NGN核心网配置指南.doc

NGN核心网配置指南内部公开产品名称Product name密级Confidentiality levelS3528G/Eudenom500/NE40/NE80/NE40E/NE80E内部公开产品版本Product versionTotal 27 pages 共7页V1.0NGN核心网配置指南Prepared by拟制李迪Date日期yyyy-mm-ddReviewed by 评审人Date日期yyyy-mm-ddApproved by批准Date日期yyyy-mm-ddAuthorized by签发Date日期yyyy-mm-ddHuawei Technologies Co., Ltd. 华为技术有限公司All rights reserved版权所有 侵权必究Revision record 修订记录Date日期Revision Version修订版本Change Description修改描述Author作者2006.09.301.0initial 初稿完成李迪1 软交换接入由于目前现网网络应用最多的就是标准组网模式，而且专网模式就是由标准组网模式演变过来的，因此本文重点介绍标准组网的配置方式，依旧沿用标准组网连接方式。1.1 交换机配置在交换机三层VLAN视图下配置VRRP协议，将下行端口划入该VLAN，在互联接口trunk该VLAN，并监控上行端口。interface Vlan-interface1000description Tsx-s3-s-bjbj-1-Sx3000_single_port ip address 10.10.0.28 255.255.255.224 vrrp vrid 1 virtual-ip 10.10.0.30 vrrp vrid 1 priority 150 vrrp vrid 1 time advertise 1 vrrp vrid 1 preempt-mode timer delay 0 vrrp vrid 1 track GigabitEthernet1/1 reduced 60 1.2 防火墙配置防火墙的配置规范是从NGN核心网向外发送的报文全部放行，而从NGN核心网外部访问内部的报文按照NGN设备IP地址和信令协议端口号进行过滤。acl number 3201 配置应用在可信和不可信区域间的规则 description inter_trust_untrust_in rule 1 permit ospf 允许OSPF报文通过/允许其它SX3000到本SX3000的SIP-T连接 /A局大区内部的 SX3000之间rule 2 permit udp source 10.10.5.1 0 source-port range 5060 5188 destination 10.10.0.1 0 destination-port range 5060 5188 rule 3 permit udp source 10.10.5.1 0 source-port range 5060 5188 destination 10.10.0.2 0 destination-port range 5060 5188 rule 4 permit udp source 10.10.5.2 0 source-port range 5060 5188 destination 10.10.0.1 0 destination-port range 5060 5188 rule 5 permit udp source 10.10.5.2 0 source-port range 5060 5188 destination 10.10.0.2 0 destination-port range 5060 5188 /A局与B局SX3000之间的SIP-T连接 rule 6 permit udp source 10.11.5.1 0 source-port range 5060 5188 destination 10.10.0.1 0 destination-port range 5060 5188 rule 7 permit udp source 10.11.5.1 0 source-port range 5060 5188 destination 10.10.0.2 0 destination-port range 5060 5188 rule 8 permit udp source 10.11.5.2 0 source-port range 5060 5188 destination 10.10.0.1 0 destination-port range 5060 5188 rule 9 permit udp source 10.11.5.2 0 source-port range 5060 5188 destination 10.10.0.2 0 destination-port range 5060 5188 /允许本大区的UMG同本SX3000的H.248连接 rule 54 permit udp source 10.17.0.1 0 source-port range 2944 2945 destination 10.10.0.1 0 destination-port range 2944 2945 rule 55 permit udp source 10.17.0.1 0 source-port range 2944 2945 destination 10.10.0.2 0 destination-port range 2944 2945 /允许允许本大区另外一个机房的SG同本SX3000的M3UA（SCTP）连接，132协议号就是SCTP rule 68 permit 132 source 10.10.5.11 0 destination 10.10.0.1 0 rule 69 permit 132 source 10.10.5.11 0 destination 10.10.0.2 0 /允许本大区另外一个机房的SX3000同本大区SG的M3UA（SCTP）连接，132协议号就是SCTPrule 70 permit 132 source 10.10.5.1 0 destination 10.10.0.11 0 rule 71 permit 132 source 10.10.5.2 0 destination 10.10.0.11 0 /允许本大区另外一个机房的SX3000同本大区的MRS的MGCP连接rule 72 permit udp source 10.10.5.1 0 source-port eq 2727 destination 10.10.0.21 0 destination-port eq 2427 rule 73 permit udp source 10.10.5.2 0 source-port eq 2727 destination 10.10.0.21 0 destination-port eq 2427 /允许网管网段对下面连接的S35-A和S35-B的Telnet rule 74 permit tcp source 10.50.0.0 0.0.255.255 destination 10.50.128.3 0 destination-port eq telnet rule 75 permit tcp source 10.50.0.0 0.0.255.255 destination 10.50.129.3 0 destination-port eq telnet /允许网管服务器对下面连接的S35-A和S35-B的snmp访问 rule 76 permit udp source 10.50.51.1 0 destination 10.50.128.3 0 destination-port eq snmp rule 77 permit udp source 10.50.51.1 0 destination 10.50.129.3 0 destination-port eq snmp acl number 3301 配置应用在不可信域和本地域之间的规则 description inter_local_untrust_in rule 0 permit icmp 允许不可信域对本机地址的ICMP rule 1 permit tcp source 10.50.0.0 0.0.255.255 destination-port eq telnet 允许网管网段对本机地址的telnet acl number 3401 配置应用在可信域和本地域之间的规则 description inter_local_trust_in rule 0 permit icmp 允许可信域对本机地址的icmp rule 1 permit tcp source 10.50.0.0 0.0.255.255 destination-port eq telnet 允许网管网段对本机地址的telnet，在此的作用主要是能让S35-A和S35-B Telnet本防火墙 缺省从本地域到可信域可信域的所有出报文都允许 firewall packet-filter default permit interzone local trust direction outbound 缺省从本地域到不可信域可信域的所有出报文都允许 firewall packet-filter default permit interzone local untrust direction outbound 缺省从可信域到不可信域的所有出报文都允许 firewall packet-filter default permit interzone trust untrust direction outbound #防火墙工作在混合模式 firewall mode composite 打开所有防攻击功能，可用firewall defend all命令配置 firewall defend ip-spoofing enable firewall defend land enable firewall defend smurf enable firewall defend fraggle enable firewall defend winnuke enable firewall defend syn-flood enable firewall defend udp-flood enable firewall defend icmp-flood enable firewall defend icmp-redirect enable firewall defend icmp-unreachable enable firewall defend ip-sweep enable firewall defend port-scan enable firewall defend source-route enable firewall defend route-record enable firewall defend tracert enable firewall defend time-stamp enable firewall defend ping-of-death enable firewall defend teardrop enable firewall defend tcp-flag enable firewall defend ip-fragment enable firewall defend large-icmp enable # firewall statistic system enable firewall zone trust /连接下行设备的接口加入可信域 set priority 85 add interface GigabitEthernet1/0/0 # firewall zone untrust /连接上行设备的口加入不可信域 set priority 5 add interface GigabitEthernet2/0/0 # firewall zone dmz set priority 50 #firewall interzone local trust