我有一台H3C的防火墙,之前2口为wan口,4口,9口为内网口。现新增一条网络专线,接防火墙3口,地址为100.100.4.18。对端也为防火墙,地址为100.100.4.17,其内网下有一台服务器,地址为100.100.0.1。现我司需通过新增的这条网络专线,从我司内网能直接访问对方100.100.0.1的服务器,同时原先访问互联网不受影响。当前大概配置如下:
#
sysname WaiWang_FW
#
context Admin id 1
#
#
irf mac-address persistent timer
irf auto-update enable
undo irf link-delay
irf member 1 priority 1
#
dialer-group 1 rule ip permit
#
nat address-group 10
address 39.152.13.225 39.152.13.225
#
dns server 211.137.32.178
dns server 211.140.197.58
#
lldp global enable
#
password-recovery enable
#
vlan 1
#
object-group ip address DEVICE_AC
0 network host address 10.1.253.253
10 network host address 10.1.254.253
#
object-group ip address NET_10.1.10.0
0 network subnet 10.1.10.0 255.255.255.0
#
object-group ip address NET_10.1.11.0
0 network subnet 10.1.11.0 255.255.255.0
#
object-group ip address NET_10.1.12.0
0 network subnet 10.1.12.0 255.255.255.0
#
object-group ip address NET_10.1.13.0
0 network subnet 10.1.13.0 255.255.255.0
#
object-group ip address youxianbixu
0 network host address 10.1.12.8
10 network host address 10.1.12.20
20 network host address 10.1.12.24
30 network host address 10.1.12.28
40 network host address 10.1.12.250
50 network host address 10.1.12.34
#
controller Cellular1/0/0
#
controller Cellular1/0/1
#
interface NULL0
#
interface GigabitEthernet1/0/0
port link-mode route
combo enable copper
ip address 10.1.1.10 255.255.255.0
#
interface GigabitEthernet1/0/1
port link-mode route
combo enable fiber
#
interface GigabitEthernet1/0/2
port link-mode route
ip address 39.152.13.225 255.255.255.0
gateway 39.152.13.1
#
interface GigabitEthernet1/0/3
port link-mode route
description to_zhuanxian
ip address 100.100.4.18 255.255.255.252
#
interface GigabitEthernet1/0/4
port link-mode route
ip address 10.1.253.254 255.255.255.0
#
interface GigabitEthernet1/0/5
port link-mode route
#
interface GigabitEthernet1/0/6
port link-mode route
#
interface GigabitEthernet1/0/8
port link-mode route
ip address 192.168.11.2 255.255.255.0
#
interface GigabitEthernet1/0/9
port link-mode route
ip address 10.1.254.254 255.255.255.0
#
interface GigabitEthernet1/0/7
port link-mode bridge
port link-type trunk
undo port trunk permit vlan 1
port trunk permit vlan 10 to 11
port trunk pvid vlan 10
#
security-zone name Local
#
security-zone name Trust
import interface GigabitEthernet1/0/9
#
security-zone name DMZ
#
security-zone name Untrust
import interface GigabitEthernet1/0/2
#
security-zone name Management
import interface GigabitEthernet1/0/0
#
security-zone name WuXian
import interface GigabitEthernet1/0/4
#
scheduler logfile size 16
#
scheduler job 1
command 0 display clock >> a.txt
command 1 display session statistics summary >> a.txt
command 2 display cpu-usage summary >> a.txt
command 3 display memory summary >> a.txt
command 4 display process cpu | in drv >> a.txt
command 5 display counters rate inbound interface >> a.txt
command 6 display counters rate outbound interface >> a.txt
command 7 sys
command 8 probe
command 9 display hardware internal xlp poe para slot 1 >> a.txt
#
scheduler schedule 1
user-role level-3
user-role network-operator
user-role network-admin
job 1
time repeating interval 1
#
line class aux
user-role network-operator
#
line class console
authentication-mode scheme
user-role network-admin
#
line class vty
user-role network-operator
#
line aux 0
user-role network-admin
#
line con 0
user-role network-admin
#
line vty 0 63
authentication-mode scheme
user-role network-admin
#
ip route-static 10.1.10.0 24 10.1.253.253
ip route-static 10.1.11.0 24 10.1.253.253
ip route-static 10.1.12.0 24 10.1.254.253
ip route-static 10.1.13.0 24 10.1.254.253
ip route-static 100.100.0.0 16 100.100.4.17
#
info-center source FILTER logfile deny
#
performance-management
#
ssh server enable
#
ntp-service enable
ntp-service unicast-server ***.***
#
acl basic 2001
step 10
rule 0 permit source 10.1.10.0 0.0.0.255
rule 10 permit source 10.1.11.0 0.0.0.255
rule 20 permit source 10.1.12.0 0.0.0.255
#
acl advanced 3000
#
domain system
#
domain default enable system
#
role name level-0
description Predefined level-0 role
#
role name level-1
description Predefined level-1 role
#
role name level-2
description Predefined level-2 role
#
role name level-3
description Predefined level-3 role
#
role name level-4
description Predefined level-4 role
#
role name level-5
description Predefined level-5 role
#
role name level-6
description Predefined level-6 role
#
role name level-7
description Predefined level-7 role
#
role name level-8
description Predefined level-8 role
#
role name level-9
description Predefined level-9 role
#
role name level-10
description Predefined level-10 role
#
role name level-11
description Predefined level-11 role
#
role name level-12
description Predefined level-12 role
#
role name level-13
description Predefined level-13 role
#
role name level-14
description Predefined level-14 role
#
user-group system
#
local-user admin class manage
password hash $h$6$sRpsoFKC4Ht6KUbQ$/Chqi4lp2zJ807dUFgn5VxyWc8YHSYfZBepgix1ZNPZaerspBBKG3AP3Bo5YYQgH+kZycPb+mtQsAhqZm3LFmg==
service-type ssh terminal https
authorization-attribute user-role level-3
authorization-attribute user-role network-admin
authorization-attribute user-role network-operator
#
session synchronization enable
session synchronization http
#
ipsec logging negotiation enable
#
nat global-policy
rule name snat
source-zone Trust
source-zone WuXian
destination-zone Untrust
destination-zone Untrust1
source-ip NET_10.1.10.0
source-ip NET_10.1.11.0
source-ip NET_10.1.12.0
source-ip NET_10.1.13.0
action snat address-group 10
#
ike logging negotiation enable
#
ip https enable
#
loadbalance isp file flash:/lbispinfo_v1.5.tp
#
security-policy ip
rule 3 name "wuxian to youxian"
action pass
source-zone WuXian
destination-zone Trust
source-ip NET_10.1.11.0
destination-ip youxianbixu
destination-ip NET_10.1.13.0
rule 2 name "youxian to wuxian"
action pass
source-zone Trust
destination-zone WuXian
source-ip NET_10.1.12.0
source-ip NET_10.1.13.0
destination-ip NET_10.1.10.0
destination-ip NET_10.1.11.0
rule 1 name to_local
action pass
source-zone Trust
source-zone WuXian
destination-zone Local
source-ip NET_10.1.11.0
source-ip NET_10.1.10.0
source-ip NET_10.1.12.0
source-ip NET_10.1.13.0
source-ip DEVICE_AC
rule 0 name to_internet
action pass
source-zone Trust
source-zone WuXian
destination-zone Untrust
source-ip NET_10.1.10.0
source-ip NET_10.1.11.0
source-ip NET_10.1.12.0
source-ip NET_10.1.13.0
source-ip DEVICE_AC
#
return
[WaiWang_FW]
麻烦大神帮忙看看,要如何配置。接口3应该放哪个安全区域?
(0)
最佳答案
亲~登录后才可以操作哦!
确定你的邮箱还未认证,请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
抄袭了我的内容
×
原文链接或出处
诽谤我
×
对根叔社区有害的内容
×
不规范转载
×
举报说明
暂无评论