学习啦 > 学习电脑 > 电脑安全 > 防火墙知识 > h3c防火墙怎么样设置

h3c防火墙怎么样设置

时间: 林辉766 分享

h3c防火墙怎么样设置

  h3c防火墙设置是怎么样的呢?想让防火墙更有效的防护我的h3c,该怎么办呢?下面由学习啦小编给你做出详细的h3c防火墙设置介绍!希望对你有帮助!

  h3c防火墙设置一:

  1、配置要求

  1)防火墙的E0/2接口为TRUST区域,ip地址是:192.168.254.1/29;

  2)防火墙的E1/2接口为UNTRUST区域,ip地址是:202.111.0.1/27;

  3)内网服务器对外网做一对一的地址映射,192.168.254.2、192.168.254.3分别映射为202.111.0.2、202.111.0.3;

  4)内网服务器访问外网不做限制,外网访问内网只放通公网地址211.101.5.49访问192.168.254.2的1433端口和192.168.254.3的80端口。

  2、防火墙的配置脚本如下

  dis cur

  #

  sysname H3CF100A

  #

  super password level 3 cipher 6aQ>Q57-$.I)0;4:\(I41!!!

  #

  firewall packet-filter enable

  firewall packet-filter default permit

  #

  insulate

  #

  nat static inside ip 192.168.254.2 global ip 202.111.0.2

  nat static inside ip 192.168.254.3 global ip 202.111.0.3

  #

  firewall statistic system enable

  #

  radius scheme system

  server-type extended

  #

  domain system

  #

  local-user net1980

  password cipher ######

  service-type telnet

  level 2

  #

  aspf-policy 1

  detect h323

  detect sqlnet

  detect rtsp

  detect http

  detect smtp

  detect ftp

  detect tcp

  detect udp

  #

  object address 192.168.254.2/32 192.168.254.2 255.255.255.255

  object address 192.168.254.3/32 192.168.254.3 255.255.255.255

  #

  acl number 3001

  description out-inside

  rule 1 permit tcp source 211.101.5.49 0 destination 192.168.254.2 0 destination-port eq 1433

  rule 2 permit tcp source 211.101.5.49 0 destination 192.168.254.3 0 destination-port eq www

  rule 1000 deny ip

  acl number 3002

  description inside-to-outside

  rule 1 permit ip source 192.168.254.2 0

  rule 2 permit ip source 192.168.254.3 0

  rule 1000 deny ip

  #

  interface Aux0

  async mode flow

  #

  interface Ethernet0/0

  shutdown

  #

  interface Ethernet0/1

  shutdown

  #

  interface Ethernet0/2

  speed 100

  duplex full

  description to server

  ip address 192.168.254.1 255.255.255.248

  firewall packet-filter 3002 inbound

  firewall aspf 1 outbound

  #

  interface Ethernet0/3

  shutdown

  #

  interface Ethernet1/0

  shutdown

  #

  interface Ethernet1/1

  shutdown

  #

  interface Ethernet1/2

  speed 100

  duplex full

  description to internet

  ip address 202.111.0.1 255.255.255.224

  firewall packet-filter 3001 inbound

  firewall aspf 1 outbound

  nat outbound static

  #

  interface NULL0

  #

  firewall zone local

  set priority 100

  #

  firewall zone trust

  add interface Ethernet0/2

  set priority 85

  #

  firewall zone untrust

  add interface Ethernet1/2

  set priority 5

  #

  firewall zone DMZ

  add interface Ethernet0/3

  set priority 50

  #

  firewall interzone local trust

  #

  firewall interzone local untrust

  #

  firewall interzone local DMZ

  #

  firewall interzone trust untrust

  #

  firewall interzone trust DMZ

  #

  firewall interzone DMZ untrust

  #

  ip route-static 0.0.0.0 0.0.0.0 202.111.0.30 preference 60

  #

  user-interface con 0

  user-interface aux 0

  user-interface vty 0 4

  authentication-mode scheme

  #

  h3c防火墙设置二:

  1、可以找一下买给你设备的人,让他给你找人来上门服务。

  2、也可以自己到官网上看看配置手册。

  h3c防火墙设置三:

  一般步骤是:

  1、配置接口地址,包括公网IP和内网网关地址,

  2、创建访问列表,开放IP访问,

  3、做NAT转换,

  4、做DHCP,为局域网电脑分配IP。

  一般接法是:

  互联网——防火墙——路由器——交换机,

  防火墙做NAT地址转换及流量控制,

  路由器可做DHCP服务器,

  交换机可做VLAN划分。

  看了“ h3c防火墙怎么样设置”文章的还看了:

1.h3c路由器教程

2.isa如何限速

3.广播电视网络安全分析

4.无线路由器哪个牌子最好信号最稳定

5.详解源地址的策略路由设置方法

775654