H3C 防火墙安全域基本配置

一、项目拓扑

二、项目需求

可通

三、配置步骤

1. 配IP地址

[R1]int g0/0
[R1-GigabitEthernet0/0]ip ad 1.1.1.1 24

[F2]interface GigabitEthernet 1/0/0
[F2-GigabitEthernet1/0/0]ip ad 1.1.1.2 24

2. 将接口加入Trust

[F2]security-zone name Trust
[F2-security-zone-Trust]import interface g1/0/0

3. 安全域配置

[F2]security-policy ip									//安全策略ip
[F2-security-policy-ip]rule name 1						//规则1
[F2-security-policy-ip-0-1]source-zone trust			//源域 trust
[F2-security-policy-ip-0-1]destination-zone local		//目的域 local	
[F2-security-policy-ip-0-1]action pass					//允许数据包通过
[F2-security-policy-ip-0-1]quit
[F2-security-policy-ip]rule name 2
[F2-security-policy-ip-1-2]source-zone local
[F2-security-policy-ip-1-2]destination-zone trust
[F2-security-policy-ip-1-2]action pass

四、测试

ping 可通