华为防火墙的基本配置

配置基本的IP地址
[FW1-GigabitEthernet1/0/0]ip add 10.1.2.1 24
[FW1-GigabitEthernet1/0/6]ip add 20.1.1.1 24
[Internet-GigabitEthernet0/0/1]ip address 20.1.1.2 24
在接口上开启ping功能后，并将接口加入相关zone,PC可以ping通与防火墙相连的接口
[FW1-GigabitEthernet1/0/0]service-manage enable
[FW1-GigabitEthernet1/0/0]service-manage ping permit
[FW1]firewall zone trust
[FW1-zone-trust]add interface GigabitEthernet 1/0/0

配置untrust区域
[FW1]firewall zone untrust
[FW1-zone-untrust]add interface GigabitEthernet 1/0/6
配置trust和untrust之间的转发策略(配置顺序很重要)
[FW1]security-policy
[FW1-policy-security]rule name deny_internet
[FW1-policy-security-rule-deny_internet]source-zone trust
[FW1-policy-security-rule-deny_internet]source-address 10.1.2.254 0.0.0.0
[FW1-policy-security-rule-deny_internet]destination-zone untrust
[FW1-policy-security-rule-deny_internet]destination-address any
[FW1-policy-security-rule-deny_internet]action deny
[FW1-policy-security]rule name policy_trust_untrust
[FW1-policy-security-rule-policy_trust_untrust]source-zone trust
[FW1-policy-security-rule-policy_trust_untrust]source-address 10.1.2.0 0.0.0.255
[FW1-policy-security-rule-policy_trust_untrust]destination-zone untrust
[FW1-policy-security-rule-policy_trust_untrust]destination-address any
[FW1-policy-security-rule-policy_trust_untrust]action permit
配置NAT策略（easy-ip）
[FW1-policy-nat]rule name to_internet
[FW1-policy-nat-rule-to_internet]destination-zone untrust
[FW1-policy-nat-rule-to_internet]source-zone trust
[FW1-policy-nat-rule-to_internet]action source-nat easy-ip
PC1可以ping通Internet

PC2 ping 不通Internet

查看nat转换

配置DMZ区域
[FW1]firewall zone dmz
[FW1-zone-dmz]add interface GigabitEthernet 1/0/1
配置NAT server的策略
[FW1]security-policy
[FW1-policy-security]rule name server_nat
[FW1-policy-security-rule-server_nat]source-zone untrust
[FW1-policy-security-rule-server_nat]destination-zone dmz
[FW1-policy-security-rule-server_nat]action permit
[FW1-policy-security-rule-server_nat]service ftp
配置nat server
[FW1]nat server ftp_server protocol tcp global 20.1.1.2 ftp inside 10.1.1.100 ftp
配置DMZ和untrust域间NAT策略、使用easy-ip技术
[FW1]nat-policy
[FW1-policy-nat]rule name server_nat
[FW1-policy-nat-rule-server_nat]destination-zone dmz
[FW1-policy-nat-rule-server_nat]source-zone untrust
[FW1-policy-nat-rule-server_nat]action source-nat easy-ip
在DMZ和untrust域间应用NAT ALG功能，使服务器可以正常对外提供FTP服务（默认以经全局开启，可以省略）
[FW1]firewall interzone dmz untrust
[FW1-interzone-dmz-untrust]detect ftp
查看NAT server