华为usg2210防火墙配置实例

<USG2200>display current-configurationdetect h323d09:29:14 2016/03/17detect qq#sysname USG2200detect#sl2tp enabledetect netbiundo l2tp domain suffix-separator @undo tunnel authentic#iike dpd interval 10allow l2tp#ifirewall packet-filter default permit interzone local trust direction inbound unicastundo synchronization#firewall packet-filter default permit interzone local trust direction outboundlocal-user user2firewall packet-filter default permit interzone local untrust direction inboundlocal-user user3 password cipher %$%$`;WkNM${E;O=5--=%yfirewall packet-filter default permit interzone local untrust direction outboundal-user user3 service-type ppp local-user useauthentication-mode vpndb#nat server 1 protocol udp global 218.56.104.*** any inside 192.100.7.73 anyheme test.scmauthorization-mode vpndb#ip df-unreachables enableaccounting-scheme defaultdomain dot1xfirewall ipv6 statistic system enableauthentication-scheme test.sc#dns resolvefirewall defend syn-flood enablefirewall defend arp-flood enablefirewall defend sip-flood enablefirewall defend udp-flood fingerprint-hit destination-max-rate 5firewall defend udp-flood fingerprint-hit source-max-rate 3firewall defend sip-flood port range 1 65535#firewall statistic system enable#pki certificate access-control-policy default permit#dns proxy enable#license-server domain #web-manager enableweb-manager security enable port 8443#user-manage web-authentication security port 8888##radius-server template test.tpl##ldap-server template test.tplldap-server authentication base-dn dc=my-domain,dc=com ldap-server group-filter ouldap-server authentication-filter (objectclass=*) ldap-server user-filter cnldap-server server-type ad-ldap#acl number 2001rule 5 permit source 192.100.7.0 0.0.0.255 rule 10 permit source 10.10.10.0 0.0.0.255acl number 3000rule 5 permit udp source-port eq 1701 rule 10 permit udp destination-port eq 1701 #acl number 3001#ike proposal 1encryption-algorithm 3des-cbcdh group2 group1integrity-algorithm aes-xcbc-96 hmac-sha1-96 hmac-md5-96 #ike peer ike20111583362exchange-mode autoike negotiate compatiblepre-shared-key %$%$sEPH;hfv{*71&V3Zc:QS^C:1%$%$ ike-proposal 1remote-id-type none#ipsec proposal prop20111583362encapsulation-mode autoesp authentication-algorithm sha1esp encryption-algorithm 3des#ipsec policy-template tpl20111583362 1 security acl 3000security acl public-ip-transparentike-peer ike20111583362alias celue1scenario point-to-multipoint l2tp-user-access proposal prop20111583362local-address applied-interfacesa duration traffic-based 1843200sa duration time-based 3600#ipsec policy ipsec2011158331 10000 isakmp template tpl #interface Cellular0/1/0link-protocol ppp#interface Virtual-Template0ppp authentication-mode chap papalias L2TP_LNS_0remote address pool#interface GigabitEthernet0/0/0ip address 10.10.10.1 255.255.255.0#interface GigabitEthernet0/0/1ip address 218.56.104.*** 255.255.255.252 ipsec policy ipsec2011158331 auto-neg nat enabledetect ftp#interface NULL0alias NULL0#firewall zone localset priority 100#firewall zone trustset priority 85detect ftpdetect rtspenticationdetect mmsUsdetect mgcpUsernamedetect sipsername:detect pptpme:admindetect sqlnetword:*detect h323n failed!detect qqUsedetect msndetect netbiosICE:This is a padd interface GigabitEthernet0/0/0 #firewall zone untrustccess or use may leadset priority 5detect ftpdetect rtspWarndetect mmsefault authdetect mgcpthod and pasdetect sipsole.detect pptpdetect sqlnetdetect h323G2200>detect qqor the sakdetect msny, please mdetect dnsiginal passdetect ilsuser.detect netbiosadd interface GigabitEthernet0/0/1<USG2200>display cyrrent-c#ffirewall zone dmzset priority 50 ^detect ftpErrodetect rtspmeter founddetect mmsion.detect mgcpdetect sipdetect ftp09detect rtsp03/17detect mms#detect pptpp domain sufdetect sqlnetdetect h323#detect qqterval 10detect dns#detect ilsket-filterdetect netbiosnterzone local#ufirewall zone name us2set priority 66detect ftpfirdetect rtspfilter defaudetect mmsterzone locdetect mgcpction outboudetect sipdetect pptpdetect sqlnetdetect h323packet-filtedetect qqermit intedetect dnsuntrust dirdetect ilsnddetect netbios#firewall interzone local trustdetect dnsdetect ilsdetect netbiosfirew#lfirewall interzone local untrusterzone local dmz direction outbo detect ftpdetect sqlnetus1 directiondetect h323detect rtspdetect qqdetect msnfirewalldetect dnsr default pdetect ilsone local udetect netbiosbound#firewall interzone local dmz detect ftpall packet-detect mmslt permit idetect mgcpt untrust didetect pptpnddetect sipdetect sqlnetdetect h323firewaldetect rtsper default pdetect qqzonedetect msndetectdetect mmsfirewaldetect mgcper default pdetect pptpne trust dmzdetect siputbounddetect sqlnetdetect h323detect rtspfirewadetect qqilter defadetect dnsnterzone dmdetect ilsrection inbdetect netbios#detect mmsone dmz untdetect mgcpn outbounddetect pptpdetect sipdetect sqlnetdetect h323r 0 protocoldetect rtsp18.56.104.18detect qqe 192.100.detect dnsdetect ilsdetect netbios#firewall interzone trust untrustlobal 218.56.104.*** any inside detect ftp anydetect mmsdetect mgcpdetect pptp#detect siphables enabdetect sqlnet#detect h323v6 sessiondetect rfirewall defend http-flooddetect ftpdetect mmsfirewadetect mgcpt-scan enabldetect pptpdetect sipewall defendetect sqlnetledetect h323firewdetect rtspmp-flood enadetect qqdetect msndetect ilsdetect netbioswall defend syn#lfirewall interzone trust us1firewall defendetect ftpenabledetect mmsdetect mgcp defend sip-detect pptpdetect sipfirdetect sqlnetp-flood fingerdetect h323tination-maxdetect rtspdetect qqdetect dnsdetect ilsdefend udp-detect netbiost-hit source-ma#rfirewall interzone trust us2 detect ftpwall defenddetect mmsort range 1detect mgcpdetect pptpdetecdetect ilsdetect netbios##sfirewall interzone dmz untrustlicense-server domain lic.hudetect ftpdetect mms#detect mgcp enabledetect pptpweb-managerdetect sipable port 8user-managdetect rtspication secudetect qq888detect msndetect dns#detect ilsrver templadetect netbios#firewall interzone us1 untrustlate test.tpl detect ftpldap-servdetect mmsation base-detect mgcpin,dc=comdetect pptpdetect sipdetect sqlneter group-filtedetect h323detect rtsp-server authdetect qqfilter (obdetect dnsdetect ilsdetect netbiosldap-server u#rfirewall interzone us2 untrustldap-server server-typdetect ftpdetect m#5firewall interzone us1 dmz#acl ndetect ftpdetect mmsermit udp sdetect mgcp 1701detect pptpdetect sip 10 permitdetect rtsp#acldetect qq1detect dnse proposaldetect ilsencrypdetect netbiosdes-cbc#firewall interzone us2 dmzup2 group1 detect ftp-algorithmdetect mmshmac-sha1-9detect mgcpdetect pptpdetect sip#detect sqlnet111583362detect h323exchadetect rtspdetect qqe negotiatdetect dnsdetect ilspre-shadetect netbios;hfv{*71&V3Zc:Q#Cfirewall interzone us2 us1 detectdetect ilsdetect netbiosp encryption-al#r#hl2tp-group 1undo tunnel authenticationtemplate tpl20111583362 1 allow l2tp virtual-template 0security acl 3000#bgp 2#uripv4-family unicastnsparentundo synchronizationike-peer ike20111583#2aaalocal-user user2 password cipher %$%$c'D=2Et9!4PN)9O{Ix*S,d[R%$%$tipointl2tp-user-accesslocal-user user2 service-type ppplocal-addreslocal-user user2 level 0local-user user3 password cipher %$%$`;WkNM${E;O=5--=%y)-;\SJ%$%$sa duration time-based 3600#ipslocal-user user3 service-type pppkmp template tpllocal-user user3local-user user5 password cipher %$%$mkyG076$a8C'6T6lJN)FG"vm%$%$ remote address pool#interfalocal-user user5 service-type pppip address 10.local-user user5 level 0local-user user1 password cipher %$%$#P{Q0BpNp"yz9!2LK54Bag^U%$%$ip address 218.56.104.*** 255.255.255.252local-user user1 service-type pppy ipsec2011158331 auto-neglocal-user user1 level 0nat enablelocal-user huawei password cipher %$%$-a$}Vs@0k&S}SpNMuu/E6e\S%$%$ULL0 #firewall zone localset prilocal-user huawei password valid-days 999 trustset priority 85local-user huawei serv ftpdeauthentication-scheme test.scmdetect sipauthentication-mode vpndbdetect sqlnet#deauthorization-scheme defaultqqdetect msnauthorization-scheme test.scmdetect ilsdetectauthorization-mode vpndbinterface GigabitEthernet0/#accounting-scheme default#firewall zone dm#domain defaultet priority 50domain dot1xdetect ftpdomain test.domct rtspauthentication-scheme test.scm mgcpdetect sipdetect mmsdip route-static 192.100.7.0 255.255.255.0 10.10.10.2 pptp detect sqlnetdete#banner enabledetect qq#v-gateway test 218.56.104.*** private detect netbios#firewall zone#auser-interface con 0set priorituser-interface tty 2 3etect ftpmodem bothuser-interface vty 0 4detect mgcpauthentication-mode aaadetect pptpprotocol inbound alldetect h32#ip address-set sslvpn type objectetect dnsdetect ilsaddress 0 11.50.1.0 mask 24#firewall int#zsa l#aslbust#cwmp#detect h32policy 1detecaction permitdetect qqpolicy source 1.5.1.0 mask 24 detect dnsdetectpolicy destination 1.5.2.0 mask 24#firewall interzone localpolicy 0action permittect ftppolicy source 1.4.1.0 mask 24ect mgcpdetect pppolicy destination 1.3.1.0 mask 24detect sqlnetdetec#hnat-policy interzone trust untrust outboundtect qq detect msnnetwork-extension enablenetwork-extension point-to-point enablenetwork-extension netpool 10.5.5.50 10.5.5.150 255.255.255.0 network-extension mode manualnetwork-extension manual-route 10.5.5.0 255.255.255.0network-extension manual-route 124.0.0.0 255.0.0.0network-extension manual-route 119.0.0.0 255.0.0.0network-extension manual-route 183.0.0.0 255.0.0.0network-extension manual-route 111.0.0.0 255.0.0.0network-extension manual-route 1.0.0.0 255.0.0.0network-extension manual-route 11.0.0.0 255.0.0.0network-extension manual-route 12.0.0.0 255.0.0.0network-extension manual-route 13.0.0.0 255.0.0.0network-extension manual-route 14.0.0.0 255.0.0.0network-extension manual-route 15.0.0.0 255.0.0.0network-extension manual-route 16.0.0.0 255.0.0.0network-extension manual-route 17.0.0.0 255.0.0.0network-extension manual-route 18.0.0.0 255.0.0.0network-extension manual-route 19.0.0.0 255.0.0.0network-extension manual-route 20.0.0.0 255.0.0.0securitypolicy-default-action permit user-src-ippolicy-default-action permit user-dst-ippolicy-default-action permit user-urlpolicy-default-action permit vt-src-ippassword-setting password-intension low 8 high 31 digits 1 letters 2 mix password-setting safe-policy 1password-setting lifetime 0 alarm 0certification cert-anonymous cert-field user-filter subject cn group-filter subject cncertification cert-anonymous filter-policy permit-allcertification cert-challenge cert-field user-filter subject cncertification user-cert-filter key-usage any#****END****##return<USG2200><USG2200><USG2200><USG2200><USG2200>。