USG50配置命令.doc

TOP内网-USG50-外网X.X.X.X-USG50dis curr#sysname USG50#web-manager enable启用WEB管理#firewall packet-filter default permit interzone trust untrust direction inboundfirewall packet-filter default permit interzone trust untrust direction outbound允许U到T,t到U 的流量通过,记住是双向的#nat alg enable ftpnat alg enable dnsnat alg enable icmpnat alg enable netbiosundo nat alg enable h323undo nat alg enable hwccundo nat alg enable ilsundo nat alg enable pptpundo nat alg enable qqundo nat alg enable msnundo nat alg enable user-defineundo nat alg enable sipundo nat alg enable rtspfirewall permit sub-ip#firewall statistic system enable#dhcp server ip-pool test_poolnetwork mask gateway-list dns-list domain-name expired day 8DHCP地址池,没设置成功,问400.400说是不支持!郁闷#interface Ethernet0/0/0ip address X.X.X.1 48外部地址#interface Ethernet0/0/1ip address 内部#interface NULL0#acl number 3001rule 5 permit ip source 55策略做用acl number 3002rule 0 permit udp source-port eq bootpsacl number 3003rule 0 permit udp source-port eq bootps#firewall zone localset priority 10#firewall zone trustset priority 85add interface Ethernet0/0/1#firewall zone untrust设置各个区域的安全级别set priority 5add interface Ethernet0/0/0#firewall zone dmzset priority 50#firewall interzone local trustpacket-filter 3002 inboundpacket-filter 3003 outbound#firewall interzone local untrust#firewall interzone local dmz#firewall interzone trust untrustpacket-filter 3001 inboundnat outbound 3001 interface Ethernet0/0/0应用关联到外部接口#firewall interzone trust dmz#firewall interzone dmz untrust#aaalocal-user usg50 password cipher F=9L.J$Z6=CQ=QMAF41!local-user usg50 level 3local-user usg50 ftp-directory flash:/authentication-scheme default访问密码#authorization-scheme default#accounting-scheme default#domain default#dhcp enable# ip route-static x.x