【正文】 地址，目的地址是所有。 policy carclass upload_class //引用創(chuàng)建的限流class。整體下載限流：trafficpolicy enable //啟用限流功能carclass download_class type sharedcar 10000//創(chuàng)建下載的限流策略，上傳的方向是從Untrust到Trusttrafficpolicy interzone trust untrust inbound shared policy 0 action car //動(dòng)作為限流 policy destination mask 24 //下載要指定目的地址，源地址是所有。 policy carclass download_class //引用創(chuàng)建的限流class。配置每IP限流策略，限制每個(gè)員工的上傳流量。每個(gè)員工的最大上傳/下載帶寬：8Mbps/10Mbps每個(gè)員工的上傳/下載保證帶寬：4Mbpscarclass per_upload_class type perip car max 8000 guaranteed 4000 //上傳最大帶寬8M，保證帶寬4M。carclass per_download_class type perip car max 10000 guaranteed 4000 //下載最大帶寬10M，保證帶寬4M。 connectionnumber 10 //也可以設(shè)置最大連接數(shù)，一般不設(shè)置，把這條命令去掉即可。trafficpolicy interzone trust untrust outbound perip policy 0 action car policy source mask 24 // 因?yàn)樾枰拗粕暇W(wǎng)員工的上傳流量，所以限流對(duì)象選擇“源地址”。 policy cartype sourceip policy carclass per_upload_classtrafficpolicy interzone trust untrust inbound perip policy 0 action car policy destination mask 24 //為需要限制上網(wǎng)員工的下載流量，所以限流對(duì)象選擇“目的地址”。 policy cartype destinationip policy carclass per_download_classcarclass ip線速 type perip connectionnumber 10 car max 20 guaranteed 10配置限制外網(wǎng)用戶(hù)訪問(wèn)內(nèi)網(wǎng)服務(wù)器連接數(shù)的整體限流策略。carclass connection_class type shared connectionnumber 20 //限制外網(wǎng)用戶(hù)訪問(wèn)內(nèi)網(wǎng)FTP服務(wù)器的最大連接數(shù)不能超過(guò)20個(gè)trafficpolicy interzone dmz untrust inbound shared policy 0 action car policy destination mask 24 //ftp服務(wù)器的ip地址 policy carclass connection_class圖形解決操作方法： 啟用限流功能上傳的整體限流策略：3下載整體限流流策略：應(yīng)用控制：創(chuàng)建應(yīng)用協(xié)議或者應(yīng)用協(xié)議集：sa enable //全局啟用應(yīng)用控制功能sa //進(jìn)入sa視圖 userdefinerule test //在sa視圖下創(chuàng)建自定義應(yīng)用程序test protocol tcp sourceport 10 destinationport 10 rule enableappset test //在sa視圖，創(chuàng)建應(yīng)用協(xié)議集，這個(gè)對(duì)應(yīng)用防火墻下的應(yīng)用協(xié)議或者應(yīng)用協(xié)議集。 description 禁止某些應(yīng)用 category P2P category Web_Video category Game category Attack category Network_Storage category Streaming category PeerCasting category VoIPcategory userdefine application test //可以將創(chuàng)建的自定義應(yīng)用程序添加到應(yīng)用協(xié)議集[huawei]sapolicy test //系統(tǒng)視圖命令，對(duì)應(yīng)于防火墻的UTM下的應(yīng)用控制下的策略。policy default action permit rule 0 rule enable action deny rule category Web_Browsing application HTTP rule 3 rule enable action deny rule appset test //引用上面創(chuàng)建的應(yīng)用協(xié)議集在策略上引用創(chuàng)建的應(yīng)用程序：policy interzone trust untrust outbound policy 24 action permit policy source addressset 生產(chǎn)網(wǎng)ip限制 policy sa 生產(chǎn)網(wǎng)ip限網(wǎng) policy 23 action permit policy source addressset 質(zhì)量管理部及pmc policy sa 質(zhì)量管理部及pmc policy 22 action permit policy logging //記錄策略匹配日志 policy source addressset oem policy sa oem policy 21 action permit policy source addressset me制造一課二課 policy sa me制造一課二課移動(dòng)策略的優(yōu)先級(jí)：域間或者域內(nèi)視圖下。policy move policyid1 { before | after } policyid2命令用來(lái)移動(dòng)策略?xún)?yōu)先級(jí)，比如policy move 2 before 4 ，before就是指將policyid1的優(yōu)先級(jí)調(diào)整到policyid2之前，after指的是將policyid1的優(yōu)先級(jí)調(diào)整到policyid2之后。firewall statistic system enable //開(kāi)啟報(bào)文的統(tǒng)計(jì)功能，缺省情況下，系統(tǒng)級(jí)的流量統(tǒng)計(jì)和監(jiān)控功能開(kāi)啟。Web管理端口配置webmanager enablewebmanager enable port 8099webmanager security enable //開(kāi)啟管理功能 webmanager security enable port 8443 undo webmanager configguide enabletelnet server enable //開(kāi)啟telnet配置功能防火墻“安全防護(hù)”里的配置。firewall defend action alert firewall defend udpshortheader enable firewall defend portscan enable firewall defend ipsweep enable firewall defend teardrop enable firewall defend ipfragment enable firewall defend tcpflag enable firewall defend winnuke enable firewall defend fraggle enable firewall defend pingofdeath enable firewall defend udpflood enable firewall defend smurf enable firewall defend land enable firewall defend arpflood enable firewall defend arpspoofing enable firewall defend udpflood basesession maxrate 20000 firewall defend icmpflood basesession maxrate 255 firewall sourceip detect interface GigabitEthernet0/0/5 firewall sourceip detect interface GigabitEthernet0/0/6 firewall defend icmpflood interface GigabitEthernet0/0/5 maxrate 200000 firewall defend icmpflood interface GigabitEthernet0/0/6 maxrate 200000 firewall defend arpflood interface GigabitEthernet0/0/1 maxrate 50000自己寫(xiě)的腳本：ip serviceset Tomcat type object service 0 protocol tcp destinationport 8181ip serviceset Tomcat2 type object service 0 protocol tcp destinationport 8181 service 1 protocol tcp destinationport 8282ip serviceset Tomcat3 type object service 0 protocol tcp destinationport 8181 service 1 protocol tcp destinationport 8585 service 2 protocol tcp destinationport 8787policy interzone untrust trust inbound policy 0 action permit policy service serviceset icmp policy service serviceset Tomcat policy source mask policy destination 0 policy destination 0 policy destination 0 policy 1 action permit policy service serviceset ftp policy service serviceset icmp policy source mask policy destination 0 policy 2 action permit policy service serviceset icmp policy service serviceset Tomcat2 policy source mask policy destination 0 policy 3 action permit policy service serviceset icmp policy service serviceset Tomcat3 policy source mask policy destination 0firewall defend arpflood enable //開(kāi)啟arp泛洪功能