{"id":6338,"date":"2022-03-01T22:30:33","date_gmt":"2022-03-02T06:30:33","guid":{"rendered":"https:\/\/www.xh86.me\/?p=6338"},"modified":"2022-03-01T22:30:33","modified_gmt":"2022-03-02T06:30:33","slug":"%e5%8d%8e%e4%b8%ba%e9%98%b2%e7%81%ab%e5%a2%99%e9%85%8d%e7%bd%ae%e5%a4%a7%e5%85%a8%e3%80%82","status":"publish","type":"post","link":"https:\/\/www.xh86.me\/?p=6338","title":{"rendered":"\u534e\u4e3a\u9632\u706b\u5899\u914d\u7f6e\u5927\u5168\u3002"},"content":{"rendered":"
\n
\n
\n
\n
\n

\u9632\u706b\u5899\uff08Firewall\uff09<\/span><\/strong>\u4e5f\u79f0\u9632\u62a4\u5899\uff0c\u662f\u7531Check Point\u521b\u7acb\u8005Gil Shwed\u4e8e1993\u5e74\u53d1\u660e\u5e76\u5f15\u5165\u56fd\u9645\u4e92\u8054\u7f51\uff08US5606668\uff08A\uff091993-12-15\uff09\u9632\u706b\u5899\u662f\u4f4d\u4e8e\u5185\u90e8\u7f51\u548c\u5916\u90e8\u7f51\u4e4b\u95f4\u7684\u5c4f\u969c\uff0c\u5b83\u6309\u7167\u7cfb\u7edf\u7ba1\u7406\u5458\u9884\u5148\u5b9a\u4e49\u597d\u7684\u89c4\u5219\u6765\u63a7\u5236\u6570\u636e\u5305\u7684\u8fdb\u51fa\u3002\u9632\u706b\u5899\u662f\u7cfb\u7edf\u7684\u7b2c\u4e00\u9053\u9632\u7ebf\uff0c\u5176\u4f5c\u7528\u662f\u9632\u6b62\u975e\u6cd5\u7528\u6237\u7684\u8fdb\u5165\u3002<\/span><\/p>\n<\/section>\n<\/section>\n

\n
<\/section>\n

\n

\n
\n
\n
<\/div><\/section>\n
\n
\n

\u521d\u59cb\u5316\u9632\u706b\u5899<\/p>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n

\n

\n

\u521d\u59cb\u5316\u9632\u706b\u5899:\u00a0<\/span><\/strong>\u9ed8\u8ba4\u7528\u6237\u540d\u4e3aadmin,\u9ed8\u8ba4\u7684\u5bc6\u7801Admin@123,\u8fd9\u91cc\u4fee\u6539\u5bc6\u7801\u4e3afox@666.<\/span><\/p>\n

\n

\n
Username:admin
Password:*****
The password needs\u00a0to<\/span>\u00a0be<\/span>\u00a0changed. Change now? [Y\/N<\/span>]:\u00a0y<\/span>
Please enter old password: Admin@123<\/span>
Please enter\u00a0new<\/span>\u00a0password: fox@666
Please\u00a0confirm<\/span>\u00a0new<\/span>\u00a0password: fox@666

<FW1><\/span>\u00a0system<\/span>-view<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u8fdb\u5165\u7cfb\u7edf\u89c6\u56fe
[FW1] sysname FW1 \/\/ \u7ed9\u9632\u706b\u5899\u547d\u540d
[FW1]\u00a0undo<\/span>\u00a0info-center<\/span>\u00a0enable \/\/ \u5173\u95ed\u65e5\u5fd7\u5f39\u51fa\u529f\u80fd
[FW1]\u00a0quit<\/span>
<FW1><\/span>\u00a0language<\/span>-mode<\/span>\u00a0Chinese \/\/ \u5c06\u63d0\u793a\u4fee\u6539\u4e3a\u4e2d\u6587
Change\u00a0language<\/span>\u00a0mode<\/span>,\u00a0confirm<\/span>? [Y\/N<\/span>]\u00a0y<\/span>
\u63d0\u793a\uff1a\u6539\u53d8\u8bed\u8a00\u6a21\u5f0f\u6210\u529f.<\/code><\/pre>\n<\/section>\n
\n
\n
\u5f00\u542fWeb\u7ba1\u7406\u754c\u9762:\u00a0<\/span><\/strong>\u9ed8\u8ba4\u9632\u706b\u5899console\u63a5\u53e3IP\u5730\u5740\u662f192.168.0.1.<\/span><\/p>\n
\n
\n
<FW1><\/span>\u00a0system<\/span>-view<\/span>
[FW1] web-manager enable \/\/ \u5f00\u542f\u56fe\u5f62\u7ba1\u7406\u754c\u9762
[FW1] interface GigabitEthernet\u00a00<\/span>\/0<\/span>\/0<\/span>
[FW1-GigabitEthernet0\/0<\/span>\/0<\/span>] ip address\u00a0192.168<\/span>.0.1<\/span>\u00a024<\/span>\u00a0\u00a0\u00a0\u00a0\/\/ \u7ed9\u63a5\u53e3\u914d\u7f6eIP\u5730\u5740
[FW1-GigabitEthernet0\/0<\/span>\/0<\/span>] service-manage\u00a0all<\/span>\u00a0permit \/\/ \u653e\u884c\u8be5\u7aef\u53e3\u7684\u8bf7\u6c42
[FW1-GigabitEthernet0\/0<\/span>\/0<\/span>]\u00a0display<\/span>\u00a0this<\/code><\/pre>\n<\/section>\n
\n
\n
\u914d\u7f6eConsole\u53e3\u767b\u9646:<\/span><\/strong><\/span><\/p>\n
\n
<FW1> system-view\u00a0\/\/ \u8fdb\u5165\u7cfb\u7edf\u89c6\u56fe<\/span>
[FW1]<\/span>\u00a0user-interface console 0\u00a0\/\/ \u8fdb\u5165console0\u7684\u7528\u6237\u914d\u7f6e\u63a5\u53e3<\/span>
[FW1-ui-console0]<\/span>\u00a0authentication-mode password\u00a0\/\/ \u4f7f\u7528\u5bc6\u7801\u9a8c\u8bc1\u6a21\u5f0f<\/span>
[FW1-ui-console0]<\/span>\u00a0set authentication password cipher Admin1234\u00a0\/\/ \u8bbe\u7f6e\u5bc6\u7801\u4e3aAdmin1234<\/span>
[FW1-ui-console0]<\/span>\u00a0quit\u00a0\/\/ \u9000\u51fa\u7528\u6237\u914d\u7f6e\u63a5\u53e3<\/span><\/code><\/pre>\n<\/section>\n
\n
\n
\u914d\u7f6etelnet\u5bc6\u7801\u8ba4\u8bc1:\u00a0<\/span><\/strong><\/span>\u914d\u7f6e\u5bc6\u7801\u8ba4\u8bc1\u6a21\u5f0f,\u6b64\u5904\u914d\u7f6e\u5bc6\u7801\u4e3aAdmin@123.<\/span><\/p>\n
\n
FW1<\/span>>\u00a0system-view<\/span>

[FW1]<\/span>\u00a0telnet<\/span>\u00a0server<\/span>\u00a0enable<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u5f00\u542fTelnet\u652f\u6301<\/span>
[FW1]<\/span>\u00a0interface<\/span>\u00a0GigabitEthernet<\/span>\u00a00<\/span>\/0<\/span>\/0<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u9009\u62e9\u914d\u7f6e\u63a5\u53e3<\/span>
[FW1-GigabitEthernet0\/0\/0]<\/span>\u00a0service-manage<\/span>\u00a0telnet<\/span>\u00a0permit<\/span>\u00a0\/\/ \u5141\u8bb8telnet<\/span>
[FW1-GigabitEthernet0\/0\/0]<\/span>\u00a0quit<\/span>

[FW1]<\/span>\u00a0user-interface<\/span>\u00a0vty<\/span>\u00a00<\/span>\u00a04<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u5f00\u542f\u865a\u62df\u7ec8\u7aef<\/span>
[FW1-ui-vty0-4]<\/span>\u00a0protocol<\/span>\u00a0inbound<\/span>\u00a0telnet<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u5141\u8bb8telnet<\/span>
[FW1-ui-vty0-4]<\/span>\u00a0authentication-mode<\/span>\u00a0password<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u8bbe\u7f6e\u4e3a\u5bc6\u7801\u8ba4\u8bc1\u6a21\u5f0f<\/span>
[FW1-ui-vty0-4]<\/span>\u00a0set<\/span>\u00a0authentication<\/span>\u00a0password<\/span>\u00a0cipher<\/span>\u00a0Admin<\/span>@123<\/span>\u00a0\u00a0\/\/ \u8bbe\u7f6e\u7528\u6237\u5bc6\u7801<\/span>

[USG6000V1]<\/span>\u00a0firewall<\/span>\u00a0zone<\/span>\u00a0trust<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u9009\u62e9\u5b89\u5168\u533a\u57df<\/span>
[USG6000V1-zone-trust]<\/span>\u00a0add<\/span>\u00a0interface<\/span>\u00a0GE0<\/span>\/0<\/span>\/0<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u6dfb\u52a0\u5230\u5b89\u5168\u533a\u57df<\/span><\/code><\/pre>\n<\/section>\n
\n
\n
\u914d\u7f6etelnet\u7528\u6237\u540d\u5bc6\u7801\u8ba4\u8bc1:<\/span><\/strong><\/span><\/p>\n
\n
<FW1> system-view\u00a0\/\/ \u8fdb\u5165\u7cfb\u7edf\u89c6\u56fe<\/span>
[FW1]\u00a0interface<\/span>\u00a0GigabitEthernet\u00a00<\/span>\/0<\/span>\/0<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u8fdb\u5165\u63a5\u53e3\u914d\u7f6e<\/span>
[FW1-GigabitEthernet0\/0<\/span>\/0<\/span>] ip address\u00a0192.168<\/span>.0.1<\/span>\u00a024<\/span>\u00a0\u00a0\u00a0\u00a0\/\/ \u914d\u7f6e\u63a5\u53e3IP<\/span>
[FW1-GigabitEthernet0\/0<\/span>\/0<\/span>] service-manage telnet permit\u00a0\/\/ \u5141\u8bb8telnet<\/span>
[FW1-GigabitEthernet0\/0<\/span>\/0<\/span>] service-manage ping permit\u00a0\/\/ \u5141\u8bb8ping<\/span>
[FW1-GigabitEthernet0\/0<\/span>\/0<\/span>] quit\u00a0\/\/\u9000\u51fa<\/span>

[FW1] firewall zone trust\u00a0\/\/ \u8fdb\u5165trust\u5b89\u5168\u57df\u914d\u7f6e<\/span>
[FW1-zone-trust] add\u00a0interface<\/span>\u00a0GigabitEthernet\u00a00<\/span>\/0<\/span>\/0<\/span>\u00a0\u00a0\u00a0\/\/ \u628aGE0\/0\/0\u52a0\u5165\u5230trust\u5b89\u5168\u57df<\/span>
[FW1-zone-trust] quit

[FW1] telnet server enable\u00a0\/\/ \u542f\u7528telnet\u670d\u52a1<\/span>
[FW1] user-interface<\/span>\u00a0vty\u00a00<\/span>\u00a04<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u8fdb\u5165vty0-4\u7684\u7528\u6237\u914d\u7f6e\u63a5\u53e3<\/span>
[FW1-ui-vty0-4<\/span>] authentication-mode aaa\u00a0\/\/ \u4f7f\u7528AAA\u9a8c\u8bc1\u6a21\u5f0f<\/span>
[FW1-ui-vty0-4<\/span>] user privilege level\u00a03<\/span>\u00a0\u00a0\u00a0\u00a0\/\/ \u914d\u7f6e\u7528\u6237\u8bbf\u95ee\u7684\u547d\u4ee4\u7ea7\u522b\u4e3a3<\/span>
[FW1-ui-vty0-4<\/span>] protocol inbound telnet\u00a0\/\/ \u914d\u7f6etelnet<\/span>
[FW1-ui-vty0-4<\/span>] quit\u00a0\/\/ \u9000\u51fa\u7528\u6237\u914d\u7f6e\u63a5\u53e3<\/span>

[FW1] aaa\u00a0\/\/ \u8fdb\u5165AAA\u914d\u7f6e\u89c6\u56fe<\/span>
[FW1-aaa] manager-user lyshark\u00a0\/\/ \u521b\u5efa\u7528\u6237vtyadmin<\/span>
[FW1-aaa-manager-user-lyshark] password cipher admin@123<\/span>\u00a0\u00a0\u00a0\/\/ \u914d\u7f6e\u7528\u6237\u5bc6\u7801<\/span>
[FW1-aaa-manager-user-lyshark] service-type<\/span>\u00a0telnet\u00a0\/\/ \u914d\u7f6e\u670d\u52a1\u7c7b\u578b<\/span>
[FW1-aaa-manager-user-lyshark] quit\u00a0\/\/ \u9000\u51fa<\/span>

[FW1-aaa] bind manager-user lyshark role system-admin\u00a0\/\/ \u7ed1\u5b9a\u7ba1\u7406\u5458\u89d2\u8272<\/span>
[FW1-aaa] quit\u00a0\/\/ \u9000\u51faAAA\u89c6\u56fe<\/span><\/code><\/pre>\n<\/section>\n
\n
\n
\u5e38\u7528\u67e5\u8be2\u547d\u4ee4:\u00a0<\/span><\/strong>\u67e5\u8be2\u9632\u706b\u5899\u7684\u5176\u4ed6\u914d\u7f6e,\u5e38\u7528\u7684\u51e0\u4e2a\u547d\u4ee4\u5982\u4e0b.<\/span><\/p>\n
\n
[FW1]<\/span>\u00a0display<\/span>\u00a0ip interface brief\u00a0\/\/ \u67e5\u9ed8\u8ba4\u63a5\u53e3\u4fe1\u606f<\/span>
[FW1]<\/span>\u00a0display<\/span>\u00a0ip routing-table<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u663e\u793a\u8def\u7531\u8868<\/span>
[FW1]<\/span>\u00a0display<\/span>\u00a0zone\u00a0\/\/ \u663e\u793a\u9632\u706b\u5899\u533a\u57df<\/span>
[FW1]<\/span>\u00a0display<\/span>\u00a0firewall session\u00a0table<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u663e\u793a\u5f53\u524d\u4f1a\u8bdd<\/span>
[FW1]<\/span>\u00a0display<\/span>\u00a0security-policy rule all\u00a0\/\/ \u663e\u793a\u5b89\u5168\u7b56\u7565<\/span><\/code><\/pre>\n<\/section>\n
\n
\u914d\u7f6e\u5230\u8fd9\u91cc,\u6211\u4eec\u5c31\u53ef\u4ee5\u5728\u6d4f\u89c8\u5668\u4e2d\u8bbf\u95ee\u4e86,\u5176\u8bbf\u95ee\u5730\u5740\u662fhttp:\/\/192.168.0.1<\/span><\/p>\n
\n
\n
\n
\n
\n
<\/div><\/section>\n
\n
\n
\u9632\u706b\u5899\u57fa\u672c\u914d\u7f6e<\/p>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n
\n
<\/div><\/p>\n
\n
\u521d\u59cb\u5316\u9632\u706b\u5899:\u00a0<\/span><\/strong><\/span>\u521d\u59cb\u5316\u914d\u7f6e,\u5e76\u8bbe\u7f6e\u597d\u9632\u706b\u5899\u5bc6\u7801,\u6b64\u5904\u7528\u6237\u540dadmin\u5bc6\u7801\u662ffox<\/span>@666<\/span>.<\/span><\/p>\n
\n
\n
Username:admin
Password:*****
The password needs\u00a0to<\/span>\u00a0be<\/span>\u00a0changed. Change now? [Y\/N<\/span>]:\u00a0y<\/span>
Please enter old password: Admin@123<\/span>
Please enter\u00a0new<\/span>\u00a0password: fox@666
Please\u00a0confirm<\/span>\u00a0new<\/span>\u00a0password: fox@666

<USG6000V1><\/span>\u00a0system<\/span>-view<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u8fdb\u5165\u7cfb\u7edf\u89c6\u56fe
[USG6000V1] sysname FW1 \/\/ \u7ed9\u9632\u706b\u5899\u547d\u540d
[FW1]\u00a0undo<\/span>\u00a0info-center<\/span>\u00a0enable \/\/ \u5173\u95ed\u65e5\u5fd7\u5f39\u51fa\u529f\u80fd
[FW1]\u00a0quit<\/span>
<FW1><\/span>\u00a0language<\/span>-mode<\/span>\u00a0Chinese \/\/ \u5c06\u63d0\u793a\u4fee\u6539\u4e3a\u4e2d\u6587
[FW1] web-manager enable \/\/ \u5f00\u542f\u56fe\u5f62\u7ba1\u7406\u754c\u9762
[FW1] interface GigabitEthernet\u00a00<\/span>\/0<\/span>\/0<\/span>
[FW1-GigabitEthernet0\/0<\/span>\/0<\/span>] service-manage\u00a0all<\/span>\u00a0permit \/\/ \u653e\u884c\u8be5\u7aef\u53e3\u7684\u8bf7\u6c42<\/code><\/pre>\n<\/section>\n
\n
\u914d\u7f6e\u5185\u7f51\u63a5\u53e3:<\/span><\/strong>\u00a0\u914d\u7f6e\u5185\u7f51\u7684\u63a5\u53e3\u4fe1\u606f,\u8fd9\u91cc\u5305\u62ec\u4e2aGE 1\/0\/0 and GE 1\/0\/1\u8fd9\u4e24\u4e2a\u5185\u7f51\u5730\u5740.<\/span><\/p>\n
\n
<FW1><\/span>\u00a0system<\/span>-view<\/span>
[FW1] interface GigabitEthernet\u00a01<\/span>\/0<\/span>\/0<\/span>
[FW1-GigabitEthernet1\/0<\/span>\/0<\/span>] ip address\u00a0192.168<\/span>.1.1<\/span>\u00a0255.255<\/span>.255.0<\/span>
[FW1-GigabitEthernet1\/0<\/span>\/0<\/span>]\u00a0undo<\/span>\u00a0shutdown
[FW1-GigabitEthernet1\/0<\/span>\/0<\/span>]\u00a0quit<\/span>

[FW1] interface GigabitEthernet\u00a01<\/span>\/0<\/span>\/1<\/span>
[FW1-GigabitEthernet1\/0<\/span>\/1<\/span>] ip address\u00a0192.168<\/span>.2.1<\/span>\u00a0255.255<\/span>.255.0<\/span>
[FW1-GigabitEthernet1\/0<\/span>\/1<\/span>]\u00a0undo<\/span>\u00a0shutdown
[FW1-GigabitEthernet1\/0<\/span>\/1<\/span>]\u00a0quit<\/span>

# -------------------------------------------------------
[FW1] firewall zone trust \/\/ \u5c06\u524d\u4e24\u4e2a\u63a5\u53e3\u52a0\u5165trust\u533a\u57df
[FW1-zone-trust]\u00a0add<\/span>\u00a0interface GigabitEthernet\u00a01<\/span>\/0<\/span>\/0<\/span>
[FW1-zone-trust]\u00a0add<\/span>\u00a0interface GigabitEthernet\u00a01<\/span>\/0<\/span>\/1<\/span><\/code><\/pre>\n<\/section>\n
\n
\u914d\u7f6e\u5916\u7f51\u63a5\u53e3:\u00a0<\/span><\/strong><\/span>\u914d\u7f6e\u5916\u7f51\u63a5\u53e3GE 1\/0\/2\u63a5\u53e3\u7684IP\u5730\u5740,\u5e76\u5c06\u5176\u52a0\u5165\u5230untrust\u533a\u57df\u4e2d.<\/span><\/p>\n
\n
\n
[FW1]<\/span>\u00a0interface<\/span>\u00a0GigabitEthernet<\/span>\u00a01<\/span>\/0<\/span>\/2<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u9009\u62e9\u5916\u7f51\u63a5\u53e3<\/span>
[FW1-GigabitEthernet1\/0\/2]<\/span>\u00a0undo<\/span>\u00a0shutdown<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u5f00\u542f\u5916\u7f51\u63a5\u53e3<\/span>
[FW1-GigabitEthernet1\/0\/2]<\/span>\u00a0ip<\/span>\u00a0address<\/span>\u00a010<\/span>.10<\/span>.10.10<\/span>\u00a0255<\/span>.255<\/span>.255<\/span>.0<\/span>\u00a0\u00a0\/\/ \u914d\u7f6eIP\u5730\u5740<\/span>
[FW1-GigabitEthernet1\/0\/2]<\/span>\u00a0gateway<\/span>\u00a010<\/span>.10<\/span>.10<\/span>.20<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u914d\u7f6e\u7f51\u5173<\/span>
[FW1-GigabitEthernet1\/0\/2]<\/span>\u00a0undo<\/span>\u00a0service-manage<\/span>\u00a0enable<\/span>
[FW1-GigabitEthernet1\/0\/2]<\/span>\u00a0quit<\/span>

#\u00a0-------------------------------------------------------<\/span>
[FW1]<\/span>\u00a0firewall<\/span>\u00a0zone<\/span>\u00a0untrust<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u9009\u62e9\u5916\u7f51\u533a\u57df<\/span>
[FW1-zone-untrust]<\/span>\u00a0add<\/span>\u00a0interface<\/span>\u00a0GigabitEthernet<\/span>\u00a01<\/span>\/0<\/span>\/2<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u5c06\u63a5\u53e3\u52a0\u5165\u5230\u6b64\u533a\u57df<\/span><\/code><\/pre>\n<\/section>\n
\n
\u914d\u7f6e\u5b89\u5168\u7b56\u7565:\u00a0<\/strong><\/span>\u914d\u7f6e\u9632\u706b\u5899\u5b89\u5168\u7b56\u7565,\u653e\u884ctrust(\u5185\u7f51)–>untrust(\u5916\u7f51)\u7684\u6570\u636e\u5305.<\/span><\/p>\n
\n
[FW1]<\/span>\u00a0security-policy\u00a0\/\/ \u914d\u7f6e\u5b89\u5168\u7b56\u7565<\/span>
[FW1-policy-security]<\/span>\u00a0rule name lyshark\u00a0\/\/ \u89c4\u5219\u540d\u79f0<\/span>
[FW1-policy-security-rule-lyshark]<\/span>\u00a0source-zone trust\u00a0\/\/ \u539f\u5b89\u5168\u533a\u57df(\u5185\u90e8)<\/span>
[FW1-policy-security-rule-lyshark]<\/span>\u00a0destination-zone untrust\u00a0\/\/ \u76ee\u6807\u5b89\u5168\u533a\u57df(\u5916\u90e8)<\/span>

[FW1-policy-security-rule-lyshark]<\/span>\u00a0source-address<\/span>\u00a0any\u00a0\/\/ \u539f\u5730\u5740\u533a\u57df<\/span>
[FW1-policy-security-rule-lyshark]<\/span>\u00a0destination-address<\/span>\u00a0any\u00a0\/\/ \u76ee\u6807\u5730\u5740\u533a\u57df<\/span>
[FW1-policy-security-rule-lyshark]<\/span>\u00a0service any\u00a0\/\/ \u653e\u884c\u6240\u6709\u670d\u52a1<\/span>
[FW1-policy-security-rule-lyshark]<\/span>\u00a0action permit\u00a0\/\/ \u653e\u884c\u914d\u7f6e<\/span>
[FW1-policy-security-rule-lyshark]<\/span>\u00a0quit<\/code><\/pre>\n<\/section>\n
\n
\u914d\u7f6e\u6e90NAT:<\/span><\/strong>\u914d\u7f6e\u539fNAT\u5730\u5740\u8f6c\u6362,\u4ec5\u914d\u7f6e\u6e90\u5730\u5740\u8bbf\u95ee\u5185\u7f51 –> \u516c\u7f51\u7684\u8f6c\u6362.<\/span><\/p>\n
\n
[FW1]<\/span>\u00a0nat-policy<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u914d\u7f6eNAT\u5730\u5740\u8f6c\u6362<\/span>
[FW1-policy-nat]<\/span>\u00a0rule<\/span>\u00a0name<\/span>\u00a0lyshark<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u6307\u5b9a\u7b56\u7565\u540d\u79f0<\/span>
[FW1-policy-nat-rule-lyshark]<\/span>\u00a0egress-interface<\/span>\u00a0GigabitEthernet<\/span>\u00a01<\/span>\/0<\/span>\/2<\/span>\u00a0\u00a0\/\/ \u5916\u7f51\u63a5\u53e3IP<\/span>
[FW1-policy-nat-rule-lyshark]<\/span>\u00a0action<\/span>\u00a0source-nat<\/span>\u00a0easy-ip<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u6e90\u5730\u5740\u8f6c\u6362<\/span>
[FW1-policy-nat-rule-lyshark]<\/span>\u00a0display<\/span>\u00a0this<\/span><\/code><\/pre>\n<\/section>\n
\n
\u914d\u7f6e\u76ee\u6807NAT:\u00a0<\/strong><\/span>\u5916\u7f51\u8bbf\u95ee10.10.10.10\u81ea\u52a8\u6620\u5c04\u5230\u5185\u7f51\u7684192.168.2.1\u8fd9\u53f0\u4e3b\u673a\u4e0a.<\/span><\/p>\n
\n
[FW1]<\/span>\u00a0firewall<\/span>\u00a0zone<\/span>\u00a0untrust<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u9009\u62e9\u5916\u7f51\u533a\u57df<\/span>
[FW1-zone-untrust]<\/span>\u00a0add<\/span>\u00a0interface<\/span>\u00a0GigabitEthernet<\/span>\u00a01<\/span>\/0<\/span>\/2<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u5c06\u63a5\u53e3\u52a0\u5165\u5230\u6b64\u533a\u57df<\/span>

#\u00a0----NAT<\/span>\u89c4\u5219---------------------------------------------------<\/span>
# \u5916\u7f51\u4e3b\u673a\u8bbf\u95ee10<\/span>.10.10.10<\/span>\u4e3b\u673a\u81ea\u52a8\u6620\u5c04\u5230\u5185\u90e8\u7684192<\/span>.168<\/span>.2.2<\/span>
[FW1]<\/span>\u00a0firewall<\/span>\u00a0detect<\/span>\u00a0ftp<\/span>
[FW1]<\/span>\u00a0nat<\/span>\u00a0server<\/span>\u00a0lyshark<\/span>\u00a0global<\/span>\u00a010<\/span>.10.10.10<\/span>\u00a0inside<\/span>\u00a0192<\/span>.168<\/span>.2.2<\/span>\u00a0no-reverse<\/span>

#\u00a0----<\/span>\u653e\u884c\u89c4\u5219---------------------------------------------------<\/span>
[FW1]<\/span>\u00a0security-policy<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u914d\u7f6e\u5b89\u5168\u7b56\u7565<\/span>
[FW1-policy-security]<\/span>\u00a0rule<\/span>\u00a0name<\/span>\u00a0untrs-trs<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u89c4\u5219\u540d\u79f0<\/span>
[FW1-policy-security-rule-lyshark]<\/span>\u00a0source-zone<\/span>\u00a0untrust<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u539f\u5b89\u5168\u533a\u57df(\u5916\u90e8)<\/span>
[FW1-policy-security-rule-lyshark]<\/span>\u00a0destination-zone<\/span>\u00a0trust<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u76ee\u6807\u5b89\u5168\u533a\u57df(\u5185\u90e8)<\/span>
[FW1-policy-security-rule-lyshark]<\/span>\u00a0action<\/span>\u00a0permit<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u653e\u884c\u914d\u7f6e<\/span>
[FW1-policy-security-rule-lyshark]<\/span>\u00a0quit<\/span><\/code><\/pre>\n<\/section>\n
\n
\n
\n
\n
\n
\n
\n
<\/div><\/section>\n
\n
\n
NAT \u5730\u5740\u8f6c\u6362<\/p>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n
\n
<\/div><\/p>\n
\n
\u914d\u7f6e\u5185\u7f51\u533a\u57df:\u00a0<\/span><\/strong><\/span>\u5206\u522b\u914d\u7f6e\u9632\u706b\u5899\u5185\u7f51\u63a5\u53e3GE1\/0\/0 and GE1\/0\/1\u8bbe\u7f6eIP\u5730\u5740,\u5e76\u52a0\u5165\u6307\u5b9a\u533a\u57df\u5185.<\/span><\/p>\n
\n
\n
<FW1><\/span>system<\/span>-view<\/span>
[FW1]undo<\/span>\u00a0info-center<\/span>\u00a0enable

# ----\u914d\u7f6eIP\u5730\u5740-----------------------------------------------
[FW1] interface GigabitEthernet\u00a01<\/span>\/0<\/span>\/0<\/span>
[FW1-GigabitEthernet1\/0<\/span>\/0<\/span>] ip address\u00a0192.168<\/span>.1.1<\/span>\u00a024<\/span>
[FW1-GigabitEthernet1\/0<\/span>\/0<\/span>]\u00a0quit<\/span>
[FW1] interface GigabitEthernet\u00a01<\/span>\/0<\/span>\/1<\/span>
[FW1-GigabitEthernet1\/0<\/span>\/1<\/span>] ip address\u00a0192.168<\/span>.2.1<\/span>\u00a024<\/span>
[FW1-GigabitEthernet1\/0<\/span>\/1<\/span>]\u00a0quit<\/span>

# ----\u52a0\u5165\u5230\u6307\u5b9a\u533a\u57df--------------------------------------------
[FW1] firewall zone trust
[FW1-zone-trust]\u00a0add<\/span>\u00a0interface GigabitEthernet\u00a01<\/span>\/0<\/span>\/0<\/span>

[FW1] firewall zone dmz
[FW1-zone-dmz]\u00a0add<\/span>\u00a0interface GigabitEthernet\u00a01<\/span>\/0<\/span>\/1<\/span><\/code><\/pre>\n<\/section>\n
\n
\n
\u914d\u7f6e\u5916\u7f51\u533a\u57df:\u00a0<\/span><\/strong>\u7136\u540e\u914d\u7f6e\u5916\u7f51\u5730\u5740,\u5c06Gig 1\/0\/2\u52a0\u5165\u5230untrust\u533a\u57df\u5185.<\/span><\/p>\n
\n
[FW1]<\/span>\u00a0interface<\/span>\u00a0GigabitEthernet<\/span>\u00a01<\/span>\/0<\/span>\/2<\/span>
[FW1-GigabitEthernet1\/0\/2]<\/span>\u00a0ip<\/span>\u00a0address<\/span>\u00a010<\/span>.10<\/span>.10.10<\/span>\u00a08<\/span>

[FW1]<\/span>\u00a0firewall<\/span>\u00a0zone<\/span>\u00a0untrust<\/span>
[FW1-zone-dmz]<\/span>\u00a0add<\/span>\u00a0interface<\/span>\u00a0GigabitEthernet<\/span>\u00a01<\/span>\/0<\/span>\/2<\/span><\/code><\/pre>\n<\/section>\n
\n
\n
\u914d\u7f6e\u6e90NAT:\u00a0<\/span><\/strong>\u914d\u7f6e\u539fNAT\u5730\u5740\u8f6c\u6362,\u4ec5\u914d\u7f6e\u6e90\u5730\u5740\u8bbf\u95ee\u5185\u7f51 –> \u516c\u7f51\u7684\u8f6c\u6362.<\/span><\/p>\n
\n
#\u00a0----<\/span>\u914d\u7f6e\u6e90NAT<\/span>\u8f6c\u6362---------------------------------------------<\/span>
[FW1]<\/span>\u00a0nat-policy<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u914d\u7f6eNAT\u5730\u5740\u8f6c\u6362<\/span>
[FW1-policy-nat]<\/span>\u00a0rule<\/span>\u00a0name<\/span>\u00a0lyshark<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u6307\u5b9a\u7b56\u7565\u540d\u79f0<\/span>
[FW1-policy-nat-rule-lyshark]<\/span>\u00a0egress-interface<\/span>\u00a0GigabitEthernet<\/span>\u00a01<\/span>\/0<\/span>\/2<\/span>\u00a0\u00a0\/\/ \u5916\u7f51\u63a5\u53e3IP<\/span>
[FW1-policy-nat-rule-lyshark]<\/span>\u00a0action<\/span>\u00a0source-nat<\/span>\u00a0easy-ip<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u6e90\u5730\u5740\u8f6c\u6362<\/span>
[FW1-policy-nat-rule-lyshark]<\/span>\u00a0display<\/span>\u00a0this<\/span>

#\u00a0----<\/span>\u653e\u884c\u76f8\u5173\u5b89\u5168\u7b56\u7565------------------------------------------<\/span>
[FW1]<\/span>\u00a0security-policy<\/span>
[FW1-policy-security]<\/span>\u00a0rule<\/span>\u00a0name<\/span>\u00a0trust_untrust<\/span>
[FW1-policy-security-rule]<\/span>\u00a0source-zone<\/span>\u00a0trust<\/span>
[FW1-policy-security-rule]<\/span>\u00a0destination-zone<\/span>\u00a0untrust<\/span>
[FW1-policy-security-rule]<\/span>\u00a0action<\/span>\u00a0permit<\/span><\/code><\/pre>\n<\/section>\n
\n
\u914d\u7f6e\u76ee\u6807NAT:\u00a0<\/span><\/strong><\/span>\u5916\u7f51\u8bbf\u95ee10.10.10.10\u81ea\u52a8\u6620\u5c04\u5230\u5185\u7f51\u7684192.168.2.2\u8fd9\u53f0\u4e3b\u673a\u4e0a.<\/span><\/p>\n
\n
\n
# ----NAT\u89c4\u5219---------------------------------------------------<\/span>
# \u5916\u7f51\u4e3b\u673a\u8bbf\u95ee10.10.10.10\u4e3b\u673a\u81ea\u52a8\u6620\u5c04\u5230\u5185\u90e8\u7684192.168.2.2<\/span>
[FW1<\/span>] firewall detect ftp
[FW1<\/span>]nat server lyshark\u00a0global<\/span>\u00a010.10<\/span>.10.10<\/span>\u00a0inside\u00a0192.168<\/span>.2.2<\/span>\u00a0no-reverse

# ----\u653e\u884c\u89c4\u5219---------------------------------------------------<\/span>
[FW1<\/span>] security-policy\u00a0\/\/ \u914d\u7f6e\u5b89\u5168\u7b56\u7565<\/span>
[FW1-policy-security<\/span>] rule name untrs-DMZ\u00a0\/\/ \u89c4\u5219\u540d\u79f0<\/span>
[FW1-policy-security-rule-untrs-DMZ<\/span>] source-zone untrust\u00a0\/\/ \u539f\u5b89\u5168\u533a\u57df(\u5916\u90e8)<\/span>
[FW1-policy-security-rule-untrs-DMZ<\/span>] destination-zone trust\u00a0\/\/ \u76ee\u6807\u5b89\u5168\u533a\u57df(\u5185\u90e8)<\/span>
[FW1-policy-security-rule-untrs-DMZ<\/span>] destination-address\u00a0192.168<\/span>.2.2<\/span>\u00a024<\/span>
[FW1-policy-security-rule-untrs-DMZ<\/span>] service any
[FW1-policy-security-rule-untrs-DMZ<\/span>] action permit\u00a0\/\/ \u653e\u884c\u914d\u7f6e<\/span>
[FW1-policy-security-rule-untrs-DMZ<\/span>] quit<\/code><\/pre>\n<\/section>\n
\n
\n
\n
\n
\n
<\/div><\/section>\n
\n
\n
\u914d\u6210\u4ea4\u6362\u673a\uff08\u900f\u660e\u6a21\u5f0f\uff09<\/p>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n
\n
<\/div><\/p>\n
\n
\u914d\u7f6e\u4e24\u53f0\u4ea4\u6362\u673a:\u00a0<\/span><\/strong><\/span>\u5206\u522b\u914d\u7f6e\u4e24\u53f0\u4ea4\u6362\u673a,\u5e76\u5212\u5206\u5230\u76f8\u5e94\u7684VLAN\u533a\u57df\u5185.<\/span><\/p>\n
\n
\n
# ----\u914d\u7f6eLSW1\u4ea4\u6362\u673a--------------------------------------------
<Huawei><\/span>\u00a0system<\/span>-view<\/span>
[LSW1] vlan\u00a010<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u521b\u5efaVLAN10
[LSW1]\u00a0quit<\/span>
[LSW1] interface Ethernet\u00a00<\/span>\/0<\/span>\/1<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u5c06\u8be5\u63a5\u53e3\u914d\u7f6e\u4e3atrunk
[LSW1-Ethernet0\/0<\/span>\/1<\/span>] port link-type<\/span>\u00a0trunk
[LSW1-Ethernet0\/0<\/span>\/1<\/span>] port trunk allow-pass vlan\u00a010<\/span>\u00a0\/\/ \u52a0\u5165\u5230vlan\u00a010<\/span>
[LSW1-Ethernet0\/0<\/span>\/1<\/span>]\u00a0quit<\/span>

[LSW1] port-group group-member Eth0\/0<\/span>\/2<\/span>\u00a0to<\/span>\u00a0Eth0\/0<\/span>\/3<\/span>
[LSW1-port-group] port link-type<\/span>\u00a0access
[LSW1-port-group] port default vlan\u00a010<\/span>
[LSW1-port-group]\u00a0quit<\/span>

# ----\u914d\u7f6eLSW2\u4ea4\u6362\u673a--------------------------------------------
<Huawei><\/span>\u00a0system<\/span>-view<\/span>
[LSW2] vlan\u00a020<\/span>
[LSW1]\u00a0quit<\/span>

[LSW2] interface Ethernet\u00a00<\/span>\/0<\/span>\/1<\/span>
[LSW2-Ethernet0\/0<\/span>\/1<\/span>] port link-type<\/span>\u00a0trunk
[LSW2-Ethernet0\/0<\/span>\/1<\/span>] port trunk allow-pass vlan\u00a020<\/span>
[LSW2-Ethernet0\/0<\/span>\/1<\/span>]\u00a0quit<\/span>

[LSW2] port-group group-member Eth0\/0<\/span>\/2<\/span>\u00a0to<\/span>\u00a0Eth0\/0<\/span>\/3<\/span>
[LSW2-port-group] port link-type<\/span>\u00a0access
[LSW2-port-group] port default vlan\u00a020<\/span>
[LSW2-port-group]\u00a0quit<\/span><\/code><\/pre>\n<\/section>\n
\n
\n
\u914d\u7f6e\u9632\u706b\u5899:\u00a0<\/span><\/strong><\/span>\u914d\u7f6eGig1\/0\/0\u548cGig1\/0\/1\u63a5\u53e3\u4e3atrunk\u6a21\u5f0f,\u5e76\u5206\u522b\u914d\u7f6e\u597d\u7f51\u5173\u5730\u5740.<\/span><\/p>\n
\n
\n
[FW1]<\/span>\u00a0vlan<\/span>\u00a010<\/span>
[FW1-vlan10]<\/span>\u00a0quit<\/span>
[FW1]<\/span>\u00a0vlan<\/span>\u00a020<\/span>
[FW1-vlan20]<\/span>\u00a0quit<\/span>

#\u00a0----<\/span>\u914d\u7f6e\u9632\u706b\u5899\u63a5\u53e3\u5730\u5740-----------------------------------------<\/span>
[FW1]<\/span>\u00a0interface<\/span>\u00a0GigabitEthernet<\/span>\u00a01<\/span>\/0<\/span>\/0<\/span>
[FW1-GigabitEthernet1\/0\/0]<\/span>\u00a0portswitch<\/span>
[FW1-GigabitEthernet1\/0\/0]<\/span>\u00a0port<\/span>\u00a0link-type<\/span>\u00a0trunk<\/span>
[FW1-GigabitEthernet1\/0\/0]<\/span>\u00a0port<\/span>\u00a0trunk<\/span>\u00a0allow-pass<\/span>\u00a0vlan<\/span>\u00a010<\/span>

[FW1]<\/span>\u00a0interface<\/span>\u00a0GigabitEthernet<\/span>\u00a01<\/span>\/0<\/span>\/1<\/span>
[FW1-GigabitEthernet1\/0\/1]<\/span>\u00a0portswitch<\/span>
[FW1-GigabitEthernet1\/0\/1]<\/span>\u00a0port<\/span>\u00a0link-type<\/span>\u00a0trunk<\/span>
[FW1-GigabitEthernet1\/0\/1]<\/span>\u00a0port<\/span>\u00a0trunk<\/span>\u00a0allow-pass<\/span>\u00a0vlan<\/span>\u00a020<\/span>

#\u00a0----<\/span>\u5206\u522b\u7ed9VLAN<\/span>\u914d\u7f6eIP<\/span>\u5730\u5740---------------------------------------<\/span>
[FW1]<\/span>interface<\/span>\u00a0Vlanif<\/span>\u00a010<\/span>
[FW1-Vlanif10]<\/span>
[FW1-Vlanif10]<\/span>ip<\/span>\u00a0address<\/span>\u00a0192<\/span>.168<\/span>.10<\/span>.1<\/span>\u00a0255<\/span>.255<\/span>.255<\/span>.0<\/span>
[FW1-Vlanif10]<\/span>alias<\/span>\u00a0vlan<\/span>\u00a010<\/span>
[FW1-Vlanif10]service-manage<\/span>\u00a0ping<\/span>\u00a0permit<\/span>

[FW1]<\/span>\u00a0interface<\/span>\u00a0Vlanif<\/span>\u00a020<\/span>
[FW1-Vlanif20]<\/span>
[FW1-Vlanif20]<\/span>\u00a0ip<\/span>\u00a0address<\/span>\u00a0192<\/span>.168<\/span>.20<\/span>.1<\/span>\u00a0255<\/span>.255<\/span>.255<\/span>.0<\/span>
[FW1-Vlanif20]<\/span>\u00a0alias<\/span>\u00a0vlan<\/span>\u00a020<\/span>
[FW1-Vlanif20]<\/span>\u00a0service-manage<\/span>\u00a0ping<\/span>\u00a0permit<\/span><\/code><\/pre>\n<\/section>\n
\n
\u6dfb\u52a0\u9632\u706b\u5899\u533a\u57df:<\/span><\/strong><\/span>\u00a0\u5c06vlan10\u548cvlan20\u6dfb\u52a0\u5230trust\u533a\u57df\u5185.<\/span><\/p>\n
\n
[FW1]<\/span>firewall zone trust
[FW1-zone-trust]<\/span>\u00a0add interface Vlanif 10
[FW1-zone-trust]<\/span>\u00a0add interface Vlanif 20<\/code><\/pre>\n<\/section>\n
\n
\n
\n
\n
\n
\n
<\/div><\/section>\n
\n
\n
\u4e3b\u5907\u53cc\u673a\u70ed\u5907<\/p>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n
\n
<\/div><\/p>\n
\n
\u653e\u884c\u6240\u6709\u6570\u636e\u5305(\u4e24\u53f0\u5899):\u00a0<\/span><\/strong><\/span>\u4e3a\u4e86\u6f14\u793a\u5b9e\u9a8c,\u9700\u8981\u624b\u52a8\u653e\u884c\u6570\u636e\u5305<\/span><\/p>\n
\n
#\u00a0------------------------------------------------------------<\/span>
# \u5c06\u9ed8\u8ba4\u9632\u706b\u5899\u89c4\u5219,\u8bbe\u7f6e\u4e3a\u5141\u8bb8\u6240\u6709
[FW1]<\/span>\u00a0security-policy<\/span>\u00a0
[FW1-policy-security]<\/span>\u00a0rule<\/span>\u00a0name<\/span>\u00a0anyall<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u6307\u5b9a\u89c4\u5219\u540d\u79f0<\/span>
[FW1-policy-security-rule-anyall]<\/span>\u00a0source-zone<\/span>\u00a0any<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u6e90\u5730\u5740\u5141\u8bb8\u6240\u6709<\/span>
[FW1-policy-security-rule-anyall]<\/span>\u00a0destination-zone<\/span>\u00a0any<\/span>\u00a0\u00a0\u00a0\/\/ \u76ee\u6807\u5730\u5740\u5141\u8bb8\u6240\u6709<\/span>
[FW1-policy-security-rule-anyall]<\/span>\u00a0action<\/span>\u00a0permit<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u653e\u884c<\/span>
[FW1-policy-security-rule-anyall]<\/span>\u00a0quit<\/span>\u00a0
[FW1-policy-security]<\/span>\u00a0quit<\/span>

#\u00a0------------------------------------------------------------<\/span>
# \u5c06\u6307\u5b9a\u7684\u63a5\u53e3\u52a0\u5165\u5230\u6307\u5b9a\u7684\u533a\u57df\u5185
[FW1]<\/span>\u00a0firewall<\/span>\u00a0zone<\/span>\u00a0trust<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u9009\u62e9trust\u533a\u57df<\/span>
[FW1-zone-trust]<\/span>\u00a0add<\/span>\u00a0interface<\/span>\u00a0GigabitEthernet<\/span>\u00a01<\/span>\/0<\/span>\/0<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u6dfb\u52a0\u5185\u90e8\u7684\u7aef\u53e3<\/span>
[FW1-zone-trust]<\/span>\u00a0quit<\/span>
[FW1]<\/span>\u00a0firewall<\/span>\u00a0zone<\/span>\u00a0untrust<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u6dfb\u52a0untru\u533a\u57df<\/span>
[FW1-zone-untrust]<\/span>\u00a0add<\/span>\u00a0interface<\/span>\u00a0GigabitEthernet<\/span>\u00a01<\/span>\/0<\/span>\/1<\/span>\u00a0\u00a0\u00a0\/\/ \u6dfb\u52a0\u5916\u90e8\u63a5\u53e3<\/span>
[FW1-zone-trust]<\/span>\u00a0quit<\/span><\/code><\/pre>\n<\/section>\n
\n
\u914d\u7f6eIP\u5730\u5740(\u4e24\u53f0) \uff1a<\/span><\/strong><\/span>\u7ed9\u9632\u706b\u5899\u7684\u4e24\u4e2a\u63a5\u53e3\u914d\u7f6e\u597dIP\u5730\u5740.<\/span><\/p>\n
\n
#\u00a0------------------------------------------------------------<\/span>
# \u914d\u7f6e\u9632\u706b\u5899FW1<\/span>
[FW1]<\/span>\u00a0interface<\/span>\u00a0GigabitEthernet<\/span>\u00a01<\/span>\/0<\/span>\/0<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u9009\u62e9\u5185\u90e8\u63a5\u53e3<\/span>
[FW1-GigabitEthernet1\/0\/0]<\/span>\u00a0ip<\/span>\u00a0address<\/span>\u00a0192<\/span>.168<\/span>.1<\/span>.253<\/span>\u00a024<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u914d\u7f6e\u9632\u706b\u5899IP<\/span>
[FW1-GigabitEthernet1\/0\/0]<\/span>\u00a0service-manage<\/span>\u00a0ping<\/span>\u00a0permit<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u5f00\u542f\u63a5\u53e3ping<\/span>
[FW1-GigabitEthernet1\/0\/0]<\/span>\u00a0quit<\/span>

[FW1]<\/span>\u00a0interface<\/span>\u00a0GigabitEthernet1<\/span>\/0<\/span>\/1<\/span>
[FW1-GigabitEthernet1\/0\/1]<\/span>\u00a0ip<\/span>\u00a0address<\/span>\u00a010<\/span>.10<\/span>.10.20<\/span>\u00a08<\/span>
[FW1-GigabitEthernet1\/0\/1]<\/span>\u00a0service-manage<\/span>\u00a0ping<\/span>\u00a0permit<\/span>
[FW1-GigabitEthernet1\/0\/1]<\/span>\u00a0quit<\/span>

#\u00a0------------------------------------------------------------<\/span>
# \u914d\u7f6e\u9632\u706b\u5899FW2<\/span>
[FW2]<\/span>\u00a0interface<\/span>\u00a0GigabitEthernet<\/span>\u00a01<\/span>\/0<\/span>\/0<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u9009\u62e9\u5185\u90e8\u63a5\u53e3<\/span>
[FW2-GigabitEthernet1\/0\/0]<\/span>\u00a0ip<\/span>\u00a0address<\/span>\u00a0192<\/span>.168<\/span>.1<\/span>.254<\/span>\u00a024<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u914d\u7f6e\u9632\u706b\u5899IP<\/span>
[FW2-GigabitEthernet1\/0\/0]<\/span>\u00a0service-manage<\/span>\u00a0ping<\/span>\u00a0permit<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u5f00\u542f\u63a5\u53e3ping<\/span>
[FW2-GigabitEthernet1\/0\/0]<\/span>\u00a0quit<\/span>
[FW2-GigabitEthernet1\/0\/0]<\/span>\u00a0quit<\/span>

[FW2]<\/span>\u00a0interface<\/span>\u00a0GigabitEthernet1<\/span>\/0<\/span>\/1<\/span>
[FW2-GigabitEthernet1\/0\/1]<\/span>\u00a0ip<\/span>\u00a0address<\/span>\u00a010<\/span>.10<\/span>.10.30<\/span>\u00a08<\/span>
[FW2-GigabitEthernet1\/0\/1]<\/span>\u00a0service-manage<\/span>\u00a0ping<\/span>\u00a0permit<\/span>
[FW2-GigabitEthernet1\/0\/1]<\/span>\u00a0quit<\/span><\/code><\/pre>\n<\/section>\n
\n
\u5f00\u542f\u6e90NAT\u5730\u5740:<\/span><\/strong><\/span>\u5c06\u5185\u7f51\u6570\u636e\u6620\u5c04\u5230\u5916\u7f51.<\/span><\/p>\n
\n
#\u00a0------------------------------------------------------------<\/span>
# \u914d\u7f6e\u9632\u706b\u5899FW1<\/span>
[FW1]<\/span>\u00a0nat-policy<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u914d\u7f6eNAT\u5730\u5740\u8f6c\u6362<\/span>
[FW1-policy-nat]<\/span>\u00a0rule<\/span>\u00a0name<\/span>\u00a0tru_untr<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u6307\u5b9a\u7b56\u7565\u540d\u79f0<\/span>
[FW1-policy-nat-rule-tru_untr]<\/span>\u00a0egress-interface<\/span>\u00a0GigabitEthernet<\/span>\u00a01<\/span>\/0<\/span>\/1<\/span>\u00a0\u00a0\/\/ \u5916\u7f51\u63a5\u53e3IP<\/span>
[FW1-policy-nat-rule-tru_untr]<\/span>\u00a0action<\/span>\u00a0source-nat<\/span>\u00a0easy-ip<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u6e90\u5730\u5740\u8f6c\u6362<\/span>
[FW1-policy-nat-rule-tru_untr]<\/span>\u00a0display<\/span>\u00a0this<\/span>

#\u00a0------------------------------------------------------------<\/span>
# \u914d\u7f6e\u9632\u706b\u5899FW2<\/span>
[FW2]<\/span>\u00a0nat-policy<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u914d\u7f6eNAT\u5730\u5740\u8f6c\u6362<\/span>
[FW2-policy-nat]<\/span>\u00a0rule<\/span>\u00a0name<\/span>\u00a0tru_untr<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u6307\u5b9a\u7b56\u7565\u540d\u79f0<\/span>
[FW2-policy-nat-rule-tru_untr]<\/span>\u00a0egress-interface<\/span>\u00a0GigabitEthernet<\/span>\u00a01<\/span>\/0<\/span>\/1<\/span>\u00a0\u00a0\/\/ \u5916\u7f51\u63a5\u53e3IP<\/span>
[FW2-policy-nat-rule-tru_untr]<\/span>\u00a0action<\/span>\u00a0source-nat<\/span>\u00a0easy-ip<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u6e90\u5730\u5740\u8f6c\u6362<\/span>
[FW2-policy-nat-rule-tru_untr]<\/span>\u00a0display<\/span>\u00a0this<\/span><\/code><\/pre>\n<\/section>\n
\n
\n
\u5f00\u542fVRRP\u652f\u6301(\u4e24\u53f0)<\/span><\/strong><\/span><\/p>\n
\n
#\u00a0------------------------------------------------------------<\/span>
# \u914d\u7f6e\u9632\u706b\u5899FW1<\/span>
[FW1]<\/span>\u00a0interface<\/span>\u00a0GigabitEthernet<\/span>\u00a01<\/span>\/0<\/span>\/0<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u9009\u62e9\u5185\u90e8\u63a5\u53e3<\/span>
[FW1-GigabitEthernet1\/0\/0]<\/span>\u00a0vrrp<\/span>\u00a0vrid<\/span>\u00a01<\/span>\u00a0virtual-ip<\/span>\u00a0192<\/span>.168<\/span>.1.1<\/span>\u00a0active<\/span>\u00a0\u00a0\/\/ \u914d\u7f6e\u865a\u62df\u63a5\u53e3\u4e3a\u4e3b<\/span>
[FW1-GigabitEthernet1\/0\/0]<\/span>\u00a0quit<\/span>

[FW1]<\/span>\u00a0interface<\/span>\u00a0GigabitEthernet<\/span>\u00a01<\/span>\/0<\/span>\/1<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u9009\u62e9\u5916\u90e8\u63a5\u53e3<\/span>
[FW1-GigabitEthernet1\/0\/1]<\/span>\u00a0vrrp<\/span>\u00a0vrid<\/span>\u00a02<\/span>\u00a0virtual-ip<\/span>\u00a010<\/span>.10<\/span>.10<\/span>.10<\/span>\u00a0active<\/span>
[FW1-GigabitEthernet1\/0\/1]<\/span>\u00a0quit<\/span>

#\u00a0------------------------------------------------------------<\/span>
# \u914d\u7f6e\u9632\u706b\u5899FW12<\/span>
[FW2]<\/span>\u00a0interface<\/span>\u00a0GigabitEthernet<\/span>\u00a01<\/span>\/0<\/span>\/0<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u9009\u62e9\u5185\u90e8\u63a5\u53e3<\/span>
[FW2-GigabitEthernet1\/0\/0]<\/span>\u00a0vrrp<\/span>\u00a0vrid<\/span>\u00a01<\/span>\u00a0virtual-ip<\/span>\u00a0192<\/span>.168<\/span>.1.1<\/span>\u00a0standby<\/span>\u00a0\/\/ \u914d\u7f6e\u865a\u62df\u63a5\u53e3\u4e3a\u5907<\/span>
[FW2-GigabitEthernet1\/0\/0]<\/span>\u00a0quit<\/span>

[FW2]<\/span>\u00a0interface<\/span>\u00a0GigabitEthernet<\/span>\u00a01<\/span>\/0<\/span>\/1<\/span>
[FW2-GigabitEthernet1\/0\/1]<\/span>\u00a0vrrp<\/span>\u00a0vrid<\/span>\u00a02<\/span>\u00a0virtual-ip<\/span>\u00a010<\/span>.10<\/span>.10<\/span>.10<\/span>\u00a0standby<\/span>
[FW2-GigabitEthernet1\/0\/1]<\/span>\u00a0quit<\/span><\/code><\/pre>\n<\/section>\n
\n
HRP\u914d\u7f6e(\u4e24\u53f0):<\/span><\/p>\n
\n
#\u00a0------------------------------------------------------------<\/span>
# \u914d\u7f6e\u9632\u706b\u5899FW1<\/span>
[FW1]<\/span>\u00a0hrp<\/span>\u00a0enable<\/span>
HRP_S[FW1]<\/span>\u00a0hrp<\/span>\u00a0interface<\/span>\u00a0GigabitEthernet<\/span>\u00a00<\/span>\/0<\/span>\/0<\/span>\u00a0remote<\/span>\u00a0172.16<\/span>.1.2<\/span>\u00a0\u00a0\u00a0\/\/ \u6307\u5b9a\u63a5\u53e3\u548c\u5bf9\u7aefIP<\/span>
HRP_M[FW1]<\/span>\u00a0interface<\/span>\u00a0GigabitEthernet<\/span>\u00a00<\/span>\/0<\/span>\/0<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u9009\u62e9\u865a\u62df\u63a5\u53e3<\/span>
HRP_M<\/span>[FW1-GigabitEthernet0\/0\/0]<\/span>\u00a0ip<\/span>\u00a0address<\/span>\u00a0172.16<\/span>.1.1<\/span>\u00a024<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u914d\u7f6e\u672c\u7aefIP\u5730\u5740<\/span>

#\u00a0------------------------------------------------------------<\/span>
# \u914d\u7f6e\u9632\u706b\u5899FW2<\/span>
[FW2]<\/span>\u00a0hrp<\/span>\u00a0enable<\/span>
HRP_S[FW2]<\/span>\u00a0hrp<\/span>\u00a0standby-device<\/span>
HRP_S[FW2]<\/span>\u00a0hrp<\/span>\u00a0interface<\/span>\u00a0GigabitEthernet<\/span>\u00a00<\/span>\/0<\/span>\/0<\/span>\u00a0remote<\/span>\u00a0172.16<\/span>.1.1<\/span>
HRP_S[FW2]<\/span>\u00a0interface<\/span>\u00a0GigabitEthernet<\/span>\u00a00<\/span>\/0<\/span>\/0<\/span>
HRP_S<\/span>[FW2-GigabitEthernet0\/0\/0]<\/span>\u00a0ip<\/span>\u00a0address<\/span>\u00a0172.16<\/span>.1.2<\/span>\u00a024<\/span><\/code><\/pre>\n<\/section>\n
\n
\u68c0\u67e5\u914d\u7f6e\uff1a<\/span><\/strong><\/p>\n
\u6ce8\u610f1\uff1a\u9ed8\u8ba4\u5904\u4e8e standby \u72b6\u6001\u7684\u8bbe\u5907\u4e0d\u5141\u8bb8\u914d\u7f6e\u5b89\u5168\u7b56\u7565\uff0c\u53ea\u5141\u8bb8\u5728\u4e3b\u8bbe<\/span><\/p>\n
\u5907\u914d\u7f6e\u5b89\u5168\u7b56\u7565\uff0c\u4e14\u5b89\u5168\u7b56\u7565\u4f1a\u81ea\u52a8\u540c\u6b65\u5230\u5907\u8bbe\u5907\u4e0a\u9762\u3002<\/span><\/p>\n
\n
\u5f00\u542f\u547d\u4ee4\uff1ahrp standby config enable<\/span><\/p>\n
\n
HRP_M[FW1] display hrp state
\u00a0Role: active, peer: standby
\u00a0Running priority: 45000, peer: 45000
\u00a0Core state: normal, peer: normal
\u00a0Backup<\/span>\u00a0channel\u00a0usage<\/span>:\u00a00.00<\/span>%
\u00a0Stable\u00a0time<\/span>:\u00a00<\/span>\u00a0days<\/span>,\u00a00<\/span>\u00a0hours,\u00a00<\/span>\u00a0minutes
\u00a0Last<\/span>\u00a0state\u00a0change<\/span>\u00a0information:\u00a02019<\/span>-05<\/span>-06<\/span>\u00a01<\/span>:37<\/span>:41<\/span>\u00a0HRP core state\u00a0changed<\/span>, old_s
tate = abnormal(active), new_state =\u00a0normal<\/span>, local_priority =\u00a045000<\/span>, peer_priori
ty =\u00a045000.<\/span>

HRP_S[FW2] display hrp state
\u00a0Role<\/span>:\u00a0standby<\/span>, peer: active
\u00a0Running\u00a0priority<\/span>:\u00a045000<\/span>, peer:\u00a045000<\/span>
\u00a0Core state:\u00a0normal<\/span>, peer:\u00a0normal<\/span>
\u00a0Backup<\/span>\u00a0channel\u00a0usage<\/span>:\u00a00.00<\/span>%
\u00a0Stable\u00a0time<\/span>:\u00a00<\/span>\u00a0days<\/span>,\u00a00<\/span>\u00a0hours,\u00a01<\/span>\u00a0minutes
\u00a0Last<\/span>\u00a0state\u00a0change<\/span>\u00a0information:\u00a02019<\/span>-05<\/span>-06<\/span>\u00a01<\/span>:37<\/span>:42<\/span>\u00a0HRP\u00a0link<\/span>\u00a0changes\u00a0to<\/span>\u00a0up.<\/code><\/pre>\n<\/section>\n
\n
\n
\n
\n
\n
<\/div><\/section>\n
\n
\n
\u914d\u7f6e\u8d1f\u8f7d\u5747\u8861<\/p>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n
\n
<\/div><\/p>\n
\u914d\u7f6e\u9632\u706b\u5899\u63a5\u53e3:<\/span><\/strong><\/p>\n
\n
[FW1]<\/span>interface<\/span>\u00a0GigabitEthernet<\/span>\u00a01<\/span>\/0<\/span>\/0<\/span>
[FW1-GigabitEthernet1\/0\/0]<\/span>ip<\/span>\u00a0address<\/span>\u00a0192<\/span>.168<\/span>.1<\/span>.1<\/span>\u00a024<\/span>
[FW1-GigabitEthernet1\/0\/0]<\/span>service-manage<\/span>\u00a0ping<\/span>\u00a0permit<\/span>\u00a0
[FW1-GigabitEthernet1\/0\/0]<\/span>service-manage<\/span>\u00a0http<\/span>\u00a0permit<\/span>
[FW1-GigabitEthernet1\/0\/0]<\/span>quit<\/span>

[FW1]<\/span>interface<\/span>\u00a0GigabitEthernet<\/span>\u00a01<\/span>\/0<\/span>\/1<\/span>
[FW1-GigabitEthernet1\/0\/1]<\/span>ip<\/span>\u00a0address<\/span>\u00a010<\/span>.10<\/span>.10<\/span>.10<\/span>\u00a08<\/span>
[FW1-GigabitEthernet1\/0\/1]<\/span>service-manage<\/span>\u00a0ping<\/span>\u00a0permit<\/span>\u00a0
[FW1-GigabitEthernet1\/0\/1]<\/span>service-manage<\/span>\u00a0http<\/span>\u00a0permit<\/span>
[FW1-GigabitEthernet1\/0\/1]<\/span>quit<\/span><\/code><\/pre>\n<\/section>\n
\n
\u52a0\u5165\u76f8\u5e94\u7684\u533a\u57df\u5185:<\/span><\/strong><\/span><\/p>\n
\n
[FW1]<\/span>firewall<\/span>\u00a0zone<\/span>\u00a0trust<\/span>
[FW1-zone-trust]<\/span>add<\/span>\u00a0interface<\/span>\u00a0\u00a0GigabitEthernet<\/span>\u00a01<\/span>\/0<\/span>\/0<\/span>
[FW1-zone-trust]<\/span>quit<\/span>

[FW1]<\/span>firewall<\/span>\u00a0zone<\/span>\u00a0untrust<\/span>
[FW1-zone-untrust]<\/span>add<\/span>\u00a0interface<\/span>\u00a0GigabitEthernet<\/span>\u00a01<\/span>\/0<\/span>\/1<\/span>
[FW1-zone-untrust]<\/span>quit<\/span><\/code><\/pre>\n<\/section>\n
\n
\u653e\u884c\u6570\u636e\u5305:<\/span><\/strong><\/p>\n
\n
[FW1]<\/span>security-policy
[FW1-policy-security]<\/span>rule name any_trust
[FW1-policy-security-rule-any_trust]<\/span>source-zone any
[FW1-policy-security-rule-any_trust]<\/span>destination-zone trust

[FW1-policy-security-rule-any_trust]<\/span>service http
[FW1-policy-security-rule-any_trust]<\/span>service icmp
[FW1-policy-security-rule-any_trust]<\/span>action permit<\/code><\/pre>\n<\/section>\n
\n
\u914d\u7f6e\u8d1f\u8f7d\u5747\u8861:<\/span><\/strong><\/p>\n
\n
[FW1<\/span>] slb enable\u00a0\/\/ \u542f\u7528SLB\u670d\u52a1<\/span>
[FW1<\/span>] slb\u00a0\/\/ \u8fdb\u5165SLB\u914d\u7f6e\u89c6\u56fe<\/span>
[FW1-slb<\/span>]\u00a0group<\/span>\u00a01<\/span>\u00a0WebServer\u00a0\/\/ \u521b\u5efa\u670d\u52a1\u5668\u7ec4webServer<\/span>
[FW1-slb-group-1<\/span>] metric weight-least-connection\u00a0\/\/ \u4f7f\u7528\u52a0\u6743\u8f6e\u8be2\u7b97\u6cd5<\/span>

# -------------------------------------------------------<\/span>
\/\/ \u4ee5\u4e0b\u4e3a\u771f\u5b9e\u670d\u52a1\u8bbe\u7f6e IP\u5730\u5740 \u7aef\u53e3 \u6743\u91cd\u503c \u522b\u540d\/\/<\/span>

[FW1-slb-group-1<\/span>] rserver\u00a01<\/span>\u00a0rip\u00a0192.168<\/span>.1<\/span>.2<\/span>\u00a0port\u00a080<\/span>\u00a0weight\u00a01<\/span>\u00a0description server1
[FW1-slb-group-1<\/span>] rserver\u00a02<\/span>\u00a0rip\u00a0192.168<\/span>.1<\/span>.3<\/span>\u00a0port\u00a080<\/span>\u00a0weight\u00a01<\/span>\u00a0description server2
[FW1-slb-group-1<\/span>] rserver\u00a03<\/span>\u00a0rip\u00a0192.168<\/span>.1<\/span>.3<\/span>\u00a0port\u00a080<\/span>\u00a0weight\u00a01<\/span>\u00a0description server3
[FW1-slb-group-1<\/span>]
[FW1-slb-group-1<\/span>] health-check type icmp tx-interval\u00a05<\/span>\u00a0times\u00a03<\/span>\u00a0\/\/ \u914d\u7f6e\u670d\u52a1\u5065\u5eb7\u68c0\u67e5\u53c2\u6570<\/span>
[FW1-slb-group-1<\/span>] persistence type source-ip aging-time\u00a0180<\/span>\u00a0\u00a0\u00a0\u00a0\/\/ \u914d\u7f6e\u4f1a\u8bdd\u4fdd\u6301\u65f6\u95f4<\/span>
[FW1-slb-group-1<\/span>] quit\u00a0\/\/ \u8fd4\u56deSLB\u89c6\u56fe<\/span>
[FW1-slb<\/span>]
[FW1-slb<\/span>] vserver\u00a01<\/span>\u00a0WebServer\u00a0\/\/ \u521b\u5efa\u865a\u62df\u670d\u52a1\u5668WebServer<\/span>
[FW1-slb-vserver-1<\/span>] protocol tcp\u00a0\/\/ \u914d\u7f6e\u865a\u62df\u670d\u52a1\u5668\u7684\u534f\u8bae\u7c7b\u578b<\/span>
[FW1-slb-vserver-1<\/span>] vip\u00a01<\/span>\u00a010.10<\/span>.10<\/span>.100<\/span>\u00a0\u00a0\u00a0\/\/ \u8bbe\u7f6e\u865a\u62df\u670d\u52a1\u5668IP\u5730\u5740<\/span>
[FW1-slb-vserver-1<\/span>] vport\u00a080<\/span>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/ \u8bbe\u7f6e\u865a\u62df\u670d\u52a1\u5668\u7aef<\/span>
[FW1-slb-vserver-1<\/span>]\u00a0group<\/span>\u00a0WebServer\u00a0\/\/ \u5173\u8054\u771f\u5b9e\u670d\u52a1\u5668\u7ec4<\/span>
[FW1-slb-vserver-1<\/span>] quit\u00a0\/\/ \u8fd4\u56deSLB\u89c6\u56fe<\/span><\/code><\/pre>\n<\/section>\n<\/section>\n<\/section>\n<\/section>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
\u9632\u706b\u5899\uff08Firewall\uff09\u4e5f\u79f0\u9632\u62a4\u5899\uff0c\u662f\u7531Check Point\u521b\u7acb\u8005Gil Shwed\u4e8e1993\u5e74\u53d1\u660e\u5e76\u5f15\u5165 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18],"tags":[],"class_list":["post-6338","post","type-post","status-publish","format-standard","hentry","category-hw"],"_links":{"self":[{"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/posts\/6338","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.xh86.me\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=6338"}],"version-history":[{"count":1,"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/posts\/6338\/revisions"}],"predecessor-version":[{"id":6571,"href":"https:\/\/www.xh86.me\/index.php?rest_route=\/wp\/v2\/posts\/6338\/revisions\/6571"}],"wp:attachment":[{"href":"https:\/\/www.xh86.me\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6338"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.xh86.me\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6338"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.xh86.me\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6338"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}