR inboundinterface GigabitEthernet1/0/0.1traffic-policy PBR inboundNAT策略配置nat-policyrule name trust_to_internetsource-zone trustdestination-zone untrustaction source-nat easy-ipnat server Web_tele protocol tcp global 14.0.0.100 www inside 192.168.3.10 wwwnat server Web_unicom protocol tcp global 12.0.0.100 www inside 192.168.3.10 www路由配置ip route-static 101.1.1.0 255.255.255.0 14.0.0.2ip route-static 102.1.1.0 255.255.255.0 12.0.0.2ip route-static 0.0.0.0 0.0.0.0 14.0.0.2 preference 70 track ip-link 1ip route-static 0.0.0.0 0.0.0.0 12.0.0.2 preference 80R4interface GigabitEthernet0/0/0ip address 14.0.0.2 255.255.255.0description TO-FW-GE1/0/1interface GigabitEthernet0/0/1ip address 200.0.0.1 255.255.255.0description TO-公網(wǎng)FTP服務(wù)器方向interface LoopBack0ip address 101.1.1.1 255.255.255.0description 電信ISP網(wǎng)段ospf 1 router-id 4.4.4.4area 0.0.0.0network 14.0.0.0 0.0.0.255network 101.1.1.0 0.0.0.255network 200.0.0.0 0.0.0.255ip route-static 192.168.0.0 255.255.252.0 14.0.0.1R2interface GigabitEthernet0/0/0ip address 12.0.0.2 255.255.255.0description TO-FW-GE1/0/2interface GigabitEthernet0/0/1ip address 200.0.0.2 255.255.255.0description TO-公網(wǎng)FTP服務(wù)器方向interface LoopBack0ip address 102.1.1.1 255.255.255.0description 聯(lián)通ISP網(wǎng)段ospf 1 router-id 2.2.2.2area 0.0.0.0network 12.0.0.0 0.0.0.255network 102.1.1.0 0.0.0.255network 200.0.0.0 0.0.0.255ip route-static 192.168.0.0 255.255.252.0 12.0.0.1測(cè)試