H3C F100防火墙策略

看着策略路由配置没什么问题，192.168.100.0/24段的网关是192.168.100.1吗？检查一下安全策略是否放行了

建议优先检查策略路由“pbr_troute”中是否存在节点编号小于10且**未配置任何`if-match`子句**的空节点。这是因为策略路由会按照节点编号从小到大进行匹配，一旦报文命中了某个节点，就不再继续匹配后续节点。如果一个节点（例如节点0或节点5）没有配置`if-match`条件，则会**默认匹配所有流量**；如果该节点也没有配置`apply`动作，那么所有流量将直接根据路由表转发，导致您后续配置的节点10（匹配ACL 3100）完全失效。

可以执行以下命令查看并清理此类空节点：

display policy-based-route pbr_troute

如果发现类似下方的配置，其中节点5没有 `if-match` 和 `apply` 语句，则需要将其删除。
policy-based-route pbr_troute permit node 5
# 此节点为空配置，将导致策略路由失效


请删除这个空的策略路由节点：
system-view
undo policy-based-route pbr_troute permit node 5

完成上述操作后，您的节点10应该可以正常匹配并生效。

有全部配置吗？去掉敏感信息

已去掉一些信息。网络通的。

#

version 7.1.064, Ess 9536P1916
#
sysname H3C
#
clock protocol none
#
context Admin id 1
#
telnet server enable
#
irf mac-address persistent timer
irf auto-update enable
undo irf link-delay
irf member 1 priority 1
#
dhcp enable
#
dns server 202.96.134.133
dns server 202.96.128.86
#
ip subscriber access-user log enable successful-login failed-login logout normal abnormal
#
password-recovery enable
#
vlan 1
#
vlan 10 to 11
#
vlan 20
#
vlan 30
#
object-group ip address LAN
0 network subnet 192.168.0.0 255.255.0.0
#
object-group ip address VLAN10
0 network subnet 192.168.100.0 255.255.255.0
#
object-group ip address VLAN20
0 network subnet 192.168.101.0 255.255.255.0
#
object-group ip address VLAN30
0 network subnet 192.168.102.0 255.255.255.0
#
object-group ip address VPN
0 network range 192.168.200.1 192.168.201.255
#
object-group service high-risk_ports
0 service tcp destination range 20 21
10 service tcp destination eq 22
20 service tcp destination eq 23
30 service tcp destination eq 69
40 service udp destination eq 69
50 service tcp destination eq 135
60 service udp destination eq 135
70 service tcp destination range 137 139
80 service udp destination range 137 139
90 service tcp destination eq 445
100 service udp destination eq 445
110 service tcp destination eq 389
120 service tcp destination eq 177
130 service tcp destination eq 4899
140 service tcp destination eq 513
150 service tcp destination range 1433 1435
160 service tcp destination range 1521 1530
170 service tcp destination eq 3306
180 service tcp destination eq 3389
190 service tcp destination eq 6379
200 service tcp destination range 6000 6063
210 service tcp destination eq 8888
220 service tcp destination range 50000 50050
#
dhcp server ip-pool vlan10
gateway-list 192.168.100.1
network 192.168.100.0 mask 255.255.255.0
address range 192.168.100.10 192.168.100.200
dns-list 202.96.128.68 202.96.134.133
expired day 0 hour 8
#
dhcp server ip-pool vlan20
gateway-list 192.168.101.1
network 192.168.101.0 mask 255.255.255.0
address range 192.168.101.10 192.168.101.255
dns-list 202.96.128.68 202.96.134.133
expired day 0 hour 8
forbidden-ip 192.168.101.118
static-bind ip-address 192.168.101.118 mask 255.255.255.0 hardware-address 9483-c4e0-2b09
#
dhcp server ip-pool vlan30
gateway-list 192.168.102.1
network 192.168.102.0 mask 255.255.255.0
dns-list 202.96.128.68 202.96.134.133
expired day 0 hour 8
#
policy-based-route pbr_softroute permit node 10
if-match acl 3100
apply next-hop 192.168.101.118
#
controller Cellular1/0/0
#
interface NULL0
#
interface Vlan-interface10
ip address 192.168.100.1 255.255.255.0
dhcp server apply ip-pool vlan10
ip policy-based-route pbr_softroute
#
interface Vlan-interface20
ip address 192.168.101.1 255.255.255.0
dhcp server apply ip-pool vlan20
#
interface Vlan-interface30
ip address 192.168.102.1 255.255.255.0
dhcp server apply ip-pool vlan30
#
interface GigabitEthernet1/0/0
port link-mode route
combo enable copper
ip address 192.168.0.1 255.255.255.0
#
interface GigabitEthernet1/0/1
port link-mode route
description GuideWan Interface
bandwidth 10000000
combo enable copper
ip address 000.000.000.000 255.255.255.0
dns server 202.96.128.68
dns server 202.96.134.133
nat outbound 3000
ipsec apply policy ipsec1
gateway 000.000.000.000
#
interface GigabitEthernet1/0/2
port link-mode route
description GuideLan Interface
ip address 192.168.140.1 255.255.255.0
#
interface GigabitEthernet1/0/3
port link-mode route
ip address 192.168.120.1 255.255.255.0
#
interface GigabitEthernet1/0/4
port link-mode route
description GuideDmz Interface
ip address 192.168.130.1 255.255.255.0
#
interface GigabitEthernet1/0/5
port link-mode bridge
description link_lan
port link-type trunk
undo port trunk permit vlan 1
port trunk permit vlan 10 20
port trunk pvid vlan 10
#
interface GigabitEthernet1/0/6
port link-mode bridge
port access vlan 20
#
interface GigabitEthernet1/0/7
port link-mode bridge
description link_lan
port access vlan 10
#
interface GigabitEthernet1/0/8
port link-mode bridge
description link_lan
port access vlan 10
#
interface GigabitEthernet1/0/9
port link-mode bridge
description link_lan
port access vlan 10
#
interface GigabitEthernet1/0/10
port link-mode bridge
description link_lan
port access vlan 20
#
interface GigabitEthernet1/0/11
port link-mode bridge
description link_lan
port access vlan 30
#
interface SSLVPN-AC1
ip address 10.1.1.1 255.255.255.0
#
security-zone name Local
#
security-zone name Trust
import interface GigabitEthernet1/0/2
import interface Vlan-interface10
import interface Vlan-interface20
import interface Vlan-interface30
import interface GigabitEthernet1/0/5 vlan 1
import interface GigabitEthernet1/0/6 vlan 20
import interface GigabitEthernet1/0/7 vlan 10
import interface GigabitEthernet1/0/8 vlan 10
import interface GigabitEthernet1/0/9 vlan 10
import interface GigabitEthernet1/0/10 vlan 20
import interface GigabitEthernet1/0/11 vlan 30
#
security-zone name DMZ
import interface GigabitEthernet1/0/4
#
security-zone name Untrust
import interface GigabitEthernet1/0/1
import interface SSLVPN-AC1
#
security-zone name Management
import interface GigabitEthernet1/0/0
#
scheduler logfile size 16
#
line class aux
user-role network-operator
#
line class console
authentication-mode scheme
user-role network-admin
#
line class usb
user-role network-admin
#
line class vty
user-role network-operator
#
line aux 0
user-role network-admin
#
line con 0
user-role network-admin
#
line vty 0 63
authentication-mode scheme
user-role network-admin
#
ip route-static 0.0.0.0 0 GigabitEthernet1/0/1 000.000.000.000
#
customlog format dpi ips
customlog format dpi anti-virus
customlog format dpi ip-reputation
customlog with-sn
#
ssh server enable
#
arp ip-conflict log prompt
#
acl basic 2000
rule 0 permit
#
acl advanced 3000
rule 10 deny ip source 192.168.0.0 0.0.255.255 destination 192.168.200.0 0.0.0.255
rule 20 deny ip source 192.168.0.0 0.0.255.255 destination 192.168.201.0 0.0.0.255
rule 999 permit ip
#
acl advanced 3100
rule 10 permit ip source 192.168.100.0 0.0.0.255
#
acl advanced 3101
rule 999 permit ip
#
acl advanced name IPsec_ipsec1_IPv4_1
rule 0 permit ip source 192.168.100.0 0.0.0.255 destination 192.168.200.0 0.0.0.255
rule 1 permit ip source 192.168.100.0 0.0.0.255 destination 192.168.201.0 0.0.0.255
rule 2 permit ip source 192.168.101.0 0.0.0.255 destination 192.168.200.0 0.0.0.255
rule 3 permit ip source 192.168.101.0 0.0.0.255 destination 192.168.201.0 0.0.0.255
#
undo password-control length enable
undo password-control composition enable
undo password-control complexity user-name check
#
domain system
#
domain default enable system
#
role name level-0
description Predefined level-0 role
#
role name level-1
description Predefined level-1 role
#
role name level-2
description Predefined level-2 role
#
role name level-3
description Predefined level-3 role
#
role name level-4
description Predefined level-4 role
#
role name level-5
description Predefined level-5 role
#
role name level-6
description Predefined level-6 role
#
role name level-7
description Predefined level-7 role
#
role name level-8
description Predefined level-8 role
#
role name level-9
description Predefined level-9 role
#
role name level-10
description Predefined level-10 role
#
role name level-11
description Predefined level-11 role
#
role name level-12
description Predefined level-12 role
#
role name level-13
description Predefined level-13 role
#
role name level-14
description Predefined level-14 role
#
user-group system
#
local-user admin class manage
password hash
service-type ssh telnet terminal https
authorization-attribute user-role level-3
authorization-attribute user-role network-admin
authorization-attribute user-role network-operator
#
local-user sslvpn class network
password cipher
service-type sslvpn
authorization-attribute acl 2000
authorization-attribute user-role network-operator
authorization-attribute sslvpn-policy-group resourcegrp
#
ssl renegotiation disable
#
ipsec logging negotiation enable
#
ipsec transform-set ipsec1_IPv4_1
esp encryption-algorithm 3des-cbc
esp authentication-algorithm sha1
#
ipsec policy ipsec1 1 isakmp
transform-set ipsec1_IPv4_1
security acl name IPsec_ipsec1_IPv4_1
local-address 0.0.0.0
remote-address 0.0.0.0
ike-profile ipsec1_IPv4_1
sa trigger-mode auto
#
apr signature auto-update
update schedule daily start-time 02:00:00 tingle 120
#
ike logging negotiation enable
#
ike profile ipsec1_IPv4_1
keychain ipsec1_IPv4_1
local-identity address 0.0.0.0
match remote identity address 0.0.0.0 255.255.255.255
match local address GigabitEthernet1/0/1
#
ike proposal 1
encryption-algorithm 3des-cbc
dh group2
#
ike keychain ipsec1_IPv4_1
match local address GigabitEthernet1/0/1
pre-shared-key address 0.0.0.0 255.255.255.255 key cipher $c$3$6a
netconf soap http enable
netconf soap https enable
restful http enable
restful https enable
#
ip http enable
ip https enable
#
blacklist logging enable
#
url-filter signature auto-update
update schedule daily start-time 02:00:00 tingle 120
#
ips signature auto-update
update schedule daily start-time 02:00:00 tingle 120
#
app-profile 1_IPv4
ips apply policy default mode protect
anti-virus apply policy default mode protect
#
app-profile 2_IPv4
ips apply policy default mode protect
anti-virus apply policy default mode protect
#
app-profile 3_IPv4
ips apply policy default mode protect
anti-virus apply policy default mode protect
#
app-profile 4_IPv4
ips apply policy default mode protect
anti-virus apply policy default mode protect
#
app-profile 6_IPv4
#
app-profile 7_IPv4
ips apply policy guideipspolicy mode protect
#
inspect logging parameter-profile av_logging_default_parameter
#
inspect logging parameter-profile ips_logging_default_parameter
#
inspect logging parameter-profile url_logging_default_parameter
#
loadbalance isp file flash:/lbispinfo_v1.5.tp
#
traffic-policy
rule 3 name GuideWANAccPolicy
action qos profile guidewanaccprofile
source-zone Trust
destination-zone DMZ
destination-zone Untrust
service ike
service ipsec-ah
service ipsec-esp
service l2tp
service nat-t-ipsec
rule 4 name GuideAVCPolicy
action qos profile guideavcprofile1
source-zone Trust
destination-zone DMZ
destination-zone Untrust
profile name guideavcprofile1
bandwidth downstream guaranteed 7000000
bandwidth downstream maximum 7000000
profile name guidewanaccprofile
bandwidth downstream guaranteed 3000000
bandwidth downstream maximum 3000000
#
sslvpn ip address-pool sslvpnpool 10.1.1.2 10.1.1.200
#
sslvpn gateway gw
ip address 0.0.0.0 port 4430
service enable
#
sslvpn context ctxip
gateway gw domain domainip
ip-tunnel interface SSLVPN-AC1
ip-tunnel address-pool sslvpnpool mask 255.255.255.0
ip-route-list rtlist
include 0.0.0.0 0.0.0.0
policy-group resourcegrp
ip-tunnel access-route ip-route-list rtlist
service enable
#
ip-mac binding ipv4 192.168.101.118 mac-address 9483-c4e0-2b09 vlan 20
#
security-policy ip
rule 11 name ipsec-vpn-ike
action pass
service ipsec-esp
service nat-t-ipsec
service ike
rule 8 name ipsec_vpn
action pass
source-ip LAN
destination-ip VPN
rule 5 name trust-trust
logging enable
source-zone trust
destination-zone trust
source-ip VLAN10
source-ip VLAN20
destination-ip VLAN30
rule 9 name ܾ vlan30
source-zone Trust
destination-zone Trust
source-ip VLAN30
destination-ip VLAN10
destination-ip VLAN20
rule 10 name vlan1020
action pass
source-zone Trust
destination-zone Trust
source-ip VLAN10
source-ip VLAN20
destination-ip VLAN10
destination-ip VLAN20
rule 7 name GuideSecPolicy
action pass
profile 7_IPv4
source-zone Trust
destination-zone Untrust
destination-zone DMZ
rule 0 name Disable_high-risk_ports
source-zone Untrust
source-zone Local
destination-zone Trust
destination-zone Local
destination-zone DMZ
destination-zone Untrust
service high-risk_ports
rule 1 name any-local
action pass
logging enable
profile 1_IPv4
source-zone trust
source-zone untrust
destination-zone local
rule 2 name local-any
action pass
logging enable
profile 2_IPv4
source-zone trust
source-zone local
destination-zone untrust
destination-zone trust
rule 4 name untrust-trust
action pass
logging enable
profile 4_IPv4
source-zone untrust
destination-zone trust
rule 3 name trust-untrust
action pass
logging enable
profile 3_IPv4
source-zone trust
destination-zone untrust
#
ips policy guideipspolicy
severity-level critical
protect-target WebServer Any
protect-target WebServer Apache
protect-target WebServer IIS
protect-target WebServer Other
protect-target WebServer Tomcat
protect-target WebServer WebLogic
#
ips logging parameter-profile ips_logging_default_parameter
#
anti-virus signature auto-update
update schedule daily start-time 02:00:00 tingle 120
#
anti-virus logging parameter-profile av_logging_default_parameter
#
cloud-management server domain opstunnel-seccloud.h3c.com
#
return

已去信息，网络通的。

#
version 7.1.064, Ess 9536P1916
#
sysname H3C
#
clock protocol none
#
context Admin id 1
#
telnet server enable
#
irf mac-address persistent timer
irf auto-update enable
undo irf link-delay
irf member 1 priority 1
#
dhcp enable
#
dns server 202.96.134.133
dns server 202.96.128.86
#
ip subscriber access-user log enable successful-login failed-login logout normal abnormal
#
password-recovery enable
#
vlan 1
#
vlan 10 to 11
#
vlan 20
#
vlan 30
#
object-group ip address LAN
0 network subnet 192.168.0.0 255.255.0.0
#
object-group ip address VLAN10
0 network subnet 192.168.100.0 255.255.255.0
#
object-group ip address VLAN20
0 network subnet 192.168.101.0 255.255.255.0
#
object-group ip address VLAN30
0 network subnet 192.168.102.0 255.255.255.0
#
object-group ip address VPN
0 network range 192.168.200.1 192.168.201.255
#
object-group service high-risk_ports
0 service tcp destination range 20 21
10 service tcp destination eq 22
20 service tcp destination eq 23
30 service tcp destination eq 69
40 service udp destination eq 69
50 service tcp destination eq 135
60 service udp destination eq 135
70 service tcp destination range 137 139
80 service udp destination range 137 139
90 service tcp destination eq 445
100 service udp destination eq 445
110 service tcp destination eq 389
120 service tcp destination eq 177
130 service tcp destination eq 4899
140 service tcp destination eq 513
150 service tcp destination range 1433 1435
160 service tcp destination range 1521 1530
170 service tcp destination eq 3306
180 service tcp destination eq 3389
190 service tcp destination eq 6379
200 service tcp destination range 6000 6063
210 service tcp destination eq 8888
220 service tcp destination range 50000 50050
#
dhcp server ip-pool vlan10
gateway-list 192.168.100.1
network 192.168.100.0 mask 255.255.255.0
address range 192.168.100.10 192.168.100.200
dns-list 202.96.128.68 202.96.134.133
expired day 0 hour 8
#
dhcp server ip-pool vlan20
gateway-list 192.168.101.1
network 192.168.101.0 mask 255.255.255.0
address range 192.168.101.10 192.168.101.255
dns-list 202.96.128.68 202.96.134.133
expired day 0 hour 8
forbidden-ip 192.168.101.118
static-bind ip-address 192.168.101.118 mask 255.255.255.0 hardware-address 9483-c4e0-2b09
#
dhcp server ip-pool vlan30
gateway-list 192.168.102.1
network 192.168.102.0 mask 255.255.255.0
dns-list 202.96.128.68 202.96.134.133
expired day 0 hour 8
#
policy-based-route pbr_softroute permit node 10
if-match acl 3100
apply next-hop 192.168.101.118
#
controller Cellular1/0/0
#
interface NULL0
#
interface Vlan-interface10
ip address 192.168.100.1 255.255.255.0
dhcp server apply ip-pool vlan10
ip policy-based-route pbr_softroute
#
interface Vlan-interface20
ip address 192.168.101.1 255.255.255.0
dhcp server apply ip-pool vlan20
#
interface Vlan-interface30
ip address 192.168.102.1 255.255.255.0
dhcp server apply ip-pool vlan30
#
interface GigabitEthernet1/0/0
port link-mode route
combo enable copper
ip address 192.168.0.1 255.255.255.0
#
interface GigabitEthernet1/0/1
port link-mode route
description GuideWan Interface
bandwidth 10000000
combo enable copper
ip address 000.000.000.000 255.255.255.0
dns server 202.96.128.68
dns server 202.96.134.133
nat outbound 3000
ipsec apply policy ipsec1
gateway 000.000.000.000
#
interface GigabitEthernet1/0/2
port link-mode route
description GuideLan Interface
ip address 192.168.140.1 255.255.255.0
#
interface GigabitEthernet1/0/3
port link-mode route
ip address 192.168.120.1 255.255.255.0
#
interface GigabitEthernet1/0/4
port link-mode route
description GuideDmz Interface
ip address 192.168.130.1 255.255.255.0
#
interface GigabitEthernet1/0/5
port link-mode bridge
description link_lan
port link-type trunk
undo port trunk permit vlan 1
port trunk permit vlan 10 20
port trunk pvid vlan 10
#
interface GigabitEthernet1/0/6
port link-mode bridge
port access vlan 20
#
interface GigabitEthernet1/0/7
port link-mode bridge
description link_lan
port access vlan 10
#
interface GigabitEthernet1/0/8
port link-mode bridge
description link_lan
port access vlan 10
#
interface GigabitEthernet1/0/9
port link-mode bridge
description link_lan
port access vlan 10
#
interface GigabitEthernet1/0/10
port link-mode bridge
description link_lan
port access vlan 20
#
interface GigabitEthernet1/0/11
port link-mode bridge
description link_lan
port access vlan 30
#
interface SSLVPN-AC1
ip address 10.1.1.1 255.255.255.0
#
security-zone name Local
#
security-zone name Trust
import interface GigabitEthernet1/0/2
import interface Vlan-interface10
import interface Vlan-interface20
import interface Vlan-interface30
import interface GigabitEthernet1/0/5 vlan 1
import interface GigabitEthernet1/0/6 vlan 20
import interface GigabitEthernet1/0/7 vlan 10
import interface GigabitEthernet1/0/8 vlan 10
import interface GigabitEthernet1/0/9 vlan 10
import interface GigabitEthernet1/0/10 vlan 20
import interface GigabitEthernet1/0/11 vlan 30
#
security-zone name DMZ
import interface GigabitEthernet1/0/4
#
security-zone name Untrust
import interface GigabitEthernet1/0/1
import interface SSLVPN-AC1
#
security-zone name Management
import interface GigabitEthernet1/0/0
#
scheduler logfile size 16
#
line class aux
user-role network-operator
#
line class console
authentication-mode scheme
user-role network-admin
#
line class usb
user-role network-admin
#
line class vty
user-role network-operator
#
line aux 0
user-role network-admin
#
line con 0
user-role network-admin
#
line vty 0 63
authentication-mode scheme
user-role network-admin
#
ip route-static 0.0.0.0 0 GigabitEthernet1/0/1 000.000.000.000
#
customlog format dpi ips
customlog format dpi anti-virus
customlog format dpi ip-reputation
customlog with-sn
#
ssh server enable
#
arp ip-conflict log prompt
#
acl basic 2000
rule 0 permit
#
acl advanced 3000
rule 10 deny ip source 192.168.0.0 0.0.255.255 destination 192.168.200.0 0.0.0.255
rule 20 deny ip source 192.168.0.0 0.0.255.255 destination 192.168.201.0 0.0.0.255
rule 999 permit ip
#
acl advanced 3100
rule 10 permit ip source 192.168.100.0 0.0.0.255
#
acl advanced 3101
rule 999 permit ip
#
acl advanced name IPsec_ipsec1_IPv4_1
rule 0 permit ip source 192.168.100.0 0.0.0.255 destination 192.168.200.0 0.0.0.255
rule 1 permit ip source 192.168.100.0 0.0.0.255 destination 192.168.201.0 0.0.0.255
rule 2 permit ip source 192.168.101.0 0.0.0.255 destination 192.168.200.0 0.0.0.255
rule 3 permit ip source 192.168.101.0 0.0.0.255 destination 192.168.201.0 0.0.0.255
#
undo password-control length enable
undo password-control composition enable
undo password-control complexity user-name check
#
domain system
#
domain default enable system
#
role name level-0
description Predefined level-0 role
#
role name level-1
description Predefined level-1 role
#
role name level-2
description Predefined level-2 role
#
role name level-3
description Predefined level-3 role
#
role name level-4
description Predefined level-4 role
#
role name level-5
description Predefined level-5 role
#
role name level-6
description Predefined level-6 role
#
role name level-7
description Predefined level-7 role
#
role name level-8
description Predefined level-8 role
#
role name level-9
description Predefined level-9 role
#
role name level-10
description Predefined level-10 role
#
role name level-11
description Predefined level-11 role
#
role name level-12
description Predefined level-12 role
#
role name level-13
description Predefined level-13 role
#
role name level-14
description Predefined level-14 role
#
user-group system
#
local-user admin class manage
password hash
service-type ssh telnet terminal https
authorization-attribute user-role level-3
authorization-attribute user-role network-admin
authorization-attribute user-role network-operator
#
local-user sslvpn class network
password cipher
service-type sslvpn
authorization-attribute acl 2000
authorization-attribute user-role network-operator
authorization-attribute sslvpn-policy-group resourcegrp
#
ssl renegotiation disable
#
ipsec logging negotiation enable
#
ipsec transform-set ipsec1_IPv4_1
esp encryption-algorithm 3des-cbc
esp authentication-algorithm sha1
#
ipsec policy ipsec1 1 isakmp
transform-set ipsec1_IPv4_1
security acl name IPsec_ipsec1_IPv4_1
local-address 0.0.0.0
remote-address 0.0.0.0
ike-profile ipsec1_IPv4_1
sa trigger-mode auto
#
apr signature auto-update
update schedule daily start-time 02:00:00 tingle 120
#
ike logging negotiation enable
#
ike profile ipsec1_IPv4_1
keychain ipsec1_IPv4_1
local-identity address 0.0.0.0
match remote identity address 0.0.0.0 255.255.255.255
match local address GigabitEthernet1/0/1
#
ike proposal 1
encryption-algorithm 3des-cbc
dh group2
#
ike keychain ipsec1_IPv4_1
match local address GigabitEthernet1/0/1
pre-shared-key address 0.0.0.0 255.255.255.255 key cipher $c$3$6a
netconf soap http enable
netconf soap https enable
restful http enable
restful https enable
#
ip http enable
ip https enable
#
blacklist logging enable
#
url-filter signature auto-update
update schedule daily start-time 02:00:00 tingle 120
#
ips signature auto-update
update schedule daily start-time 02:00:00 tingle 120
#
app-profile 1_IPv4
ips apply policy default mode protect
anti-virus apply policy default mode protect
#
app-profile 2_IPv4
ips apply policy default mode protect
anti-virus apply policy default mode protect
#
app-profile 3_IPv4
ips apply policy default mode protect
anti-virus apply policy default mode protect
#
app-profile 4_IPv4
ips apply policy default mode protect
anti-virus apply policy default mode protect
#
app-profile 6_IPv4
#
app-profile 7_IPv4
ips apply policy guideipspolicy mode protect
#
inspect logging parameter-profile av_logging_default_parameter
#
inspect logging parameter-profile ips_logging_default_parameter
#
inspect logging parameter-profile url_logging_default_parameter
#
loadbalance isp file flash:/lbispinfo_v1.5.tp
#
traffic-policy
rule 3 name GuideWANAccPolicy
action qos profile guidewanaccprofile
source-zone Trust
destination-zone DMZ
destination-zone Untrust
service ike
service ipsec-ah
service ipsec-esp
service l2tp
service nat-t-ipsec
rule 4 name GuideAVCPolicy
action qos profile guideavcprofile1
source-zone Trust
destination-zone DMZ
destination-zone Untrust
profile name guideavcprofile1
bandwidth downstream guaranteed 7000000
bandwidth downstream maximum 7000000
profile name guidewanaccprofile
bandwidth downstream guaranteed 3000000
bandwidth downstream maximum 3000000
#
sslvpn ip address-pool sslvpnpool 10.1.1.2 10.1.1.200
#
sslvpn gateway gw
ip address 0.0.0.0 port 4430
service enable
#
sslvpn context ctxip
gateway gw domain domainip
ip-tunnel interface SSLVPN-AC1
ip-tunnel address-pool sslvpnpool mask 255.255.255.0
ip-route-list rtlist
include 0.0.0.0 0.0.0.0
policy-group resourcegrp
ip-tunnel access-route ip-route-list rtlist
service enable
#
ip-mac binding ipv4 192.168.101.118 mac-address 9483-c4e0-2b09 vlan 20
#
security-policy ip
rule 11 name ipsec-vpn-ike
action pass
service ipsec-esp
service nat-t-ipsec
service ike
rule 8 name ipsec_vpn
action pass
source-ip LAN
destination-ip VPN
rule 5 name trust-trust
logging enable
source-zone trust
destination-zone trust
source-ip VLAN10
source-ip VLAN20
destination-ip VLAN30
rule 9 name ܾ vlan30
source-zone Trust
destination-zone Trust
source-ip VLAN30
destination-ip VLAN10
destination-ip VLAN20
rule 10 name vlan1020
action pass
source-zone Trust
destination-zone Trust
source-ip VLAN10
source-ip VLAN20
destination-ip VLAN10
destination-ip VLAN20
rule 7 name GuideSecPolicy
action pass
profile 7_IPv4
source-zone Trust
destination-zone Untrust
destination-zone DMZ
rule 0 name Disable_high-risk_ports
source-zone Untrust
source-zone Local
destination-zone Trust
destination-zone Local
destination-zone DMZ
destination-zone Untrust
service high-risk_ports
rule 1 name any-local
action pass
logging enable
profile 1_IPv4
source-zone trust
source-zone untrust
destination-zone local
rule 2 name local-any
action pass
logging enable
profile 2_IPv4
source-zone trust
source-zone local
destination-zone untrust
destination-zone trust
rule 4 name untrust-trust
action pass
logging enable
profile 4_IPv4
source-zone untrust
destination-zone trust
rule 3 name trust-untrust
action pass
logging enable
profile 3_IPv4
source-zone trust
destination-zone untrust
#
ips policy guideipspolicy
severity-level critical
protect-target WebServer Any
protect-target WebServer Apache
protect-target WebServer IIS
protect-target WebServer Other
protect-target WebServer Tomcat
protect-target WebServer WebLogic
#
ips logging parameter-profile ips_logging_default_parameter
#
anti-virus signature auto-update
update schedule daily start-time 02:00:00 tingle 120
#
anti-virus logging parameter-profile av_logging_default_parameter
#
cloud-management server domain opstunnel-seccloud.h3c.com
#
return