H3C防火牆2區域配置案例
基於多年參與電力行業資訊化的經驗,H3C公司推出電力資訊網路安全加固解決方案,該解決方案主要由對終端安全防護和安全管理中心等關鍵部件組成。那麼H3C防火牆2區域是怎麼配置的呢?下面跟yjbys小編一起來看看!
1、配置要求
1)防火牆的E0/2介面為TRUST區域,ip地址是:;
2)防火牆的'E1/2介面為UNTRUST區域,ip地址是:;
3)內網伺服器對外網做一對一的地址對映,、分別對映為、;
4)內網伺服器訪問外網不做限制,外網訪問內網只放通公網地址訪問的1433埠和的80埠。
2、防火牆的配置指令碼如下
dis cur
#
sysname H3CF100A
#
super password level 3 cipher 6aQ>Q57-$.I)0;4:(I41!!!
#
firewall packet-filter enable
firewall packet-filter default permit
#
insulate
#
nat static inside ip global ip
nat static inside ip global ip
#
firewall statistic system enable
#
radius scheme system
server-type extended
#
domain system
#
local-user net1980
password cipher ######
service-type telnet
level 2
#
aspf-policy 1
detect h323
detect sqlnet
detect rtsp
detect http
detect smtp
detect ftp
detect tcp
detect udp
#
object address
object address
#
acl number 3001
description out-inside
rule 1 permit tcp source 0 destination 0destination-port eq 1433
rule 2 permit tcp source 0 destination 0destination-port eq www
rule 1000 deny ip
acl number 3002
description inside-to-outside
rule 1 permit ip source 0
rule 2 permit ip source 0
rule 1000 deny ip
#
interface Aux0
async mode flow
#
interface Ethernet0/0
shutdown
#
interface Ethernet0/1
shutdown
#
interface Ethernet0/2
speed 100
duplex full
description to server
ip address
firewall packet-filter 3002 inbound
firewall aspf 1 outbound
#
interface Ethernet0/3
shutdown
#
interface Ethernet1/0
shutdown
#
interface Ethernet1/1
shutdown
#
interface Ethernet1/2
speed 100
duplex full
description to internet
ip address
firewall packet-filter 3001 inbound
firewall aspf 1 outbound
nat outbound static
#
interface NULL0
#
firewall zone local
set priority 100
#
firewall zone trust
add interface Ethernet0/2
set priority 85
#
firewall zone untrust
add interface Ethernet1/2
set priority 5
#
firewall zone DMZ
add interface Ethernet0/3
set priority 50
#
firewall interzone local trust
#
firewall interzone local untrust
#
firewall interzone local DMZ
#
firewall interzone trust untrust
#
firewall interzone trust DMZ
#
firewall interzone DMZ untrust
#
ip route-static preference 60
#
user-interface con 0
user-interface aux 0
user-interface vty 0 4
authentication-mode scheme
#