龙空技术网

华为防火墙小型企业边界网关配置实例

蜗牛网工晨雨 1216

前言:

此时兄弟们对“防火墙配置实例”大体比较着重,你们都想要了解一些“防火墙配置实例”的相关文章。那么小编在网上搜集了一些关于“防火墙配置实例””的相关文章,希望同学们能喜欢,姐妹们快快来了解一下吧!

组网及规划:

华为USG6000作为边界网关实现企业内部网络出口,防火墙实现内部网络NAT功能实现访问Internet功能

实现公司财务部门访问内网服务器。

办公网络不能访问内网服务器,

办公室及财务部均可以访问外网。

外部网络可以通过NatServer实现外部网络通过8080端口访问内网服务器80端口。

网络规划:办公网地址段:192.168.10.0/24 VLAN:10

财务地址段:192.168.20.0/24 VLAN:20

服务器地址段:192.168.200.0/24

运营商固定IP地址:202.1.1.1/24

网络组网见下图:

办公接入交换机配置:

sysname BanGong

#

vlan batch 10

#

interface Eth-Trunk1

port link-type trunk

port trunk allow-pass vlan 10

#

interface GigabitEthernet0/0/1

port link-type access

port default vlan 10

interface GigabitEthernet0/0/23

eth-trunk 1

#

interface GigabitEthernet0/0/24

eth-trunk 1

财务接入交换机配置:

sysname CaiWu

#

vlan batch 20

interface Eth-Trunk1

port link-type trunk

port trunk allow-pass vlan 20

#

interface GigabitEthernet0/0/1

port link-type access

port default vlan 20

interface GigabitEthernet0/0/23

eth-trunk 1

#

interface GigabitEthernet0/0/24

eth-trunk 1

#

核心交换机配置:

sysname SW

#

undo info-center enable

#

vlan batch 10 20 100

#

interface Vlanif10

ip address 192.168.10.254 255.255.255.0

#

interface Vlanif20

ip address 192.168.20.254 255.255.255.0

#

interface Vlanif100

ip address 192.168.100.1 255.255.255.0

#

interface Eth-Trunk1

port link-type trunk

port trunk allow-pass vlan 10

#

interface Eth-Trunk2

port link-type trunk

port trunk allow-pass vlan 20

#

interface GigabitEthernet0/0/1

port link-type access

port default vlan 100

#

interface GigabitEthernet0/0/21

eth-trunk 2

#

interface GigabitEthernet0/0/22

eth-trunk 2

#

interface GigabitEthernet0/0/23

eth-trunk 1

#

interface GigabitEthernet0/0/24

eth-trunk 1

#

ip route-static 0.0.0.0 0.0.0.0 192.168.100.2

#

防火墙配置:

acl number 2000

rule 5 permit source 192.168.10.0 0.0.0.255

#

interface GigabitEthernet0/0/0

undo shutdown

ip address 202.1.1.1 255.255.255.0

#

interface GigabitEthernet1/0/0

undo shutdown

ip address 192.168.100.2 255.255.255.0

#

interface GigabitEthernet1/0/1

undo shutdown

ip address 192.168.200.254 255.255.255.0

#

firewall zone local

set priority 100

#

firewall zone trust

set priority 85

add interface GigabitEthernet1/0/0

#

firewall zone untrust

set priority 5

add interface GigabitEthernet0/0/0

#

firewall zone dmz

set priority 50

add interface GigabitEthernet1/0/1

#

ip route-static 0.0.0.0 0.0.0.0 GigabitEthernet0/0/0 202.1.1.2

ip route-static 192.168.10.0 255.255.255.0 192.168.100.1

ip route-static 192.168.20.0 255.255.255.0 192.168.100.1

#

nat server 0 protocol tcp global 202.1.1.1 8080 inside 192.168.200.1 www

#

security-policy

rule name policy_ses_1

source-zone trust

destination-zone untrust

source-address 192.168.10.0 mask 255.255.255.0

action permit

rule name policy_ses_2

source-zone trust

destination-zone dmz

source-address 192.168.20.0 mask 255.255.255.0

action permit

rule name policy_ses_3

source-zone trust

destination-zone untrust

source-address 192.168.20.0 mask 255.255.255.0

action permit

rule name Untrust_DMA

source-zone untrust

destination-zone dmz

destination-address 192.168.200.1 mask 255.255.255.255

action permit

#

nat-policy

rule name policy_nat_1

source-zone trust

egress-interface GigabitEthernet0/0/0

source-address 192.168.10.0 mask 255.255.255.0

action source-nat easy-ip

rule name policy_nat_2

source-zone trust

egress-interface GigabitEthernet0/0/0

source-address 192.168.20.0 mask 255.255.255.0

action source-nat easy-ip

验证配置:办公PC可以访问Internet,不能访内网问服务器。

财务PC:可以访问Internet,也可以访问内网服务器。

外网PC可以通过NATSERVER实现访问内网服务器:

标签: #防火墙配置实例 #防火墙配置案例