等保二级 交换机安全配置模板（华为）

#配置日志服务器
info-center loghost source Vlanif2
info-center loghost 192.168.0.203
#配置DNS服务器
dns server 223.5.5.5
dns server 223.6.6.6
dns server source-ip 172.16.1.1
#打开邻居发现
lldp enable
#关闭HTTP管理 TELNET
undo http server enable
#仅允许堡垒机访问设备
acl number 2000
description Baoleiji_to_jieru_sw
rule 5 permit source 192.168.0.202 0
rule 10 deny
#仅允许服务器访问安全设备
acl number 2100
description allow_server
rule 5 permit source 192.100.100.0 0.0.0.255 logging
rule 10 deny
#仅允许安全设备和内网设备访问服务器
acl number 2101
description allow_anquanshebei_yewu
rule 5 permit source 192.168.0.0 0.0.255.255 logging
rule 10 permit source 192.101.101.0 0.0.0.255 logging
rule 15 deny
#仅允许堡垒机访问服务器的22端口
acl number 3000
description only_allow_baoleiji
rule 5 permit tcp source 192.168.1.216 0 destination-port eq 22 logging
rule 10 deny tcp destination-port eq 22 logging
rule 15 permit ip
#在VLAN 调用
traffic classifier 1 operator or
if-match acl 2100
traffic classifier 2 operator or
if-match acl 2101

traffic behavior 1
permit
traffic behavior 2
permit

traffic policy 1
classifier 1 behavior 1
traffic policy 2
classifier 2 behavior 2
#创建对应VLAN
vlan 100
description Server
vlan 101
description Anquanguanli
traffic-policy 1 inbound
#在接服务器的接口调用ACL
interface GigabitEthernet0/0/23
traffic-filter inbound acl 3000

interface GigabitEthernet0/0/24
traffic-filter inbound acl 3000
#创建管理员和操作员 密码锁定 分配权限
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user user password PASS
local-user user privilege level 1
local-user user service-type ssh
local-user pw password PASS
local-user pw privilege level 15
local-user pw service-type ssh
undo local-user admin
local-aaa-user wrong-password retry-interval 5 retry-time 3 block-time 5
#指定NTP源端口
ntp-service source-interface Vlanif3
ntp-service unicast-server 202.112.29.82
#打开SSH 并非用户权限
stelnet server enable
ssh user pw
ssh user pw authentication-type password
ssh user pw service-type stelnet
ssh user user
ssh user user authentication-type password
ssh user user service-type stelnet
#配置console和远程登录方式 和登录超时
user-interface con 0
authentication-mode aaa
idle-timeout 30 0
user-interface vty 0 4
acl 2000 inbound
authentication-mode aaa
user privilege level 15
idle-timeout 30 0
protocol inbound ssh
#给与用户权限1的命令
command-privilege level 1 view shell display trapbuffer
command-privilege level 1 view shell display logbuffer
command-privilege level 1 view shell display memory-usage
command-privilege level 1 view shell display cpu-usage
command-privilege level 1 view shell display interface brief
command-privilege level 1 view shell display clock
command-privilege level 1 view shell display saved-configuration
command-privilege level 1 view shell display elabel
command-privilege level 1 view shell display patch-information
command-privilege level 1 view shell display version
command-privilege level 1 view shell display device
command-privilege level 1 view shell display current-configuration
command-privilege level 1 view shell display diagnostic-information