華為雙鏈路出口調(diào)試步驟(參考版)
2024-08-16 03:24本頁面
【正文】 在校園網(wǎng)內(nèi)的一臺(tái)主機(jī)上，訪問ISP1所屬網(wǎng)段的一臺(tái)服務(wù)器（），通過執(zhí)行命令display firewall session table，可以看到私網(wǎng)IP地址轉(zhuǎn)換成了ISP1的公網(wǎng)IP地址。[USG] firewall defend synflood enable[USG] firewall defend udpflood enable[USG] firewall defend icmpflood enable[USG] firewall defend icmpflood basesession maxrate 5結(jié)果驗(yàn)證1. 執(zhí)行命令display nat all，可以看到配置的NAT地址池和內(nèi)部服務(wù)器信息。 注意： 請(qǐng)根據(jù)網(wǎng)絡(luò)實(shí)際情況開啟攻擊防范功能和調(diào)整報(bào)文速率閾值，本例中配置的攻擊防范功能僅供參考。[USG] ip routestatic 24 GigabitEthernet 0/0/2 [USG] ip routestatic 24 GigabitEthernet 0/0/2 [USG] ip routestatic 24 GigabitEthernet 5/0/0 [USG] ip routestatic 24 GigabitEthernet 5/0/0 配置兩條缺省路由，當(dāng)報(bào)文無法匹配靜態(tài)路由時(shí)，通過缺省路由發(fā)送給下一跳。因此需要咨詢運(yùn)營商獲取ISP所屬網(wǎng)段信息。 為特定目的IP地址的報(bào)文指定出接口，目的地址為IPS1的指定出接口為GigabitEthernet 0/0/目的地址為ISP2的指定出接口為GigabitEthernet 5/0/0。[USG] natpolicy interzone trust isp1 outbound[USGnatpolicyinterzonetrustisp1outbound] policy 1[USGnatpolicyinterzonetrustisp1outbound1] policy source [USGnatpolicyinterzonetrustisp1outbound1] action sourcenat[USGnatpolicyinterzonetrustisp1outbound1] addressgroup 1[USGnatpolicyinterzonetrustisp1outbound1] quit[USGnatpolicyinterzonetrustisp1outbound] quit 在Trust—ISP2域間配置NAT outbound，將校內(nèi)用戶的私網(wǎng)IP地址轉(zhuǎn)換為ISP2提供的公網(wǎng)IP地址。[USG] nat addressgroup 1 配置應(yīng)用于Trust—ISP2域間的NAT地址池2。[USG] firewall interzone trust isp1[USGinterzonetrustisp1] detect ftp[USGinterzonetrustisp1] detect qq[USGinterzonetrustisp1] detect msn[USGinterzonetrustisp1] quit[USG] firewall interzone trust isp2[USGinterzonetrustisp2] detect ftp[USGinterzonetrustisp2] detect qq[USGinterzonetrustisp2] detect msn[USGinterzonetrustisp2] quit3. 配置NAT outbound，使內(nèi)網(wǎng)用戶通過轉(zhuǎn)換后的公網(wǎng)IP地址訪問Internet。[USG] policy interzone trust isp1 outbound[USGpolicyinterzonetrustisp1outbound] policy 1[USGpolicyinterzonetrustisp1outbound1] policy source [USGpolicyinterzonetrustisp1outbound1] action permit[USGpolicyinterzonetrustisp1outbound1] quit[USGpolicyinterzonetrustisp1outbound] quit 配置Trust—ISP2的域間包過濾，允許校內(nèi)用戶訪問ISP2。[USG] firewall zone name isp2[USGzoneisp2] set priority 20[USGzoneisp2] add interface GigabitEthernet 5/0/0[USGzoneisp2] quit2. 配置域間包過濾及ASPF功能，對(duì)校內(nèi)外數(shù)據(jù)流進(jìn)行訪問控制。USG systemview[USG] interface GigabitEthernet 0/0/0[USGGigabitEthernet0/0/0] ip address 16[USGGigabitEthernet0/0/0] quit[USG] interface GigabitEthernet 0/0/2[USGGigabitEthernet0/0/2] ip address 24[USGGigabitEthernet0/0/2] quit[USG] interface GigabitEthernet 5/0/0[USGGigabitEthernet5/0/0] ip address 24[USGGigabitEthernet5/0/0] quit 將GigabitEthernet 0/0/0接口加入Trust安全區(qū)域[USG] firewall zone trust[USGzonetrust] add interface GigabitEthernet 0/0/0
高考資料相關(guān)推薦
鄂ICP備17016276號(hào)-1