防火墙安全策略例外情况演示（）

#验证1：查看OSFP邻居协商过程，通过修改防火墙策略验证例外情况。
#在FW6和R2上配置ospf同时在接口上抓包。
[FW6]inter GigabitEthernet 1/0/0
[FW6-GigabitEthernet1/0/0]ip add 192.168.1.6 24
[FW6]ospf	
[FW6]ospf 1
[FW6-ospf-1]area 0
[FW6-ospf-1-area-0.0.0.0]network 192.168.1.6 0.0.0.0

[R2]inter GigabitEthernet 0/0/0
[R2-GigabitEthernet0/0/0]ip add 192.168.1.2 24
[R2]ospf 
[R2-ospf-1]
[R2-ospf-1]are 0
[R2-ospf-1-area-0.0.0.0]network 192.168.1.2 0.0.0.0

#查看邻居状态,一直在Exstart中。
[FW6]dis ospf peer brief 
	 OSPF Process 1 with Router ID 192.168.1.6
		  Peer Statistic Information
 ----------------------------------------------------------------------------
 Area Id          Interface                        Neighbor id      State    
 0.0.0.0          GigabitEthernet1/0/0             192.168.1.2      ExStart     
 ----------------------------------------------------------------------------
 Total Peer(s):     1

# 配置如下使OSPF的单播报文不受安全策略和缺省安全策略控制。

[FW6]undo firewall packet-filter basic-protocol enable
[FW6]undo firewall packet-filter basic-protocol enable

#在FW6上配置安全策略：
#
firewall zone trust
 set priority 85
 add interface GigabitEthernet0/0/0   //默认存在
 add interface GigabitEthernet1/0/0   //需要配置
#
#
security-policy
 rule name ospf
  source-zone local
  destination-zone trust
  source-address 192.168.1.6 mask 255.255.255.255
  destination-address 192.168.1.2 mask 255.255.255.255
  service ospf
  action permit
#
[FW6-zone-trust]
Sep  5 2022 07:05:36 FW6 DS/4/DATASYNC_CFGCHANGE:OID 1.3.6.1.4.1.2011.5.25.191.3
.1 configurations have been changed. The current change number is 14, the change
 loop count is 0, and the maximum number of records is 4095.
Sep  5 2022 07:05:36 FW6 %%01OSPF/4/NBR_CHANGE_E(l)[8]:Neighbor changes event: n
eighbor status changed. (ProcessId=1, NeighborAddress=192.168.1.2, NeighborEvent
=NegotiationDone, NeighborPreviousState=ExStart, NeighborCurrentState=Exchange)
Sep  5 2022 07:05:36 FW6 %%01OSPF/4/NBR_CHANGE_E(l)[9]:Neighbor changes event: n
eighbor status changed. (ProcessId=1, NeighborAddress=192.168.1.2, NeighborEvent
=ExchangeDone, NeighborPreviousState=Exchange, NeighborCurrentState=Loading)
Sep  5 2022 07:05:36 FW6 %%01OSPF/4/NBR_CHANGE_E(l)[10]:Neighbor changes event: 
neighbor status changed. (ProcessId=1, NeighborAddress=192.168.1.2, NeighborEven
t=LoadingDone, NeighborPreviousState=Loading, NeighborCurrentState=Full)

#此时OSPF邻居full，已经正常建立。
[FW6-zone-trust]dis ospf peer brief 
2022-09-05 07:07:51.980 

	 OSPF Process 1 with Router ID 192.168.1.6
		  Peer Statistic Information
 ----------------------------------------------------------------------------
 Area Id          Interface                        Neighbor id      State    
 0.0.0.0          GigabitEthernet1/0/0             192.168.1.2      Full        
 ----------------------------------------------------------------------------

#FW6和R2上配置简单的bgp邻居。
[FW6]bgp 100
[FW6-bgp]peer 192.168.1.2 as-number 100

[R2]bgp 100
[R2-bgp]peer 192.168.1.6 as-number 100

#邻居状态直接Established。
[FW6-bgp]dis bgp peer
 BGP local router ID : 192.168.1.6
 Local AS number : 100
 Total number of peers : 1		  Peers in established state : 1

  Peer            V          AS  MsgRcvd  MsgSent  OutQ  Up/Down       State Pre
fRcv

  192.168.1.2     4         100        2        3     0 00:00:47 Established   

#配置默认协议包过滤策略命令。
[FW6-bgp]firewall packet-filter basic-protocol enable

[FW6]quit
<FW6>
<FW6>reset bgp all //重启BGP进程，观察协商情况。
<FW6>
Sep  5 2022 07:22:13 FW6 %%01BGP/3/STATE_CHG_UPDOWN(l)[12]:The status of the pee
r 192.168.1.2 changed from ESTABLISHED to IDLE. (InstanceName=Public, StateChang
eReason=CEASE/Administrative Reset) 

#此时R2收到系统消息，Notification Message Received。
[R2-bgp]
Sep  5 2022 15:22:16-08:00 R2 %%01BGP/3/STATE_CHG_UPDOWN(l)[1]:The status of the
 peer 192.168.1.6 changed from ESTABLISHED to IDLE. (InstanceName=Public, StateC
hangeReason=Notification Message Received) 

#再次尝试配置undo命令，观察下现象，BGP邻居迅速建立：
[FW6-bgp]undo firewall packet-filter basic-protocol enable

[FW6]undo firewall packet-filter basic-protocol enable
[FW6]dis bgp peer
 BGP local router ID : 192.168.1.6
 Local AS number : 100
 Total number of peers : 1		  Peers in established state : 1

  Peer            V          AS  MsgRcvd  MsgSent  OutQ  Up/Down       State Pre
fRcv
  192.168.1.2     4         100        2        2     0 00:00:16 Established     0