问

H3C NS-SecPath F1050 Y2 配置地址转换、端口映射

2021-04-15提问

0关注
1收藏，1517浏览

zhiliao_DH1ELD

zhiliao_DH1ELD 零段

粉丝：0人关注：0人

问题描述：

从公网访问内部192.168.100.244服务器，端口1522

组网及组网描述：

[yidong_FW]dis current-configuration
#
version 7.1.054, Ess 9308P05
#
sysname yidong_FW
#
context Admin id 1
#
telnet server enable
#
irf mac-address persistent timer
irf auto-update enable
undo irf link-delay
irf member 1 priority 1
#
ip unreachables enable
ip ttl-expires enable
#
dhcp enable
dhcp server forbidden-ip 10.188.0.1
dhcp server forbidden-ip 10.188.0.250
dhcp server forbidden-ip 10.188.0.251
dhcp server forbidden-ip 10.188.0.254
#
password-recovery enable
#
vlan 1
#
vlan 10
description YeWu-Vlan
#
vlan 1100
description waiwang-VLAN
#
vlan-group q
#
dhcp server ip-pool 1
gateway-list 10.188.0.1
network 10.188.0.0 mask 255.255.0.0
dns-list 211.138.180.2
#
interface NULL0
#
interface Vlan-interface10
ip address 10.188.0.1 255.255.0.0
#
interface Vlan-interface1100
ip address 111.39.13.17 255.255.255.0
nat outbound
nat server protocol tcp global 111.39.13.17 9080 inside 10.176.211.160 9080
#
interface GigabitEthernet1/0/0
port link-mode route
description guanli_default
ip address 192.168.0.1 255.255.255.0
#
interface GigabitEthernet1/0/15
port link-mode route
description TO_waiwang(NO)
ip address 120.193.69.50 255.255.255.0
nat outbound
nat server protocol tcp global 111.39.13.17 1000 inside 192.168.188.2 1000
nat server protocol tcp global 120.193.69.50 8897 inside 192.168.188.2 443
nat server protocol tcp global 120.193.69.50 8898 inside 192.168.188.2 443
nat server protocol tcp global current-interface 1522 inside 192.168.100.244 1522
#
interface GigabitEthernet1/0/16
port link-mode route
description TO_wangsheng
ip address 192.168.188.1 255.255.255.0
nat server protocol tcp global current-interface 1522 inside 192.168.100.244 1522
nat static enable
#
interface GigabitEthernet1/0/18
port link-mode route
#
interface GigabitEthernet1/0/19
port link-mode route
#
interface GigabitEthernet1/0/20
port link-mode route
#
interface GigabitEthernet1/0/21
port link-mode route
#
interface GigabitEthernet1/0/22
port link-mode route
#
interface GigabitEthernet1/0/23
port link-mode route
#
interface GigabitEthernet1/0/1
port link-mode bridge
description TO_hexin(10.188.0.254)
port link-type trunk
port trunk permit vlan all
#
interface GigabitEthernet1/0/2
port link-mode bridge
description yewu
port access vlan 10
#
interface GigabitEthernet1/0/3
port link-mode bridge
description yewu
port access vlan 10
#
interface GigabitEthernet1/0/4
port link-mode bridge
description yewu
port access vlan 10
#
interface GigabitEthernet1/0/5
port link-mode bridge
description yewu
port access vlan 10
#
interface GigabitEthernet1/0/6
port link-mode bridge
description yewu
port access vlan 10
#
interface GigabitEthernet1/0/7
port link-mode bridge
description yewu
port access vlan 10
#
interface GigabitEthernet1/0/8
port link-mode bridge
description yewu
port access vlan 10
#
interface GigabitEthernet1/0/9
port link-mode bridge
description yewu
port access vlan 10
#
interface GigabitEthernet1/0/10
port link-mode bridge
description yewu
port access vlan 10
#
interface GigabitEthernet1/0/11
port link-mode bridge
description yewu
port access vlan 10
#
interface GigabitEthernet1/0/12
port link-mode bridge
description yewu
port access vlan 10
#
interface GigabitEthernet1/0/13
port link-mode bridge
description yewu
port access vlan 10
#
interface GigabitEthernet1/0/14
port link-mode bridge
description yewu
port access vlan 10
#
interface GigabitEthernet1/0/17
port link-mode bridge
description TO_waiwang
port link-type trunk
port trunk permit vlan all
#
security-zone name Local
#
security-zone name Trust
import interface GigabitEthernet1/0/0
import interface GigabitEthernet1/0/16
import interface Vlan-interface10
#
security-zone name DMZ
#
security-zone name Untrust
import interface Vlan-interface1100
#
zone-pair security source Any destination Any
#
zone-pair security source Any destination Trust
packet-filter 2000
packet-filter 3000
#
zone-pair security source Any destination Untrust
packet-filter 2000
#
zone-pair security source Local destination Local
packet-filter 2000
#
zone-pair security source Local destination Trust
packet-filter 2000
packet-filter 3000
#
zone-pair security source Local destination Untrust
packet-filter 2000
#
zone-pair security source Trust destination Any
packet-filter 2000
packet-filter 3000
#
zone-pair security source Trust destination Local
packet-filter 2000
packet-filter 3000
#
zone-pair security source Trust destination Trust
packet-filter 2000
packet-filter 3000
#
zone-pair security source Trust destination Untrust
packet-filter 2000
packet-filter 3000
#
zone-pair security source Untrust destination Any
packet-filter 2000
#
zone-pair security source Untrust destination Local
packet-filter 2000
#
zone-pair security source Untrust destination Trust
packet-filter 2000
#
zone-pair security source Untrust destination Untrust
packet-filter 2000
#
scheduler logfile size 16
#
line class aux
user-role network-operator
#
line class console
user-role network-admin
#
line class vty
user-role network-operator
#
line aux 0
user-role network-admin
#
line con 0
authentication-mode scheme
user-role network-admin
#
line vty 0 4
authentication-mode scheme
user-role level-15
user-role network-admin
set authentication password hash $h$6$4i9NXPW2m61xwuhC$6EnesAH+D0NghsH6JYr4vvbU5euyTxOQvFs2YNHpzWkQsDRS3yO9b7BDyV5gOQBRfC9MMIoFDBs4LO2AaDDMdQ==
#
line vty 5 63
user-role network-operator
#
ip route-static 0.0.0.0 0 111.39.13.1
ip route-static 10.170.0.0 16 192.168.188.2
ip route-static 10.176.0.0 16 192.168.188.2
ip route-static 10.189.10.0 24 192.168.188.2
ip route-static 59.203.0.0 16 192.168.188.2
ip route-static 59.255.0.0 16 192.168.188.2
ip route-static 192.168.0.0 16 192.168.188.2
#
undo ssh server compatible-ssh1x enable
#
acl number 2000
rule 0 permit
#
acl number 3000
rule 0 deny tcp source-port eq 445
rule 1 deny tcp source-port eq 5554
rule 2 deny tcp source-port eq 139
rule 3 deny tcp source-port eq 135
rule 4 deny udp source-port eq tftp
rule 5 deny udp source-port eq 1434
rule 10 permit ip
#
acl number 3333
rule 1 permit ip source 0.0.0.0 255.255.0.0
#
domain ci
#
domain system
#
aaa session-limit ftp 16
aaa session-limit telnet 16
aaa session-limit ssh 16
domain default enable system
#
role name level-0
description Predefined level-0 role
#
role name level-1
description Predefined level-1 role
#
role name level-2
description Predefined level-2 role
#
role name level-3
description Predefined level-3 role
#
role name level-4
description Predefined level-4 role
#
role name level-5
description Predefined level-5 role
#
role name level-6
description Predefined level-6 role
#
role name level-7
description Predefined level-7 role
#
role name level-8
description Predefined level-8 role
#
role name level-9
description Predefined level-9 role
#
role name level-10
description Predefined level-10 role
#
role name level-11
description Predefined level-11 role
#
role name level-12
description Predefined level-12 role
#
role name level-13
description Predefined level-13 role
#
role name level-14
description Predefined level-14 role
#
user-group system
#
local-user admin class manage
password hash $h$6$7kbkur5EuIwNHNAk$uiUB5DGuK4f1IZljtZkymWENM+1o/7QDmAVzliSVtGViJr0RbnkNFdcIPuGEX+9gViR0Kydemf9EawN77UImWg==
service-type telnet terminal http
authorization-attribute user-role level-3
authorization-attribute user-role network-admin
authorization-attribute user-role network-operator
#
local-user fhq class manage
password hash $h$6$ctZDbxRpD1RqXiTA$teeEiphXKQZjCtzU1dqTvkcFRMKERKVdxd+SLOAekZf/ovHH5eKV6fCPh9ctJzA8mkZH2YrzUUA7MSTeyQbYDQ==
service-type telnet http https
authorization-attribute user-role level-15
authorization-attribute user-role network-operator
#
nat static outbound 192.168.100.244 10.188.0.1
#
ip http port 8899
ip http enable
ip https enable
#
return