目前配置下,所有区域之间可以通讯,不被检查。但是由于当前尚未定义NAT,外部区域不能与内部和DMZ区域相互访问。
步骤四.配置区域间的安全过滤 配置从Trust区域的部分网段10.0.2.3发往Untrust区域的数据包被放行。从Untrust区域发往DMZ目标服务器10.0.3.3的telnet请求被放行。 [FW]firewall session link-state check[FW]policy interzone trust untrust outbound[FW-policy-interzone-trust-untrust-outbound]policy014:06:57 2014/07/08[FW-policy-interzone-trust-untrust-outbound-0]policysource 10.0.2.0 0.0.0.25514:07:18 2014/07/08[FW-policy-interzone-trust-untrust-outbound-0]actionpermit14:07:31 2014/07/08[FW-policy-interzone-trust-untrust-outbound-0]q14:07:40 2014/07/08[FW-policy-interzone-trust-untrust-outbound]q14:07:40 2014/07/08]policy interzone dmz untrust inbound14:09:01 2014/07/08[FW-policy-interzone-dmz-untrust-inbound]policy014:09:08 2014/07/08[FW-policy-interzone-dmz-untrust-inbound-0]policydestination 10.0.3.3 014:09:37 2014/07/08[FW-policy-interzone-dmz-untrust-inbound-0]policyservice service-set telnet[FW-policy-interzone-dmz-untrust-inbound-0]actionpermit14:09:55 2014/07/08[FW-policy-interzone-dmz-untrust-inbound-0]q14:09:55 2014/07/08
步骤五.