当前位置：首页 > news >正文

【网工】华为配置专题进阶篇④

news 2025/6/21 17:30:21

■防火墙配置

▲实验

■防火墙配置

▲实验

配置要求

①防火墙接口的IP地址如拓扑所示，将接口划入相应的安全区域。

②内网主机PC1可以主动访问Internet，但Internet无法主动访问PC1。

③出口防火墙进行NAT，NAT公网地址池100.1.1.10-100.1.1.20。

④Internet可以通过公网地址100.1.1.100/24访问目的地址为192.168.2.100/24 的内部Web服务。

Internet

<Huawei>system-view

[Huawei]sysname Internet

[Internet]interface GigabitEthernet 0/0/0

[Internet-GigabitEthernet0/0/0]ip add 100.1.1.2 24

[Internet-GigabitEthernet0/0/0]quit

[Internet]

Firewall

<USG6000V1>system-view

[USG6000V1]]sysname Firewall

[Firewall]

[Firewall]interface GigabitEthernet 1/0/1

[Firewall-GigabitEthernet1/0/1]ip address 192.168.1.254 24

[Firewall-GigabitEthernet1/0/1]quit

[Firewall] linterface GigabitEthernet 1/0/2

[Firewall-GigabitEthernet1/0/2]ip address 192.168.2.254 24

[Firewall-GigabitEthernet1/0/2]quit

[Firewall] interface GigabitEthernet 1/0/3

[Firewall-GigabitEthernet1/0/3]ip address 100.1.1.1 24

[Firewall-GigabitEthernet1/0/3]quit

[Firewall]

[Firewall]firewall zone untrust

[Firewall-zone-untrust]add interface GigabitEthernet 1/0/3

[Firewall-zone-untrust]quit

[Firewall]

[Firewall]firewall zone trust

[Firewall-zone-trust]add interface GigabitEthernet 1/0/1

[Firewall-zone-trust]quit

[Firewall]firewall zone dmz

[Firewall-zone-dmz] add interface GigabitEthernet 1/0/2

[Firewall-zone-dmz]quit

[Firewall]

[Firewall]security-policy

[Firewall-policy-security]rule name trust_to_untrust

[Firewall-policy-security-rule-trust_to_untrust]source-zone trust

[Firewall-policy-security-rule-trust_to_untrust]destination-zone untrust

[Firewall-policy-security-rule-trust_to_untrust]source-address 192.168.1.0 24

[Firewall-policy-security-rule-trust_to_untrust]destination-address any

[Firewall-policy-security-rule-trust_to_untrust]action permit

[Firewall-policy-security-rule-trust_to_untrust]quit

[Firewall]

# 配置NAT地址池，开启端口转换。

[Firewall] nat address-group addressgroupl

[Firewall-address-qroup-addressgroup1]mode pat

[Firewall-address-group-addressgroupl]section 0 100.1.1.10 100.1.1.20

[Firewall-address-group-addresagroupl]quit

[Firewall]

# 配置源NAT策略1，实现私网指定网段访问Internet时自动进行源地址转换。

[Firewall] nat-policy

[Firewall-policy-nat] rule name policy_natl

[Firewall-policy-nat-rule-policy natl] source-zone trust

[Firewall-policy-nat-rule-policy natl] destination-zone untrust

[Firewall-policy-nat-rule-policy natl] source-address 192.168.1.0 24

[Firewall-policy-nat-rule-policy natl] destination-address any

[Firewall-policy-nat-rule-policy natl] action source-nat address-group addressgroup1

[Firewall]security-policy

[Firewall-policy-security]rule name trust_to_dmz

[Firewall-policy-security-rule-trust_to_dmz]source-zone trust

[Firewall-policy-security-rule-trust_to_dmz]destination-zone dmz

[Firewall-policy-security-rule-trust_to_dmz]action permit

[Firewall-policy-security-rule-trust_to_dmz]quit

# 配置NAT Server功能，把内网Web服务映射到公网地址。

[Firewall] nat server policy_web protocol tcp global 100.1.1.100 80 inside 192.168.2.100 80

[Firewall] display firewall session table

[Firewall]security-policy

[Firewall-policy-security]rule name untrust_to_dmz

[Firewall-policy-security-rule-untrust_to_dmz]source-zone untrust

[Firewall-policy-security-rule-untrust_to_dmz]destination-zone dmz

[Firewall-policy-security-rule-untrust_to_dmz]destination-address 192.168.2.100 32

[Firewall-policy-security-rule-untrust_to_dmz]action permit