LAB2.Virtual Wire

冷不防 2022-01-16 14:27 275阅读 0赞

## 1.VirtualWire简介 ##

Virtual Wire模式可以在不改变原有网络拓扑结构的情况下，实现安全。需要两个接口为一组进行绑定。可以实现所有的安全防护功能，支持NAT。同时可以实现安全区域间VLAN Tag的控制。

*  该模式下支持的功能：App-ID、decryption、NAT、Content-ID、User-ID
 *  配置步骤：
    
     *  创建Virtual Wire object
     *  配置Virtual Wire中的接口

## 2.实验目的 ##

*  理解Virtual Wire的原理
 *  掌握Virtual Wire的配置
 *  灵活运用该模式

## 3.实验拓扑信息 ##

![LAB2.Virtual Wire][]

<table> 
 <thead> 
  <tr> 
   <th>序号</th> 
   <th>设备名称</th> 
   <th>接口</th> 
   <th>接口信息</th> 
   <th>备注</th> 
  </tr> 
 </thead> 
 <tbody> 
  <tr> 
   <td>1</td> 
   <td>R1</td> 
   <td>E0/0</td> 
   <td>10.0.0.1/24</td> 
   <td></td> 
  </tr> 
  <tr> 
   <td>2</td> 
   <td>SW1</td> 
   <td>E0/1</td> 
   <td>VLAN2</td> 
   <td></td> 
  </tr> 
  <tr> 
   <td></td> 
   <td></td> 
   <td>E0/2</td> 
   <td>Trunk</td> 
   <td></td> 
  </tr> 
  <tr> 
   <td>3</td> 
   <td>SW2</td> 
   <td>E0/1</td> 
   <td>VLAN2</td> 
   <td></td> 
  </tr> 
  <tr> 
   <td></td> 
   <td></td> 
   <td>E0/2</td> 
   <td>Trunk</td> 
   <td></td> 
  </tr> 
  <tr> 
   <td>4</td> 
   <td>PA</td> 
   <td>E1/1</td> 
   <td>Virtual Wire</td> 
   <td>区域：Untrust</td> 
  </tr> 
  <tr> 
   <td></td> 
   <td></td> 
   <td>E1/2</td> 
   <td>Virtual Wire</td> 
   <td>区域：Trust</td> 
  </tr> 
  <tr> 
   <td>5</td> 
   <td>R2</td> 
   <td>E0/1</td> 
   <td>10.0.0.2/24</td> 
   <td>开启telnet</td> 
  </tr> 
 </tbody> 
</table>

## 4.实验步骤 ##

### 4.1 网络设备初始化配置 ###

*  R1&R2配置接口IP，R2开启Telnet

R1：
    ------------
    en
    conf t
    interface e0/0
    ip address 10.0.0.1 255.255.255.0
    no shutdown
    
    R2：
    ------------
    en
    conf t
    hostname R1
    interface e0/0
    ip address 10.0.0.2 255.255.255.0
    no shutdown
    exit
    line vty 0 4
    password cisco

*  SW1&SW2创建VLAN2，并配置接口E0/1和E0/2

SW1：
    ------------
    en
    conf t
    hostname SW1
    
    vlan 2
    exit
    interface e0/1
    switch mode access
    no shutdown
    exit
    interface Ethernet0/2
     switchport trunk encapsulation dot1q
     switchport mode trunk
     exit
    ================================================
    SW2：
    ------------
    en
    conf t
    hostname SW2
    
    vlan 2
    exit
    interface e0/1
    switch mode access
    no shutdown
    exit
    interface Ethernet0/2
     switchport trunk encapsulation dot1q
     switchport mode trunk
     exit

### 4.2 PaloAlto配置VirtualWire ###

*  创建Virtual Wire组  
    ![LAB2.Virtual Wire][LAB2.Virtual Wire 1]  
    ![LAB2.Virtual Wire][LAB2.Virtual Wire 2]

*  创建Zone Trust和Untrust  
    ![LAB2.Virtual Wire][LAB2.Virtual Wire 3]  
    ![LAB2.Virtual Wire][LAB2.Virtual Wire 4]  
    ![LAB2.Virtual Wire][LAB2.Virtual Wire 5]
 *  将E1/1和E1/2划入规划好的Zone和Virtual Wire组，并设置模式为Virtual Wire  
    【Network】--【Interfaces】

![LAB2.Virtual Wire][LAB2.Virtual Wire 6]

### 4.3 配置策略，放行Untrust到Trunst ###

【Policy】-【Security】  
![LAB2.Virtual Wire][LAB2.Virtual Wire 7]

说明：配置完成后，记得Commit

## 5.测试及结论 ##

*  从R1 Telnet R2测试

转载于:https://blog.51cto.com/robingo/2130180

[LAB2.Virtual Wire]: https://s1.51cto.com/images/blog/201806/17/549db53e50a9f76418c03929b5565dd5.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[LAB2.Virtual Wire 1]: https://s1.51cto.com/images/blog/201806/17/cba6587b3a1ea6e803f413b6bfc368e6.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[LAB2.Virtual Wire 2]: https://s1.51cto.com/images/blog/201806/17/018080acdc525dba31aebce3a0ee5fb9.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[LAB2.Virtual Wire 3]: https://s1.51cto.com/images/blog/201806/17/302a0197250932709eb91ebdc2245fde.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[LAB2.Virtual Wire 4]: https://s1.51cto.com/images/blog/201806/17/12da8c26d5a77aa446030d7bebfc2c19.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[LAB2.Virtual Wire 5]: https://s1.51cto.com/images/blog/201806/17/d6e3aa9eed39a8da70ba00f6fcc0014f.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[LAB2.Virtual Wire 6]: https://s1.51cto.com/images/blog/201806/17/8aac08c6407f17950bd7d2f2cb2e933a.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=
[LAB2.Virtual Wire 7]: https://s1.51cto.com/images/blog/201806/17/1dafb2544fc9a9e77e08ad4ba776c97e.png?x-oss-process=image/watermark,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_100,g_se,x_10,y_10,shadow_90,type_ZmFuZ3poZW5naGVpdGk=