華為防火墻USG配置(共4頁(yè))

1、精選優(yōu)質(zhì)文檔-傾情為你奉上內(nèi)網(wǎng)：配置GigabitEthernet 0/0/1加入Trust區(qū)域USG5300 firewall zone trustUSG5300-zone-untrust add interface GigabitEthernet 0/0/1外網(wǎng)：配置GigabitEthernet 0/0/2加入U(xiǎn)ntrust區(qū)域USG5300 firewall zone untrustUSG5300-zone-untrust add interface GigabitEthernet 0/0/2DMZ：USG5300 firewall zone dmzUSG5300-zone-untru

2、st add interface GigabitEthernet 0/0/3USG5300-zone-untrust quit1.4.1 Trust和Untrust域間：允許內(nèi)網(wǎng)用戶訪問(wèn)公網(wǎng)policy 1：允許源地址為/24的網(wǎng)段的報(bào)文通過(guò)USG5300 policy interzone trust untrust outboundUSG5300-policy-interzone-trust-untrust-outbound policy 1USG5300-policy-interzone-trust-untrust-outbound-1 policy source 10

3、.10.10.0 55 USG5300-policy-interzone-trust-untrust-outbound-1 action permitUSG5300-policy-interzone-trust-untrust-outbound-1 quit如果是允許所有的內(nèi)網(wǎng)地址上公網(wǎng)可以用以下命令：USG2100firewall packet-filter default permit interzone trust untrust direction outbound /必須1.4.2 DMZ和Untrust域間：從公網(wǎng)訪問(wèn)內(nèi)部服務(wù)器policy 2：允許目的地址為10.1

4、0.11.2，目的端口為21的報(bào)文通過(guò)policy 3：允許目的地址為，目的端口為8080的報(bào)文通過(guò)USG5300 policy interzone untrust dmz inboundUSG5300-policy-interzone-dmz-untrust-inbound policy 2USG5300-policy-interzone-dmz-untrust-inbound-2 policy destination 0USG5300-policy-interzone-dmz-untrust-inbound-2 policy service ser

5、vice-set ftpUSG5300-policy-interzone-dmz-untrust-inbound-2 action permitUSG5300-policy-interzone-dmz-untrust-inbound-2 quitUSG5300-policy-interzone-dmz-untrust-inbound policy 3USG5300-policy-interzone-dmz-untrust-inbound-3 policy destination 0USG5300-policy-interzone-dmz-untrust-inbound-3

6、 policy service service-set httpUSG5300-policy-interzone-dmz-untrust-inbound-3 action permitUSG5300-policy-interzone-dmz-untrust-inbound-3 quitUSG5300-policy-interzone-dmz-untrust-inbound quit配置內(nèi)部服務(wù)器：<USG5300> system-viewUSG5300 nat server protocol tcp global 6 8080 inside 10.10.11.

7、2 wwwUSG5300 nat server protocol tcp global 7 ftp inside ftpNAT2、通過(guò)公網(wǎng)接口的方式創(chuàng)建Trust區(qū)域和Untrust區(qū)域之間的NAT策略，確定進(jìn)行NAT轉(zhuǎn)換的源地址范圍/24網(wǎng)段，并且將其與外網(wǎng)接口GigabitEthernet 0/0/4進(jìn)行綁定。USG nat-policy interzone trust untrust outboundUSG-nat-policy-interzone-trust-untrust-outbound policy 0USG-na

8、t-policy-interzone-trust-untrust-outbound-0 policy source 55USG-nat-policy-interzone-trust-untrust-outbound-0 action source-natUSG-nat-policy-interzone-trust-untrust-outbound-0 easy-ip GigabitEthernet 0/0/4 USG-nat-policy-interzone-trust-untrust-outbound-0 quit3、直接在接口啟用nat如果是針對(duì)內(nèi)網(wǎng)用

9、戶上公網(wǎng)做nat，需要在內(nèi)網(wǎng)接口使用USG-GigabitEthernet0/0/0nat enable2.10 配置策略路由配置要求：走77，走3。1、創(chuàng)建aclacl number 3000 rule 1 permit ip source 55acl number 3001 rule 1 permit ip source 552、創(chuàng)建策略路由 policy-based-route internet permit node 0 if-match acl 3000 apply ip-address next-hop 77policy-based-route internet permit node 1 if-match acl 3001 apply ip-address next-hop 33、將策略路由引用到入接口（內(nèi)網(wǎng)口） ip policy-based-route internet4、