1. 组网需求
    · 某公司内的各部门之间通过Device实现互连，该公司的工作时间为每周工作日的8点到18点。

· 通过配置安全策略规则，允许总裁办在任意时间、财务部在工作时间通过HTTP协议访问财务数据库服务器的Web服务，禁止其它部门在任何时间、财务部在非工作时间通过HTTP协议访问该服务器的Web服务。

  1. 组网图
    图1-6 基于IP地址的安全策略配置组网图

华三防火墙gre放行策略 华三防火墙策略配置_网络

  1. 配置步骤
    (1) 配置接口IP地址

根据组网图中规划的信息，配置各接口的IP地址，具体配置步骤如下。

system-view
[Device] interface gigabitethernet 1/0/1
[Device-GigabitEthernet1/0/1] ip address 192.168.0.1 255.255.255.0
[Device-GigabitEthernet1/0/1] quit

请参考以上步骤配置其他接口的IP地址，具体配置步骤略。

(2) 配置接口加入安全域

请根据组网图中规划的信息，创建安全域，并将接口加入对应的安全域，具体配置步骤如下。

[Device] security-zone name database
[Device-security-zone-database] import interface gigabitethernet 1/0/1
[Device-security-zone-database] quit
[Device] security-zone name president
[Device-security-zone-president] import interface gigabitethernet 1/0/2
[Device-security-zone-president] quit
[Device] security-zone name finance
[Device-security-zone-finance] import interface gigabitethernet 1/0/3
[Device-security-zone-finance] quit
[Device] security-zone name market
[Device-security-zone-market] import interface gigabitethernet 1/0/4
[Device-security-zone-market] quit

(3) 配置时间段

创建名为work的时间段，其时间范围为每周工作日的8点到18点，具体配置步骤如下。

[Device] time-range work 08:00 to 18:00 working-day

(4) 配置安全策略

配置名称为president-database的安全策略规则，允许总裁办在任意时间通过HTTP协议访问财务数据库服务器，具体配置步骤如下。

[Device] security-policy ip
[Device-security-policy-ip] rule name president-database
[Device-security-policy-ip-0-president-database] source-zone president
[Device-security-policy-ip-0-president-database] destination-zone database
[Device-security-policy-ip-0-president-database] source-ip-subnet 192.168.1.0 24
[Device-security-policy-ip-0-president-database] destination-ip-subnet 192.168.0.0 24
[Device-security-policy-ip-0-president-database] service http
[Device-security-policy-ip-0-president-database] action pass
[Device-security-policy-ip-0-president-database] quit

配置名称为finance-database的安全策略规则，只允许财务部在工作时间通过HTTP协议访问财务数据库服务器，具体配置步骤如下。

[Device-security-policy-ip] rule name finance-database
[Device-security-policy-ip-1-finance-database] source-zone finance
[Device-security-policy-ip-1-finance-database] destination-zone database
[Device-security-policy-ip-1-finance-database] source-ip-subnet 192.168.2.0 24
[Device-security-policy-ip-1-finance-database] destination-ip-subnet 192.168.0.0 24
[Device-security-policy-ip-1-finance-database] service-port tcp destination eq 80
[Device-security-policy-ip-1-finance-database] action pass
[Device-security-policy-ip-1-finance-database] time-range work
[Device-security-policy-ip-1-finance-database] quit

配置名称为market-database的安全策略规则，禁止市场部在任何时间通过HTTP协议访问财务数据库服务器，具体配置步骤如下。

[Device-security-policy-ip] rule name market-database
[Device-security-policy-ip-2-market-database] source-zone market
[Device-security-policy-ip-2-market-database] destination-zone database
[Device-security-policy-ip-2-market-database] source-ip-subnet 192.168.3.0 24
[Device-security-policy-ip-2-market-database] destination-ip-subnet 192.168.0.0 24
[Device-security-policy-ip-2-market-database] service http
[Device-security-policy-ip-2-market-database] action drop
[Device-security-policy-ip-2-market-database] quit

激活安全策略规则的加速功能，具体配置步骤如下。

[Device-security-policy-ip] accelerate enhanced enable
[Device-security-policy-ip] quit
  1. 验证配置
    配置完成后，总裁办可以在任意时间访问财务数据库服务器的Web服务，财务部仅可以在工作时间访问财务数据库服务器的Web服务，其他部门任何时间均不可以访问财务数据库服务器的Web服务。