H3C SECPATH防火墙firewall命令

防火墙透明部署：

1、组网：

网关（192.168.1.1）----------------V7防火墙-----------------终端（192.168.1.2）

防火墙上连口 1/0/2 。下连口1/0/4 ，防火墙做纯二层透传，实现终端可以到网关可达

防火墙默认拒绝通信，所以在终端上ping网关地址 不通

Pc 上：

Ping 192.168.1.1 (192.168.1.1): 56 data bytes, press CTRL_C to break

Request time out

Request time out

Request time out

Request time out

Request time out

--- Ping statistics for 192.168.1.1 ---

2、配置：

先将接口切为二层接口

[H3C]inter g1/0/2

[H3C-GigabitEthernet1/0/2]port link-mode bridge

[H3C]inter g1/0/4

[H3C-GigabitEthernet1/0/4]port link-mode bridge

将接口划入安全域

[H3C]security-zone name Untrust

[H3C-security-zone-Untrust] import interface g1/0/2 vlan 1   

[H3C]security-zone name Trust

[H3C-security-zone-Trust] import interface  GigabitEthernet 1/0/4 vlan 1

域间策略写成 any 到any  ,执行放通所有

[H3C]zone-pair security source any destination any

[H3C-zone-pair-security-Any-Any]packet-filter 2000

[H3C]acl basic 2000

[H3C-acl-ipv4-basic-2000]rule permit

测试可达：

<H3C>%Dec  1 14:00:25:985 2017 H3C PING/6/PING_STATISTICS: Ping statistics for 192.168.1.1: 5 packet(s) transmitted, 0 packet(s) received, 100.0% packet loss.

ping 192.168.1.1

Ping 192.168.1.1 (192.168.1.1): 56 data bytes, press CTRL_C to break

56 bytes from 192.168.1.1: icmp_seq=0 ttl=255 time=2.000 ms

56 bytes from 192.168.1.1: icmp_seq=1 ttl=255 time=1.000 ms

56 bytes from 192.168.1.1: icmp_seq=2 ttl=255 time=1.000 ms

56 bytes from 192.168.1.1: icmp_seq=3 ttl=255 time=1.000 ms

56 bytes from 192.168.1.1: icmp_seq=4 ttl=255 time=1.000 ms

后续域间策略的配置 ，以及访问控制，再做细致的优化