H3C F1070配置案例

背景：

• 把内网的10.11.4.0/24的某些主机映射出去成172.29.81.40/29的地址，供172.27.220.0/24的地址访问。
• 内网的10.11.4.0/24通过nat成172.29.81.40/29去访问172.27.220.0/24的地址

配置案例步骤

1、配置防火墙的用户名、密码及管理方式

local-user sysadmin class manage

password simple Shiyanshi@2022!@

service-type ssh telnet http https

authorization-attribute user-role network-admin

authorization-attribute user-role network-operator

2、开启web管理和ssh远程管理

ip http enable

ip https enable

ssh server enable

3、配置vty线路

line vty 0 63

authentication-mode scheme

user-role network-operator

4、接口如果用trunk对接，这按照下面配置

interface GigabitEthernet1/0/19

port link-mode bridge

port link-type trunk

port trunk permit vlan  608

undo port trunk permit vlan 1 

#

interface Vlan-interface608

ip address 172.20.3.81 255.255.255.248

#

interface GigabitEthernet1/0/17

port link-mode route

ip address 172.29.81.42 255.255.255.248

nat server protocol tcp global current-interface 18001 inside 10.11.4.7 18001 acl 3000 reversible  --->映射端口10.11.4.7:18001出去

5、创建安全区域【非必要，可以不创建】

security-zone name CTY

security-zone name LAB

6、接口加入安全区域

security-zone name CTY

import interface Vlan-interface608

#

security-zone name LAB

import interface GigabitEthernet1/0/17

7、配置对象组

object-group ip address 10.11.4.x

security-zone CTY

0 network subnet 10.11.4.0 255.255.255.0

#

object-group ip address LAB

security-zone LAB

0 network subnet 172.27.220.0 255.255.255.0

8、策略配置

security-policy ip --->进入安全策略模块

rule 4 name LAB-Local --->新建安全策略，名称 LAB-Local，这条策略是为了能ping通墙上面的地址测试，故需放通到local区域

action pass --->运行通行

logging enable --->开日日志

counting enable --->开启统计

source-zone LAB --->源区域

source-zone Local

destination-zone LAB

destination-zone Local --->目标区域

#

rule 8 name CTY_to_LAB

action pass

logging enable

counting enable

source-zone CTY

destination-zone LAB

source-ip 10.11.4.x

destination-ip LAB

#

rule 9 name LAB_TO_CTY

action pass

logging enable

counting enable

source-zone LAB

destination-zone CTY

source-ip LAB

destination-ip 10.11.4.x

qui

#

accelerate enhanced enable ---->用来激活安全策略规则的加速功能，全部策略配置好后得激活一下

9、会话开启

session statistics enable

10、一对一静态NAT

nat static outbound 10.11.4.4 172.29.81.43 acl 3000 reversible

nat static outbound 10.11.4.5 172.29.81.44 acl 3000 reversible

nat static outbound 10.11.4.6 172.29.81.45 acl 3000 reversible

nat static outbound 10.11.4.23 172.29.81.46 acl 3000 reversible

查看：

display security-policy 查看安全策略

reset security-policy statistics [ip|ipv6|rule rule-name] ---->清楚安全策略的统计信息【ip是清除ipv4的安全策略的统计信息，ipv6是清除ipv6安全策略的统计信息。rule rule-name表示清除指定安全策略规则的统计信息，rule-name是策略名称】