h3c防火墙怎么样设置

2016-12-02

h3c防火墙设置是怎么样的呢?想让防火墙更有效的防护我的h3c,该怎么办呢?下面由小编给你做出详细的h3c防火墙设置介绍!希望对你有帮助!

h3c防火墙设置一:

1、配置要求

1)防火墙的E0/2接口为TRUST区域,ip地址是:192.168.254.1/29;

2)防火墙的E1/2接口为UNTRUST区域,ip地址是:202.111.0.1/27;

3)内网服务器对外网做一对一的地址映射,192.168.254.2、192.168.254.3分别映射为202.111.0.2、202.111.0.3;

4)内网服务器访问外网不做限制,外网访问内网只放通公网地址211.101.5.49访问192.168.254.2的1433端口和192.168.254.3的80端口。

2、防火墙的配置脚本如下

dis cur

#

sysname H3CF100A

#

super password level 3 cipher 6aQ>Q57-$.I)0;4:(I41!!!

#

firewall packet-filter enable

firewall packet-filter default permit

#

insulate

#

nat static inside ip 192.168.254.2 global ip 202.111.0.2

nat static inside ip 192.168.254.3 global ip 202.111.0.3

#

firewall statistic system enable

#

radius scheme system

server-type extended

#

domain system

#

local-user net1980

password cipher ######

service-type telnet

level 2

#

aspf-policy 1

detect h323

detect sqlnet

detect rtsp

detect http

detect smtp

detect ftp

detect tcp

detect udp

#

object address 192.168.254.2/32 192.168.254.2 255.255.255.255

object address 192.168.254.3/32 192.168.254.3 255.255.255.255

#

acl number 3001

description out-inside

rule 1 permit tcp source 211.101.5.49 0 destination 192.168.254.2 0 destination-port eq 1433

rule 2 permit tcp source 211.101.5.49 0 destination 192.168.254.3 0 destination-port eq www

rule 1000 deny ip

acl number 3002

description inside-to-outside

rule 1 permit ip source 192.168.254.2 0

rule 2 permit ip source 192.168.254.3 0

rule 1000 deny ip

#

interface Aux0

async mode flow

#

interface Ethernet0/0

shutdown

#

interface Ethernet0/1

shutdown

#

interface Ethernet0/2

speed 100

duplex full

description to server

ip address 192.168.254.1 255.255.255.248

firewall packet-filter 3002 inbound

firewall aspf 1 outbound

#

interface Ethernet0/3

shutdown

#

interface Ethernet1/0

shutdown

#

interface Ethernet1/1

shutdown

#

interface Ethernet1/2

speed 100

duplex full

description to internet

ip address 202.111.0.1 255.255.255.224

firewall packet-filter 3001 inbound

firewall aspf 1 outbound

nat outbound static

#

interface NULL0

#

firewall zone local

set priority 100

#

firewall zone trust

add interface Ethernet0/2

set priority 85

#

firewall zone untrust

add interface Ethernet1/2

set priority 5

#

firewall zone DMZ

add interface Ethernet0/3

set priority 50

#

firewall interzone local trust

#

firewall interzone local untrust

#

firewall interzone local DMZ

#

firewall interzone trust untrust

#

firewall interzone trust DMZ

#

firewall interzone DMZ untrust

#

ip route-static 0.0.0.0 0.0.0.0 202.111.0.30 preference 60

#

user-interface con 0

user-interface aux 0

user-interface vty 0 4

authentication-mode scheme

#

h3c防火墙设置二:

1、可以找一下买给你设备的人,让他给你找人来上门服务。

2、也可以自己到官网上看看配置手册。

h3c防火墙设置三:

一般步骤是:

1、配置接口地址,包括公网IP和内网网关地址,

2、创建访问列表,开放IP访问,

3、做NAT转换,

4、做DHCP,为局域网电脑分配IP。

一般接法是:

互联网——防火墙——路由器——交换机,

防火墙做NAT地址转换及流量控制,

路由器可做DHCP服务器,

交换机可做VLAN划分。

更多相关阅读

最新发布的文章