華為雙鏈路出口調(diào)試步驟-文庫吧
2025-07-21 03:24 本頁面
【正文】 USG] policy interzone trust isp2 outbound[USGpolicyinterzonetrustisp2outbound] policy 1[USGpolicyinterzonetrustisp2outbound1] policy source [USGpolicyinterzonetrustisp2outbound1] action permit[USGpolicyinterzonetrustisp2outbound1] quit[USGpolicyinterzonetrustisp2outbound] quit 在域間開啟ASPF功能，防止多通道協(xié)議無法建立連接。[USG] firewall interzone trust isp1[USGinterzonetrustisp1] detect ftp[USGinterzonetrustisp1] detect qq[USGinterzonetrustisp1] detect msn[USGinterzonetrustisp1] quit[USG] firewall interzone trust isp2[USGinterzonetrustisp2] detect ftp[USGinterzonetrustisp2] detect qq[USGinterzonetrustisp2] detect msn[USGinterzonetrustisp2] quit3. 配置NAT outbound，使內(nèi)網(wǎng)用戶通過轉(zhuǎn)換后的公網(wǎng)IP地址訪問Internet。 配置應(yīng)用于Trust—ISP1域間的NAT地址池1。[USG] nat addressgroup 1 配置應(yīng)用于Trust—ISP2域間的NAT地址池2。[USG] nat addressgroup 2 在Trust—ISP1域間配置NAT outbound，將校內(nèi)用戶的私網(wǎng)IP地址轉(zhuǎn)換為ISP1提供的公網(wǎng)IP地址。[USG] natpolicy interzone trust isp1 outbound[USGnatpolicyinterzonetrustisp1outbound] policy 1[USGnatpolicyinterzonetrustisp1outbound1] policy source [USGnatpolicyinterzonetrustisp1outbound1] action sourcenat[USGnatpolicyinterzonetrustisp1outbound1] addressgroup 1[USGnatpolicyinterzonetrustisp1outbound1] quit[USGnatpolicyinterzonetrustisp1outbound] quit 在Trust—ISP2域間配置NAT outbound，將校內(nèi)用戶的私網(wǎng)IP地址轉(zhuǎn)換為ISP2提供的公網(wǎng)IP地址。[USG] natpolicy interzone trust isp2 outbound[USGnatpolicyinterzonetrustisp2outbound] policy 1[USGnatpolicyinterzonetrustisp2outbound1] policy source [USGnatpolicyinterzonetrustisp2outbound1] action sourcenat[USGnatpolicyinterzonetrustisp2outbound1] addressgroup 2[USGnatpolicyinterzonetrustisp2outbound1] quit[USGnatpolicyinterzonetrustisp2outbound] quit4. 配置多條靜態(tài)路由和兩條缺省路由，實現(xiàn)網(wǎng)絡(luò)的雙出口特性和鏈路的可靠性。 為特定目的IP地址的報文指定出接口，目的地址為IPS1的指定出接口為GigabitEthernet 0/0/目的地址為ISP2的指定出接口為GigabitEthernet 5/0/0。注意： 實際場景中，可能需指定多條靜態(tài)路由，為特定目的IP地址配置明細路由。因此需要咨詢運營商獲取ISP所屬網(wǎng)段信息。本例中僅給出了四條靜態(tài)路由的配置。[USG] ip routestatic 24 GigabitEthernet 0/0/2 [USG] ip routestatic 24 GigabitEthernet 0/0/2 [USG] ip routestatic 24 GigabitEthernet 5/0/0 [USG] ip routestatic 24 GigabitEthernet 5/0/0 配置兩條缺省路由，當(dāng)報文無法匹配靜態(tài)路由時，通過缺省路由發(fā)送給下一跳。[USG] ip routestatic GigabitEthernet 0/0/2 [USG] ip routestatic GigabitEthernet 5/0/0 5. 配置攻擊防范功能，保護校園網(wǎng)絡(luò)。 注意： 請根據(jù)網(wǎng)絡(luò)實際情況開啟攻擊防范功能和調(diào)整報文速率閾值，本例中配置的攻擊防范功能僅供參考。 開SYN Flood、UDP Flood和ICMP Flood攻擊防范功能，并限制每條會話允許通過的ICMP報文最大速率為5包/秒。[USG] firewall defend synflood enable[USG] firewall defend udpflood enable[USG] firewall defend icmpflood enable[USG] firewall defend icmpflood basesession maxrate 5
高考資料相關(guān)推薦
鄂ICP備17016276號-1