华为防火墙配置

防火墙配置：

dis current-configuration #显示当前配置

[SRG]stp region-configuration #进入MST视图

[SRG]active region-configuration #激活MST配置

[SRG]interface GigabitEthernet 0/0/0 #进入GE0/0/0端口

[SRG-GigabitEthernet0/0/0]alias GE0/GMT #别名GE0管理

[SRG-GigabitEthernet0/0/0]ip add 192.168.100.1 255.255.255.0 #端口配置IP

[SRG-GigabitEthernet0/0/0]dhcp select interface #客户端从接口地址池中通过dhcp自动获取IP地址[SRG-GigabitEthernet0/0/0]dhcp server gateway-list 192.168.100.1 #DHCP服务默认网关

[SRG-GigabitEthernet0/0/0]dhcp server dns-list 8.8.8.8 #DNCP默认DNS

[SRG-GigabitEthernet0/0/1]ip add 192.168.200.1 255.255.255.0 #配置端口IP

[SRG-GigabitEthernet0/0/2]ip add 211.1.1.1 255.255.255.0 #配置公网IP

[SRG]interface NULL0 #建立伪接口，进行包的分发。当宝的目的和路由不匹配时候，则通过NULL0丢弃ps:如果通过默认路由进行分发的话就会形成环路

[SRG]firewall zone untrust #进入防火墙不信任区域

[SRG-zone-trust]add interface GigabitEthernet 0/0/2 #添加不信任区域端口

[SRG]firewall zone trust #进入防火墙信任区域

[SRG-zone-trust]add interface GigabitEthernet 0/0/0 #添加信任区域端口

[SRG]firewall zone dmz #进入防火墙了隔离区域

[SRG-zone-trust]add interface GigabitEthernet 0/0/1 #添加隔离区域端口

[SRG]firewall zone name usr1 #添加区域

[SRG-zone-usr1]set priority 86 #设置优先级

[SRG-zone-usr1]add interface GigabitEthernet 0/0/8 #添加端口

[SRG-zone-usr1]aaa #aaa认证协议

[SRG-aaa]local-user admin password cipher 123456 #设置用户名和加密密码

[SRG-aaa]local-user admin service-type web terminal telnet #允许三种登入方式

[SRG-aaa]local-user admin level 15 #设置等级为15级

[SRG-aaa]authentication-scheme default #验证方式默认及本地设备验证

[SRG-aaa]authorization-scheme default #验证方式默认及本地设备验证

[SRG-aaa]accounting-scheme default #验证方式默认及本地设备验证

[SRG-aaa]domain default #域缺省

[SRG]nqa-jitter tag-version 1

[SRG]banner enable

[SRG]user-interface con 0

[SRG-ui-console0]authentication-mode aaa 允许登陆模式为aaa

[SRG]user-interface vty 0 4

[SRG-ui-vty0-4]uthentication-mode aaa

[SRG-ui-vty0-4]protocol inbound all # 允许所有登陆协议

[SRG]slb #负载均衡

[SRG-slb]rserver 1 rip 192.168.200.201 weight 32 healthchk

[SRG-slb]rserver 2 rip 192.168.200.202 weight 32 healthchk

[SRG-slb]rserver 3 rip 192.168.200.203 weight 32 healthchk

[SRG-slb]group g1

[SRG-slb-group-g1]metric roundrobin #加权轮询算法分配连接

[SRG-slb-group-g1]addrserver 1

[SRG-slb-group-g1]addrserver 2

[SRG-slb-group-g1] addrserver 3

[SRG-slb] vserver ser1 vip 211.1.1.200 group g1

[SRG]firewall packet-filter default permit interzone local trust direction inbound

[SRG]firewall packet-filter default permit interzone local trust direction outbound #开启域间包过滤规则使得local和trust能ping通

[SRG]firewall packet-filter default permit interzone local untrust direction inbound

[SRG]firewall packet-filter default permit interzone local untrust direction outbound

[SRG]firewall packet-filter default permit interzone local dmz direction inbound

[SRG]firewall packet-filter default permit interzone local dmz direction outbound

[SRG]firewall packet-filter default permit interzone dmz untrust direction outbound