vlan 2属于办公区，vlan 3 属于生产区

Sw1配置：

[sw1]vlan batch 2 3

[sw1-GigabitEthernet0/0/2]port link-type access

[sw1-GigabitEthernet0/0/2]port default vlan 2

[sw1-GigabitEthernet0/0/3]port link-type access

[sw1-GigabitEthernet0/0/3]port default vlan 3

[sw1-GigabitEthernet0/0/1]port link-type  trunk

[sw1-GigabitEthernet0/0/1]port trunk allow-pass vlan 2 3

Fw配置：

接口配置：

[FW1-GigabitEthernet1/0/1.2]vlan-type dot1q 2

[FW1-GigabitEthernet1/0/1.2]ip address  192.168.1.126 25

[FW1-GigabitEthernet1/0/1.3]vlan-type dot1q 3

[FW1-GigabitEthernet1/0/1.3]ip address 192.168.1.254 25

[FW1-GigabitEthernet1/0/0]ip address 10.0.0.254 24

安全区域配置

[FW1]firewall zone trust

[FW1-zone-trust]add interface GigabitEthernet 1/0/1.2

[FW1-zone-trust]add interface GigabitEthernet 1/0/1.3

[FW1]firewall zone dmz

[FW1-zone-dmz]add int GigabitEthernet 1/0/0

地址对象配置

[FW1]ip address-set PC1 type object

[FW1-object-address-set-PC1]address 192.168.1.1 mask 32

[FW1]ip address-set PC2 type object

[FW1-object-address-set-PC2]address 192.168.1.129 mask 32

[FW1]ip address-set PC3 type object

[FW1-object-address-set-PC3]address 192.168.1.130 mask 32

[FW1]ip  address-set OA_Server type object

[FW1-object-address-set-OA_Server]address 10.0.0.1 mask 32

[FW1]ip address-set Web-Server type object

[FW1-object-address-set-Web-Server]address 10.0.0.2 mask 32

[FW1]ip address-set  Production_area type group

[FW1-group-address-set-Production_area]add address-set  PC2

[FW1-group-address-set-Production_area]add address-set  PC3

时间段配置

[FW1]time-range worktime

[FW1-time-range-worktime]period-range 08:00:00 to 18:00:00 working-day

[FW1]time-range monday_update

[FW1-time-range-monday_update]period-range 10:00:00 to 11:00:00 Mon

安全策略配置

[FW1]security-policy

[FW1-policy-security]rule name policy_01

[FW1-policy-security-rule-policy_01]source-zone trust

[FW1-policy-security-rule-policy_01]destination-zone dmz

[FW1-policy-security-rule-policy_01]source-address address-set PC3

[FW1-policy-security-rule-policy_01]destination-address address-set Web_Server

[FW1-policy-security-rule-policy_01]time-range monday_update

[FW1-policy-security-rule-policy_01]action permit

[FW1-policy-security]rule name policy_02

[FW1-policy-security-rule-policy_02]source-zone trust

[FW1-policy-security-rule-policy_02]destination-zone dmz

[FW1-policy-security-rule-policy_02]source-address address-set PC1

[FW1-policy-security-rule-policy_02]destination-address address-set OA_Server

[FW1-policy-security-rule-policy_02]time-range worktime

[FW1-policy-security-rule-policy_02]action permit

[FW1-policy-security]rule name policy_03

[FW1-policy-security-rule-policy_03]source-zone trust

[FW1-policy-security-rule-policy_03]destination-zone dmz

[FW1-policy-security-rule-policy_03]source-address address-set PC1

[FW1-policy-security-rule-policy_03]destination-address address-set Web_Server

[FW1-policy-security-rule-policy_03]action permit

[FW1-policy-security]rule name policy_04

[FW1-policy-security-rule-policy_04]source-zone trust

[FW1-policy-security-rule-policy_04]destination-zone dmz

[FW1-policy-security-rule-policy_04]source-address address-set PC2

[FW1-policy-security-rule-policy_04]source-address address-set PC3

[FW1-policy-security-rule-policy_04]destination-address address-set OA_Server

[FW1-policy-security-rule-policy_04]action permit