华为防火墙USG配置

1、配置 GigabitEthernet 0/0/1加入 Trust 区域USG5300 firewall zone trustUSG5300-zone-untrust add interface GigabitEthernet 0/0/1外网：配置 GigabitEthernet 0/0/2加入 Untrust 区域USG5300 firewall zone untrustUSG5300-zone-untrust add interface GigabitEthernet 0/0/2DMZ：USG5300 firewall zone dmzUSG5300-zone-untrustadd inte

2、rface GigabitEthernet 0/0/3USG5300-zone-untrust quitTrust 和 Untrust 域间 ： 允许内网用户访问公网policy 1 ：允许源地址为的网段的报文通过USG5300 policy interzone trust untrust outboundUSG5300-policy-interzone-trust-untrust-outboundpolicy 1USG5300-policy-interzone-trust-untrust-outbound-1policy sourceUSG5300-policy-interzone-trus

3、t-untrust-outbound-1action permitUSG5300-policy-interzone-trust-untrust-outbound-1quit如果是允许所有的内网地址上公网可以用以下命令：USG2100firewall packet-filter default permit interzone trust untrust direction outbound / 必须DMZ和 Untrust 域间：从公网访问内部服务器policy 2 ：允许目的地址为，目的端口为21 的报文通过policy 3 ：允许目的地址为，目的端口为8080 的报文通过USG5300 p

4、olicy interzone untrust dmz inboundUSG5300-policy-interzone-dmz-untrust-inboundpolicy 2USG5300-policy-interzone-dmz-untrust-inbound-2policy destination 0USG5300-policy-interzone-dmz-untrust-inbound-2policy service service-set ftpUSG5300-policy-interzone-dmz-untrust-inbound-2action permitUSG5300-poli

5、cy-interzone-dmz-untrust-inbound-2quitUSG5300-policy-interzone-dmz-untrust-inboundpolicy 3USG5300-policy-interzone-dmz-untrust-inbound-3policy destination 0USG5300-policy-interzone-dmz-untrust-inbound-3policy service service-set httpUSG5300-policy-interzone-dmz-untrust-inbound-3action permitUSG5300-

6、policy-interzone-dmz-untrust-inbound-3quitUSG5300-policy-interzone-dmz-untrust-inboundquit配置内部服务器： system-viewUSG5300 natserver protocol tcp global 8080 inside wwwUSG5300 natserver protocol tcp global ftp inside ftpNAT2、通过公网接口的方式创建 Trust 区域和 Untrust 区域之间的 NAT策略， 确定进行 NAT转换的源地址范围网段， 并 且将其与外网接口 Gigabi

7、tEthernet 0/0/4进行绑定。USG nat-policy interzone trust untrust outboundUSG-nat-policy-interzone-trust-untrust-outboundpolicy 0USG-nat-policy-interzone-trust-untrust-outbound-0policy source actionsource-natUSG-nat-policy-interzone-trust-untrust-outbound-0easy-ip GigabitEthernet0/0/4USG-nat-policy-interzo

8、ne-trust-untrust-outbound-0 quit3、直接在接口启用 nat如果是针对内网用户上公网做 nat ，需要在内网接口使用USG-GigabitEthernet0/0/0 nat enable配置策略路由配置要求：走，走。1、创建 aclacl number 3000rule 1 permit ip source number 3001rule 1 permit ip source、创建策略路由policy-based-route internet permit node 0if-match acl 3000apply ip-address next-hop internet permit node 1if-match acl 3001apply ip-address next-hop 、将策略路由