3 配置步骤

3.1  A公司虚拟防火墙配置

3.1.1  在根防火墙上创建名称为Company_A的虚拟防火墙

system-view

[H3C]context Company_A

[H3C-context-2-Company_A]description Company_A

3.1.2  将Company_A的虚拟防火墙CPU权重设置为8、内存使用上限设置为60%并启动虚拟防火墙

[H3C-context-2-Company_A]limit-resource memory slot 1 cpu 0 ratio 60

[H3C-context-2-Company_A]limit-resource cpu weight 8

[H3C-context-2-Company_A]context start

It will take some time to start the context...

Context started successfully.

3.1.3  配置将接口GigabitEthernet1/0/1和GigabitEthernet1/0/2分配给Context Company_A。

[H3C-context-2-Company_A]allocate interface gigabitethernet 1/0/1 gigabitethernet 1/0/2

Configuration of the interfaces will be lost. Continue? [Y/N]:Y

[H3C-context-2-Company_A]quit

3.1.4  进入Context Company_A的虚拟防火墙配置接口IP地址、路由及NAT地址转换。

[H3C]switchto context Company_A

system-view

[H3C]sysname Company_A

[Company_A]interface GigabitEthernet 1/0/1

[Company_A-GigabitEthernet1/0/1]ip address 198.76.28.2 255.255.255.252

[Company_A-GigabitEthernet1/0/1]nat outbound

[Company_A-GigabitEthernet1/0/1]quit

[Company_A]interface GigabitEthernet 1/0/2

[Company_A-GigabitEthernet1/0/2]ip address 172.16.100.1 255.255.255.0

[Company_A-GigabitEthernet1/0/2]quit

[Company_A]ip route-static 0.0.0.0 0 198.76.28.1

3.1.5  进入Context Company_A的虚拟防火墙配置外网与内网的安全域并放通安全策略。

[Company_A]security-zone name untrust

[Company_A-security-zone-Untrust]import interface GigabitEthernet 1/0/1

[Company_A-security-zone-Untrust]quit

[Company_A]security-zone name trust

[Company_A-security-zone-Trust]import interface GigabitEthernet 1/0/2

[Company_A-security-zone-Trust]quit

[Company_A]security-policy ip

[Company_A-security-policy-ip]rule 1 name pass

[Company_A-security-policy-ip-1-pass]source-zone trust

[Company_A-security-policy-ip-1-pass]destination-zone untrust

[Company_A-security-policy-ip-1-pass]destination-zone local

[Company_A-security-policy-ip-1-pass]action pass

[Company_A-security-policy-ip-1-pass]quit

[Company_A]save f

3.2  B公司虚拟防火墙配置

3.2.1  在根防火墙上创建名称为Company_B的虚拟防火墙

system-view

[H3C]context Company_B

[H3C-context-3-Company_B]description Company_B

3.2.2  将Company_B的虚拟防火墙CPU、内存使用系统缺省的资源。

[H3C-context-3-Company_B]context start

It will take some time to start the context...

Context started successfully.

3.2.3  配置将接口GigabitEthernet1/0/3和GigabitEthernet1/0/4分配给Context Company_B。

[H3C-context-3-Company_B]allocate interface gigabitethernet 1/0/3 gigabitethernet 1/0/4

Configuration of the interfaces will be lost. Continue? [Y/N]:Y

[H3C-context-3-Company_B]quit

3.2.4  进入Context Company_B的虚拟防火墙配置接口IP地址、路由及NAT地址转换。

[H3C]switchto context Company_B

system-view

[H3C]sysname Company_B

[Company_B]interface GigabitEthernet 1/0/3

[Company_B-GigabitEthernet1/0/3ip address 200.1.8.2 255.255.255.252

[Company_B-GigabitEthernet1/0/3nat outbound

[Company_B-GigabitEthernet1/0/3]quit

[Company_B]interface GigabitEthernet 1/0/4

[Company_B-GigabitEthernet1/0/4]ip address 172.16.200.1 255.255.255.0

[Company_B-GigabitEthernet1/0/4]quit

[Company_B]ip route-static 0.0.0.0 0 200.1.8.1

3.2.5  进入Context Company_B的虚拟防火墙配置外网与内网的安全域并放通安全策略。

[Company_B]security-zone name untrust

[Company_B-security-zone-Untrust]import interface GigabitEthernet 1/0/3

[Company_B-security-zone-Untrust]quit

[Company_B]security-zone name trust

[Company_B-security-zone-Trust]import interface GigabitEthernet 1/0/4

[Company_B-security-zone-Trust]quit

[Company_B]security-policy ip

[Company_B-security-policy-ip]rule 1 name pass

[Company_B-security-policy-ip-1-pass]source-zone trust

[Company_B-security-policy-ip-1-pass]destination-zone untrust

[Company_B-security-policy-ip-1-pass]destination-zone local

[Company_B-security-policy-ip-1-pass]action pass

[Company_B-security-policy-ip-1-pass]quit

[Company_B]save f

3.3  C公司虚拟防火墙配置

3.3.1  在根防火墙上创建名称为Company_C的虚拟防火墙

system-view

[H3C]context Company_C

[H3C-context-4-Company_C]description Company_C

3.3.2  将Company_C的虚拟防火墙CPU权重设置为2、内存使用上限设置为20%并启动虚拟防火墙。

[H3C-context-4-Company_C]

[H3C-context-4-Company_C]limit-resource memory slot 1 cpu 0 ratio 20

[H3C-context-4-Company_C]limit-resource cpu weight 2

[H3C-context-4-Company_C]context start

It will take some time to start the context...

Context started successfully.

3.3.3  配置将接口GigabitEthernet1/0/5和GigabitEthernet1/0/6分配给Context Company_C。

[H3C-context-4-Company_C]allocate interface gigabitethernet 1/0/5 gigabitethernet 1/0/6

Configuration of the interfaces will be lost. Continue? [Y/N]:Y

[H3C-context-4-Company_C]quit

3.3.4  进入Context Company_C的虚拟防火墙配置接口IP地址、路由及NAT地址转换。

[H3C]switchto context Company_C

system-view

[H3C]sysname Company_C

[Company_C]interface GigabitEthernet 1/0/5

[Company_C-GigabitEthernet1/0/5]ip address 100.100.99.2 255.255.255.252

[Company_C-GigabitEthernet1/0/5]nat outbound

[Company_C-GigabitEthernet1/0/5]quit

[Company_C-interface GigabitEthernet 1/0/6

[Company_C-GigabitEthernet1/0/6]ip address 172.16.300.1 255.255.255.0

[Company_C-GigabitEthernet1/0/6]quit

[Company_C]ip route-static 0.0.0.0 0 100.100.99.1

3.3.5  进入Context Company_C的虚拟防火墙配置外网与内网的安全域并放通安全策略。

[Company_C]security-zone name untrust

[Company_C-security-zone-Untrust]import interface GigabitEthernet 1/0/5

[Company_C-security-zone-Untrust]quit

[Company_C]security-zone name trust

[Company_C-security-zone-Trust]import interface GigabitEthernet 1/0/6

[Company_C-security-zone-Trust]quit

[Company_C]security-policy ip

[Company_C-security-policy-ip]rule 1 name pass

[Company_C-security-policy-ip-1-pass]source-zone trust

[Company_C-security-policy-ip-1-pass]destination-zone untrust

[Company_C-security-policy-ip-1-pass]destination-zone local

[Company_C-security-policy-ip-1-pass]action pass

[Company_C-security-policy-ip-1-pass]quit

[Company_C]save f

3.3.6  保存配置

激活前需要保存根墙，以免重启后配置丢失。

[Company_C]quit

[H3C]save f