H3C SecPath F100-M-SI

<CMJY-FWL01>dis current-configuration
#
 version 5.20, Release 5141
#
 sysname CMJY-FWL01
#
 clock timezone Beijing add 08:00:00
#
 super password level 3 cipher $c$3$NyyUVN4Rkd25XJvlqZHahcapKFjM5Kjr2mHvQ
#
#
 undo voice vlan mac-address 00e0-bb00-0000
#
 ip local policy-based-route sre
#
 nat address-group 1 180.168.114.98 180.168.114.98 level 1
 nat address-group 2 116.228.47.70 116.228.47.70 level 1
#
 domain default enable system
#
 undo alg dns
 undo alg rtsp
 undo alg h323
 undo alg sip
 undo alg sqlnet
 undo alg ils
 undo alg nbt
 undo alg msn
 undo alg qq
 undo alg tftp
 undo alg sccp
 undo alg gtp
#
session synchronization enable
#
 password-recovery enable
#
acl number 3000
 rule 2 permit ip source 172.25.0.0 0.0.255.255 destination 10.19.36.0 0.0.0.255
 rule 5 deny ip
acl number 3001
 rule 2 deny ip source 172.25.0.0 0.0.255.255 destination 10.19.36.0 0.0.0.255
 rule 5 permit ip source 10.17.0.0 0.0.255.255
 rule 10 permit ip source 10.19.0.0 0.0.255.255
acl number 3002
 rule 1 permit ip source 10.19.37.0 0.0.0.255
 rule 2 permit ip source 10.19.38.0 0.0.0.255
 rule 3 deny ip
#
vlan 1
#
domain system
 access-limit disable
 state active
 idle-cut disable
 self-service-url disable
#
pki domain default
  crl check disable
#
ike proposal 1
 dh group2
 authentication-algorithm md5
 sa duration 60480
#
ike dpd 7ftoyishan_dpd
#
ike peer 7ftoyishan_ike
 pre-shared-key cipher $c$3$TwBsQwppRjXWQ1hS3oWWk4xagTlcNbT+247n2Ons=
 remote-address 210.14.78.104
 local-address 180.168.114.98
 dpd 7ftoyishan_dpd
#
ipsec transform-set 1
 encapsulation-mode tunnel
 transform esp
 esp authentication-algorithm md5
 esp encryption-algorithm des
#
ipsec policy 7ftoyishan_poli 1 isakmp
 security acl 3000
 pfs dh-group2
 ike-peer 7ftoyishan_ike
 transform-set 1
 sa duration traffic-based 60480
 sa duration time-based 60480
#
policy-based-route sre permit node 0
 if-match acl 3002
 apply ip-address next-hop 116.228.47.169
policy-based-route sre permit node 1
 apply ip-address default next-hop 180.168.114.97
#
user-group system
 group-attribute allow-guest
#
local-user admin
 password cipher $c$3$0XKryYjDr8iHBtp8ByzvLQnzjOcx0qw42I1w4ww==
 authorization-attribute level 3
 service-type telnet terminal
 service-type web
local-user cmjyi
 password cipher $c$3$xaRp5E/GUZkdiF33yrY1xqC5BMQbV0AGHvqeG0w==
 authorization-attribute level 3
 service-type ssh telnet
 service-type web
local-user xuentian
 password cipher $c$3$Fi0EwtL6V3uWz5szgmLyebKnRCMVTkgJZvHHRTniPdDH5
 authorization-attribute level 3
 service-type ssh telnet terminal
 service-type web
#
interface NULL0
#
interface GigabitEthernet0/0
 port link-mode route
 nat outbound address-group 1
 ip address 180.168.114.98 255.255.255.248
 ipsec policy 7ftoyishan_poli
#
interface GigabitEthernet0/1
 port link-mode route
 ip address 10.19.0.1 255.255.255.192
 ip policy-based-route sre
#
interface GigabitEthernet0/2
 port link-mode route
 ip address 10.17.255.249 255.255.255.252
#
interface GigabitEthernet0/3
 port link-mode route
#
interface GigabitEthernet0/4
 port link-mode route
#
interface GigabitEthernet0/5
 port link-mode route
 nat outbound 3001 address-group 2
 ip address 116.228.47.70 255.255.255.248
#
vd Root id 1
#
zone name Management id 0
 priority 100
zone name Local id 1
 priority 100
zone name Trust id 2
 priority 100
 import interface GigabitEthernet0/1
zone name DMZ id 3
 priority 50
zone name Untrust id 4
 priority 5
 import interface GigabitEthernet0/0
switchto vd Root
 object network subnet 180.166.214.82/255.255.255.255
  subnet 180.166.214.82 255.255.255.255
 object network subnet 210.14.78.104/255.255.255.255
  subnet 210.14.78.104 255.255.255.255
 zone name Management id 0
 ip virtual-reassembly
 zone name Local id 1
 ip virtual-reassembly
 zone name Trust id 2
 ip virtual-reassembly
 zone name DMZ id 3
 ip virtual-reassembly
 zone name Untrust id 4
 ip virtual-reassembly
 interzone source Trust destination DMZ
  rule 0 permit
   source-ip any_address
   destination-ip any_address
   service any_service
   rule enable
 interzone source Trust destination Untrust
  rule 0 permit
   source-ip any_address
   destination-ip any_address
   service any_service
   rule enable
 interzone source DMZ destination Trust
  rule 0 permit
   source-ip any_address
   destination-ip any_address
   service any_service
   rule enable
 interzone source DMZ destination Untrust
  rule 0 permit
   source-ip any_address
   destination-ip any_address
   service any_service
   rule enable
 interzone source Untrust destination Trust
  rule 0 permit
   comment VoIP
   source-ip 180.166.214.82/255.255.255.255
   destination-ip any_address
   service any_service
   rule enable
  rule 1 permit
   source-ip 210.14.78.104/255.255.255.255
   destination-ip any_address
   service any_service
   rule enable
 interzone source Untrust destination DMZ
  rule 0 permit
   source-ip any_address
   destination-ip any_address
   service any_service
   rule enable
#
 ip route-static 0.0.0.0 0.0.0.0 180.168.114.97
 ip route-static 0.0.0.0 0.0.0.0 116.228.47.169 preference 70
 ip route-static 10.14.230.0 255.255.255.0 GigabitEthernet0/1 10.19.0.62
 ip route-static 10.19.0.0 255.255.240.0 GigabitEthernet0/1 10.19.0.62
 ip route-static 10.19.16.0 255.255.255.0 GigabitEthernet0/1 10.19.0.62
 ip route-static 10.19.17.0 255.255.255.0 GigabitEthernet0/1 10.19.0.62
 ip route-static 10.19.18.0 255.255.255.0 GigabitEthernet0/1 10.19.0.62
 ip route-static 10.19.19.0 255.255.255.0 GigabitEthernet0/1 10.19.0.62
 ip route-static 10.19.20.0 255.255.255.0 GigabitEthernet0/1 10.19.0.62
 ip route-static 10.19.31.0 255.255.255.0 10.19.0.62
 ip route-static 10.19.34.0 255.255.255.0 10.19.0.62
 ip route-static 10.19.35.0 255.255.255.0 10.19.0.62
 ip route-static 10.19.37.0 255.255.255.0 10.19.0.62
 ip route-static 10.19.38.0 255.255.255.0 10.19.0.62
 ip route-static 172.25.0.0 255.255.0.0 GigabitEthernet0/1 10.19.0.62
 ip route-static 172.25.32.0 255.255.255.0 10.19.0.62
 ip route-static 172.26.0.0 255.255.0.0 GigabitEthernet0/1 10.19.0.62
#
 
 load xml-configuration
#
 load tr069-configuration
#
user-interface con 0
user-interface vty 0 4
 authentication-mode scheme
 user privilege level 3
 protocol inbound ssh
#
return
<CMJY-FWL01>