F1000 ak145 防火墙双wan配置问题

# version 7.1.064, Release 9345P2413 # sysname SEFA_ID:8864 # context Admin id 1 # irf mac-address persistent timer irf auto-update enable undo irf link-delay irf member 1 priority 1 # track 1 nqa entry admin wan1/0/2 reaction 1 # track 2 nqa entry dia0 dia0 reaction 1 # ospf 100 area 0.0.0.0 network 10.1.1.0 0.0.0.3 # ip pool aaa 100.19.0.2 100.19.0.20 ip pool aaa gateway 100.19.0.1 # dialer-group 1 rule ip permit # nat log enable # dns server 223.5.5.5 dns server 114.114.114.114 dns server 8.8.8.8 # password-recovery enable # vlan 1 # object-group ip address 10.168.1 security-zone Trust 0 network subnet 10.168.1.0 255.255.255.0 # object-group ip address 10.168.2-4 security-zone Trust 0 network subnet 10.168.2.0 255.255.255.0 10 network subnet 10.168.3.0 255.255.255.0 20 network subnet 10.168.4.0 255.255.255.0 stp global enable # policy-based-route lyj permit node 10 if-match acl 3500 apply next-hop x.x.x.x track 1 # policy-based-route lyj permit node 20 if-match acl 3501 apply default-output-interface Dialer0 track 2 # nqa entry admin wan1/0/2 type icmp-echo destination ip 223.5.5.5 frequency 2000 history-record enable probe count 3 probe timeout 1000 reaction 1 checked-element probe-fail threshold-type consecutive 1 action-type trigger-only source interface GigabitEthernet1/0/2 # nqa entry dia0 dia0 type icmp-echo destination ip 223.5.5.5 frequency 2000 history-record enable out interface Dialer0 probe count 3 probe timeout 1000 reaction 1 checked-element probe-fail threshold-type consecutive 1 action-type trigger-only # nqa schedule admin wan1/0/2 start-time now lifetime forever nqa schedule dia0 dia0 start-time now lifetime forever # controller Cellular1/0/0 # interface Dialer0 mtu 1492 ppp chap password cipher $c$3$eOhYZdPH3V+nxZNypsRp+JGWVkVYFYw7O7Dj ppp chap user ****** ppp pap local-user ********* password cipher ******** dialer bundle enable dialer-group 1 dialer timer idle 0 dialer timer autodial 5 ip address ppp-negotiate dns server 61.139.2.69 dns server 223.6.6.6 tcp mss 1200 nat outbound # interface Virtual-Template1 ppp authentication-mode chap domain system remote address pool aaa # interface NULL0 # interface GigabitEthernet1/0/0 port link-mode route ip address 192.168.0.1 255.255.255.0 # interface GigabitEthernet1/0/1 port link-mode route ip address 10.1.1.1 255.255.255.252 nat hairpin enable ip policy-based-route lyj # interface GigabitEthernet1/0/2 port link-mode route ip address x.x.x.x 255.255.255.0 ip last-hop hold nat outbound gateway x.x.x.1 # interface GigabitEthernet1/0/3 port link-mode route bandwidth 400000 mtu 1454 shutdown broadcast-suppression 90 multicast-suppression 90 unicast-suppression 90 ip last-hop hold nat static enable pppoe-client dial-bundle-number 0 # interface GigabitEthernet1/0/4 port link-mode route # interface GigabitEthernet1/0/5 port link-mode route ip address 10.1.1.10 255.255.255.0 # interface GigabitEthernet1/0/6 port link-mode route # interface GigabitEthernet1/0/7 port link-mode route # interface GigabitEthernet1/0/8 port link-mode route # interface GigabitEthernet1/0/9 port link-mode route shutdown ip address 10.2.2.2 255.255.255.0 # interface GigabitEthernet1/0/10 port link-mode route # interface GigabitEthernet1/0/11 port link-mode route # interface GigabitEthernet1/0/12 port link-mode route # interface GigabitEthernet1/0/13 port link-mode route # interface GigabitEthernet1/0/14 port link-mode route # interface GigabitEthernet1/0/15 port link-mode route # interface GigabitEthernet1/0/16 port link-mode route # interface GigabitEthernet1/0/17 port link-mode route # security-zone name Local # security-zone name Trust import interface GigabitEthernet1/0/1 attack-defense apply policy def # security-zone name DMZ blacklist enable # security-zone name Untrust import interface Dialer0 import interface GigabitEthernet1/0/2 import interface GigabitEthernet1/0/3 attack-defense apply policy def blacklist enable # security-zone name Management import interface GigabitEthernet1/0/0 blacklist enable # zone-pair security source Any destination Any packet-filter 2000 # scheduler logfile size 16 # line class aux user-role network-operator # line class console authentication-mode scheme user-role network-admin # line class vty user-role network-operator # line aux 0 user-role network-admin # line con 0 user-role network-admin # line vty 0 63 authentication-mode scheme user-role network-admin # ip route-static 0.0.0.0 0 Dialer0 track 2 ip route-static 0.0.0.0 0 x.x.x.1 track 1 ip route-static 10.168.0.0 16 10.1.1.2 # info-center logfile module ATK size-quota 10 info-center logfile module BLS size-quota 10 # customlog format nat unicom customlog format security-policy sgcc customlog format dpi ips customlog format dpi anti-virus customlog format dpi ip-reputation customlog format dpi traffic-policy # ssh server enable ssh server acl 3500 # time-range "work time" 08:11 to 11:30 daily time-range "work time" 13:30 to 17:30 daily # ntp-service enable ntp-service refclock-master # acl basic 2000 rule 0 permit source 10.168.4.144 0 rule 1 deny # acl basic 2001 rule 0 permit source 10.168.1.0 0.0.0.255 rule 5 deny source 0.0.0.0 0 # acl basic 2040 rule 0 permit source object-group 10.168.1 counting # acl basic 2041 rule 0 permit source object-group 10.168.2-4 # acl basic 2500 # acl advanced 3000 rule 0 permit ip source object-group 服务器 # acl advanced 3001 rule 0 permit ip destination 0.0.0.5 255.255.255.0 # acl advanced 3500 rule 0 permit ip source 10.168.1.0 0.0.0.255 # acl advanced 3501 rule 0 permit ip source 10.168.2.0 0.0.0.255 rule 1 permit ip source 10.168.3.0 0.0.0.255 rule 2 permit ip source 10.168.4.0 0.0.0.255 #