2023年-H3C防火墙2区域配置案例经典文稿

第页2023H3C防火墙2区域配置案例H3C防火墙2区域配置案例

基于多年参加电力行业信息化的阅历，H3C公司推出电力信息网络平安加固解决方案，该解决方案主要由对终端平安防护和平安管理中心等关键部件组成。那么H3C防火墙2区域是怎么配置的呢?下面跟yjbys我一起来看看!

1、配置要求

1)防火墙的E0/2接口为TRUST区域，ip地址是：/29;

2)防火墙的E1/2接口为UNTRUST区域，ip地址是：/27;

3)内网效劳器对外网做一对一的地址映射，、分别映射为、;

4)内网效劳器访问外网不做限制，外网访问内网只放通公网地址9访问的`1433端口和的80端口。

2、防火墙的配置脚本如下server-typeextended

#

domainsystem

#

local-usernet1980

passwordcipher######

service-typetelnet

level2

#

aspf-policy1

detecth323

detectsqlnet

detectrtsp

detect

detectsmtp

detectftp

detecttcp

detectudp

#

objectaddress/3255

objectaddress/3255

#

aclnumber3001

descriptionout-inside

rule1permittcpsource90destination0destination-porteq1433

rule2permittcpsource90destination0destination-porteqwww

rule1000denyip

aclnumber3002

descriptioninside-to-outside

rule1permitipsource0

rule2permitipsource0

rule1000denyip

#

interfaceAux0

asyncmodeflow

#

interfaceEthernet0/0

shutdown

#

interfaceEthernet0/1

shutdown

#

interfaceEthernet0/2

speed100

duplexfull

descriptiontoserver

ipaddress48

firewallpacket-filter3002inbound

firewallaspf1outbound

#

interfaceEthernet0/3

shutdown

#

interfaceEthernet1/0

shutdown

#

interfaceEthernet1/1

shutdown

#

interfaceEthernet1/2

speed100

duplexfull

descriptiontointernet

ipaddress24

firewallpacket-filter3001inbound

firewallaspf1outbound

natoutboundstatic

#

interfaceNULL0

#

firewallzonelocal

setpriority100

#

firewallzonetrust

addinterfaceEthernet0/2

setpriority85

#

firewallzoneuntrust

addinterfaceEthernet1/2

setpriority5

#

firewallzoneDMZ

addinterfaceEthernet0/3

setpriority50

#

firewallinterzonelocaltrust

#

firewallinterzonelocaluntrust

#

firewallinterzonelocalDMZ

#

firewallinterzonetrustuntrust

#

firewallinterzonetrustDMZ

#

firewallinterzoneDMZuntrust

#

iproute-static0preference60

#

user-interfacecon0