为什么我把rule4的安全策略打开网就特别卡
version 7.1.064, Release 8860P41
#
sysname YSGYY-FW-main
#
clock timezone Lisbon add 00:00:00
clock protocol ntp context 1
#
context Admin id 1
#
irf mac-address persistent timer
irf auto-update enable
undo irf link-delay
irf member 1 priority 10
#
dns server 8.8.8.8
dns server 114.114.114.114
#
lldp global enable
#
password-recovery enable
#
vlan 1
#
vlan 29
#
vlan 33
#
vlan 123
#
vlan 1076 to 1078
#
vlan 1192
description QiLuYiYuan-DianXin-ZhuanXian
#
vlan 2000
#
object-group ip address 白名单
security-zone Trust
10 network range 172.30.120.191 172.30.120.254
20 network host address 172.30.123.9
object 20 description 杨玉霞
30 network host address 172.30.123.27
object 30 description 宋俊贤
40 network host address 172.30.123.13
object 40 description 宋惠娟
50 network host address 172.30.123.6
object 50 description 王梅林
60 network host address 172.30.123.17
object 60 description 护理部陈文倩
70 network host address 172.30.123.3
object 70 description 隋春晓
80 network host address 172.30.123.7
object 80 description 田崇林
90 network host address 172.30.123.28
object 90 description 李世杰
100 network host address 172.30.125.7
object 100 description 鞠佳良
110 network host address 172.30.125.6
object 110 description 贾善菲
120 network host address 172.30.145.252
object 120 description 宋日旭
130 network host address 172.30.125.8
object 130 description 医务部赵娟
140 network host address 172.30.125.50
object 140 description 医务部张立福
150 network subnet 172.30.142.0 255.255.255.0
object 150 description 查体中心
160 network host address 172.30.125.86
object 160 description 医养中心
170 network host address 172.30.123.20
object 170 description 经管科王文娟
180 network host address 172.30.125.40
object 180 description 医养中心
190 network host address 172.30.125.155
object 190 description 设备科1
200 network host address 172.30.125.98
object 200 description 设备科2
210 network host address 172.30.125.95
object 210 description 设备科3
220 network host address 172.30.125.20
object 220 description 设备科4
230 network host address 172.30.125.157
object 230 description 设备科5
240 network host address 172.30.123.201
object 240 description 护理部
250 network host address 172.30.125.2
object 250 description 康文楼检验科1
260 network host address 172.30.125.3
object 260 description 康文楼检验科2
270 network host address 172.30.122.89
object 270 description 病房楼检验科
280 network host address 172.30.125.19
object 280 description 检验科陈静
290 network host address 172.30.121.4
object 290 description 便民药房
300 network host address 172.30.123.5
object 300 description 临床药学
310 network host address 172.30.130.2
#
object-group ip address 财务共享中心服务器
security-zone Untrust
0 network subnet 172.20.128.0 255.255.192.0
10 network host address 182.40.34.73
#
object-group ip address 集团南山服务器组
security-zone Untrust
0 network subnet 172.15.248.0 255.255.255.0
10 network range 172.15.253.0 172.15.254.255
20 network subnet 172.20.231.0 255.255.255.0
30 network range 172.20.238.0 172.20.244.255
40 network range 172.20.248.0 172.20.249.255
50 network subnet 172.20.254.0 255.255.255.0
60 network host address 10.0.0.251
object 60 description 上网认证
70 network host address 192.168.188.195
#
object-group ip address 其他必要公网服务
description 其他必要公网服务
security-zone Untrust
0 network host name www.baidu.com
#
object-group ip address 齐鲁医院服务器网段
security-zone Untrust
0 network subnet 172.20.231.0 255.255.255.0
#
object-group ip address 网络监管
security-zone Untrust
0 network subnet 172.16.102.0 255.255.255.0
10 network subnet 172.15.1.0 255.255.255.0
20 network subnet 172.15.3.0 255.255.255.0
30 network subnet 172.16.69.0 255.255.255.0
40 network subnet 172.16.207.0 255.255.255.0
#
object-group ip address 医院到南山互联
10 network subnet 10.2.0.0 255.255.255.0
#
object-group ip address 医院内网网段
security-zone Trust
0 network subnet 172.30.112.0 255.255.252.0
10 network subnet 172.30.102.0 255.255.255.0
20 network subnet 172.30.119.0 255.255.255.0
30 network range 172.30.120.0 172.30.123.254
40 network range 172.30.125.1 172.30.127.254
50 network range 172.30.129.1 172.30.153.254
60 network range 172.30.176.1 172.30.178.254
#
object-group ip address 允许访问域名
security-zone Untrust
10 network host name ***.***
20 network range 27.221.34.176 27.221.34.177
30 network host address 106.11.35.100
40 network host address 106.11.40.32
50 network host address 106.11.43.136
60 network host address 106.11.43.160
70 network host address 119.249.58.142
80 network host name ***.***
90 network host name ***.***
100 network host name *.***.***
110 network host name ***.***
object 110 description 钉钉
120 network host name ***.***
object 120 description 钉钉
130 network host name space.***.***
object 130 description 钉钉
140 network host name ***.***
150 network host name ***.***
object 150 description 钉钉
160 network host address 119.188.223.101
object 160 description 钉钉
170 network host name ***.***
object 170 description 钉钉
180 network range 119.188.223.101 119.188.223.108
object 180 description 钉钉
190 network host name oa.***.***
#
interface NULL0
#
interface GigabitEthernet1/0/4
port link-mode route
#
interface GigabitEthernet1/0/5
port link-mode route
#
interface GigabitEthernet1/0/6
port link-mode route
#
interface GigabitEthernet1/0/7
port link-mode route
#
interface GigabitEthernet1/0/8
port link-mode route
#
interface GigabitEthernet1/0/9
port link-mode route
#
interface GigabitEthernet1/0/10
port link-mode route
#
interface GigabitEthernet1/0/11
port link-mode route
#
interface GigabitEthernet1/0/12
port link-mode route
#
interface GigabitEthernet1/0/13
port link-mode route
#
interface GigabitEthernet1/0/14
port link-mode route
#
interface GigabitEthernet1/0/15
port link-mode route
#
interface GigabitEthernet1/0/16
port link-mode route
combo enable fiber
#
interface GigabitEthernet1/0/17
port link-mode route
combo enable fiber
#
interface GigabitEthernet1/0/18
port link-mode route
combo enable fiber
#
interface GigabitEthernet1/0/19
port link-mode route
combo enable fiber
#
interface GigabitEthernet1/0/0
port link-mode bridge
description QiLuYiYuan-CMCC-ZhuanXian-To-core
port link-type trunk
undo port trunk permit vlan 1
port trunk permit vlan 1076 to 1078
#
interface GigabitEthernet1/0/1
port link-mode bridge
description QiLuYiYuan-CMCC-ZhuanXian
port link-type trunk
undo port trunk permit vlan 1
port trunk permit vlan 1076 to 1078
#
interface GigabitEthernet1/0/2
port link-mode bridge
#
interface GigabitEthernet1/0/3
port link-mode bridge
#
interface GigabitEthernet1/0/20
port link-mode bridge
description dianshijifang-To-CORE
port access vlan 33
#
interface GigabitEthernet1/0/21
port link-mode bridge
description Dianshijifang
port access vlan 33
speed 1000
duplex full
#
interface GigabitEthernet1/0/22
port link-mode bridge
description ToCSHY-5800-g1/0/10_To_core
port link-type trunk
undo port trunk permit vlan 1
port trunk permit vlan 29 123 2000
#
interface GigabitEthernet1/0/23
port link-mode bridge
description ToCSHY-5800-g1/0/10
port link-type trunk
undo port trunk permit vlan 1
port trunk permit vlan 29 123 2000
#
interface M-GigabitEthernet1/0/0
ip address 172.30.120.253 255.255.255.0
#
interface Ten-GigabitEthernet1/0/27
port link-mode route
#
interface Ten-GigabitEthernet1/0/28
port link-mode route
#
interface Ten-GigabitEthernet1/0/29
port link-mode route
#
interface Ten-GigabitEthernet1/0/24
port link-mode bridge
description QiLuYiYuan-DianXin-LuoGuangLan-10G-To_CORE
port link-type trunk
undo port trunk permit vlan 1
port trunk permit vlan 1192
#
interface Ten-GigabitEthernet1/0/25
port link-mode bridge
description QiLuYiYuan-DianXin-LuoGuangLan-10G
port link-type trunk
undo port trunk permit vlan 1
port trunk permit vlan 1192
#
interface Ten-GigabitEthernet1/0/26
port link-mode bridge
#
security-zone name Local
#
security-zone name Trust
import interface GigabitEthernet1/0/0 vlan 1 to 4094
import interface GigabitEthernet1/0/20 vlan 1 to 4094
import interface GigabitEthernet1/0/22 vlan 1 to 4094
import interface Ten-GigabitEthernet1/0/24 vlan 1 to 4094
#
security-zone name DMZ
#
security-zone name Untrust
import interface GigabitEthernet1/0/1 vlan 1 to 4094
import interface GigabitEthernet1/0/21 vlan 1 to 4094
import interface GigabitEthernet1/0/23 vlan 1 to 4094
import interface Ten-GigabitEthernet1/0/25 vlan 1 to 4094
#
security-zone name Management
import interface M-GigabitEthernet1/0/0
#
scheduler logfile size 16
#
line class console
user-role network-admin
#
line class vty
user-role network-operator
#
line con 0
authentication-mode scheme
user-role network-admin
#
line vty 0 63
authentication-mode scheme
user-role network-admin
#
ip route-static 0.0.0.0 0 172.30.120.254
#
performance-management
#
ssh server enable
#
ntp-service enable
ntp-service source M-GigabitEthernet1/0/0
ntp-service authentication-keyid 1 authentication-mode md5 cipher $c$3$Hw4nybF19dUiJstp/3hcAwjcEvM=
ntp-service reliable authentication-keyid 1
ntp-service unicast-server 172.30.120.188 authentication-keyid 1 version 1
#
undo password-control blacklist all-line
#
domain system
#
domain default enable system
#
role name level-0
description Predefined level-0 role
#
role name level-1
description Predefined level-1 role
#
role name level-2
description Predefined level-2 role
#
role name level-3
description Predefined level-3 role
#
role name level-4
description Predefined level-4 role
#
role name level-5
description Predefined level-5 role
#
role name level-6
description Predefined level-6 role
#
role name level-7
description Predefined level-7 role
#
role name level-8
description Predefined level-8 role
#
role name level-9
description Predefined level-9 role
#
role name level-10
description Predefined level-10 role
#
role name level-11
description Predefined level-11 role
#
role name level-12
description Predefined level-12 role
#
role name level-13
description Predefined level-13 role
#
role name level-14
description Predefined level-14 role
#
user-group system
#
local-user admin class manage
password hash $h$6$3/PiKkFy0WESWZlm$8O95aQLuBnGv+SjwFrISXfm5hfa99jZhnE4/Q5kN1GPgD3tTzdYJK1BveHdibb7TqHF8eL5/7E+IonYVc2H/GA==
service-type ssh terminal https
authorization-attribute user-role level-3
authorization-attribute user-role network-admin
authorization-attribute user-role network-operator
#
session synchronization enable
session synchronization dns http
#
ipsec logging negotiation enable
#
ike logging negotiation enable
#
ip https enable
#
blacklist global enable
#
inspect logging parameter-profile av_logging_default_parameter
#
inspect logging parameter-profile ips_logging_default_parameter
#
inspect logging parameter-profile url_logging_default_parameter
#
inspect logging parameter-profile waf_logging_default_parameter
#
inspect email parameter-profile mailsetting_default_parameter
undo authentication enable
#
loadbalance isp file flash:/lbispinfo_v1.5.tp
#
waf logging parameter-profile waf_logging_default_parameter
#
security-policy ip
rule 7 name LAN-WAN-白名单允许内网访问
action pass
logging enable
counting enable
source-ip 白名单
rule 3 name 允许内网网段访问服务器网段
action pass
logging enable
counting enable
source-zone Trust
destination-zone Untrust
source-ip 医院内网网段
destination-ip 齐鲁医院服务器网段
destination-ip 集团南山服务器组
destination-ip 网络监管
destination-ip 医院到南山互联
destination-ip 财务共享中心服务器
rule 8 name 允许访问域名
action pass
logging enable
counting enable
source-zone Trust
destination-zone Untrust
source-ip 医院内网网段
destination-ip 允许访问域名
rule 9 name WAN-LAN允许外网部分服务访问内网
action pass
logging enable
counting enable
source-zone Untrust
destination-zone Trust
source-ip 允许访问域名
destination-ip 医院内网网段
rule 4 name 拒绝齐鲁医院内网网段trust-untrust
disable
source-zone Trust
destination-zone Untrust
source-ip 医院内网网段
rule 5 name WAN-LAN允许外网网段访问内网
action pass
logging enable
counting enable
source-zone Untrust
destination-zone Trust
source-ip 集团南山服务器组
source-ip 网络监管
source-ip 医院到南山互联
source-ip 财务共享中心服务器
destination-ip 医院内网网段
rule 6 name WAN-LAN拒绝外到内访问
source-zone Untrust
destination-zone Trust
destination-ip 医院内网网段
rule 2 name any
action pass
logging enable
counting enable
source-zone Local
source-zone Trust
source-zone DMZ
source-zone Untrust
source-zone Management
destination-zone Local
destination-zone Trust
destination-zone DMZ
destination-zone Untrust
destination-zone Management
#
ips logging parameter-profile ips_logging_default_parameter
#
anti-virus logging parameter-profile av_logging_default_parameter
#
cloud-management server domain opstunnel-seccloud.h3c.com
#
return
(0)
最佳答案
亲~登录后才可以操作哦!
确定你的邮箱还未认证,请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
抄袭了我的内容
×
原文链接或出处
诽谤我
×
对根叔社区有害的内容
×
不规范转载
×
举报说明
暂无评论