trunk到untrunk流量大

 

防火墙测试只有5个人使用6小时，策略trunk到untrunk流量有180G,但是untrunk到trunk只有600mb.这个流量异常吗，下面是配置，只有1口4口在使用

 

 

 

 

<H3C>

<H3C>DIS CU

#

 version 7.1.064, Release 9345P2416

#

 sysname H3C

#

context Admin id 1

#

 telnet server enable

#

 irf mac-address persistent timer

 irf auto-update enable

 undo irf link-delay

 irf member 1 priority 1

#

 ip pool aaa 100.19.0.2 100.19.0.20 

 ip pool aaa gateway 100.19.0.1 

#

 dhcp enable

#

 lldp global enable

#

 password-recovery enable

#

vlan 1         

#

object-group ip address 172.168.0.20

 security-zone Trust

 0 network host address 172.168.0.20

#

object-group ip address 172.168.1.201

 security-zone Trust

 0 network host address 172.168.1.201

#

controller Cellular1/0/0

#

interface Virtual-Template1

 ppp authentication-mode chap domain system 

 remote address pool aaa 

#

interface NULL0

#

interface GigabitEthernet1/0/0

 port link-mode route

 ip address 192.168.0.1 255.255.255.0

#

interface GigabitEthernet1/0/1

 port link-mode route

 ip address dhcp-alloc

 nat outbound

#

interface GigabitEthernet1/0/2

 port link-mode route

 ip address 222.185.248.10 255.255.255.248

 nat outbound 3001

 nat server protocol tcp global 222.185.248.10 9800 inside 172.168.1.201 9800 rule ServerRule_7

 nat server protocol tcp global 222.185.248.10 9801 inside 172.168.1.201 9801 rule ServerRule_8

 nat server protocol tcp global 222.185.248.10 9821 inside 172.168.1.201 9821 rule ServerRule_9

 nat server protocol tcp global 222.185.248.10 9822 inside 172.168.1.201 9822 rule ServerRule_10

 nat server protocol tcp global 222.185.248.10 9823 inside 172.168.1.201 9823 rule ServerRule_11

 nat server protocol tcp global 222.185.248.10 9824 inside 172.168.1.201 9824 rule ServerRule_12

 nat server protocol tcp global 222.185.248.10 9825 inside 172.168.1.201 9825 rule ServerRule_13

 nat server protocol tcp global 222.185.248.10 9831 inside 172.168.1.201 9831 rule ServerRule_14

 nat server protocol tcp global 222.185.248.10 9832 inside 172.168.1.201 9832 rule ServerRule_15

 nat server protocol tcp global 222.185.248.10 9833 inside 172.168.1.201 9833 rule ServerRule_16

 nat server protocol tcp global 222.185.248.10 9834 inside 172.168.1.201 9834 rule ServerRule_17

 nat server protocol tcp global 222.185.248.10 9835 inside 172.168.1.201 9835 rule ServerRule_20

 nat server protocol tcp global 222.185.248.10 18443 inside 10.10.10.6 18443 rule ServerRule_19

 nat server protocol tcp global 222.185.248.10 18888 inside 10.10.10.1 18888 rule ServerRule_18

 nat server protocol tcp global 222.185.248.10 20080 inside 172.168.0.20 20080 rule ServerRule_6

 nat server protocol tcp global 222.185.248.10 20081 inside 172.168.0.20 20081 rule ServerRule_5

 nat server protocol tcp global 222.185.248.10 50001 inside 172.168.0.20 50001 rule ServerRule_4

 nat server protocol tcp global 222.185.248.10 51001 inside 172.168.0.20 51001 rule ServerRule_3

 nat server protocol tcp global 222.185.248.10 65500 inside 172.168.0.20 65500 rule ServerRule_2

 gateway 222.185.248.9

#

interface GigabitEthernet1/0/3

 port link-mode route

#

interface GigabitEthernet1/0/4

 port link-mode route

 ip address 10.10.10.254 255.255.255.0

 nat hairpin enable

#

interface GigabitEthernet1/0/5

 port link-mode route

#

interface GigabitEthernet1/0/6

 port link-mode route

#

interface GigabitEthernet1/0/7

 port link-mode route

#

interface GigabitEthernet1/0/8

 port link-mode route

#

interface GigabitEthernet1/0/9

 port link-mode route

#

interface GigabitEthernet1/0/10

 port link-mode route

#

interface GigabitEthernet1/0/11

 port link-mode route

#

interface GigabitEthernet1/0/12

 port link-mode route

#

interface GigabitEthernet1/0/13

 port link-mode route

#

interface GigabitEthernet1/0/14

 port link-mode route

#

interface GigabitEthernet1/0/15

 port link-mode route

#              

interface GigabitEthernet1/0/16

 port link-mode route

#

interface GigabitEthernet1/0/17

 port link-mode route

#

interface GigabitEthernet1/0/18

 port link-mode route

#

interface GigabitEthernet1/0/19

 port link-mode route

#

interface GigabitEthernet1/0/20

 port link-mode route

#

interface GigabitEthernet1/0/21

 port link-mode route

#

interface GigabitEthernet1/0/22

 port link-mode route

#

interface GigabitEthernet1/0/23

 port link-mode route

#

security-zone name Local

#

security-zone name Trust

 import interface GigabitEthernet1/0/4

#

security-zone name DMZ

#

security-zone name Untrust

 import interface GigabitEthernet1/0/1

 import interface GigabitEthernet1/0/2

#

security-zone name Management

 import interface GigabitEthernet1/0/0

#

zone-pair security source Untrust destination Trust

 packet-filter 3001

#

 scheduler logfile size 16

#

line class aux

 user-role network-operator

#              

line class console

 authentication-mode scheme

 user-role network-admin

#

line class vty

 user-role network-operator

#

line aux 0

 user-role network-admin

#

line con 0

 user-role network-admin

#

line vty 0 63

 authentication-mode scheme

 user-role network-admin

#

 ip route-static 0.0.0.0 0 222.185.248.9

 ip route-static 10.10.10.0 24 10.10.10.1

 ip route-static 172.168.0.0 21 10.10.10.1

 ip route-static 172.168.10.0 24 10.10.10.1

 ip route-static 172.168.11.0 24 10.10.10.1

#              

 ssh server enable

#

acl advanced 3000

 rule 0 permit ip

#

acl advanced 3001

 rule 0 permit ip

#

domain system

 authentication ppp local

#

 domain default enable system

#

role name level-0

 description Predefined level-0 role

#

role name level-1

 description Predefined level-1 role

#

role name level-2

 description Predefined level-2 role

#

role name level-3

 description Predefined level-3 role

#

role name level-4

 description Predefined level-4 role

#

role name level-5

 description Predefined level-5 role

#

role name level-6

 description Predefined level-6 role

#

role name level-7

 description Predefined level-7 role

#

role name level-8

 description Predefined level-8 role

#

role name level-9

 description Predefined level-9 role

#

role name level-10

 description Predefined level-10 role

#              

role name level-11

 description Predefined level-11 role

#

role name level-12

 description Predefined level-12 role

#

role name level-13

 description Predefined level-13 role

#

role name level-14

 description Predefined level-14 role

#

user-group system

#

local-user admin class manage

 password hash $h$6$SULkYgwszTYLk2wQ$8SGSZDhKCtpsAj7Gulul8RcC9y6x/7EmiVfe5mco+NYfp5ROjB2+FsKDs2f6mE3TNg6GNfgCZEMA97lqFqCLuA==

 service-type ssh telnet terminal http https

 authorization-attribute user-role level-3

 authorization-attribute user-role network-admin

 authorization-attribute user-role network-operator

 password-control length 4

 password-control composition type-number 1 type-length 1

 undo password-control complexity user-name check

#

local-user system class network

 password cipher $c$3$2wzN75pw6zeKKZHEWJF0qWT5j+cGmeL5qQ==

 service-type ppp

 authorization-attribute user-role network-operator

#

 session statistics enable

#

 ipsec logging negotiation enable

#

l2tp-group 1 mode lns

 allow l2tp virtual-template 1

 undo tunnel authentication

 tunnel name LNS

#

 l2tp enable

#

 ike logging negotiation enable

#

 ip http enable

 ip https enable

 webui log enable

#              

inspect block-source parameter-profile ips_block_default_parameter

#

inspect block-source parameter-profile url_block_default_parameter

#

inspect logging parameter-profile av_logging_default_parameter

#

inspect logging parameter-profile ips_logging_default_parameter

#

 loadbalance isp file flash:/lbispinfo_v1.5.tp

#

security-policy ip

 rule 0 name l-t,u

  action pass

  logging enable

  counting enable

  source-zone Local

  destination-zone Trust

  destination-zone Untrust

 rule 1 name t,u-l

  action pass

  counting enable

  source-zone Trust

  source-zone Untrust

  destination-zone Local

 rule 2 name t-u

  action pass

  logging enable

  counting enable

  source-zone Trust

  destination-zone Untrust

 rule 3 name 1

  action pass

  counting enable

  source-zone Untrust

  destination-zone Trust

  destination-ip 172.168.0.20

  destination-ip 172.168.1.201

 rule 4 name 2

  action pass

  source-zone Trust

  destination-zone Trust

#

ips logging parameter-profile ips_logging_default_parameter

#

anti-virus logging parameter-profile av_logging_default_parameter

#              

return