HCIP-Security1.1多出口选路4（DNS透明代理）

一，网络拓扑

二，规划说明

2.1IP地址规划

设备　 接口 安全区域 IP地址
FW1 GE0/0/0 Local 192.168.0.10/24
GE1/0/0 Local 202.100.2.10/24
GE1/0/1 Local 202.100.1.10/24
GE1/0/2 Local 10.1.1.10/24
GE1/0/3 Local 10.1.2.10/24
GE1/0/4 Local 10.1.3.10/24
GE1/0/5 Local 192.168.34.10/24
ISP1 GE0/0/0 untrust 11.1.1.20/24
GE0/0/1 untrust 202.100.1.20/24
Loopback0 untrust 1.1.1.1/32
Loopback1 untrust 2.2.2.2/32
GE0/0/2 untrust　 223.5.5.20/24
ISP2 GE0/0/0 untrust 12.1.1.20/24
GE0/0/1 untrust 202.100.2.20/24
Loopback0 untrust 3.3.3.3/32
Loopback1 untrust 4.4.4/32
GE0/0/2 untrust 223.6.6.20/24
Internet GE0/0/0　 untrust 11.1.1.30/24　
GE0/0/1 untrust 12.1.1.30/24
GE0/0/2 untrust　 120.1.1.30/24
http_server Ethernet0/0/0 untrust 120.1.1.2/24
ISP1_DNS1 Ethernet0/0/0 untrust 223.5.5.5/24
ISP1_DNS2 Ethernet0/0/0　 untrust 223.5.5.6/24
ISP2_DNS1 Ethernet0/0/0 untrust 223.6.6.6/24
ISP2_DNS2 Ethernet0/0/0　 untrust 223.6.6.7/24
DMZ_Server Ethernet0/0/0 dmz 192.168.34.1/24
kali_linux Ethernet0/0/0 trust 10.1.1.128/24
RHEL Ethernet0/0/0 trust 10.1.2.2/24
PC2 Ethernet0/0/0 trust 10.1.3.1/24
MGMT_PC Ethernet0/0/0 trust 192.168.0.1/24

 2.2实验需求

 　当内网用户访问某个域名，DNS透明代理的功能将原本DNS服务器地址转换为防火墙设置的DNS地址。不同的接口会分发到不同的ISP的链路和DNS。

三，配置部分

3.1防火墙以外的配置

3.1.1 ISP1路由器

<Huawei>system-view 
[Huawei]sysname ISP1
[ISP1]user-interface  con 0
[ISP1-ui-console0]idle-timeout 0 0
[ISP1]interface GigabitEthernet 0/0/0
[ISP1-GigabitEthernet0/0/0]ip address 11.1.1.20 24
[ISP1-GigabitEthernet0/0/0]interface GigabitEthernet 0/0/1
[ISP1-GigabitEthernet0/0/1]ip address 202.100.1.20 24
[ISP1-GigabitEthernet0/0/1]interface Loopback 0
[ISP1-LoopBack0]ip address 1.1.1.1 32
[ISP1-LoopBack0]interface Loopback 1
[ISP1-LoopBack1]ip address 2.2.2.2 32
[ISP1-LoopBack1]ip route-static 0.0.0.0 0 11.1.1.30
[ISP1-LoopBack1]interface GigabitEthernet0/0/2
[ISP1-GigabitEthernet0/0/2]ip address 223.5.5.20 24

3.1.2ISP2路由器

<Huawei>system-view 
[Huawei]sysname ISP2
[ISP2]user-interface  con 0
[ISP2-ui-console0]idle-timeout 0 0
[ISP2-ui-console0]interface GigabitEthernet 0/0/0
[ISP2-GigabitEthernet0/0/0]ip address 12.1.1.20 24
[ISP2-GigabitEthernet0/0/0]interface GigabitEthernet 0/0/1
[ISP2-GigabitEthernet0/0/1]ip address 202.100.2.20 24
[ISP2-GigabitEthernet0/0/1]interface Loopback 0
[ISP2-LoopBack0]ip address 3.3.3.3 32
[ISP2-LoopBack0]interface Loopback 1
[ISP2-LoopBack1]ip address 4.4.4.4 32
[ISP2-LoopBack1]ip route-static 0.0.0.0 0 12.1.1.30
[ISP2-LoopBack1]interface GigabitEthernet0/0/2
[ISP2-GigabitEthernet0/0/2]ip address 223.6.6.20 24

3.1.3Internet路由器

<Huawei>system-view 
[Huawei]sysname Internet
[Internet]user-interface  con 0
[Internet-ui-console0]idle-timeout 0 0
[Internet-ui-console0]interface GigabitEthernet 0/0/0
[Internet-GigabitEthernet0/0/0]ip address 11.1.1.30 24
[Internet-GigabitEthernet0/0/0]interface GigabitEthernet 0/0/1
[Internet-GigabitEthernet0/0/1]ip address 12.1.1.30 24
[Internet-GigabitEthernet0/0/1]interface GigabitEthernet 0/0/2
[Internet-GigabitEthernet0/0/2]ip address 120.1.1.30 24
[Internet-GigabitEthernet0/0/2]ip address 120.1.1.30 24
[Internet-GigabitEthernet0/0/2]ip route-static 202.100.1.0 24 11.1.1.20
[Internet]ip route-static 1.1.1.1 32 11.1.1.20
[Internet]ip route-static 2.2.2.2 32 11.1.1.20
[Internet]ip route-static 202.100.2.0 24 12.1.1.20
[Internet]ip route-static 3.3.3.3 32 12.1.1.20
[Internet]ip route-static 4.4.4.4 32 12.1.1.20
[Internet]ip route-static 223.5.5.0 11.1.1.20
[Internet]ip route-static 223.6.6.0 12.1.1.20

3.1.4 Http Server

　　Http Server是使用ENSP桥接的一台vmware workstation的一台虚机，简单的配置了http。

 3.1.5MGMT_PC

　　MGPT_PC是ENSP桥接到我本地的物理机，可以通过浏览器进行图形化管理FW1。

 3.1.6 内网测试主机

①kali_linux

②RHEL

3.1.7DNS服务器

 

 

 3.2 防火墙配置

3.2.1接口地址以及安全区域

<USG6000V1>system-view 
[USG6000V1]sysname FW1
[FW1]user-interface  con 0
[FW1-ui-console0]idle-timeout 0 0
[FW1-ui-console0]interface GigabitEthernet 0/0/0
[FW1-GigabitEthernet0/0/0]ip address 192.168.0.10 24
[FW1-GigabitEthernet0/0/0]service-manage http permit
[FW1-GigabitEthernet0/0/0]service-manage https permit
[FW1-GigabitEthernet0/0/0]service-manage ping permit
[FW1-GigabitEthernet0/0/0]interface GigabitEthernet 1/0/0
[FW1-GigabitEthernet1/0/0]ip address  202.100.2.10 24
[FW1-GigabitEthernet1/0/0]service-manage ping permit
[FW1-GigabitEthernet1/0/0]interface GigabitEthernet 1/0/1
[FW1-GigabitEthernet1/0/1]ip address 202.100.1.10 24
[FW1-GigabitEthernet1/0/1]service-manage ping permit
[FW1-GigabitEthernet1/0/1]interface GigabitEthernet  1/0/2
[FW1-GigabitEthernet1/0/2]ip address  10.1.1.10 24
[FW1-GigabitEthernet1/0/2]service-manage ping permit
[FW1-GigabitEthernet1/0/2]interface GigabitEthernet   1/0/3
[FW1-GigabitEthernet1/0/3]ip address 10.1.2.10  24
[FW1-GigabitEthernet1/0/3]service-manage ping permit
[FW1-GigabitEthernet1/0/3]interface GigabitEthernet   1/0/4
[FW1-GigabitEthernet1/0/4]ip address 10.1.3.10 24
[FW1-GigabitEthernet1/0/4]service-manage ping permit
[FW1-GigabitEthernet1/0/4]interface GigabitEthernet   1/0/5
[FW1-GigabitEthernet1/0/5]ip address 192.168.34.10 24
[FW1-GigabitEthernet1/0/5]service-manage ping permit
[FW1-GigabitEthernet1/0/5]firewall zone trust
[FW1-zone-trust]add interface GigabitEthernet 0/0/0
[FW1-zone-trust]add interface GigabitEthernet 1/0/2
[FW1-zone-trust]add interface GigabitEthernet 1/0/3
[FW1-zone-trust]add interface GigabitEthernet 1/0/4
[FW1-zone-trust]firewall zone dmz
[FW1-zone-dmz]add interface GigabitEthernet 1/0/5
[FW1-zone-dmz]firewall zone untrust
[FW1-zone-untrust]add interface GigabitEthernet 1/0/0
[FW1-zone-untrust]add interface GigabitEthernet 1/0/1
[FW1-zone-untrust]add interface GigabitEthernet 1/0/1

3.2.2 多出口联动IP-Link

[FW1]ip-link  check  enable
[FW1]ip-link  name isp1
[FW1-iplink-isp1]destination  202.100.1.20 interface  GigabitEthernet  1/0/1 mode  icmp 
[FW1-iplink-isp1]quit
[FW1]ip-link  name isp2
[FW1-iplink-isp2]destination  202.100.2.20 interface  GigabitEthernet  1/0/0 mode icmp 
[FW1]ip route-static  0.0.0.0 0 GigabitEthernet  1/0/1 202.100.1.20 track  ip-link  isp1
[FW1]ip route-static 0.0.0.0 0 GigabitEthernet  1/0/0 202.100.2.20 track  ip-link  isp2

3.2.3  源NAT

[FW1]nat-policy 
[FW1-policy-nat]rule name easy-ip
[FW1-policy-nat-rule-easy-ip]source-zone trust
[FW1-policy-nat-rule-easy-ip]destination-zone  untrust
[FW1-policy-nat-rule-easy-ip]source-address address-set pc 
[FW1-policy-nat-rule-easy-ip]action   source-nat  easy-ip

3.2.4 DNS透明代理

①使用CLI配置G1/0/1出口的主备DNS透明代理

[FW1]dns-transparent-policy 
[FW1-policy-dns]rule name dns-proxy
[FW1-policy-dns-rule-dns-proxy]source-address 10.1.1.0 24
[FW1-policy-dns-rule-dns-proxy]source-address 10.1.2.0 24
[FW1-policy-dns-rule-dns-proxy]action  tpdns 
[FW1-policy-dns-rule-dns-proxy]quit
[FW1-policy-dns]dns  transparent-proxy  enable
[FW1-policy-dns]dns  server  bind  interface  GigabitEthernet  1/0/1 preferred  223.5.5.5 alternate 223.5.5.6 health-check  enable  tx-interval 3 times  2

②GUI配置G1/0/0出口的主备DNS透明代理

 四，测试效果

1.测试虚机的dns地址是114.114.114.114，也可以正常的进行地址解析

 

2.查看会话表，发现地址进行的目的地址转换，114.114.114.114转换为ISP2的主DNS

 

 

 

 

 

 3.将连接ISP2的接口关闭

[FW1]int g1/0/2
[FW1-GigabitEthernet1/0/2]shutdown

4.DNS立刻切换到ISP1的主设备

 

 

 5.在ISP1将DNS1的链路中断

[SW1]interface GigabitEthernet  0/0/2
[SW1-GigabitEthernet0/0/2]shutdown

6.DNS切换到ISP1的备用地址

posted @ 2022-04-16 10:18  L_F_A_L  阅读(575)  评论(0)    收藏  举报