Topology Overview

The lab consists of three security zones—Office, Production, and Guest—plus a DMZ that hosts an HTTP server. Two ISPs provide Internet acccess: China-Telecom (12.0.0.0/24) and China-Mobile (21.0.0.0/24). A branch office connects through a separate firewall that must reach the DMZ server through either ISP link.

High-Level Requirements

1. DMZ Access Rules
   • Office PCs may reach DMZ only during business hours (09:00–18:00).
   • Production hosts have 24×7 access.
2. Internet Reachability
   • Production is completely isolated from the Internet.
   • Office and Guest can browse the web.
3. Micro-segmentation
   • Office host 10.0.2.10 is forbidden from FTP/HTTP on 10.0.3.10 but may ping it.
4. User Authentication Matrix | Zone | Department | Auth Method | IP Binding | |---|---|---|---| | Office | Marketing | Anonymous | Fixed | | Office | R&D | None (IP-bound) | Yes | | Guest | — | Guest/Admin@123 | No |
5. Production Portal
   • Three departments, three users each, password openlab123, 10-day expiry, no concurrent logins.
6. Custom Admin
   • Create a junior admin role without system-level privileges.
7. Outbound NAT
   • Office uses both ISPs in a 1:1 pool, excluding one public IP.
8. Branch Office Hairpin
   • Branch clients reach DMZ-HTTP through either ISP link.
9. Smart Routing
   • Bandwidth-ratio load-balancing, except 10.0.2.10 must always exit via Telecom.
   • Overload protection kicks in at 80 % link utilization.
10. DNS Hairpinning
    • Branch LAN resolves an internal server via FQDN; external users also resolve the same name to the branch server.
11. Guest Policy
    • Guest zone can only leave through the Mobile ISP.

ISP Stub Configuration

system-view
sysname ISP
interface GigabitEthernet0/0/0
 ip address 12.0.0.1 255.255.255.0
#
interface GigabitEthernet0/0/1
 ip address 21.0.0.1 255.255.255.0
#
interface GigabitEthernet0/0/2
 ip address 23.0.0.1 255.255.255.0
#
interface GigabitEthernet3/0/0
 ip address 100.0.0.1 255.255.255.0
#
interface LoopBack0
 ip address 1.1.1.1 255.255.255.0

Outbound NAT for Office Zone

1. Create Adress Pools

ip pool TELECOM-NAT
 section 0 12.0.0.2 12.0.0.253
 exclude 12.0.0.254
#
ip pool MOBILE-NAT
 section 0 21.0.0.2 21.0.0.253
 exclude 21.0.0.254

2. NAT Policy (Telecom)

nat-policy
 rule name OFFICE-TO-TELECOM
  source-zone office
  destination-zone untrust
  egress-interface GigabitEthernet0/0/0
  source-address 10-range 10.0.2.0 24
  action source-nat address-pool TELECOM-NAT

3. Security Policy (Telecom)

security-policy
 rule name OFFICE-INTERNET-TELECOM
  source-zone office
  destination-zone untrust
  source-address 10.0.2.0 24
  service http https dns icmp
  action permit

4. Repeat for Mobile Link

nat-policy
 rule name OFFICE-TO-MOBILE
  source-zone office
  destination-zone untrust
  egress-interface GigabitEthernet0/0/1
  source-address 10.0.2.0 24
  action source-nat address-pool MOBILE-NAT

Branch Office Access to DMZ-HTTP

Branch Firewall

interface GigabitEthernet0/0/0
 ip address 172.168.100.5 255.255.255.0
 service-manage all permit

NAT on Branch

nat-policy
 rule name BRANCH-TO-DMZ
  source-zone trust
  destination-zone untrust
  destination-address 10.0.3.10 32
  service http
  action source-nat easy-ip

Head-Quarters Firewall

security-policy
 rule name BRANCH-DMZ-HTTP
  source-zone untrust
  destination-zone dmz
  destination-address 10.0.3.10 32
  service http
  action permit

Policy-Based Routing for 10.0.2.10

policy-based-route
 rule name FORCE-TELECOM
  source-address 10.0.2.10 32
  next-hop 12.0.0.1

Smart Routing with Overload Protection

load-balance-profile ISP-BALANCE
 mode proportion
 link-group TELECOM
  interface GigabitEthernet0/0/0
  threshold outbound 80
 link-group MOBILE
  interface GigabitEthernet0/0/1
  threshold outbound 80

DNS Hairpinning (Branch)

1. Internal View

dns transparent-proxy
 zone branch.local
  record server.branch.local 192.168.1.100

2. External View (NAT Loopback)

nat-policy
 rule name EXTERNAL-DNS-LOOP
  source-zone untrust
  destination-address 21.0.0.254 32
  service dns
  action destination-nat static 192.168.1.100

Guest-Zone NAT via Mobile Only

nat-policy
 rule name GUEST-OUT-MOBILE
  source-zone guest
  destination-zone untrust
  egress-interface GigabitEthernet0/0/1
  action source-nat easy-ip

Security Policy for Guest

security-policy
 rule name GUEST-INTERNET
  source-zone guest
  destination-zone untrust
  service http https dns
  action permit