一、实验拓扑：
二、实验要求：
ASA中只能定义个主机或者一个范围，SRG可以同时定义主机、范围；
从虚拟防火墙的到物理防火墙也是Inbound，华为里管理类型防火墙就是思科的管理子防火墙；
三、命令部署：
1、R1、R2、R3地址省略，部署默认路由到USG：
[R1]ip route-static 0.0.0.0 0.0.0.0 202.100.1.10
[R2]ip route-static 0.0.0.0 0.0.0.0 192.168.1.10
[R3]ip route-static 0.0.0.0 0.0.0.0 10.1.1.10
2、USG部署：
[SRG]ip service-set aaa type object
[SRG-object-service-set-aaa]service protocol icmp
[SRG]policy interzone trust untrust outbound
[SRG-policy-interzone-trust-untrust-outbound]policy 0
[SRG-policy-interzone-trust-untrust-outbound-0]policy source 192.168.1.0 mask 24
[SRG-policy-interzone-trust-untrust-outbound-0]policy destination 202.100.1.0 mask 24
[SRG-policy-interzone-trust-untrust-outbound-0]policy service service-set aaa
[SRG-policy-interzone-trust-untrust-outbound-0]action permit
[SRG]display current-configuration configuration object-service-set
ip service-set aaa type object
service 0 protocol icmp
[SRG]display current-configuration configuration policy-interzone
policy interzone trust untrust outbound
policy 0
action permit
policy service service-set aaa
policy source 192.168.1.0 mask 24
policy destination 202.100.1.0 mask 24
测试：
[R2]ping 202.100.1.1
Reply from 202.100.1.1: bytes=56 Sequence=1 ttl=254 time=50 ms
Reply from 202.100.1.1: bytes=56 Sequence=2 ttl=254 time=50 ms
Reply from 202.100.1.1: bytes=56 Sequence=3 ttl=254 time=40 ms
Reply from 202.100.1.1: bytes=56 Sequence=4 ttl=254 time=30 ms
Reply from 202.100.1.1: bytes=56 Sequence=5 ttl=254 time=30 ms
[R1]ping 192.168.1.1
Request time out
Request time out
Request time out
Request time out
Request time out
转载于:https://blog.51cto.com/13856092/2138630