HC防火墻配置實例

1、本文為大家介紹一個H3C防火墻的配置實例，配置內(nèi)容包括：配置接口IP地址、配置區(qū)域、配置 NAT地址轉(zhuǎn)換、配置 訪 問 策 略 等， 組 網(wǎng) 拓 撲 及 需 求 如 下1、網(wǎng)絡(luò)拓撲圖2、配置要求3、防火墻的配置腳本如下discur#sys nameH3CF100A#superpasswordlevel3cipher6aQQ57-$.l)0;4:(l41!#firewallpacket-filtere nablefirewallpacket-filterdefaultpermit#in sulate#n atstatic in sideipglobalipn atstatic in sideip

2、globalip#firewallstatisticsysteme nable#radiusschemesystemserver-typeexte nded#domai nsystem#local-user net1980passwordcipher#service-typete lnetlevel2#aspf-policy1detecth323detectsq lnetdetectrtspdetecthttpdetectsmtpdetectftpdetecttcpdetectudp#objectaddressobjectaddressacln umber3001descripti on ou

3、t-i nsiderulelpermittcpsourceOdesti nati onO dest in ati on-porteq1433 rule2permittcpsource0desti nati onO dest in ati on-porteqwww rulelOOOde nyipacl number3002descripti onin side-to-outsiderulelpermitipsourceOrule2permitipsource0rulelOOOde nyip#in terfaceAuxOasyn cmodeflow#in terfaceEthern etO/Osh

4、utdow n#in terfaceEthern etO/1shutdow n#in terfaceEthern etO/2speed100duplexfulldescripti on toserveripaddressfirewallpacket-filter3002i nbou nd firewallaspf1outbou nd#in terfaceEthern etO/3shutdow n#in terfaceEther net1/Oshutdow n#in terfaceEther net1/1shutdow n#in terfaceEther net1/2speed100duplex

5、fulldescripti ontointernetipaddressfirewallpacket-filter3001i nbou nd firewallaspf1outbou ndn atoutbou ndstaticin terfaceNULLO#firewallz on elocalsetprioritylOO#firewallzon etrustaddi nterfaceEthernet0/2setpriority85#firewallz oneun trustaddi nterfaceEthern et1/2setpriority5#firewallz on eDMZaddi nterfaceEthernet0/3setpriority50#firewalli nterz on elocaltrust#firewalli nterz on elocalu ntrust#firewalli nterz on elocalDMZ#firewalli nterz on etrustu ntrust#firewall in terz on etrustDMZ#firewalli nterz on eDMZu ntrust#iproute-staticprefere nce60#user-