《华为防火墙设置948.pdf》由会员分享，可在线阅读，更多相关《华为防火墙设置948.pdf（6页珍藏版）》请在taowenge.com淘文阁网|工程机械CAD图纸|机械工程制图|CAD装配图下载|SolidWorks_CaTia_CAD_UG_PROE_设计图分享下载上搜索。
1、 具体外网 IP 和内网 ARP 绑定信息已经用“x”替代，请根据实际情况更换。“”后面的部分是我导出配置后添加的注释。防火墙型号为华为 Eudemon 200，E0/0/0 口为外网接口，E0/0/1 口为内网。另外此配置方法也完全适用于华为 Secpath 系列防火墙，略加改动也可适用于华为 AR 系列路由器。#sysname Eudemon 设置主机名#super password level 3 simple xxxxxxxx 密码为 xxxxxxxx#firewall packet-filter default permit interzone local trust directi
2、on inbound firewall packet-filter default permit interzone local trust direction outbound firewall packet-filter default permit interzone local untrust direction inbound firewall packet-filter default permit interzone local untrust direction outbound firewall packet-filter default permit interzone l
3、ocal dmz direction inbound firewall packet-filter default permit interzone local dmz direction outbound firewall packet-filter default permit interzone trust untrust direction inbound firewall packet-filter default permit interzone trust untrust direction outbound firewall packet-filter default perm
4、it interzone trust dmz direction inbound firewall packet-filter default permit interzone trust dmz direction outbound firewall packet-filter default permit interzone dmz untrust direction inbound firewall packet-filter default permit interzone dmz untrust direction outbound 设置默认允许所有数据包通过#nat address
5、-group 1 x.x.x.x x.x.x.x 将分配的公网加入地址池 nat server global x.x.x.x inside 172.16.20.4 nat server global x.x.x.x inside 172.16.20.3 nat server global x.x.x.x inside 172.16.20.2 nat server global x.x.x.x inside 172.16.20.5 nat server global x.x.x.x inside 172.16.20.35 将几个公网地址映射到内部服务器 nat alg enable ftp na
6、t alg enable dns nat alg enable icmp nat alg enable netbios undo nat alg enable h323 undo nat alg enable hwcc undo nat alg enable ils undo nat alg enable pptp undo nat alg enable qq undo nat alg enable msn undo nat alg enable user-define undo nat alg enable rtsp firewall permit sub-ip#firewall stati
7、stic system enable#interface Aux0 async mode flow link-protocol ppp#interface Ethernet0/0/0 ip address x.x.x.x 255.255.255.248 设置外网端口地址，此处为网通 分配的内部私有，10.x.x.x#interface Ethernet0/0/1 ip address 172.16.20.1 255.255.255.0 设置内网地址，采用 172.16.20.0/24 网络地址#interface NULL0#acl number 2000 rule 0 permit sour
8、ce 172.16.20.0 0.0.0.255 ACL 2000，目的是只允许 172.16.20.0/24 的地址出外网 rule 1 deny#acl number 3001 rule 0 deny udp destination-port eq 445 rule 1 deny udp destination-port eq netbios-ns rule 2 deny udp destination-port eq netbios-dgm rule 3 deny udp destination-port eq netbios-ssn rule 4 deny udp destinatio
9、n-port eq 1434 rule 5 deny tcp destination-port eq 135 rule 6 deny tcp destination-port eq 139 rule 7 deny tcp destination-port eq 389 rule 8 deny tcp destination-port eq 445 rule 9 deny tcp destination-port eq 636 rule 10 deny tcp destination-port eq 1025 rule 11 deny tcp destination-port eq 1503 r
10、ule 12 deny tcp destination-port eq 3268 rule 13 deny tcp destination-port eq 3269 rule 14 deny tcp destination-port eq 4444 rule 15 deny tcp destination-port eq 5554 rule 16 deny tcp destination-port eq 5800 rule 17 deny tcp destination-port eq 5900 rule 18 deny tcp destination-port eq 9996 rule 19
11、 deny tcp destination-port eq 6667 ACL 3001，关闭常见蠕虫病毒使用的端口#firewall zone local set priority 100#firewall zone trust set priority 85 add interface Ethernet0/0/1 将 E0/0/1 口加入 TRUST 区#firewall zone untrust set priority 5 add interface Ethernet0/0/0 将 E0/0/0 口加入 UNTRUST 区#firewall zone dmz set priority 5
12、0#firewall interzone local trust packet-filter 3001 inbound 在LOCAL到TRUST方向应用ACL 3001 号#firewall interzone local untrust packet-filter 3001 inbound 在 LOCAL 到 UNTRUST 方向应用 ACL 3001 号#firewall interzone local dmz#firewall interzone trust untrust nat outbound 2000 address-group 1 在 TRUST 到 UNTRUST 的方向做
13、NAT，使用 2000 号 ACL#firewall interzone trust dmz#firewall interzone dmz untrust#aaa local-user admin password cipher A.5+_KCH)./a!1$HGYA!建立用户 admin，密码为密文 local-user admin level 3 用户权限为 3（最高级）authentication-scheme default#authorization-scheme default#accounting-scheme default#domain default#arp static
14、172.16.20.2 xxxx-xxxx-xxxx 做和地址绑定 arp static 172.16.20.3 xxxx-xxxx-xxxx arp static 172.16.20.4 xxxx-xxxx-xxxx arp static 172.16.20.5 xxxx-xxxx-xxxx arp static 172.16.20.6 xxxx-xxxx-xxxx arp static 172.16.20.7 xxxx-xxxx-xxxx arp static 172.16.20.250 1111-1111-1111 arp static 172.16.20.251 1111-1111-1
15、111 arp static 172.16.20.252 1111-1111-1111 arp static 172.16.20.253 1111-1111-1111 arp static 172.16.20.254 1111-1111-1111 把不使用的与不存在的#ip route-static 0.0.0.0 0.0.0.0 x.x.x.x 设置缺省路由，此处地址为网通内部，10.x.x.x#snmp-agent snmp-agent local-engineid 000007DB7F0000010000370D snmp-agent community read xxxxxx snmp-agent community write xxxxxx snmp-agent sys-info version all 设置 SNMP参数，以使用网管软件来监控#user-interface con 0 user-interface aux 0 user-interface vty 0 4 authentication-mode aaa 设置 VTY口的认证模式为 AAA#return