F1000+行为管理+核心交换

您好，防火墙把对应安全域放通

vlan 10
#
dhcp server ip-pool 10
gateway-list 192.168.10.1
network 192.168.10.0 mask 255.255.255.0
dns-list 61.147.37.1 114.114.114.114
#
controller Cellular1/0/0
#
controller Cellular1/0/1
#
interface NULL0
#
interface Vlan-interface10
ip address 192.168.10.1 255.255.255.0
#
interface GigabitEthernet1/0/0
port link-mode route
combo enable copper
#
interface GigabitEthernet1/0/1
port link-mode route
combo enable copper
#
interface GigabitEthernet1/0/2
port link-mode route
ip address 公网地址
nat outbound
#
interface GigabitEthernet1/0/3
port link-mode route
#
interface GigabitEthernet1/0/4
port link-mode bridge
port access vlan 10
#
interface GigabitEthernet1/0/5
port link-mode bridge
port access vlan 10
#
interface GigabitEthernet1/0/6
port link-mode bridge
port access vlan 10
#
interface GigabitEthernet1/0/7
port link-mode bridge
port access vlan 10
#
interface GigabitEthernet1/0/8
port link-mode bridge
port access vlan 10
#
interface GigabitEthernet1/0/9
port link-mode bridge
port access vlan 10
#
interface GigabitEthernet1/0/10
port link-mode bridge
port access vlan 10
#
interface GigabitEthernet1/0/11
port link-mode bridge
port access vlan 10
#
object-policy ip pass
rule 0 pass
#
security-zone name Local
#
security-zone name Trust
import interface GigabitEthernet1/0/1
import interface Vlan-interface10
import interface GigabitEthernet1/0/4 vlan 10
import interface GigabitEthernet1/0/5 vlan 10
import interface GigabitEthernet1/0/6 vlan 10
import interface GigabitEthernet1/0/7 vlan 10
import interface GigabitEthernet1/0/8 vlan 10
import interface GigabitEthernet1/0/9 vlan 10
import interface GigabitEthernet1/0/10 vlan 10
import interface GigabitEthernet1/0/11 vlan 10
#
security-zone name DMZ
#
security-zone name Untrust
import interface GigabitEthernet1/0/2
import interface GigabitEthernet1/0/3
#
security-zone name Management
import interface GigabitEthernet1/0/0
#
zone-pair security source Local destination Trust
object-policy apply ip pass
#
zone-pair security source Local destination Untrust
object-policy apply ip pass
#
zone-pair security source Trust destination Local
object-policy apply ip pass
#
zone-pair security source Trust destination Untrust
object-policy apply ip pass
#
scheduler logfile size 16
#
line class aux
user-role network-operator
#
line class console
authentication-mode scheme
user-role network-admin
#
line class vty
user-role network-operator
#
line aux 0
user-role network-admin
#
line con 0
user-role network-admin
#
line vty 0 63
authentication-mode scheme
user-role network-admin
#
ip route-static 0.0.0.0 0 公网网关
ip route-static 0.0.0.0 0 192.168.10.254

是不是安全域没放通？

security-zone intra-zone default permit命令用来配置同一安全域内接口间报文处理的缺省动作为允许。

undo security-zone intra-zone default permit命令用来配置同一安全域内接口间报文处理的缺省动作为拒绝。

【命令】

security-zone intra-zone default permit

undo security-zone intra-zone default permit

【缺省情况】

同一安全域内报文过滤的缺省动作为拒绝。

【视图】

系统视图

【缺省用户角色】

network-admin

mdc-admin

【使用指导】

对于同一安全域内接口间的报文，若设备上不存在当前域到当前域的域间策略，设备缺省会将其拒绝，可以通过配置安全域内接口间报文处理的缺省动作为允许来放行报文。

【举例】

# 配置同一安全域内接口间报文处理的缺省动作为允许。

<Sysname> system-view

[Sysname] security-zone intra-zone default permit

你好，需要放通trust到trust的安全策略。