一、组网拓扑：

二、组网需求：

　　　要求内部用户访问内部服务器时，可通过外网映射的地址访问服务器（WWW，FTP等）。

三、配置实例如下：

<Quidway>dis cur

#

 sysname Quidway

#

 firewall packet-filter enable

 firewall packet-filter default permit

#

 undo insulate

#

 undo connection-limit enable

 connection-limit default deny

 connection-limit default amount upper-limit 50 lower-limit 20

#

 firewall statistic system enable

#

radius scheme system

#

domain system

#

acl number 2000

 rule 0 permit source 172.16.0.0 0.0.255.255

#

interface Aux0                           

 async mode flow

#

interface Ethernet0/0

 ip address 172.16.2.1 255.255.255.0

nat server protocol tcp global 10.153.49.212 www inside 172.16.1.2 www

#

interface Ethernet1/0

 ip address 10.153.49.193 255.255.252.0

 nat outbound 2000

 nat server protocol tcp global 10.153.49.212 www inside 172.16.1.2 www

#

interface Ethernet1/1

#

interface Ethernet1/2

 ip address 172.16.1.1 255.255.255.0

#

interface NULL0

#

firewall zone local

 set priority 100

#

firewall zone trust

 add interface Ethernet0/0

 set priority 85

#                                        

firewall zone untrust

 add interface Ethernet1/0

 set priority 5

#

firewall zone DMZ

 add interface Ethernet1/2

 set priority 50

#

firewall interzone local trust

#

firewall interzone local untrust

#

firewall interzone local DMZ

#

firewall interzone trust untrust

#

firewall interzone trust DMZ

#

firewall interzone DMZ untrust

#

ip route-static 0.0.0.0 0.0.0.0 10.153.48.1 preference 60

#

user-interface con 0

user-interface aux 0

user-interface vty 0 4

 authentication-mode none                

#

return

<Quidway>

 

四、说明：

　1．映射地址可以是出口的接口地址。

　2．服务器可以在“TRUST”区域中。

　3．目前在SecPath防火墙上，暂时还没有办法使内网用户通过域名、外网IP、私网地址同时能访问内网服务器。