05 HCIP NAT Server配置

d3interspace

05 HCIP NAT Server配置

1.     配置ISP接口
   
2.     <Huawei>system-view
   
3.     [Huawei]sysname ISP
   
4.     [ISP]interface gigabitethernet 0/0/0
   
5.     [ISP-GigabitEthernet0/0/0]ip address 100.100.100.1 29
   
6.     [ISP-GigabitEthernet0/0/0]interface gigabitethernet 0/0/1
   
7.     [ISP-GigabitEthernet0/0/1]ip address 200.200.200.1 24
   
8.     [ISP-GigabitEthernet0/0/1]quit
   
9.     配置FW接口及加入安全区
   
10.     <USG6000V1>system-view
    
11.     [USG6000V1]sysname FW
    
12.     [FW]interface gigabitethernet 1/0/1
    
13.     [FW-GigabitEthernet1/0/1]ip address 10.1.1.1 24
    
14.     [FW-GigabitEthernet1/0/1]interface gigabitethernet 1/0/0
    
15.     [FW-GigabitEthernet1/0/0]ip address 100.100.100.2 29
    
16.     [FW-GigabitEthernet1/0/0]quit
    
17.     [FW]firewall zone trust //创建Trust安全区
    
18.     [FW-zone-trust]add interface gigabitethernet 1/0/1 //区域加入端口
    
19.     [FW-zone-trust]firewall zone untrust //创建untrust安全区
    
20.     [FW-zone-untrust]add interface gigabitethernet 1/0/0 //区域加入端口
    
21.     [FW-zone-untrust]quit
    
22.     配置NAT Easy-IP
    
23.     [FW]nat-policy //NAT策略
    
24.     [FW-policy-nat]rule name easyip //配置策略名称
    
25.     [FW-policy-nat-rule-easyip]source-zone trust //源安全区域
    
26.     [FW-policy-nat-rule-easyip]destination-zone untrust //目标安全区载
    
27.     [FW-policy-nat-rule-easyip]source-address 10.1.1.0 24 //源地址段
    
28.     [FW-policy-nat-rule-easyip]action source-nat easy-ip //动作为执行easy-ip源NAT转换
    
29.     [FW-policy-nat-rule-easyip]quit
    
30.     [FW-policy-nat]quit
    
31.     配置安全策略trust-untrust
    
32.     [FW]security-policy //安全策略
    
33.     [FW-policy-security]rule name tust-untrust //策略名称
    
34.     [FW-policy-security-rule-tust-untrust]source-zone trust //源安全区域
    
35.     [FW-policy-security-rule-tust-untrust]destination-zone untrust //目标安全区载
    
36.     [FW-policy-security-rule-tust-untrust]source-address 10.1.1.0 24 //源地址段
    
37.     [FW-policy-security-rule-tust-untrust]action permit //执行允许动作
    
38.     [FW-policy-security-rule-tust-untrust]quit
    
39.     [FW-policy-security]quit
    
40.     配置默认路由
    
41.     [fw]ip route-static 0.0.0.0 0.0.0.0 100.100.100.1 //配置去往公网的默认路由
    
42.     配置NAT Server服务
    
43.     [FW]nat server protocol tcp global 100.100.100.2 65535 inside 10.1.1.100 ftp //NAT地址及端口映射
    
44.     [FW]nat server protocol tcp global 100.100.100.2 65534 inside 10.1.1.102 www no-reverse //不反向NAT
    
45.     配置安全策略untrust-trust
    
46.     [FW]security-policy
    
47.     [FW-policy-security]rule name ftp-http
    
48.     [FW-policy-security-rule-ftp-http]source-zone untrust
    
49.     [FW-policy-security-rule-ftp-http]destination-zone trust
    
50.     [FW-policy-security-rule-ftp-http]destination-address 10.1.1.0 24
    
51.     [FW-policy-security-rule-ftp-http]service ftp http
    
52.     [FW-policy-security-rule-ftp-http]action permit
    
53.     查看会话
    
54.     [fw1]display firewall server-map
    
55.     [fw1]display firewall session table
    
56.     [fw1]display firewall session table verbose
    
57.     清除会话表
    
58.     [fw]diagnose //诊断
    
59.     [fw-diagnose]reset firewall server-map //重置防火墙会话表
    
60.     [fw-diagnose]quit

复制代码