华三中低端防火墙产品主要技术参数H3CSecpathF1

合集下载

H3C+SecPath+F100系列防火墙配置

H3C SecPath F100系列防火墙配置初始化配置〈H3C〉system-view开启防火墙功能[H3C]firewall packet-filter enable[H3C]firewall packet-filter default permit分配端口区域[H3C] firewall zone untrust[H3C-zone-trust] add interface GigabitEthernet0/0[H3C] firewall zone trust[H3C-zone-trust] add interface GigabitEthernet0/1工作模式firewall mode transparent 透明传输firewall mode route 路由模式http 服务器使能HTTP 服务器 undo ip http shutdown关闭HTTP 服务器 ip http shutdown添加WEB用户[H3C] local-user admin[H3C-luser-admin] password simple admin[H3C-luser-admin] service-type telnet[H3C-luser-admin] level 3开启防范功能firewall defend all 打开所有防范切换为中文模式 language-mode chinese设置防火墙的名称 sysname sysname配置防火墙系统IP 地址 firewall system-ip system-ip-address [ address-mask ] 设置标准时间 clock datetime time date设置所在的时区 clock timezone time-zone-name { add | minus } time取消时区设置 undo clock timezone配置切换用户级别的口令 super password [ level user-level ] { simple | cipher } password取消配置的口令 undo super password [ level user-level ]缺缺省情况下，若不指定级别，则设置的为切换到 3 级的密码。

华三设备全参数介绍

第1章 H3C ER3100 企业级宽带路由器 (1)1.1 产品照片 (1)1.2 产品介绍 (2)1.3 主要特性： (2)1.4 技术规格 (3)第2章 H3C S3600系列智能弹性交换机 (5)2.1 产品简介 (5)2.2 产品特点 (6)2.3 产品规格 (8)2.4 典型组网 (11)第3章 H3C S1526可管理接入交换机 (14)3.1 产品概述 (14)3.2 产品规格 (14)3.3 典型组网 (17)第4章 SecPath F100-A防火墙 (17)4.1 产品概述 (17)4.2 产品特点 (18)4.3 产品规格 (19)4.4 典型组网 (23)第1章H3C ER3100 企业级宽带路由器1.1 产品照片1.2 产品介绍ER3100是H3C公司推出的一款高性能路由器，它主要定位于以太网/光纤/ADSL接入的SMB市场和政府、企业机构、网吧等网络环境，如需要高速Internet带宽的网吧、企业、学校和酒店等。

ER3100采用专业的64位网络处理器，主频高达500MHz，并且支持丰富的软件特性，如IP<->MAC地址绑定，ARP防攻击，流量限速，链接数限制等功能。

它是H3C ER系列路由器中的中端产品，中型网吧用户和企业用户的理想选择。

1.3 主要特性：●专业的64位网络处理器，主频高达500MHz●高性能，达到百兆线速转发●高处理性能：ER3100采用64位网络处理器，主频高达500MHz，同时配合DDRII高速RAM进行高速转发，可以达到百兆线速转发。

在实际应用中，典型的带机量为100~200台。

●ARP病毒双重防护ER3100通过IP<->MAC地址绑定功能，固定了网关的ARP列表，可以有效防止ARP欺骗引起的内网通讯中断；此外ER3100的免费ARP的定时发送机制，可以有效地避免局域网PC中毒后引发的ARP攻击。

●网络流量限速BT，迅雷等P2P软件对网络带宽的过度占用会影响到网内其他用户的正常业务，ER3100通过基于IP或基于NAT表项的网络流量限速机制可以有效地控制单台PC的上/下行流量和建立的NAT表项的个数，限制了P2P软件对网络带宽的过度占用，弹性带宽又保证了闲事对带宽的充分利用。

H3C SecPath F100系列防火墙配置教程

H3C SecPath F100系列防火墙配置教程初始化配置〈H3C〉system-view开启防火墙功能[H3C]firewall packet-filter enable[H3C]firewall packet-filter default permit分配端口区域[H3C] firewall zone untrust[H3C-zone-trust] add interface GigabitEthernet0/0[H3C] firewall zone trust[H3C-zone-trust] add interface GigabitEthernet0/1工作模式firewall mode transparent 透明传输firewall mode route 路由模式http 服务器使能HTTP 服务器 undo ip http shutdown关闭HTTP 服务器 ip http shutdown添加WEB用户[H3C] local-user admin[H3C-luser-admin] password simple admin[H3C-luser-admin] service-type telnet[H3C-luser-admin] level 3开启防范功能firewall defend all 打开所有防范切换为中文模式 language-mode chinese设置防火墙的名称 sysname sysname配置防火墙系统IP 地址 firewall system-ip system-ip-address [ address-mask ] 设置标准时间 clock datetime time date设置所在的时区 clock timezone time-zone-name { add | minus } time取消时区设置 undo clock timezone配置切换用户级别的口令 super password [ level user-level ] { simple | cipher } password取消配置的口令 undo super password [ level user-level ]缺缺省情况下，若不指定级别，则设置的为切换到3 级的密码。

华三中低端防火墙产品主要技术参数H3CSecpathF1

100万
6
每秒新建连接数
10K
7
虚拟防火墙
64
8
3DES加密性能
500Mbps
9
L2TP隧道数
1000
10
IPSec隧道数
3500
11
GRE隧道数
1000
12
扩展插槽数量
2
13
MTBF
41.68年
14
环境兼容性
工作电压支持100V~240V（交流），
工作温度支持0~40℃
工作湿度支持10～90%（不结露）
16
高可靠性Байду номын сангаас
必须支持负载分担和冗余备份
17
服务质量保证
支持流量监管（Traffic Policing），支持FIFO、PQ、CQ、WFQ、CBWFQ、RTPQ等队列技术，支持WRED拥塞幸免技术、支持GTS流量整形、支持CAR、LR接口限速
18
爱护性
19
安全爱护
支持治理员分级，可分≥4级
20
认证
支持本地认证，同时支持远端RADIUS认证
21
路由协议
支持静态路由、RIP、OSPF、策略路由
华三中低端防火墙产品主要技术参数H3CSecpathF1
特性
参考指标要求
1
产地
必须是具有自主知识产权的国产设备
2
认证
必须同时通过公安部、国家信息安全测评认证中心、国家保密局涉密信息系统、解放军信息安全测评中心的认证
3
端口数
≥4个10/100M/1000M以太网端口
4
防火墙吞吐量
850Mbps
5
并发连接数
11
抗攻击能力

H3C SecPath F100-C-SI防火墙 Web配置指导-5PW100-安全配置

目录1访问控制 ············································································································································ 1-11.1 概述 ··················································································································································· 1-11.2 配置访问控制····································································································································· 1-11.3 访问控制典型配置举例 ······················································································································ 1-3 2网站过滤 ············································································································································ 2-12.1 概述 ··················································································································································· 2-12.2 网站过滤典型配置举例 ······················································································································ 2-23 MAC地址过滤 ···································································································································· 3-13.1 概述 ··················································································································································· 3-13.2 配置MAC地址过滤····························································································································· 3-13.2.1 配置MAC地址过滤类型··········································································································· 3-13.2.2 配置要过滤的MAC地址··········································································································· 3-23.3 MAC地址过滤典型配置举例 ·············································································································· 3-3 4攻击防范 ············································································································································ 4-14.1 概述 ··················································································································································· 4-14.1.1 黑名单功能······························································································································ 4-14.1.2 入侵检测功能 ·························································································································· 4-14.2 配置黑名单 ········································································································································ 4-34.2.1 配置概述 ································································································································· 4-34.2.2 启用黑名单过滤功能 ··············································································································· 4-44.2.3 手动新建黑名单表项 ··············································································································· 4-44.2.4 查看黑名单······························································································································ 4-54.3 配置入侵检测····································································································································· 4-54.4 攻击防范典型配置举例 ······················································································································ 4-64.4.1 攻击防范典型配置举例 ··········································································································· 4-6 5应用控制 ············································································································································ 5-15.1 概述 ··················································································································································· 5-15.2 配置应用控制····································································································································· 5-15.2.1 配置概述 ································································································································· 5-15.2.2 加载应用程序 ·························································································································· 5-15.2.3 配置自定义应用程序 ··············································································································· 5-25.2.4 使能应用控制 ·························································································································· 5-35.3 应用控制典型配置举例 ······················································································································ 5-41 访问控制1.1 概述访问控制是指通过设置时间段、局域网内计算机的IP地址、端口范围和数据包协议类型，禁止符合指定条件的数据包通过，来限制局域网内的计算机对Internet的访问。

F100-C-EI

SecPath F100-C-EI防火墙1 产品概述SecPath F100-C-EI是H3C公司面向中小型企业用户开发的新一代专业防火墙设备。

支持外部攻击防范、内网安全、流量监控、邮件过滤、网页过滤、应用层过滤等功能，能够有效的保证网络的安全；采用ASPF（Application Specific Packet Filter）应用状态检测技术，可对连接状态过程和异常命令进行检测；提供多种智能分析和管理手段，支持邮件告警，支持多种日志，提供网络管理监控，协助网络管理员完成网络的安全管理；支持多种VPN业务，如L2TP VPN、GRE VPN、IPSec VPN和动态VPN等，可以构建多种形式的VPN；提供基本的路由能力，支持RIP、OSPF、路由策略及策略路由；支持丰富的QoS特性，提供流量监管、流量整形及多种队列调度策略。

SecPath F100-C-EI 防火墙产品2 产品特点市场领先的安全防护功能l增强型状态安全过滤：支持基础、扩展和基于接口的状态检测包过滤技术；支持H3C 特有ASPF应用层报文过滤（Application Specific Packet Filter）协议，支持对每一个连接状态信息的维护监测并动态地过滤数据包，支持对应用层协议的状态监控。

l抗攻击防范能力：包括多种DoS/DDoS攻击防范、ARP欺骗攻击的防范、超大ICMP 报文攻击防范、地址/端口扫描的防范、Tracert报文控制功能；静态和动态黑名单功能；MAC和IP绑定功能。

l应用层内容过滤：支持邮件过滤，提供SMTP邮件地址、标题、附件和内容过滤；支持网页过滤，提供HTTP URL和内容过滤。

l多种安全认证服务：支持RADIUS和HWTACACS协议及域认证；支持基于PKI/CA 体系的数字证书（X.509格式）认证功能；支持用户身份管理，不同身份的用户拥有不同的命令执行权限；支持用户视图分级，不同级别的用户赋予不同的管理配置权限。

H3C SecPath F100系列防火墙配置教程

H3C SecPath F100系列防火墙01-入门配置指导-基本配置

• 配置 NAT 静态转换
nat static local-ip [ vpn-instance local-name ] global-ip [ vpn-instance global-name ]
• 使配置在接口上生效
nat outbound static
nat outbound [ acl-number ] [ address-group group-number [ vpn-instance vpn-instance-name ] [ no-pat ] ] [ track vrrp virtual-router-id ]
目录
1 基本配置 ············································································································································ 1-1 1.1 概述 ···················································································································································1-1 1.2 通过Web方式进行设备基本配置 ·······································································································1-1 1.3 通过命令行方式进行设备基本配置 ····································································································1-8 1.4 业务配置说明·····································································································································1-9

H3C SecPath F1000-C详细参数

H3C SecPath F1000-C详细参数
切换到传统表格版
主要参数
设备类型企业级防火墙
网络端口
2*10/100/1000Mbps以太网口,2*10/100/1000Mbps以太网口,1*AUX口,1*Con
sole,2个MIM插槽
入侵检测Dos,DDoS
安全标准CE,FCC
管理支持标准网管SNMPv3,并且兼容SNMP v2c、SNMP v1,支持NTP时间同步,支持Web方式进行远程配置管理,支持Quidview BIMS系统进行设备管理,支持Quidview VPN Manager系统进行VPN业务管理和监控,命令行接口
VPN支持支持
一般参数
适用环境工作温度:0℃-45℃,相对湿度:10-95%无凝结
电源输入:100-240V ；50/60Hz,输出:12V,最大功率:100W
防火墙尺
寸
44×436×430mm
防火墙重
量
5kg
其他性能
支持外部攻击防范、内网安全、流量监控、邮件过滤、网页过滤、应用层过滤,
多种VPN业务等功能
产品特性
产品特性1 内存容量：512MB 闪存容量：16MB
主要参数
设备类型：企业级防火墙
网络端口：2*10/100/1000Mbps以太网口,2*10/100/1000Mbps以太网口,1*AUX口,1*Console,2个MIM插槽
入侵检测：Dos,DDoS。

H3C SecPath F100-C-EI 防火墙说明书

目录第1章产品介绍...............................................................................1-11.1 简介....................................................................................1-11.2 外观....................................................................................1-21.2.1 前面板......................................................................1-21.2.2 后面板......................................................................1-21.3 规格....................................................................................1-31.4 指示灯................................................................................1-31.5 固定接口.............................................................................1-41.5.1 配置口......................................................................1-41.5.2 以太网口..................................................................1-5第2章安装前准备工作....................................................................2-12.1 安装场所要求......................................................................2-12.1.1 温度/湿度要求..........................................................2-12.1.2 洁净度要求...............................................................2-12.1.3 防静电要求...............................................................2-22.1.4 电磁环境要求...........................................................2-42.1.5 防雷击要求...............................................................2-42.1.6 检查安装台...............................................................2-52.1.7 机柜安装要求...........................................................2-52.2 安全注意事项......................................................................2-52.2.1 安全标志..................................................................2-52.2.2 通用安全建议...........................................................2-62.2.3 用电安全..................................................................2-62.3 安装工具、仪表和设备.......................................................2-6第3章防火墙的安装.......................................................................3-13.1 防火墙安装流程..................................................................3-13.2 安装防火墙到指定位置.......................................................3-13.2.1 安装防火墙到工作台................................................3-23.2.2 安装防火墙到机柜....................................................3-23.3 连接保护地线......................................................................3-43.4 连接电源线.........................................................................3-53.5 连接接口电缆......................................................................3-73.5.1 连接配置口电缆.......................................................3-73.5.2 连接以太网电缆.......................................................3-83.6 安装后的检查......................................................................3-8第4章防火墙的启动与配置............................................................4-14.1 搭建配置环境......................................................................4-14.1.1 连接防火墙到配置终端............................................4-14.1.2 设置配置终端的参数................................................4-14.2 防火墙上电.........................................................................4-44.2.1 上电前检查...............................................................4-44.2.2 防火墙上电...............................................................4-54.2.3 上电后检查/操作......................................................4-54.3 启动过程.............................................................................4-54.4 防火墙配置的基本思路.......................................................4-64.5 命令行接口.........................................................................4-74.5.1 命令行接口的特点....................................................4-74.5.2 命令行接口...............................................................4-7第5章防火墙的软件维护................................................................5-15.1 Boot菜单.............................................................................5-15.1.1 防火墙的Boot菜单....................................................5-25.1.2 防火墙的Boot ROM子菜单......................................5-35.2 利用XModem协议完成应用程序和Boot ROM程序升级.........5-45.2.1 应用程序的升级.......................................................5-45.2.2 Boot ROM程序的升级..............................................5-75.2.3 Boot ROM程序扩展段的升级...................................5-85.3 通过TFTP完成应用程序的升级..........................................5-85.4 利用FTP完成程序/文件的上传下载..................................5-125.5 应用程序及配置文件的维护..............................................5-165.5.1 显示所有文件.........................................................5-165.5.2 删除文件................................................................5-175.6 Boot ROM程序扩展段的备份及恢复.................................5-185.6.1 在FLASH中备份Boot ROM程序的扩展段..............5-185.6.2 从FLASH中恢复Boot ROM程序扩展段..................5-185.7 口令丢失的处理................................................................5-195.7.1 用户口令丢失.........................................................5-195.7.2 Boot ROM口令丢失...............................................5-20第6章安装故障处理.......................................................................6-16.1 电源系统问题故障处理.......................................................6-16.2 配置系统故障处理..............................................................6-1插图目录图1-1 F100-C-EI防火墙前面板.................................................1-2图1-2 F100-C-EI防火墙后面板.................................................1-2图1-3 配置口电缆示意图..........................................................1-5图1-4 以太网电缆示意图..........................................................1-6图2-1 佩戴防静电手腕示意图...................................................2-4图3-1 防火墙安装流程..............................................................3-1图3-2 挂耳结构图.....................................................................3-2图3-3 安装左、右前挂耳到防火墙的两侧.................................3-3图3-4 固定防火墙到机架..........................................................3-3图3-5 连接保护地接地端子到防火墙........................................3-4图3-6 连接保护地线到接地排...................................................3-5图3-7 连接交流电源线..............................................................3-6图3-8 连接配置口电缆..............................................................3-7图4-1 新建连接........................................................................4-1图4-2 本地配置连接端口设置...................................................4-2图4-3 串口参数设置.................................................................4-2图4-4 超级终端窗口.................................................................4-3图4-5 终端类型设置.................................................................4-4图5-1 断开终端连接.................................................................5-5图5-2 修改波特率.....................................................................5-5图5-3 [发送文件]对话框............................................................5-6图5-4 正在发送文件界面..........................................................5-6图5-5 搭建TFTP升级环境........................................................5-9图5-6 搭建FTP升级环境........................................................5-12表格目录表1-1 F100-C-EI防火墙规格....................................................1-3表1-2 F100-C-EI指示灯含义....................................................1-3表1-3 配置口属性.....................................................................1-4表1-4 以太网口属性.................................................................1-5表2-1 机房温度/湿度要求.........................................................2-1表2-2 机房灰尘含量限值..........................................................2-2表2-3 机房有害气体限值..........................................................2-2第1章产品介绍1.1 简介H3C SecPath F100-C-EI防火墙设备（以下简称F100-C-EI）是H3C公司面向家庭办公、小型办公室（Small Office Home Office，SOHO）开发的新一代专业防火墙产品。

H3C SecPath F100系列防火墙配置

H3C SecPath F100系列防火墙配置2009-10-13 16:52:34标签：H3C防火墙配置初始化配置〈H3C〉system-view开启防火墙功能[H3C]firewall packet-filter enable[H3C]firewall packet-filter default permit分配端口区域[H3C] firewall zone untrust[H3C-zone-trust] add interface GigabitEthernet0/0[H3C] firewall zone trust[H3C-zone-trust] add interface GigabitEthernet0/1工作模式firewall mode transparent 透明传输firewall mode route 路由模式http 服务器使能HTTP 服务器 undo ip http shutdown关闭HTTP 服务器 ip http shutdown添加WEB用户[H3C] local-user admin[H3C-luser-admin] password simple admin[H3C-luser-admin] service-type telnet[H3C-luser-admin] level 3开启防范功能firewall defend all 打开所有防范切换为中文模式 language-mode chinese设置防火墙的名称 sysname sysname配置防火墙系统IP 地址 firewall system-ip system-ip-address [ address-mask ]设置标准时间 clock datetime time date设置所在的时区 clock timezone time-zone-name { add | minus } time取消时区设置 undo clock timezone配置切换用户级别的口令 super password [ level user-level ] { simple | cipher } password取消配置的口令 undo super password [ level user-level ]缺缺省情况下，若不指定级别，则设置的为切换到3 级的密码。

H3CF100-A-AC防火墙

H3C SecPath F100 系列防火墙稳定可靠功能全面H3C SecPath防火墙/VPN是业界功能最全面、扩展性最好的防火墙/VPN产品，集成防火墙、VPN和丰富的网络特性，为用户提供平安防护、平安远程接入等功能。

H3C SecPath F100系列防火墙包括SecPath F100-C/SecPath F100-C-EI/SecPath F100-S/SecPath F100-M/SecPath F100-A-SI/SecPath F100-A/SecPath F100-E等七款产品，支持外部攻击防X、内网平安、流量监控、过滤、网页过滤、应用层过滤等功能，能够有效的保证网络的平安；采用ASPF〔Application Specific Packet Filter〕应用状态检测技术，可对连接状态过程和异常命令进展检测；提供多种智能分析和管理手段，支持告警，支持多种日志，提供网络管理监控，协助网络管理员完成网络的平安管理；支持多种VPN业务，如L2TP VPN、GRE VPN、IPSec VPN、动态VPN等；支持RIP/OSPF/BGP/路由策略及策略路由；支持丰富的QoS特性，提供流量监管、流量整形及多种队列调度策略。

H3C F100-A-AC防火墙产品特点扩展性最强基于H3C 先进的OAA开放应用架构，SecPath防火墙能灵活扩展病毒防X、网络流量监控和SSL VPN等硬件业务模块，实现2-7层的全面平安。

强大的攻击防X能力能防御DoS/DDoS攻击〔如CC、SYN flood、DNS Query Flood、SYN Flood、UDP Flood等〕、ARP欺骗攻击、TCP报文标志位不合法攻击、Large ICMP报文攻击、地址扫描攻击和端口扫描攻击等多种恶意攻击，同时支持黑、MAC绑定、内容过滤等先进功能。

增强型状态平安过滤支持根底、扩展和基于接口的状态检测包过滤技术；支持H3C特有ASPF应用层报文过滤协议，支持对每一个连接状态信息的维护监测并动态地过滤数据包，支持对应用层协议的状态监控。

H3C SecPath F1000-S-AI 防火墙

H3C SecPath F1000-S-AI防火墙产品SecPath系列产品是H3C公司为企业和运营商用户设计的专业网络安全产品，通过将强大安全抵御功能、专业VPN服务和智能网络特性无缝集成在一个硬件平台上，不但能为用户提供广泛和深入的安全防护和安全连接功能，同时可以降低与安全相关的总体拥有成本以及部署的复杂程度，是网络安全解决方案的理想选择。

SecPath系列产品作为H3C公司iSPN（智能安全渗透网络）解决方案的重要组成部分，已经成为H3C公司IToIP核心理念中的IP自适应安全网络的坚实基础。

1 产品概述SecPath F1000-S-AI是H3C公司面向大型企业和运营商用户开发的新一代电信级防火墙设备。

SecPath F1000-S-AI采用了H3C公司最新的硬件平台和体系架构，实现防火墙性能的跨越式突破，可支持万兆接口、数十个GE接口，能满足电信级应用的需求。

SecPath F1000-S-AI支持外部攻击防范、内网安全、流量监控、邮件过滤、网页过滤、应用层过滤等功能，能够有效的保证网络的安全；采用ASPF（Application Specific Packet Filter）应用状态检测技术，可对连接状态过程和异常命令进行检测；提供多种智能分析和管理手段，支持邮件告警，支持多种日志，提供网络管理监控，协助网络管理员完成网络的安全管理；支持多种VPN业务，如GRE VPN、IPSec VPN、SSL VPN等，可以构建多种形式的VPN；提供基本的路由能力，支持RIP/OSPF/BGP/路由策略及策略路由；支持IPv4/IPv6双协议栈；支持丰富的QoS特性。

SecPath F1000-S-AI防火墙充分考虑网络应用对高可靠性的要求，充分满足网络维护、升级、优化的需求；支持双机状态热备，支持Active/Active和Active/Passive两种工作模式。

提供机箱内部环境温度检测功能，支持网管的统一管理。

(产品管理)华三中低端防火墙产品主要技术参数

19
安全维护
支持管理员分级，可分≥4级
20
认证
支持本地认证，同时支持远端RADIUS认证
21
路由协议
支持静态路由、RIP、OSPF、策略路由
11
抗攻击能力
要能够抵抗包括Land、Smurf、Fraggle、WinNuke、Ping of Death、Tear Drop、IP Spoofing、ARP Spoofing、ARP Flooding、地址扫描、端口扫描等攻击方式在内的攻击
12
防蠕虫病毒攻击能力
防火墙要能够抵抗蠕虫病毒爆发时的DoS和DDoS攻击
16
高可靠性
必须支持负载分担和冗余备份
17
服务质量保证
支持流量监管（Traffic Policing），支持FIFO、PQ、CQ、WFQ、CBWFQ、RTPQ等队列技术，支持WRED拥塞避免技术、支持GTS流量整形、支持CAR、LR接口限速
18
维护性
支持网管软件统一网管，支持TELNET、SSH、CONSOLE、SNMPv1、SNMPv2C、SNMPv3，支持NTP时间同步
工作湿度支持10～90%（不结露）
15
可扩展性
≥1个扩展槽
8
状态报文过滤
支持FTP、HTTP、SMTP、RTSP、H323协议簇的状态报文过滤
9
虚拟防火墙系统
必须支持虚拟防火墙系统，可以灵活划分安全区
10
VPN
必须支持IKE/IPSEC协议标准，支持加密算法（DES、3DES）及数字签名算法（MD5、SHA-1），支持NAT穿越草案，支持L2TP VPN，GRE VPN等多种VPN功能
4
防火墙吞吐量
850Mbps

SecPathF1000-E防火墙产品

SecPathF1000-E防火墙产品介绍
ISSUE 1.0
课程目标
学习完本课程，您应该能够：掌握SecPathF1000-E的基本产品特性掌握虚拟设备、区域、会话的概念掌握基本转发流程掌握透明模式、路由模式、混合模式下的组网和配置掌握包过滤、NAT、攻击防范的配置与问题排查方法

17
防火墙的详细处理流程——入方向
IP正规化（普通合法性检查）黑名单 URPF(与IPSPOOFING整合) 虚拟分片重组
IPSec预处理
Session-start
单包攻击和扫描处理
NAT
Flood攻击
QoS
IP路由等处理

18
防火墙的详细处理流程——出方向
interface GigabitEthernet0/1 port link-mode bridge port access vlan 100 combo enable copper # interface GigabitEthernet0/2 port link-mode bridge port access vlan 100 combo enable copper
业务高可扩展性
传承H3C多年网络设备制造经验，提供良好的网络 / IM/P2P流控的支持应用协议支持，国内首家高端IPv4/v6双栈防火墙
新型攻击方式的识别
电源风扇冗余设计，机箱温度自动监控硬件关键部件冗余设计
高可用性
多年成功应用于H3C电信级路由交换设备的软件平台健壮性 Comware平台，稳定性高，无系统漏洞支持全状态双机和负载均衡良好的组网能力

14
V5与V3会话管理的区别—V5的会话管理
NAT ASPF ATKPROC

H3C F100-A-AC防火墙

H3C SecPath F100 系列防火墙稳定可靠功能全面H3C SecPath防火墙/VPN是业界功能最全面、扩展性最好的防火墙/VPN产品，集成防火墙、VPN和丰富的网络特性，为用户提供安全防护、安全远程接入等功能。

H3C SecPath F100系列防火墙包括SecPath F100-C/SecPath F100-C-EI/SecPa th F100-S/SecPath F100-M/SecPath F100-A-SI/SecPath F100-A/SecPath F10 0-E等七款产品，支持外部攻击防范、内网安全、流量监控、邮件过滤、网页过滤、应用层过滤等功能，能够有效的保证网络的安全；采用ASPF（Application Specific Packet Filter）应用状态检测技术，可对连接状态过程和异常命令进行检测；提供多种智能分析和管理手段，支持邮件告警，支持多种日志，提供网络管理监控，协助网络管理员完成网络的安全管理；支持多种VPN业务，如L 2TP VPN、GRE VPN、IPSec VPN、动态VPN等；支持RIP/OSPF/BGP/路由策略及策略路由；支持丰富的QoS特性，提供流量监管、流量整形及多种队列调度策略。

H3C F100-A-AC防火墙产品特点扩展性最强基于H3C 先进的OAA开放应用架构，SecPath防火墙能灵活扩展病毒防范、网络流量监控和SSL VPN等硬件业务模块，实现2-7层的全面安全。

强大的攻击防范能力能防御DoS/DDoS攻击（如CC、SYN flood、DNS Query Flood、SYN Flood、UDP Flood等）、ARP欺骗攻击、TCP报文标志位不合法攻击、Large ICMP报文攻击、地址扫描攻击和端口扫描攻击等多种恶意攻击，同时支持黑名单、MAC绑定、内容过滤等先进功能。

增强型状态安全过滤支持基础、扩展和基于接口的状态检测包过滤技术；支持H3C特有ASPF应用层报文过滤协议，支持对每一个连接状态信息的维护监测并动态地过滤数据包，支持对应用层协议的状态监控。

H3C SecPath F100系列防火墙01-入门配置指导-基本配置

该命令在接口视图下执行
1-8
操作
基于ACL的 NAT Server
命令
nat server protocol pro-type global acl-number inside local-address [ local-port ] [ vpn-instance local-name ]
配置接口的IP地址
(12) 在 NAT 配置页面单击<下一步>按钮，进入如下图所示的页面。图1-6 6/6: 基本配置向导
1-7
(13) 设置在提交配置的同时是否将设备当前的配置保存到下次启动配置文件（包括.cfg 文件和.xml 文件），并确认配置的参数是否正确，如果需要修改，则单击<上一步>按钮返回到前面的页面对配置进行修改。
接口指定 IP 地址和网络掩码
• DHCP：表示接口通过 DHCP 协议自动获取 IP 地址 • 保持现有配置：表示保持接口 IP 地址的现有配置不变
修改当前接入接口的 IP 地址将导致与设备的连接中断，请谨慎操作
当接口获取IP地址的方式为“静态地址”时，设置接口的IP 地址和网络掩码
(10) 在接口 IP 地址配置页面单击<下一步>按钮，进入 NAT 配置页面，如下图所示。图1-5 5/6: 基本配置向导（NAT 配置）
外部IP地址：端口内部IP地址：端口
配置内部服务器功能可能会导致与设备的连接中断（例如将外部 IP 地址指定为本地主机的 IP 地址或当前接入接口的 IP 地址时），请谨慎操作
启用内部服务器时，设置服务器提供给外部访问的合法IP地址和服务端口号
启用内部服务器时，设置服务器在内部局域网的IP地址和服务端口号
设置是否在设备上启用Telnet服务缺省情况下，Telnet服务处于关闭状态