華為防火墻設(shè)置

1、用戶名：admin 密碼;Admin123第一次配制時(shí)，可以設(shè)置本地IP自動(dòng)獲取。也可以設(shè)置成IP192.168.0.X/ (x=2-254)防火墻的IP: 配制如下：# sysname USG2130# web-manager enable# info-center source default channel 4 log level notifications# firewall packet-filter default permit interzone local trust direction inbound firewall pac

2、ket-filter default permit interzone local trust direction outbound# firewall permit sub-ip# dhcp enable# firewall mode route# firewall statistic system enable # set runmode firewall#interface Cellular5/0/0 link-protocol ppp#vlan 1#interface Vlanif1 ip address dhcp select in

3、terface#interface Ethernet0/0/0#interface Ethernet1/0/0#interface Ethernet1/0/1#interface Ethernet1/0/2#interface Ethernet1/0/3#interface Ethernet1/0/4#interface Ethernet1/0/5#interface Ethernet1/0/6#interface Ethernet1/0/7#interface NULL0#right-manager server-group #cwmp #firewall zone local set pr

4、iority 100#firewall zone trust set priority 85 add interface Vlanif1#firewall zone untrust set priority 5 add interface Ethernet0/0/0#firewall zone dmz set priority 50#firewall interzone local trust#firewall interzone local untrust#firewall interzone local dmz#firewall interzone trust untrust#firewa

5、ll interzone trust dmz#firewall interzone dmz untrust#aaa local-user maintainadmin password simple maintainadmin local-user maintainadmin level 3 local-user admin password cipher MQ;4B+4Z,YWX*NZ55OA! local-user admin level 3 local-user admin ftp-directory flash:/ authentication-scheme default# autho

6、rization-scheme default# accounting-scheme default # domain default# slb#user-interface con 0user-interface tty 81 authentication-mode none modem bothuser-interface vty 0 4 authentication-mode aaa#common update auto time 2:30#surfbehavior#ips# protocol#mailfilter用網(wǎng)線接上 fe1/0/0 口，我們來做如下的要求建二個(gè)vlan vlan

7、100 vlan200FFFe/1/0/1-fe/10/3要與Fe/1/0/4-fe/10/7通信，則FFe/1/0/4-fe/10/7的網(wǎng)關(guān)要設(shè)置成.1Fe/1/0/0的配制不變，還是處于默認(rèn)的/24 段步驟如下：把網(wǎng)線接在F打開ie，在IE里輸入：如下圖 輸入用戶名：admin 密碼：Admin123點(diǎn)擊“網(wǎng)絡(luò)管理”-“Vlan”在點(diǎn)新建Vlan ID 寫入100 點(diǎn)擊應(yīng)用就好了，現(xiàn)在vlan 100就建好了現(xiàn)在給vlan 100加入接口Fe/1/0/1-fe/10/3點(diǎn)擊接口在點(diǎn)右邊ethernet1/0/1 的詳細(xì) 在vlan 里寫入100 點(diǎn)應(yīng)用現(xiàn)在ethern

8、et1/0/1就加入vlan 100了重得上面的步驟，把ethernet1/0/2 ethernet1/0/3加入vlan 100接下來建vlan 200也是按上面的步驟，只是id里寫入200就可以然后在一個(gè)一個(gè)的把接口加入vlan 200就行做完后，可以看到配制文件如下：interface Ethernet0/0/0#interface Ethernet1/0/0#interface Ethernet1/0/1 port access vlan 100#interface Ethernet1/0/2 port access vlan 100#interface Ethernet1/0/3 port access vlan 100#interface Ethernet1/0/4 port access vlan 200#interface Ethernet1/0/5 port access vlan 200#interface Ethernet1/0/6 port access vlan 200#interface Ethernet1/0/7 port access vlan 200#最后就是給vlan分配網(wǎng)段與ip點(diǎn)擊接口：在