【正文】 ourceport eq 593 [Facladv3001]rule 14 deny tcp sourceport eq 4444 [Facladv3001]rule 15 deny tcp sourceport eq 5800 [Facladv3001]rule 16 deny tcp sourceport eq 5900 [Facladv3001] rule 18 deny tcp sourceport eq 8998 [Facladv3001]rule 19 deny tcp sourceport eq 445 [Facladv3001]rule 20 deny udp sourceport eq 445 [Facladv3001]rule 21 deny udp sourceport eq 1434 [Facladv3001]rule 30 deny tcp destinationport eq 3127 [Facladv3001]rule 31 deny tcp destinationport eq 1025 [Facladv3001]rule 32 deny tcp destinationport eq 5554 [Facladv3001]rule 33 deny tcp destinationport eq 9996 [Facladv3001]rule 34 deny tcp destinationport eq 1068 [Facladv3001]rule 35 deny tcp destinationport eq 135 [Facladv3001]rule 36 deny udp destinationport eq 135 [Facladv3001]rule 37 deny tcp destinationport eq 137 [Facladv3001]rule 38 deny udp destinationport eq biosns [Facladv3001]rule 39 deny tcp destinationport eq 138 [Facladv3001]rule 40 deny udp destinationport eq biosdgm [Facladv3001] rule 41 deny tcp destinationport eq 139 [Facladv3001]rule 42 deny udp destinationport eq biosssn [Facladv3001]rule 43 deny tcp destinationport eq 593 [Facladv3001]rule 44 deny tcp destinationport eq 4444 [Facladv3001]rule 45 deny tcp destinationport eq 5800 [Facladv3001]rule 46 deny tcp destinationport eq 5900 [Facladv3001]rule 48 deny tcp destinationport eq 8998 [Facladv3001]rule 49 deny tcp destinationport eq 445 [Facladv3001]rule 50 deny udp destinationport eq 445 重慶科技學院《網(wǎng)絡(luò)系統(tǒng)集成》實訓報告 27 [Facladv3001]rule 51 deny udp destinationport eq 1434 [Facladv3001]quit 在內(nèi)網(wǎng)接口處使用防病毒列表 [F]interface Ether 0/0 [FEther0/0]ip add 24 [FEther0/0]firewall packetfilter 3001 inbound [FEther0/0]quit 在外網(wǎng)出口處應(yīng)用防病毒列表 [F]interface Ether 0/1 [FEther0/1]ip add 24 [FEther0/1]firewall packetfilter 3001 inbound 將對外網(wǎng)口的 訪問通過 NAT server 映射到內(nèi)網(wǎng) WEB 服務(wù)器上 [FEther0/1]nat outbound 2021 [FEther0/1]nat server protocol tcp global inside [FEther0/1]quit [F]firewall zone trust [Fzonetrust]add interface Ether 0/0 [Fzonetrust]quit [F]firewall zone untrust [Fzoneuntrust]add interface e0/1 [Fzoneuntrust]quit 防火墻郵件主題過濾、網(wǎng)頁地址過濾實現(xiàn)。 I n t e r n e t防 火 墻P C 1I P : 1 7 2 . 1 9 . 6 8 . 9 9交 換 機交 換 機W e b 服 務(wù) 器I P : 1 9 2 . 1 6 8 . 1 . 9 9P C 2E 0 / 0 I P : 1 9 2 . 1 6 8 . 1 . 4 / 2 4E 0 / 1 I P : 1 7 2 . 1 9 . 6 8 . 4 / 2 4I P : 1 7 2 . 1 9 . 6 8 . 1 1 7 圖 網(wǎng)絡(luò)拓撲圖 （ 1）網(wǎng)頁地址過濾 重慶科技學院《網(wǎng)絡(luò)系統(tǒng)集成》實訓報告 28 [F]int Ether 0/0 [FEther0/0]ip add 24 [F]int Ether0/1 [FEther0/1]ip add 24 [FEther0/1]quit [F]firewall packetfilter enable [F]firewall zone trust [Fzonetrust]add int eth 0/0 [Fzonetrust]quit [F]fire zone dmz [Fzonedmz]add int e0/1 [Fzonedmz]quit [F]firewall packetfilter default permit 配置 aspf，對 進行檢測，創(chuàng)建 DHCP 地址池，定義它的屬性值。 [F]aspf 1 [Faspfpolicy1]detect //對 進行檢測 [Faspfpolicy1]detect udp [Faspfpolicy1]detect tcp [Faspfpolicy1]quit [F]dhcp server ippool test [Fdhcppooltest]work mask [Fdhcppooltest]gatewaylist [Fdhcppooltest]dnslist 創(chuàng)建 NAT 轉(zhuǎn)換 ACL [F]acl number 3000 [Facladv3000]rule 0 permit ip source [Facladv3000]rule 1 deny ip [Facladv3000]quit 在接口下啟用 DHCP，定義 DHCP server 分配的 DNS，在接口方向應(yīng)用 aspf，配置 nat outbound。 [F]int eth0/0 [FEther0/0]dhcp select interface [FEther0/0] dhcp server dnslist [FEther0/0]quit 重慶科技學院《網(wǎng)絡(luò)系統(tǒng)集成》實訓報告 29 [F]int Ether0/1 [FEther0/1]firewall aspf 1 outbound [FEther0/1]nat outbound 3000 [FEther0/1]quit 配置默認路由，添加關(guān)鍵字 [F]ip routestatic 0 [F]firewall urlfilter host add deny Adding host name succeeded. 啟用 urlfilter，并對 IP 地址訪問為允許。 [F] firewall urlfilter host enable [F]firewall urlfilter host ipaddress permit 顯示關(guān)鍵字。 [F]dis firewall urlfilter host itemall Firewall urlfilter host items item(s) added manually : 1 item(s) loaded from file : 0 SN MatchTimes Keywords 1 0 deny [F]quit 指定加載位置和文件。 [F]firewall urlfilter host savefile webfilter... The configuration has been saved successfully. [F]firewall urlfilter host loadfile flash:/webfilter The keyword is found in filter when loading line:1. The keyword is found in filter when loading line:2. Item(s) loaded :0. Fdir Directory of flash:/ 1 rw 6454944 Jan 01 2021 00:03:19 system 2 rw 1093929 Jan 01 2021 00:03:49 重慶科技學院《網(wǎng)絡(luò)系統(tǒng)集成》實訓報告 30 3 rw 4589 Jan 10 2021 11:00:18 4 rw 0 Jan 08 2021 18:02:27 webdata 5 rw 0 Jan 08 2021 18:09:13 mail 6 rw 70 Nov 23 2021 18:14:02 small 7 rw 18 Nov 23 2021 18:29:44 smallhost 8 rw 9 Nov 23 2021 18:21:43 smallsmtp 9 rw 1599 Jan 13 2021 18:46:36 10 rw 43 Jan 13 2021 18:59:58 webfilter 15621 KB total (8218 KB free) Fmore webfilter deny deny （ 2） 網(wǎng)頁地址過濾 實驗效果驗證 DHCP 自動獲取 IP 地址效果圖。 圖 DHCP自動獲取地址 網(wǎng)頁地址過濾之前，我們訪問百度網(wǎng)頁。 重慶科技學院《網(wǎng)絡(luò)系統(tǒng)集成》實訓報告 31 圖 過濾前訪問百度網(wǎng) 網(wǎng)頁地址過濾后，我們訪問百度網(wǎng)頁。 圖 過濾后訪問 百度網(wǎng) （ 3） 郵件主題過濾 [F] firewall packetfilter enable [F]firewall packetfilter default permit [F]firewall smtpfilter subject enable //啟用郵件主題過濾功能 [F]aspfpolicy 1 [Faspfpolicy1]detect smtp [Faspfpolicy1] detect tcp [Faspfpolicy1]detect udp [Faspfpolicy1]dhcp server ippool test [Fdhcppooltest] work mask [Fdhcppooltest]gatewaylist [Fdhcppooltest]dnslist 重慶科技學院《網(wǎng)絡(luò)系統(tǒng)集成》實訓報告 32 [Fdhcppooltest]acl number 3000 [Facladv3000] rule 0 permit ip source [Facladv3000]rule 1 deny ip [F]int Ether0/0 [FEther0/