华为Eudemon防火墙NAT配置实例

[原创]华为Eudemon防火墙NAT配置实例Post By：2007-7-11 11:35:00

贴一下我公司里防火墙的配置，希望能够起到抛砖引玉的作用。具体外网IP和内网ARP绑定信息已经用“x”替代，请根据实际情况更换。“／／”后面的部分是我导出配置后添加的注释。防火墙型号为华为Eudemon 200，E0/0/0口为外网接口，E0/0/1口为内网。另外此配置方法也完全适用于华为Secpath系列防火墙，略加改动也可适用于华为AR系列路由器。

------------------------------------------传说中的分隔线------------------------------------------

#

sysname Eudemon／／设置主机名

#

super password level 3 simple xxxxxxxx／／Ｓｕｐｅｒ密码为xxxxxxxx #

firewall packet-filter default permit interzone local trust direction inbound

firewall packet-filter default permit interzone local trust direction outbound

firewall packet-filter default permit interzone local untrust direction inbound

firewall packet-filter default permit interzone local untrust direction outbound

firewall packet-filter default permit interzone local dmz direction inbound

firewall packet-filter default permit interzone local dmz direction outbound

firewall packet-filter default permit interzone trust untrust direction inbound

firewall packet-filter default permit interzone trust untrust direction outbound

firewall packet-filter default permit interzone trust dmz direction inbound

firewall packet-filter default permit interzone trust dmz direction outbound

firewall packet-filter default permit interzone dmz untrust direction inbound

firewall packet-filter default permit interzone dmz untrust direction outbound／／设置默认允许所有数据包通过

#

青岛IT社区提醒：本地交易眼见为实，当面验货！不要嫌麻烦！交易地点建议在人多地方，防止抢劫！

QQ:

支持(0) 中立(0) 反对(0)

wanghaoqd 小大 2楼个性首页| QQ| 信息| 搜索| 邮箱| 主页| 手机号码所在地查询|

加好友发短信

蛋白超人

等级：退役版主帖子：206 7积分：185 威望：5精华：1 注册：2004-3-24

Post By：2007-7-11 11:35:00

nat address-group 1 ／／将ＩＳＰ分配的公网ＩＰ加入地址池１

nat server global inside

nat server global inside

nat server global inside

nat server global inside

nat server global inside ／／将几个公网ＩＰ地址映射到内部服务器

nat alg enable ftp

nat alg enable dns

nat alg enable icmp

nat alg enable netbios

undo nat alg enable h323

undo nat alg enable hwcc

undo nat alg enable ils

undo nat alg enable pptp

undo nat alg enable qq

undo nat alg enable msn

undo nat alg enable user-define

undo nat alg enable rtsp

firewall permit sub-ip

#

firewall statistic system enable

#

interface Aux0

async mode flow

link-protocol ppp

#

interface Ethernet0/0/0

ip address ／／设置外网端口ＩＰ地址，此处为网通分配的内部私有ＩＰ，

#

interface Ethernet0/0/1

ip address ／／设置内网ＩＰ地址，采用

#

interface NULL0

#

acl number 2000

rule 0 permit source ／／ACL 2000，目的是只允许

rule 1 deny

#

acl number 3001

rule 0 deny udp destination-port eq 445

rule 1 deny udp destination-port eq netbios-ns

rule 2 deny udp destination-port eq netbios-dgm

rule 3 deny udp destination-port eq netbios-ssn

rule 4 deny udp destination-port eq 1434

rule 5 deny tcp destination-port eq 135

rule 6 deny tcp destination-port eq 139

rule 7 deny tcp destination-port eq 389