hc防火墙配置实例.docx

集团标准化办公室：[VV986T-J682P28-JP266L8-68PNN] 集团标准化办公室：[VV986T-J682P28-JP266L8-68PNN] HC防火墙配置实例 本文为大家介绍一个H3C防火墙的配置实例，配置内容包括：配置接口IP地址、配置区域、配置NAT地址转换、配置访问策略等，组网拓扑及需求如下。 1、网络拓扑图 2、配置要求 1）防火墙的E0/2接口为TRUST区域，ip地址是：； 2）防火墙的E1/2接口为UNTRUST区域，ip地址是：； 3）内网服务器对外网做一对一的地址映射，、分别映射为、； 4）内网服务器访问外网不做限制，外网访问内网只放通公网地址访问的1433端口和的80端口。 3、防火墙的配置脚本如下 H3CF100Adis cur # sysname H3CF100A # super password level 3 cipher 6aQQ57-$.I)0;4:\(I41!!! # firewall packet-filter enable firewall packet-filter default permit # insulate # nat static inside ip global ip static inside ip global ip statistic system enable # radius scheme system server-type extended # domain system # local-user net1980 password cipher ###### service-type telnet level 2 # aspf-policy 1 detect h323 detect sqlnet detect rtsp detect http detect smtp detect ftp detect tcp detect udp # object address address number 3001 description out-inside rule 1 permit tcp source 0 destination 0 destination-port eq 1433 rule 2 permit tcp source 0 destination 0 destination-port eq www rule 1000 deny ip acl number 3002 description inside-to-outside rule 1 permit ip source 0 rule 2 permit ip source 0 rule 1000 deny ip # interface Aux0 async mode flow # interface Ethernet0/0 shutdown # interface Ethernet0/1 shutdown # interface Ethernet0/2 speed 100 duplex full description to server ip address packet-filter 3002 inbound firewall aspf 1 outbound # interface Ethernet0/3 shutdown # interface Ethernet1/0 shutdown # interface Ethernet1/1 shutdown # interface Ethernet1/2 speed 100 duplex full description to internet ip address packet-filter 3001 inbound firewall aspf 1 outbound nat outbound static # interface NULL0 # firewall zone local set priority 100 # firewall zone trust add interface Ethernet0/2 set priority 85 # firewall zone untrust add interface Ethernet1/2 set priority 5 # firewall zone DMZ add interface Ethernet0/3 set priority 50 # firewall interzone local trust