Ｆ1000-710配置

现通过Ｆ1000-710访问外网，外网有两条：接口4访问internet，已成功配置，内网电脑可上网。接口5通过固定ＩＰ连通上级监控专线，与接口4的配置原理相同，上级一直看不到监控有适时画面。

是下面通过三层核心交换机接终端，划分不同ＶＬＡＮ,监控为ＶＬＡＮ60.

导出配置如下，请大神予以指导。

#

 version 7.1.064, Ess 9536P2415

#

 sysname lblx

#

 irf mac-address persistent timer

 irf auto-update enable

 undo irf link-delay

 irf member 1 priority 1

#

nat address-group 100

 address AAA.AA.AAA.AAA AAA.AA.AAA.AAA（公网ＩＰ）

#

 dhcp enable

#

 dns server 114.114.114.114

 dns server 8.8.8.8

#

 password-recovery enable

#

vlan 1

#

object-group ip address Jiankong_IP(监控ＶＬＡＮ60）

 0 network subnet 192.168.60.0 255.255.255.0

#

object-group ip address jyj_IP

 0 network subnet 10.0.0.0 255.0.0.0

#

object-group ip address 内网

 0 network subnet 0.0.0.0 0.0.0.0

#

object-group ip address 外网

 0 network subnet 0.0.0.0 0.0.0.0

#

dhcp server ip-pool GuideSecDHCPPool

 gateway-list 10.100.0.254

 network 10.100.0.0 mask 255.255.255.0

 dns-list 202.102.224.68 202.102.227.68

#

policy-based-route jyzw permit node 10

 if-match acl 3000

 apply next-hop 10.10.75.1 direct

#

controller Cellular1/0/0

#

interface NULL0

#

interface GigabitEthernet1/0/0

 port link-mode route

 combo enable copper

 ip address 192.168.0.1 255.255.255.0

#

interface GigabitEthernet1/0/1

 port link-mode route

 combo enable fiber

#

interface GigabitEthernet1/0/2

 port link-mode route

 ip address 192.168.1.1 255.255.255.0

#

interface GigabitEthernet1/0/3

 port link-mode route

#

interface GigabitEthernet1/0/4(访问internet)

 port link-mode route

 description GuideWan Interface

 bandwidth 100000000

 ip address ＡＡＡ.ＡＡ.ＡＡＡ.ＡＡＡ 255.255.255.252

 dns server 202.102.224.68

 dns server 202.102.227.68

 nat outbound description GuideNat

 gateway ＢＢＢ.ＢＢ.ＢＢＢ.ＢＢＢ

#

interface GigabitEthernet1/0/5(上级监控专线)

 port link-mode route

 ip address 10.10.75.3 255.255.255.0

 gateway 10.10.75.1

#

interface GigabitEthernet1/0/6

 port link-mode route

#

interface GigabitEthernet1/0/7

 port link-mode route

#

interface GigabitEthernet1/0/8

 port link-mode route

 description GuideLan Interface

 ip address 10.100.0.254 255.255.255.0

 connection-limit apply policy 1

 ip policy-based-route jyzw

#

interface GigabitEthernet1/0/9

 port link-mode route

#

interface GigabitEthernet1/0/10

 port link-mode route

#

interface GigabitEthernet1/0/11

 port link-mode route

#

security-zone name Local

#

security-zone name Trust

 import interface GigabitEthernet1/0/8

 attack-defense apply policy 1

#

security-zone name DMZ

#

security-zone name Untrust

 import interface GigabitEthernet1/0/4

 import interface GigabitEthernet1/0/5

#

security-zone name Management

 import interface GigabitEthernet1/0/0

 import interface GigabitEthernet1/0/2

#

 scheduler logfile size 16

#

line class aux

 user-role network-operator

#

line class console

 authentication-mode scheme

 user-role network-admin

#

line class vty

 user-role network-operator

#

line aux 0

 user-role network-admin

#

line con 0

 user-role network-admin

#

line vty 0 63

 authentication-mode scheme

 user-role network-admin

#

 ip route-static 0.0.0.0 0 ＢＢＢ.ＢＢ.ＢＢＢ.ＢＢＢ

 ip route-static 10.0.0.0 8 10.10.75.1

 ip route-static 192.168.0.0 16 10.100.0.1

#

 snmp-agent

 snmp-agent local-engineid

 snmp-agent sys-info contact

 snmp-agent sys-info version v3

#

 ssh server enable

#

 arp ip-conflict log prompt

#

acl basic 2000

 rule 0 permit source object-group Jiankong_IP

#

acl basic 2100

 description 限制连接

 rule 0 permit source 0.0.0.0 255.255.0.0

#

acl advanced 3000

 rule 0 permit ip source object-group Jiankong_IP destination object-group jyj_IP

#

domain system

#

 domain default enable system

#

role name level-0

 description Predefined level-0 role

#

role name level-1

 description Predefined level-1 role

#

role name level-2

 description Predefined level-2 role

#

role name level-3

 description Predefined level-3 role

#

role name level-4

 description Predefined level-4 role

#

role name level-5

 description Predefined level-5 role

#

role name level-6

 description Predefined level-6 role

#

role name level-7

 description Predefined level-7 role

#

role name level-8

 description Predefined level-8 role

#

role name level-9

 description Predefined level-9 role

#

role name level-10

 description Predefined level-10 role

#

role name level-11

 description Predefined level-11 role

#

role name level-12

 description Predefined level-12 role

#

role name level-13

 description Predefined level-13 role

#

role name level-14

 description Predefined level-14 role

#

user-group system

#

local-user admin class manage

 password hash

 authorization-attribute user-role level-3

 authorization-attribute user-role network-admin

 authorization-attribute user-role network-operator

#

connection-limit policy 1

 limit 10 acl 2100 per-source amount 500 450 rate 100 

#

 ipsec logging negotiation enable

#

nat policy

 rule name PAT

  outbound-interface GigabitEthernet1/0/4

  action address-group 100

#

 ike logging negotiation enable

#

 ip https enable

#

attack-defense policy 1

 scan detect level low action drop logging

#

inspect block-source parameter-profile ips_block_default_parameter

#

inspect block-source parameter-profile url_block_default_parameter

#

inspect capture parameter-profile ips_capture_default_parameter

#

inspect logging parameter-profile url_logging_default_parameter

#

inspect redirect parameter-profile av_redirect_default_parameter

#

inspect redirect parameter-profile ips_redirect_default_parameter

#

inspect redirect parameter-profile url_redirect_default_parameter

#

 loadbalance isp file flash:/lbispinfo_v1.5.tp

#

traffic-policy

 rule 1 name GuideAVCPolicy

  action qos profile guideavcprofile1

  source-zone Trust

  destination-zone DMZ

  destination-zone Untrust

 profile name guideavcprofile1

  bandwidth downstream guaranteed 100000000

  bandwidth downstream maximum 100000000

#

security-policy ip

 rule 0 name GuideSecPolicy

  action pass

  source-zone Trust

  source-zone Local

  destination-zone Untrust

  destination-zone DMZ

  destination-zone Local

  destination-zone Trust

 rule 1 name trust-Untrust

  action pass

  source-zone Trust

  destination-zone Untrust

 rule 2 name untrust-trust

  action pass

  source-zone Untrust

  destination-zone Trust

#

 cloud-management server domain opstunnel-seccloud.h3c.com

#

return