华为防火墙配置(共3页)

1、防火墙配置：<SRG>dis current-configuration  #显示当前配置SRGstp region-configuration #进入MST视图SRGactive region-configuration #激活MST配置SRGinterface GigabitEthernet 0/0/0 #进入GE0/0/0端口SRG-GigabitEthernet0/0/0alias GE0/GMT #别名GE0管理SRG-GigabitEthernet0/0/0ip add 192.168.100.1 255.255.255.0 #端口配置IPSRG-Gigabi

2、tEthernet0/0/0dhcp select interface #客户端从接口地址池中通过自动获取IP地址SRG-GigabitEthernet0/0/0dhcp server gateway-list 192.168.100.1 #DHCP服务默认网关SRG-GigabitEthernet0/0/0dhcp server dns-list 8.8.8.8 #DNCP默认DNSSRG-GigabitEthernet0/0/1ip add 192.168.200.1 255.255.255.0 #配置端口IPSRG-GigabitEthernet0/0/2ip add 211.1.1.1

3、 255.255.255.0 #配置公网IPSRGinterface NULL0 #建立伪接口，进行包的分发。当宝的目的和路由不匹配时候，则通过NULL0丢弃 ps:如果通过默认路由进行分发的话就会形成环路SRGfirewall zone untrust #进入防火墙不信任区域SRG-zone-trustadd interface GigabitEthernet 0/0/2 #添加不信任区域端口SRGfirewall zone trust #进入防火墙信任区域SRG-zone-trustadd interface GigabitEthernet 0/0/0 #添加信任区域端口SRGfirewa

4、ll zone dmz #进入防火墙了隔离区域SRG-zone-trustadd interface GigabitEthernet 0/0/1 #添加隔离区域端口SRGfirewall zone name usr1 #添加区域SRG-zone-usr1set priority 86 #设置优先级SRG-zone-usr1add interface GigabitEthernet 0/0/8 #添加端口SRG-zone-usr1aaa #aaa认证协议SRG-aaalocal-user admin password cipher 123456 #设置用户名和加密密码SRG-aaalocal-u

5、ser admin service-type web terminal telnet #允许三种登入方式SRG-aaalocal-user admin level 15 #设置等级为15级SRG-aaaauthentication-scheme default #验证方式默认及本地设备验证SRG-aaaauthorization-scheme default #验证方式默认及本地设备验证SRG-aaaaccounting-scheme default #验证方式默认及本地设备验证SRG-aaadomain default #域缺省SRGnqa-jitter tag-version 1 

6、;SRGbanner enableSRGuser-interface con 0 SRG-ui-console0authentication-mode aaa 允许登陆模式为aaaSRGuser-interface vty 0 4SRG-ui-vty0-4uthentication-mode aaa SRG-ui-vty0-4protocol inbound all # 允许所有登陆协议SRGslb #负载均衡SRG-slbrserver 1 rip 192.168.200.201 weight 32 healthchkSRG-slbrserver 2 rip 192.168.200

7、.202 weight 32 healthchkSRG-slbrserver 3 rip 192.168.200.203 weight 32 healthchkSRG-slbgroup g1SRG-slb-group-g1metric roundrobin #加权轮询算法分配连接SRG-slb-group-g1addrserver 1SRG-slb-group-g1addrserver 2SRG-slb-group-g1  addrserver 3SRG-slb vserver ser1 vip 211.1.1.200 group g1SRGfirewall packet-

8、filter default permit interzone local trust direction inboundSRGfirewall packet-filter default permit interzone local trust direction outbound #开启域间包过滤规则 使得local和trust能ping通SRGfirewall packet-filter default permit interzone local untrust direction inbound SRGfirewall packet-filter default permit interzone local untrust direction outbound SRGfirewall packet-filter default permit interzone local dmz direction inboundSRGfirewall packet-filter d