一、实验拓扑：
二、实验要求：
ASA中只能定义个主机或者一个范围，SRG可以同时定义主机、范围；
从虚拟防火墙的到物理防火墙也是Inbound，华为里管理类型防火墙就是思科的管理子防火墙；
三、命令部署：
1、R1、R2、R3地址省略，部署默认路由到USG：
[R1]ip route-static 0.0.0.0 0.0.0.0 202.100.1.10
[R2]ip route-static 0.0.0.0 0.0.0.0 192.168.1.10
[R3]ip route-static 0.0.0.0 0.0.0.0 10.1.1.10
2、USG部署：
[SRG]ip service-set aaa type object
[SRG-object-service-set-aaa]service protocol icmp
[SRG]policy interzone trust untrust outbound
[SRG-policy-interzone-trust-untrust-outbound]policy 0
[SRG-policy-interzone-trust-untrust-outbound-0]policy source 192.168.1.0 mask 24
[SRG-policy-interzone-trust-untrust-outbound-0]policy destination 202.100.1.0 mask 24
[SRG-policy-interzone-trust-untrust-outbound-0]policy service service-set aaa
[SRG-policy-interzone-trust-untrust-outbound-0]action permit
[SRG]display current-configuration configuration object-service-set ip service-set aaa type object service 0 protocol icmp [SRG]display current-configuration configuration policy-interzone policy interzone trust untrust outbound policy 0 action permit policy service service-set aaa policy source 192.168.1.0 mask 24 policy destination 202.100.1.0 mask 24 测试： [R2]ping 202.100.1.1 Reply from 202.100.1.1: bytes=56 Sequence=1 ttl=254 time=50 ms Reply from 202.100.1.1: bytes=56 Sequence=2 ttl=254 time=50 ms Reply from 202.100.1.1: bytes=56 Sequence=3 ttl=254 time=40 ms Reply from 202.100.1.1: bytes=56 Sequence=4 ttl=254 time=30 ms Reply from 202.100.1.1: bytes=56 Sequence=5 ttl=254 time=30 ms
[R1]ping 192.168.1.1 Request time out Request time out Request time out Request time out Request time out
