F1020防火墙

配置策略后直连不通

version 7.1.064, Release 9313P11 # sysname H3C # context Admin id 1 # irf mac-address persistent timer irf auto-update enable undo irf link-delay irf member 2 priority 1 # password-recovery enable # vlan 1 # interface NULL0 # interface GigabitEthernet2/0/0 port link-mode route # interface GigabitEthernet2/0/1 port link-mode route # interface GigabitEthernet2/0/2 port link-mode route # interface GigabitEthernet2/0/3 port link-mode route # interface GigabitEthernet2/0/4 port link-mode route # interface GigabitEthernet2/0/5 port link-mode route # interface GigabitEthernet2/0/6 port link-mode route # interface GigabitEthernet2/0/7 port link-mode route # interface GigabitEthernet2/0/8 port link-mode route # interface GigabitEthernet2/0/9 port link-mode route # interface GigabitEthernet2/0/10 port link-mode route # interface GigabitEthernet2/0/11 port link-mode route # interface GigabitEthernet2/0/12 port link-mode route # interface GigabitEthernet2/0/13 port link-mode route # interface GigabitEthernet2/0/14 port link-mode route # interface GigabitEthernet2/0/15 port link-mode route # interface GigabitEthernet2/0/16 port link-mode route # interface GigabitEthernet2/0/17 port link-mode route # interface GigabitEthernet2/0/18 port link-mode route # interface GigabitEthernet2/0/19 port link-mode route # interface GigabitEthernet2/0/20 port link-mode route # interface GigabitEthernet2/0/21 port link-mode route # interface GigabitEthernet2/0/22 port link-mode route # interface GigabitEthernet2/0/23 port link-mode route # scheduler logfile size 16 # line class aux user-role network-operator # line class console user-role network-admin # line class vty user-role network-operator # line aux 1 user-role network-operator # line con 1 user-role network-admin # line vty 0 63 user-role network-operator # domain system # domain default enable system # role name level-0 description Predefined level-0 role # role name level-1 description Predefined level-1 role # role name level-2 description Predefined level-2 role # role name level-3 description Predefined level-3 role # role name level-4 description Predefined level-4 role # role name level-5 description Predefined level-5 role # role name level-6 description Predefined level-6 role # role name level-7 description Predefined level-7 role # role name level-8 description Predefined level-8 role # role name level-9 description Predefined level-9 role # role name level-10 description Predefined level-10 role # role name level-11 description Predefined level-11 role # role name level-12 description Predefined level-12 role # role name level-13 description Predefined level-13 role # role name level-14 description Predefined level-14 role # user-group system # return [H3C] [H3C]dis cur # version 7.1.064, Release 9333P39 # sysname H3C # context Admin id 1 # ip vpn-instance NQA # ip vpn-instance mgmt # irf mac-address persistent timer irf auto-update enable undo irf link-delay irf member 1 priority 32 irf member 2 priority 1 # security-zone intra-zone default permit # dns server 21.1.1.53 dns server 22.1.1.53 # lldp global enable # password-recovery enable # vlan 1 # vlan 30 description NQA # vlan 99 # vlan 355 # vlan 1000 # irf-port 1/2 port group interface GigabitEthernet1/0/14 port group interface GigabitEthernet1/0/15 # irf-port 2/1 port group interface GigabitEthernet2/0/14 port group interface GigabitEthernet2/0/15 # interface Bridge-Aggregation30 description to DC1_DTS_DS_CE8861_01&02 port link-type trunk undo port trunk permit vlan 1 port trunk permit vlan 99 355 1000 link-aggregation mode dynamic # interface Route-Aggregation3 mad bfd enable mad ip address 1.1.1.1 255.255.255.252 member 1 mad ip address 1.1.1.2 255.255.255.252 member 2 # interface NULL0 # interface Vlan-interface30 ip binding vpn-instance NQA ip address 2.2.2.1 255.255.255.248 # interface Vlan-interface99 description to DC1_DTS_DS_CE8861_01&02_BS ip address 21.1.100.1 255.255.255.240 # interface Vlan-interface355 description OOB ip address 21.100.255.3 255.255.255.0 # interface Vlan-interface1000 description to DC1_DTS_DS_CE8861_01&02_TEST ip address 21.100.254.1 255.255.255.240 # interface GigabitEthernet1/0/0 port link-mode route ip binding vpn-instance mgmt ip address 21.10.100.3 255.255.255.0 # interface GigabitEthernet1/0/1 port link-mode route # interface GigabitEthernet1/0/2 port link-mode route # interface GigabitEthernet1/0/3 port link-mode route # interface GigabitEthernet1/0/4 port link-mode route # interface GigabitEthernet1/0/5 port link-mode route # interface GigabitEthernet1/0/6 port link-mode route # interface GigabitEthernet1/0/7 port link-mode route # interface GigabitEthernet1/0/8 port link-mode route # interface GigabitEthernet1/0/9 port link-mode route # interface GigabitEthernet1/0/10 port link-mode route # interface GigabitEthernet1/0/11 port link-mode route # interface GigabitEthernet1/0/12 port link-mode route # interface GigabitEthernet1/0/13 port link-mode route # interface GigabitEthernet1/0/20 port link-mode route # interface GigabitEthernet1/0/21 port link-mode route # interface GigabitEthernet1/0/23 port link-mode route port link-aggregation group 3 # interface GigabitEthernet2/0/0 port link-mode route # interface GigabitEthernet2/0/1 port link-mode route # interface GigabitEthernet2/0/2 port link-mode route # interface GigabitEthernet2/0/3 port link-mode route # interface GigabitEthernet2/0/4 port link-mode route # interface GigabitEthernet2/0/5 port link-mode route # interface GigabitEthernet2/0/6 port link-mode route # interface GigabitEthernet2/0/7 port link-mode route # interface GigabitEthernet2/0/8 port link-mode route # interface GigabitEthernet2/0/9 port link-mode route # interface GigabitEthernet2/0/10 port link-mode route # interface GigabitEthernet2/0/11 port link-mode route # interface GigabitEthernet2/0/12 port link-mode route # interface GigabitEthernet2/0/13 port link-mode route # interface GigabitEthernet2/0/20 port link-mode route # interface GigabitEthernet2/0/21 port link-mode route # interface GigabitEthernet2/0/22 port link-mode route # interface GigabitEthernet2/0/23 port link-mode route port link-aggregation group 3 # interface GigabitEthernet1/0/16 port link-mode bridge port link-type trunk undo port trunk permit vlan 1 port trunk permit vlan 30 # interface GigabitEthernet1/0/17 port link-mode bridge port link-type trunk undo port trunk permit vlan 1 port trunk permit vlan 99 355 1000 shutdown port link-aggregation group 30 # interface GigabitEthernet1/0/18 port link-mode bridge port link-type trunk undo port trunk permit vlan 1 port trunk permit vlan 99 355 1000 port link-aggregation group 30 # interface GigabitEthernet1/0/19 port link-mode bridge port link-type trunk undo port trunk permit vlan 1 port trunk permit vlan 99 355 1000 port link-aggregation group 30 # interface GigabitEthernet1/0/22 port link-mode bridge shutdown # interface GigabitEthernet2/0/16 port link-mode bridge port link-type trunk port trunk permit vlan 1 99 355 1000 port link-aggregation group 30 # interface GigabitEthernet2/0/17 port link-mode bridge port link-type trunk port trunk permit vlan 1 99 355 1000 port link-aggregation group 30 # interface GigabitEthernet2/0/18 port link-mode bridge port link-type trunk port trunk permit vlan 1 99 355 1000 port link-aggregation group 30 # interface GigabitEthernet2/0/19 port link-mode bridge port link-type trunk port trunk permit vlan 1 99 355 1000 port link-aggregation group 30 # interface GigabitEthernet1/0/14 # interface GigabitEthernet1/0/15 # interface GigabitEthernet2/0/14 # interface GigabitEthernet2/0/15 # security-zone name Local # security-zone name Trust # security-zone name DMZ # security-zone name Untrust # security-zone name Management import interface GigabitEthernet1/0/0 # security-zone name BS import interface GigabitEthernet1/0/16 vlan 30 # security-zone name TEST import vlan 355 1000 # scheduler logfile size 16 # line class aux user-role network-operator # line class console authentication-mode scheme user-role network-admin # line class usb user-role network-operator # line class vty user-role network-operator # line aux 0 user-role network-admin # line aux 1 user-role network-operator # line con 0 1 user-role network-admin # line vty 0 63 authentication-mode scheme user-role network-admin # ip route-static 0.0.0.0 0 21.1.100.6 description TEST to BS ip route-static 21.100.0.0 16 21.100.254.6 description BS to TEST ip route-static vpn-instance mgmt 0.0.0.0 0 21.10.100.1 description OOB # info-center source FILTER logfile deny # ssh server enable # ntp-service unicast-server 10.21.81.120 source Vlan-interface355 # acl advanced 3100 rule 0 permit ip # domain system # domain default enable system # role name level-0 description Predefined level-0 role # role name level-1 description Predefined level-1 role # role name level-2 description Predefined level-2 role # role name level-3 description Predefined level-3 role # role name level-4 description Predefined level-4 role # role name level-5 description Predefined level-5 role # role name level-6 description Predefined level-6 role # role name level-7 description Predefined level-7 role # role name level-8 description Predefined level-8 role # role name level-9 description Predefined level-9 role # role name level-10 description Predefined level-10 role # role name level-11 description Predefined level-11 role # role name level-12 description Predefined level-12 role # role name level-13 description Predefined level-13 role # role name level-14 description Predefined level-14 role # user-group system # local-user admin class manage password hash $h$6$8kqTFRbQuVpn9aif$06sD4NFAj8wHQ2M563EnGlb76PH37+spvwCIX5tH9JrqTEC0zHb+vS5NeTJ0tuO/PIVsyymsAZ24sEWH7zqSyg== service-type ssh terminal https authorization-attribute user-role level-3 authorization-attribute user-role network-admin authorization-attribute user-role network-operator # local-user onebank class manage password hash $h$6$9GG8tMZ28Vtglv++$mQsFTylrCz/+5TT5Hrd9ANKrv+jH34pgkvRql1zJt8THPqlBeLg6sXBvcBz74LJD9R6ykIBSYAhgBP8XQDhwcQ== service-type ssh telnet https authorization-attribute user-role level-15 authorization-attribute user-role network-admin authorization-attribute user-role network-operator # session statistics enable session synchronization enable session synchronization http # ipsec logging negotiation enable # ike logging negotiation enable # ip https enable # loadbalance isp file flash:/lbispinfo_v1.5.tp # security-policy ip rule 0 name icmp_any action pass counting enable rule 1 name BS_ACL1 action pass counting enable source-zone BS destination-zone TEST destination-zone Local rule 3 name TEST_ACL1 action pass counting enable source-zone TEST destination-zone BS destination-zone Local rule 4 name LOCAL_ACL1 action pass counting enable source-zone Local destination-zone BS destination-zone TEST # return