双出口链路nat配置案例outbound1

1、文档名称文档密级2019-7-11华赛机密，未经许可不得扩散第1页，共 5 页HuaweiJ Symantec防火墙双链路出口nat策略路由配置案例、用户组网二、需求场景需求一：10.0.0.0及30.10.0.0网段内网用户的走G0/0/0口，通过External networt a访问公网，nat转化为地址1.0.0.1 ; 20.0.0.0及30.20.0.0的内网用户走G0/0/1口，通过External network b访问公网，nat转化为地址2.0.0.1。防火墙出口到External networt a或External network b任意链路故障后，所有内网用户转化为同

2、一出口地址访问公网。G5/0/0启子接口，下行30.10.0.0和30.20.0.0网段，网关配置在防火墙上。需求二：访问公网地址，如果访问的External networt a地址走External networt a访问公网； 如果访问的为External networt b地址走External networt b访问公网需求三：内网用户均可通过External networt a或External networt b访问公网需求四：所有网络均走External networt a访问公网，当G/0/0链路down时，内网用户通过External networtb访问公网。三、适用产品版

3、本设备型号：usg软件版本：V100R002C01SPC100四、配置步骤需求一配置步骤:1、 进入系统视图sys2、 配置外网接口地址#配置External network a出 口地址USG interface GigabitEthernet 0/0/0USG -GigabitEthernet0/0/0ip address 1.0.0.1 255.255.255.0#配置External network a出 口地址Firewall/ /- 10.0.0.110.0.0.1 E2E2 0 0 0 0HuaweiSyrnantec文档名称文档密级2019-7-11华赛机密，未经许可不得扩散第

4、2页，共 5 页USG interface GigabitEthernet 0/0/1USG -GigabitEthernet0/0/1ip address 2.0.0.1 255.255.255.03、 创建vlan，并将接口加入vlan（如果加入接口为三层口，也可在接口下配置地址）#创建vlan 2和vlan 3 ,并加入相应接口。USG vlan 2USG -vlan-2port interface Ethernet 2/0/0USG -vlan-2quitUSG vlan 3USG -vlan-3port interface Ethernet 2/0/2USG -vlan-3quit4

5、、#配置vlanif接口地址#配置vlan2、vlan3接口地址USG interface Vlanif 2USG -Vlanif2ip address 10.0.0.1 255.255.255.0USG -Vlanif2quitUSG interface Vlanif 3USG -Vlanif3ip address 20.0.0.1 255.255.255.0USG -Vlanif3quit5 5、 配置子接口，设置子接口封装类型、vlanvlan号（该场景为下行多个vlan,vlan,网关设置在防火墙上）#在interface g5/0/0下配置子接口、封装类型及地址USG interfa

6、ce g5/0/0.1USG -GigabitEthernet5/0/0.1vlan-type dot1q 10USG -GigabitEthernet5/0/0.1ip address 30.10.0.1 255.255.255.0USG interface g5/0/0.2USG -GigabitEthernet5/0/0.2vlan-type dot1q 20USG -GigabitEthernet5/0/0.2ip address 30.20.0.1 255.255.255.0创建安全区域#创建区域external_aexternal_a和external_bexternal_b并设置

7、优先级USG firewall zone name external_aUSG -zone-zone_aset priority 20USG -zone-zone_aquitUSG firewall zone name external_bUSG -zone-zone_bset priority 10USG -zone-zone_bquit将各接口加入相应安全区域#将通往External networt a接口加入external_a安全域USG firewall zone external_aUSG -zone-external_aadd interface GigabitEthernet

8、0/0/0USG -zone-external_aquit#将通往External networt b接口加入external_b安全域USG firewall zone external_bUSG -zone-external_badd interface GigabitEthernet 0/0/1USG -zone-external_bquit#将内网接口加入trust安全域USG firewall zone trustUSG -zone-trustadd interface Vlanif 2USG -zone-trustadd interface Vlanif 3USG -zone-tr

9、ustadd interface GigabitEthernet 5/0/0USG -zone-trustadd interface GigabitEthernet 5/0/0.1HuaweiSyrnantec文档名称文档密级2019-7-11华赛机密，未经许可不得扩散第3页，共 5 页USG -zone-trustadd interface GigabitEthernet 5/0/0.2USG -zone-trustquit6、配置允许作nat转换访问公网的地址acl#配置内网访问公网aclUSG acl 2000USG -acl-basic-2000rule permit source a

10、nyUSG -acl-basic-2000quit7、配置域间包过滤#开启域间包过滤USG firewall packet-filter default permit all8 8、配置双链路natnat出口转化地址#配置External networt a和External networt b地址池USG nat address-group 1 1.0.0.1 1.0.0.1USG nat address-group 2 2.0.0.1 2.0.0.19 9、配置到ExternalExternal networtnetwort a a和ExternalExternal networtnetw

11、ort b b默认出 口路由USG ip route-static 0.0.0.0 0.0.0.0 1.0.0.2USG ip route-static 0.0.0.0 0.0.0.0 2.0.0.21010、 配置内网段走不同出口的策略aclacl#配置10.0.0.0及30.10.0.0地址段从G/0/0出去的aclUSG acl 3010USG -acl-basic-3010rule permit source 10.0.0.0 0.0.0.255USG -acl-basic-3010rule permit source 30.10.0.0 0.0.0.255USG -acl-basic

12、-3010quit#配置10.0.0.0及30.10.0.0地址段从G/0/0出去的aclUSG acl 3020USG -acl-basic-3020rule permit source 20.0.0.0 0.0.0.255USG -acl-basic-3020rule permit source 30.20.0.0 0.0.0.255USG -acl-basic-3020quit1111、 配置到ExternalExternal networtnetwort a a和ExternalExternal networtnetwort b b的natnat地址转换USG firewall int

13、erzone trust external_aUSG -interzone-trust-external_anat outbound 2000 address-group 1USG firewall interzone trust external_bUSG -interzone-trust-external_bnat outbound 2000 address-group 2USG -interzone-trust-external_bquit1212、 创建qosqos策略分类、流行为、策略#定义匹酉己至V external network a的类、aclUSG traffic class

14、ifier ext_aUSG -classifier-ext_aif-match acl 3010USG -classifier-ext_aquit#定义匹配到external network b的类、aclUSG traffic classifier ext_bUSG -classifier-ext_bif-match acl 3020USG -classifier-ext_bquit#定义匹配到external network a的行为动作USG traffic behavior ext_aUSG -behavior-ext_aremark ip-nexthop 1.0.0.2 outpu

15、t-interface GigabitEthernet 0/0/0USG -behavior-ext_aquit#定义匹配到external network b的行为动作USG traffic behavior ext_bHuaweiSyrnantec文档名称文档密级2019-7-11华赛机密，未经许可不得扩散第4页，共 5 页USG -behavior-ext_bremark ip-nexthop 2.0.0.2 output-interface GigabitEthernet 0/0/1USG -behavior-ext_bquit1313、创建QOSQOS策略external_abext

16、ernal_ab , ,定义匹配的行为策略USG qos policy external_abUSG -qospolicy-external_abclassifier ext_a behavior ext_aUSG -qospolicy-external_abclassifier ext_b behavior ext_bUSG -qospolicy-external_abquit1414、在内网接口上应用策略（注意应用在相应的内外接口）USG interface Vlanif 2USG -Vlanif2qos apply policy external_ab outboundUSG -Vlan

17、if2quitUSG interface Vlanif 3USG -Vlanif3qos apply policy external_ab outboundUSG interface GigabitEthernet 5/0/0USG -GigabitEthernet5/0/0qos apply policy external_ab outbound-结束-需求二配置步骤：1、 配置步骤与需求一中1-8相同2 2、 配置访问ExternalExternal networtnetwort a a和ExternalExternal networtnetwort b b路由#配置External networt a为默认路由USG ip route-static 0.0.0.0 0.0.0.0 1.0.0.2# #配置ExternalExternal networtnetwort b b的精确路由 （如将ExternalExternal networtnetwort b b地址分举与精确路由）USG ip route-static x.x.x.xx.x.x.x2.0.0.2USG ip route-static x.x