防火墙认证用户部署

1、配置vlan

vlan batch 10 20
[Huawei-GigabitEthernet0/0/2]port link-type access 	
[Huawei-GigabitEthernet0/0/2]port default vlan 10
[Huawei-GigabitEthernet0/0/1]port link-type trunk 
[Huawei-GigabitEthernet0/0/1]port trunk allow-pass vlan 10 20
[Huawei-GigabitEthernet0/0/1]undo port trunk allow-pass  vlan 1

2、防火墙配置

[FW-GigabitEthernet1/0/0]ip address 10.0.0.254 24
[FW-GigabitEthernet1/0/2]ip address 100.1.1.10 24

（1）配置安全区域

（2）接口加入安全区域

(3)fw配置DHCP

[FW]ip pool dhcp-a
[FW-ip-pool-dhcp-a]network 172.16.1.0 mask 255.255.255.0 
[FW-ip-pool-dhcp-a]gateway-list 172.16.1.254
[FW-ip-pool-dhcp-a]dns-list 10.0.0.30
[FW-GigabitEthernet1/0/1.1]dhcp select global
[FW-GigabitEthernet1/0/1.2]dhcp select global 
display  current-configuration---查看设备中DHCP地址池相关配置

(4)地址组

（5）管理员

(6)用户认证

配置认证域


配置用户组

创建用户

认证策略

配置安全策略

测试