拓扑图需求1、Client1属于财务部Client2属于研发部2、企业内网存在一个web-server服务器3、FW上通过ISP路由将电信和联通的路由网段进行导入并补充缺省路由公网路由器运行OSPF协议实现公网环境网络可达4、公网用户1通过电信DNS解析web-server服务器地址要求通过FW的GE1/0/1接口进入访问公网用户2通过联通DNS解析web-server服务器地址要求通过FW的GE1/0/2接口进入访问5、财务部访问FTP服务器时通过电信网络通行研发部访问FTP服务器时通过联通网络通行使用策略路由选路机制并开启IP-LINK检测策略路由需要基于源IP和用户的认证方式6、财务部采用免认证方式研发部采用匿名认证方式添加用户组和地址组信息7、外网访问内网采用NAT Server技术进行映射内网访问外网采用esay-ip方式进行数据访问通信8、安全策略要求编写精准策略配置设备LSW1vlan batch 10 20 30 interface GigabitEthernet 0/0/1 port link-type trunk port trunk allow-pass vlan 10 20 30 interface GigabitEthernet 0/0/2 port default vlan 10 interface GigabitEthernet 0/0/3 port default vlan 20 interface GigabitEthernet 0/0/4 port default vlan 30FWinterface GigabitEthernet 1/0/0.1 vlan-type dotlq 10 ip address 192.168.1.254 24 interface GigabitEthernet 1/0/0.2 vlan-type dotlq 20 ip address 192.168.2.254 24 interface GigabitEthernet 1/0/0.3 vlan-type dotlq 30 ip address 192.168.3.254 24 interface GigabitEthernet 1/0/1 ip address 14.0.0.1 24 interface GigabitEthernet 1/0/2 ip address 12.0.0.1 24 firewall zone trust add interface GigabitEthernet 1/0/0.1 add interface GigabitEthernet 1/0/0.2 add interface GigabitEthernet 1/0/0.3 firewall zone untrust add interface GigabitEthernet 1/0/1 add interface GigabitEthernet 1/0/2 ip route-static 0.0.0.0 0.0.0.0 14.0.0.10 ip route-static 0.0.0.0 0.0.0.0 12.0.0.10nat server global 14.0.0.1 www inside 192.168.3.1 www nat server protocol tcp global 12.0.0.1 www inside 192.168.3.1 www no-reverseR2interface GigabitEthernet0/0/0 ip address 12.0.0.10 24 interface GigabitEthernet0/0/1 ip address 23.0.0.10 24 interface GigabitEthernet0/0/2 ip address 200.1.1.254 24 interface GigabitEthernet0/0/3 ip address 102.1.1.254 24 ospf 1 router-id 2.2.2.2 area 0.0.0.0 network 12.0.0.0 0.0.0.255 network 23.0.0.0 0.0.0.255 network 200.1.1.0 0.0.0.255 network 102.1.1.0 0.0.0.255R3interface GigabitEthernet0/0/0 ip address 34.0.0.11 24 interface GigabitEthernet0/0/1 ip address 23.0.0.11 24 interface GigabitEthernet0/0/2 ip address 50.0.0.254 24 ospf 1 router-id 3.3.3.3 area 0.0.0.0 network 34.0.0.0 0.0.0.255 network 23.0.0.0 0.0.0.255 network 50.0.0.0 0.0.0.255R4interface GigabitEthernet0/0/0 ip address 14.0.0.10 24 interface GigabitEthernet0/0/1 ip address 34.0.0.10 24 interface GigabitEthernet0/0/2 ip address 100.1.1.254 24 interface GigabitEthernet0/0/3 ip address 101.1.1.254 24 ospf 1 router-id 4.4.4.4 area 0.0.0.0 network 14.0.0.0 0.0.0.255 network 34.0.0.0 0.0.0.255 network 100.1.1.0 0.0.0.255 network 101.1.1.0 0.0.0.255测试: