华为防火墙USG配置.doc

_内网：配置GigabitEthernet 0/0/1加入Trust区域USG5300 firewall zone trustUSG5300-zone-untrust add interface GigabitEthernet 0/0/1外网：配置GigabitEthernet 0/0/2加入Untrust区域USG5300 firewall zone untrustUSG5300-zone-untrust add interface GigabitEthernet 0/0/2DMZ：USG5300 firewall zone dmzUSG5300-zone-untrust add interface GigabitEthernet 0/0/3USG5300-zone-untrust quit1.4.1 Trust和Untrust域间：允许内网用户访问公网policy 1：允许源地址为/24的网段的报文通过USG5300 policy interzone trust untrust outboundUSG5300-policy-interzone-trust-untrust-outbound policy 1USG5300-policy-interzone-trust-untrust-outbound-1 policy source 55 USG5300-policy-interzone-trust-untrust-outbound-1 action permitUSG5300-policy-interzone-trust-untrust-outbound-1 quit如果是允许所有的内网地址上公网可以用以下命令：USG2100firewall packet-filter default permit interzone trust untrust direction outbound /必须1.4.2 DMZ和Untrust域间：从公网访问内部服务器policy 2：允许目的地址为，目的端口为21的报文通过policy 3：允许目的地址为，目的端口为8080的报文通过USG5300 policy interzone untrust dmz inboundUSG5300-policy-interzone-dmz-untrust-inbound policy 2USG5300-policy-interzone-dmz-untrust-inbound-2 policy destination 0USG5300-policy-interzone-dmz-untrust-inbound-2 policy service service-set ftpUSG5300-policy-interzone-dmz-untrust-inbound-2 action permitUSG5300-policy-interzone-dmz-untrust-inbound-2 quitUSG5300-policy-interzone-dmz-untrust-inbound policy 3USG5300-policy-interzone-dmz-untrust-inbound-3 policy destination 0USG5300-policy-interzone-dmz-untrust-inbound-3 policy service service-set httpUSG5300-policy-interzone-dmz-untrust-inbound-3 action permitUSG5300-policy-interzone-dmz-untrust-inbound-3 quitUSG5300-policy-interzone-dmz-untrust-inbound quit配置内部服务器： system-viewUSG5300 nat server protocol tcp global 6 8080 inside wwwUSG5300 nat server protocol tcp global 7 ftp inside ftpNAT2、通过公网接口的方式创建Trust区域和Untrust区域之间的NAT策略，确定进行NAT转换的源地址范围/24网段，并且将其与外网接口GigabitEthernet 0/0/4进行绑定。USG nat-policy interzone trust untrust outboundUSG-nat-policy-interzone-trust-untrust-outbound policy 0USG-nat-policy-interzone-trust-untrust-outbound-0 policy source 55USG-nat-policy-interzone-trust-untrust-outbound-0 action source-natUSG-nat-policy-interzone-trust-untrust-outbound-0 easy-ip GigabitEthernet 0/0/4 USG-nat-policy-interzone-trust-untrust-outbound-0 quit3、直接在接口启用nat如果是针对内网用户上公网做nat，需要在内网接口使用USG-GigabitEthernet0/0/0nat enable2.10 配置策略路由配置要求：走77，走3。1、创建aclacl number 3000 rule 1 permit ip source 55acl number 3001 rule 1 permit ip source 552、创建策略路由 policy-based-route internet permit node 0 if-match acl 3000 apply ip-address next-hop 77policy-based-route internet permit node 1 if-match acl 3001 apply ip-address next-hop 33、将策略路由引用到入接口（内网口） ip policy-based-route internet4、配置默认路由，配置策略路由的时候不需要配置明细路由。 ip