一、實驗拓撲：
二、實驗要求：
ASA中只能定義個主機或者一個範圍，SRG可以同時定義主機、範圍；
從虛擬防火牆的到物理防火牆也是Inbound，華爲裏管理類型防火牆就是思科的管理子防火牆；
三、命令部署：
1、R1、R2、R3地址省略，部署默認路由到USG：
[R1]ip route-static 0.0.0.0 0.0.0.0 202.100.1.10
[R2]ip route-static 0.0.0.0 0.0.0.0 192.168.1.10
[R3]ip route-static 0.0.0.0 0.0.0.0 10.1.1.10
2、USG部署：
[SRG]ip service-set aaa type object
[SRG-object-service-set-aaa]service protocol icmp
[SRG]policy interzone trust untrust outbound
[SRG-policy-interzone-trust-untrust-outbound]policy 0
[SRG-policy-interzone-trust-untrust-outbound-0]policy source 192.168.1.0 mask 24
[SRG-policy-interzone-trust-untrust-outbound-0]policy destination 202.100.1.0 mask 24
[SRG-policy-interzone-trust-untrust-outbound-0]policy service service-set aaa
[SRG-policy-interzone-trust-untrust-outbound-0]action permit
[SRG]display current-configuration configuration object-service-set
ip service-set aaa type object
service 0 protocol icmp
[SRG]display current-configuration configuration policy-interzone
policy interzone trust untrust outbound
policy 0
action permit
policy service service-set aaa
policy source 192.168.1.0 mask 24
policy destination 202.100.1.0 mask 24
測試：
[R2]ping 202.100.1.1
Reply from 202.100.1.1: bytes=56 Sequence=1 ttl=254 time=50 ms
Reply from 202.100.1.1: bytes=56 Sequence=2 ttl=254 time=50 ms
Reply from 202.100.1.1: bytes=56 Sequence=3 ttl=254 time=40 ms
Reply from 202.100.1.1: bytes=56 Sequence=4 ttl=254 time=30 ms
Reply from 202.100.1.1: bytes=56 Sequence=5 ttl=254 time=30 ms
[R1]ping 192.168.1.1
Request time out
Request time out
Request time out
Request time out
Request time out