HC防火墙配置实例

1、本文为大家介绍一个H3C防火墙的配置实例，配置内容包括：配置接口IP地址、配置区域、配置 NAT地址转换、配置 访 问 策 略 等， 组 网 拓 扑 及 需 求 如 下1、网络拓扑图2、配置要求3、防火墙的配置脚本如下discur#sys nameH3CF100A#superpasswordlevel3cipher6aQQ57-$.l)0;4:(l41!#firewallpacket-filtere nablefirewallpacket-filterdefaultpermit#in sulate#n atstatic in sideipglobalipn atstatic in sideip

2、globalip#firewallstatisticsysteme nable#radiusschemesystemserver-typeexte nded#domai nsystem#local-user net1980passwordcipher#service-typete lnetlevel2#aspf-policy1detecth323detectsq lnetdetectrtspdetecthttpdetectsmtpdetectftpdetecttcpdetectudp#objectaddressobjectaddressacln umber3001descripti on ou

3、t-i nsiderulelpermittcpsourceOdesti nati onO dest in ati on-porteq1433 rule2permittcpsource0desti nati onO dest in ati on-porteqwww rulelOOOde nyipacl number3002descripti onin side-to-outsiderulelpermitipsourceOrule2permitipsource0rulelOOOde nyip#in terfaceAuxOasyn cmodeflow#in terfaceEthern etO/Osh

4、utdow n#in terfaceEthern etO/1shutdow n#in terfaceEthern etO/2speed100duplexfulldescripti on toserveripaddressfirewallpacket-filter3002i nbou nd firewallaspf1outbou nd#in terfaceEthern etO/3shutdow n#in terfaceEther net1/Oshutdow n#in terfaceEther net1/1shutdow n#in terfaceEther net1/2speed100duplex

5、fulldescripti ontointernetipaddressfirewallpacket-filter3001i nbou nd firewallaspf1outbou ndn atoutbou ndstaticin terfaceNULLO#firewallz on elocalsetprioritylOO#firewallzon etrustaddi nterfaceEthernet0/2setpriority85#firewallz oneun trustaddi nterfaceEthern et1/2setpriority5#firewallz on eDMZaddi nterfaceEthernet0/3setpriority50#firewalli nterz on elocaltrust#firewalli nterz on elocalu ntrust#firewalli nterz on elocalDMZ#firewalli nterz on etrustu ntrust#firewall in terz on etrustDMZ#firewalli nterz on eDMZu ntrust#iproute-staticprefere nce60#user-