大型园区出口配置示例（防火墙直连部署）(6)

大型园区出口配置示例（防火墙直连部署）

1 大型园区出口配置示例（防火墙直连部署）

firewall defend udp-flood enable

firewall defend udp-flood zone untrust max-rate 1500 firewall defend icmp-flood enable

firewall defend icmp-flood zone untrust max-rate 20000 firewall blacklist enable

firewall defend ip-sweep enable

firewall defend ip-sweep max-rate 4000 firewall defend port-scan enable

firewall defend port-scan max-rate 4000 firewall defend ip-fragment enable firewall defend ip-spoofing enable #

return ?

FW2的配置文件

#

sysname FW2

# router id 4.4.4.4 #

hrp mirror session enable hrp adjust ospf-cost enable hrp enable

hrp interface GigabitEthernet 1/0/7 remote 10.10.1.1 hrp track interface GigabitEthernet1/0/1 hrp track interface Eth-Trunk 20 #

interface Eth-Trunk 20

ip address 10.4.1.1 255.255.255.0 #

interface GigabitEthernet 1/0/1 ip address 10.2.1.2 255.255.255.0 #

interface GigabitEthernet 1/0/7

ip address 10.10.1.2 255.255.255.0 #

interface GigabitEthernet 2/0/3 eth-trunk 20 #

interface GigabitEthernet 2/0/4 eth-trunk 20 #

interface LoopBack0

ip address 4.4.4.4 255.255.255.255 #

firewall zone trust set priority 85 add interface Eth-Trunk20 #

firewall zone dmz set priority 50

add interface GigabitEthernet1/0/7 #

firewall zone untrust set priority 5

文档版本 ()

华为专有和保密信息 版权所有 ? 华为技术有限公司

26

大型园区出口配置示例（防火墙直连部署）

1 大型园区出口配置示例（防火墙直连部署）

add interface GigabitEthernet 1/0/1

# ospf 1 area 0.0.0.0 network 10.2.1.0 0.0.0.255 network 10.4.1.0 0.0.0.255 #

ip route-static 0.0.0.0 0.0.0.0 10.2.1.1 #

policy interzone local trust outbound policy 1

action permit

policy source 10.4.1.0 mask 24 policy source 10.6.1.0 mask 24 policy source 192.168.2.0 mask 24 #

policy interzone local untrust inbound policy 2

action permit

policy source 10.2.1.0 mask 24 #

policy interzone trust untrust inbound policy 3

action permit

policy source 10.2.1.0 mask 24 #

firewall defend syn-flood enable

firewall defend syn-flood zone untrust max-rate 20000 firewall defend udp-flood enable

firewall defend udp-flood zone untrust max-rate 1500 firewall defend icmp-flood enable

firewall defend icmp-flood zone untrust max-rate 20000 firewall blacklist enable

firewall defend ip-sweep enable

firewall defend ip-sweep max-rate 4000 firewall defend port-scan enable

firewall defend port-scan max-rate 4000 firewall defend ip-fragment enable firewall defend ip-spoofing enable #

return ?

CSS的配置文件

#

sysname CSS

# vlan batch 100 200 300 #

dhcp enable #

ip pool poola

gateway-list 192.168.1.1 network 192.168.1.0 mask 255.255.255.0 #

ip pool poolb

文档版本 ()

华为专有和保密信息 版权所有 ? 华为技术有限公司

27

大型园区出口配置示例（防火墙直连部署）

1 大型园区出口配置示例（防火墙直连部署）

gateway-list 192.168.2.1 network 192.168.2.0 mask 255.255.255.0 #

interface Vlanif 100

ip address 10.5.1.1 255.255.255.0 dhcp select global #

interface Vlanif 200

ip address 10.6.1.1 255.255.255.0 dhcp select global #

interface Vlanif 300

ip address 10.100.1.100 255.255.255.0 #

interface Eth-Trunk 10 undo portswitch

ip address 10.3.1.2 255.255.255.0 #

interface Eth-Trunk 20 undo portswitch

ip address 10.4.1.2 255.255.255.0 #

interface Eth-Trunk 100 port hybrid pvid vlan 100

port hybrid untagged vlan 100 #

interface Eth-Trunk 200 port hybrid pvid vlan 200

port hybrid untagged vlan 200 #

interface GigabitEthernet 1/1/0/1 port link-type access port default vlan 300 #

interface GigabitEthernet 1/1/0/3 eth-trunk 10 #

interface GigabitEthernet 1/1/0/4 eth-trunk 20 #

interface GigabitEthernet 1/2/0/3 eth-trunk 100 #

interface GigabitEthernet 1/2/0/4 eth-trunk 200 #

interface GigabitEthernet 2/1/0/3 eth-trunk 10 #

interface GigabitEthernet 2/1/0/4 eth-trunk 20 #

interface GigabitEthernet 2/2/0/3 eth-trunk 100 #

文档版本 ()

华为专有和保密信息 版权所有 ? 华为技术有限公司

28

大型园区出口配置示例（防火墙直连部署）

1 大型园区出口配置示例（防火墙直连部署）

interface GigabitEthernet 2/2/0/4 eth-trunk 200 #

interface LoopBack0

ip address 5.5.5.5 255.255.255.255

# ospf 1 router-id 5.5.5.5 area 0.0.0.0 network …… 此处隐藏：3725字，全部文档内容请下载后查看。喜欢就下载吧 ……