MSR常见应用场景配置指导(内部服务器访问典型配置篇)

1、MSR常见应用场景配置指导(内部服务器访问典型配置篇)  适用产品：       H3C MSR20、MSR30、MSR50 各系列的所有产品 适应版本：2008.8.15日之后正式发布的版本。绝大部分配置也适用之前发布的版本。 使用方法：根据实际应用场景，在本文配置指导基础上，做定制化修改后使用。实际组网中可能存在特殊要求，建议由专业人员或在专业人员指导下操作。 本文以MSR2010 产品， 2008.8.15日ESS 1710软件版本为案例（1710以后的版本同样支持）。H3C C

2、omware Platform SoftwareComware Software, Version 5.20, ESS 1710Comware Platform Software Version COMWAREV500R002B58D001SP01H3C MSR2010 Software Version V300R003B01D004SP01Copyright (c) 2004-2008 Hangzhou H3C Tech. Co., Ltd. All rights reserved.Compiled Aug 15 2008 13:57:11, RELEASE SOFTWARE 1.

3、1       内部服务器访问目前大部分企业会在内部网络搭建各种应用服务器，如：WWW、数据库和邮件服务器等，通过在网关设备上启用NAT内部服务器映射功能，可以使外网用户访问企业内部的服务器。但是这种配置下常常会碰到一个问题，外网PC可以正常地访问内部服务器，但是内部PC却无法通过域名或者公网地址访问内部服务器，这是由于网关设备没有启用NAT内部地址转换功能导致的。典型组网如下：  配置需求如下：1、 MSR采用单条以太网线路接入Internet；2、 内部存在WWW和SMTP服务器，要求外部PC可以通过访问域名访

4、问内部服务器；3、 内部可以通过域名或者公网地址访问内部服务器；典型配置如下：<H3C>dis cur# version 5.20, ESS 1711# sysname H3C# ipsec cpu-backup enable# nat aging-time tcp 300 nat aging-time udp 180 nat aging-time pptp 300 nat aging-time ftp-ctrl 300# domain default enable system# telne

5、t server enable# qos carl 1 source-ip-address range to 54 per-address qos carl 2 destination-ip-address range to 54 per-address#acl number 3001 name WANDefend rule 0 deny udp destination-port eq tftp rule 1 deny tcp destination-port e

6、q 4444 rule 2 deny tcp destination-port eq 135 rule 3 deny udp destination-port eq 135 rule 4 deny udp destination-port eq netbios-ns rule 5 deny udp destination-port eq netbios-dgm rule 6 deny tcp destination-port eq 139 rule 7 deny udp destination-port eq netbios-ssn&

7、#160;rule 8 deny tcp destination-port eq 445 rule 9 deny udp destination-port eq 445 rule 10 deny udp destination-port eq 593 rule 11 deny tcp destination-port eq 593 rule 12 deny tcp destination-port eq 5554 rule 13 deny tcp destination-port eq 9995 rule 14 deny tcp de

8、stination-port eq 9996 rule 15 deny udp destination-port eq 1434 rule 16 deny tcp destination-port eq 1068 rule 17 deny tcp destination-port eq 5800 rule 18 deny tcp destination-port eq 5900 rule 19 deny tcp destination-port eq 10080 rule 22 deny tcp destination-port eq

9、 3208 rule 23 deny tcp destination-port eq 1871 rule 24 deny tcp destination-port eq 4510 rule 25 deny udp destination-port eq 4334 rule 26 deny tcp destination-port eq 4331 rule 27 deny tcp destination-port eq 4557 rule 28 deny udp destination-port eq 4444 rule 29

10、 deny udp destination-port eq 1314 rule 30 deny tcp destination-port eq 6969 rule 31 deny tcp destination-port eq 137 rule 32 deny tcp destination-port eq 389 rule 33 deny tcp destination-port eq 138 rule 34 deny udp destination-port eq 136 rule 35 deny tcp destination-

11、port eq 1025 rule 36 deny tcp destination-port eq 6129 rule 37 deny tcp destination-port eq 1029 rule 38 deny tcp destination-port eq 20168 rule 39 deny tcp destination-port eq 4899 rule 40 deny tcp destination-port eq 45576 rule 41 deny tcp destination-port eq 1433

12、0;rule 42 deny tcp destination-port eq 1434 rule 43 deny udp destination-port eq 1433 rule 200 permit icmp icmp-type echo rule 201 permit icmp icmp-type echo-reply rule 202 permit icmp icmp-type ttl-exceeded rule 210 deny icmp rule 300 permit udp source-port eq dns 

13、;rule 310 permit tcp destination-port eq telnet rule 1000 permit ip destination 55 rule 2000 deny ipacl number 3003 name LANDefend rule 0 deny udp destination-port eq tftp rule 1 deny tcp destination-port eq 4444 rule 2 deny tcp destination-port eq 135

14、0;rule 3 deny udp destination-port eq 135 rule 4 deny udp destination-port eq netbios-ns rule 5 deny udp destination-port eq netbios-dgm rule 6 deny tcp destination-port eq 139 rule 7 deny udp destination-port eq netbios-ssn rule 8 deny tcp destination-port eq 445 rule

15、9 deny udp destination-port eq 445 rule 10 deny udp destination-port eq 593 rule 11 deny tcp destination-port eq 593 rule 12 deny tcp destination-port eq 5554 rule 13 deny tcp destination-port eq 9995 rule 14 deny tcp destination-port eq 9996 rule 15 deny udp destinatio

16、n-port eq 1434 rule 16 deny tcp destination-port eq 1068 rule 17 deny tcp destination-port eq 5800 rule 18 deny tcp destination-port eq 5900 rule 19 deny tcp destination-port eq 10080 rule 22 deny tcp destination-port eq 3208 rule 23 deny tcp destination-port eq 1871

17、60;rule 24 deny tcp destination-port eq 4510 rule 25 deny udp destination-port eq 4334 rule 26 deny tcp destination-port eq 4331 rule 27 deny tcp destination-port eq 4557 rule 28 deny udp destination-port eq 4444 rule 29 deny udp destination-port eq 1314 rule 30 deny tc

18、p destination-port eq 6969 rule 31 deny tcp destination-port eq 137 rule 32 deny tcp destination-port eq 389 rule 33 deny tcp destination-port eq 138 rule 34 deny udp destination-port eq 136 rule 35 deny tcp destination-port eq 1025 rule 36 deny tcp destination-port eq

19、6129 rule 37 deny tcp destination-port eq 1029 rule 38 deny tcp destination-port eq 20168 rule 39 deny tcp destination-port eq 4899 rule 40 deny tcp destination-port eq 45576 rule 41 deny tcp destination-port eq 1433 rule 42 deny tcp destination-port eq 1434 rule 4

20、3 deny udp destination-port eq 1433 rule 200 permit icmp icmp-type echo rule 201 permit icmp icmp-type echo-reply rule 202 permit icmp icmp-type ttl-exceeded rule 210 deny icmp rule 1000 permit ip source 55rule 1001 permit udp destination-port eq bootps

21、60;rule 2000 deny ipacl number 3200 rule 0 permit ip source 55 destination 55 rule 1000 deny ip#vlan 1#domain system access-limit disable state active idle-cut disable self-service-url disable#user-group system#local-user admin 

22、;password cipher .USE=B,53Q=QMAF4<1! authorization-attribute level 3 service-type telnet#interface Aux0 async mode flow link-protocol ppp#interface Ethernet0/0 port link-mode route firewall packet-filter 3001 inbound nat outbound nat server protocol tcp glo

23、bal www inside www nat server protocol tcp global smtp inside smtp ip address #interface NULL0#interface Vlan-interface1 ip address  qos car inbound carl 1 cir 512 cbs 32000 ebs 0 green pa

24、ss red discard qos car outbound carl 2 cir 1024 cbs 64000 ebs 0 green pass red discard nat outbound 3200 firewall packet-filter 3003 inbound#interface Ethernet0/1 port link-mode bridge#interface Ethernet0/2 port link-mode bridge#interface Ethernet0/3 port link-mode bridge#interface Ethernet0/4 port link-mode bridge#