SecPath F1070防火墙NAT

Web_server:

<H3C>sys

System View: return to User View with Ctrl+Z.

[H3C]sysname web_server

[web_server]int gi 1/0/1

[web_server-GigabitEthernet1/0/1]port link-mode route

[web_server-GigabitEthernet1/0/1]des <connect to FW1>

[web_server-GigabitEthernet1/0/1]ip address 10.0.0.2 30

[web_server-GigabitEthernet1/0/1]quit

[web_server]ip route-static 0.0.0.0 0.0.0.0 10.0.0.1

[web_server]ip http enable

[web_server]ip https enable

[web_server]local-user admin

New local user added.

[web_server-luser-manage-admin]password simple admin

[web_server-luser-manage-admin]service-type http https

[web_server-luser-manage-admin]authorization-attribute user-role network-admin

[web_server-luser-manage-admin]quit

[web_server]

ISP:

<H3C>sys

System View: return to User View with Ctrl+Z.

[H3C]sysname ISP

[ISP]int gi 0/1

[ISP-GigabitEthernet0/1]ip address 202.103.224.254 24

[ISP-GigabitEthernet0/1]quit

[ISP]int gi 0/0

[ISP-GigabitEthernet0/0]des <connect to FW1>

[ISP-GigabitEthernet0/0]ip address 202.1.100.1 28

[ISP-GigabitEthernet0/0]quit

FW1:

<H3C>sys

System View: return to User View with Ctrl+Z.

[H3C]sysname FW1

[FW1]acl basic 2001

[FW1-acl-ipv4-basic-2001]rule 0 permit source any

[FW1-acl-ipv4-basic-2001]quit

[FW1]

[FW1]zone-pair security source trust destination untrust

[FW1-zone-pair-security-Trust-Untrust]packet-filter 2001

[FW1-zone-pair-security-Trust-Untrust]quit

[FW1]

[FW1]zone-pair security source untrust destination trust

[FW1-zone-pair-security-Untrust-Trust]packet-filter 2001

[FW1-zone-pair-security-Untrust-Trust]quit

[FW1]

[FW1]zone-pair security source trust destination local

[FW1-zone-pair-security-Trust-Local]packet-filter 2001

[FW1-zone-pair-security-Trust-Local]quit

[FW1]

[FW1]zone-pair security source local destination trust

[FW1-zone-pair-security-Local-Trust]packet-filter 2001

[FW1-zone-pair-security-Local-Trust]quit

[FW1]

[FW1]zone-pair security source untrust destination local

[FW1-zone-pair-security-Untrust-Local]packet-filter 2001

[FW1-zone-pair-security-Untrust-Local]quit

[FW1]

[FW1]zone-pair security source local destination untrust

[FW1-zone-pair-security-Local-Untrust]packet-filter 2001

[FW1-zone-pair-security-Local-Untrust]quit

[FW1]int gi 1/0/3

[FW1-GigabitEthernet1/0/3]des <connect to web_server>

[FW1-GigabitEthernet1/0/3]ip address 10.0.0.1 30

[FW1-GigabitEthernet1/0/3]quit

[FW1]security-zone name Trust

[FW1-security-zone-Trust]import interface GigabitEthernet 1/0/3

[FW1-security-zone-Trust]quit

FW1 NAT及NAT server关键配置点：

[FW1]acl basic 2000

[FW1-acl-ipv4-basic-2000]rule 0 permit source any

[FW1-acl-ipv4-basic-2000]quit

[FW1]int gi 1/0/4

[FW1-GigabitEthernet1/0/4]des <connect to ISP>

[FW1-GigabitEthernet1/0/4]ip address 202.1.100.2 28

[FW1-GigabitEthernet1/0/4]nat outbound 2000

[FW1-GigabitEthernet1/0/4]nat server protocol tcp global 202.1.100.3 80 inside 10.0.0.2 80

[FW1-GigabitEthernet1/0/4]nat server protocol tcp global 202.1.100.3 443 inside 10.0.0.2 443

[FW1-GigabitEthernet1/0/4]quit

[FW1]ip route-static 0.0.0.0 0.0.0.0 202.1.100.1

[FW1]security-zone name Untrust

[FW1-security-zone-Untrust]import interface GigabitEthernet 1/0/4

[FW1-security-zone-Untrust]quit

物理机填写IP地址：

物理机打开浏览器，输入网址：https://202.1.100.3 ，可以登陆到web服务器

输入用户名、密码，点击登录：

登陆成功：

查看FW1 NAT的显示信息：