2019 年 11 月卷 · 第 1 题

配置防火墙 FW_A 的命令如下 #——(1)—— <FW_A> system-view [FW_A] interface GigabitEthernet 1/0/0 [FW_A-GigabitEthernet1/0/0] ip address 1.1.1.1 24 [FW_A-GigabitEthernet1/0/0] gateway 1.1.1.254 [FW_A-GigabitEthernet1/0/0] service-manage enable [FW_A-GigabitEthernet1/0/0] service-manage ping permit [FW_A-GigabitEthernet1/0/0] quit [FW_A] interface GigabitEthernet 1/0/2 [FW_A-GigabitEthernet1/0/2] ip address 10.10.1.1 24 [FW_A-GigabitEthernet1/0/2] quit #——(2)—— [FW_A] firewall zone trust [FW_A-zone-trust] add interface GigabitEthernet 1/0/2 [FW_A-zone-trust] quit [FW_A] firewall zone untrust [FW_A-zone-untrust] add interface GigabitEthernet 1/0/0 [FW_A-zone-untrust] quit #——(3)—— [FW_A] security-policy [FW_A-policy-security] rule name 1 [FW_A-policy-security-rule-1] source-zone trust [FW_A-policy-security-rule-1] destination-zone untrust [FW_A-policy-security-rule-1] source-address 10.10.1.0 24 [FW_A-policy-security-rule-1] destination-address 10.1.2.0 24 [FW_A-policy-security-rule-1] action permit [FW_A-policy-security-rule-1] quit [FW_A-policy-security] rule name 2 [FW_A-policy-security-rule-2] source-zone untrust [FW_A-policy-security-rule-2] destination-zone trust [FW_A-policy-security-rule-2] source-address 10.1.2.0 24 [FW_A-policy-security-rule-2] destination-address 10.10.1.0 24 [FW_A-policy-security-rule-2] action permit [FW_A-policy-security-rule-2] quit #——(4)—— [FW_A-policy-security] rule name 3 [FW_A-policy-security-rule-3] source-zone local [FW_A-policy-security-rule-3] destination-zone untrust [FW_A-policy-security-rule-3] source-address 1.1.1.1 32 [FW_A-policy-security-rule-3] destination-address 3.3.3.3 32 [FW_A-policy-security-rule-3] action permit [FW_A-policy-security-rule-3] quit [FW_A-policy-security] rule name 4 [FW_A-policy-security-rule-4] source-zone untrust [FW_A-policy-security-rule-4] destination-zone local [FW_A-policy-security-rule-4] source-address 3.3.3.3 32 [FW_A-policy-security-rule-4] destination-address 1.1.1.1 32 [FW_A-policy-security-rule-4] action permit [FW_A-policy-security-rule-4] quit #——(5)—— [FW_A] acl 3000 [FW_A-acl-adv-3000] rule permit ip source 10.10.1.0 0.0.0.255 destination 10.1.2.0 0.0.0.255 [FW_A-acl-adv-3000] rule permit icmp source 1.1.1.1 0 destination 3.3.3.3 0 [FW_A-acl-adv-3000] quit #——(6)—— [FW_A] ipsec proposal tran1 [FW_A-ipsec-proposal-tran1] encapsulation-mode tunnel [FW_A-ipsec-proposal-tran1] transform esp [FW_A-ipsec-proposal-tran1] esp authentication-algorithm sha2-256 [FW_A-ipsec-proposal-tran1] esp encryption-algorithm aes-256 [FW_A-ipsec-proposal-tran1] quit #——(7)—— [FW_A] ike proposal 10 [FW_A-ike-proposal-10] authentication-method pre-share [FW_A-ike-proposal-10] authentication-algorithm sha2-256 [FW_A-ike-proposal-10] integrity-algorithm aes-xcbc-96 hmac-sha2-256 [FW_A-ike-proposal-10] quit #——(8)—— [FW_A] ike peer b [FW_A-ike-peer-b] ike-proposal 10 [FW_A-ike-peer-b] pre-shared-key test12345 [FW_A-ike-peer-b] undo version 2 [FW_A-ike-peer-b] quit #——(9)—— [FW_A] ipsec policy template map_temp 1 [FW_A-ipsec-policy-template-map-temp-1] security acl 3000 [FW_A-ipsec-policy-template-map-temp-1] proposal tran1 [FW_A-ipsec-policy-template-map-temp-1] ike-peer b [FW_A-ipsec-policy-template-map-temp-1] quit #——(10)—— [FW_A] ipsec policy map1 10 isakmp template map_temp [FW_A] interface GigabitEthernet 1/0/0 [FW_A-GigabitEthernet1/0/0] ipsec policy map1 [FW_A-GigabitEthernet1/0/0] quit