H3C防火墙配置

发布时间：2019-09-10 09:14:46编辑：auto阅读（1625）

    wKiom1lfS1PwSvXJAAB1Yj6-WBs085.png-wh_50

    <H3C>sys

    [H3C]int g1/0/1

    [H3C-GigabitEthernet1/0/1]ipadd 123.232.115.11 24

    [H3C-GigabitEthernet1/0/1]qu

    [H3C]int g1/0/3

    [H3C-GigabitEthernet1/0/3]ipadd 192.168.10.1 24

    [H3C-GigabitEthernet1/0/3]qu

     

    [H3C]interfaceGigabitEthernet 1/0/1

    [H3C-GigabitEthernet1/0/1]nat outbound

     

    [H3C]iproute-static 0.0.0.0 0 123.232.115.10

     

     

    配置ACL 3000，定义规则：允许IP流量。

    [H3C]acladvanced 3000

    [H3C-acl-ipv4-adv-3000]rule permit ip

    [H3C-acl-ipv4-adv-3000]qu

     

    向安全域Untrust中添加接口GigabitEthernet1/0/1

    [H3C]security-zone name Untrust

    [H3C-security-zone-Untrust]import interfaceGigabitEthernet 1/0/1

    [H3C-security-zone-Untrust]qu

    向安全域Trust中添加接口GigabitEthernet1/0/3

    [H3C]security-zone name Trust

    [H3C-security-zone-Trust]import interfaceGigabitEthernet 1/0/3

    [H3C-security-zone-Trust]qu

     

    [H3C]zone-pair security source Trustdestination local

    [H3C-zone-pair-security-Trust-Local]packet-filter3000

    [H3C-zone-pair-security-Trust-Local]qu

    [H3C]zone-pairsecurity source local destination Trust

    [H3C-zone-pair-security-Local-Trust]packet-filter3000

    [H3C-zone-pair-security-Local-Trust]qu

    [H3C]zone-pair security source Trustdestination Untrust

    [H3C-zone-pair-security-Trust-Untrust]packet-filter3000

    [H3C-zone-pair-security-Trust-Untrust]qu

    如果设备上多个端口加入同一个安全域，那么还需要加一条下面命令，否则同一个端口下面的终端之间是不能互通的。

    [H3C]security-zone intra-zone default permit

     

    DHCP配置：

    [H3C]dhcp enable

    [H3C]dhcp serverip-pool 10

    [H3C-dhcp-pool-10]network192.168.10.20 mask 255.255.255.0

    [H3C-dhcp-pool-10]gateway-list 192.168.10.1

    [H3C-dhcp-pool-10]dns-list 202.102.152.3202.102.128.68

    定义各DHCP地址池禁止分配的IP地址（开始～结束）

    [H3C-dhcp-pool-10]dhcp server forbidden-ip 192.168.10.1   192.168.10.100

    http配置：

    [H3C]ip httpenable

    [H3C]ip https enable

    [H3C]local-useradmin

    [H3C-luser-manage-admin]service-typehttp https

    [H3C-luser-manage-admin]password simple 123456


关键字：

上一篇： CentOS编译安装Python3.6.

下一篇： Python网络爬虫实战案例之：7000