H3C防火牆配置
<H3C>sys
[H3C]int g1/0/1
[H3C-GigabitEthernet1/0/1]ipadd 123.232.115.11 24
[H3C-GigabitEthernet1/0/1]qu
[H3C]int g1/0/3
[H3C-GigabitEthernet1/0/3]ipadd 192.168.10.1 24
[H3C-GigabitEthernet1/0/3]qu
[H3C]interfaceGigabitEthernet 1/0/1
[H3C-GigabitEthernet1/0/1]nat outbound
[H3C]iproute-static 0.0.0.0 0 123.232.115.10
配置ACL 3000,定義規則:允許IP流量。
[H3C]acladvanced 3000
[H3C-acl-ipv4-adv-3000]rule permit ip
[H3C-acl-ipv4-adv-3000]qu
向安全域Untrust中新增介面GigabitEthernet1/0/1
[H3C]security-zone name Untrust
[H3C-security-zone-Untrust]import interfaceGigabitEthernet 1/0/1
[H3C-security-zone-Untrust]qu
向安全域Trust中新增介面GigabitEthernet1/0/3
[H3C]security-zone name Trust
[H3C-security-zone-Trust]import interfaceGigabitEthernet 1/0/3
[H3C-security-zone-Trust]qu
[H3C]zone-pair security source Trustdestination local
[H3C-zone-pair-security-Trust-Local]packet-filter3000
[H3C-zone-pair-security-Trust-Local]qu
[H3C]zone-pairsecurity source local destination Trust
[H3C-zone-pair-security-Local-Trust]packet-filter3000
[H3C-zone-pair-security-Local-Trust]qu
[H3C]zone-pair security source Trustdestination Untrust
[H3C-zone-pair-security-Trust-Untrust]packet-filter3000
[H3C-zone-pair-security-Trust-Untrust]qu
如果裝置上多個埠加入同一個安全域,那麼還需要加一條下面命令,否則同一個埠下面的終端之間是不能互通的。
[H3C]security-zone intra-zone default permit
DHCP配置:
[H3C]dhcp enable
[H3C]dhcp serverip-pool 10
[H3C-dhcp-pool-10]network192.168.10.20 mask 255.255.255.0
[H3C-dhcp-pool-10]gateway-list 192.168.10.1
[H3C-dhcp-pool-10]dns-list 202.102.152.3202.102.128.68
定義各DHCP地址池禁止分配的IP地址(開始~結束)
[H3C-dhcp-pool-10]dhcpserverforbidden-ip192.168.10.1 192.168.10.100
http配置:
[H3C]ip httpenable
[H3C]ip https enable
[H3C]local-useradmin
[H3C-luser-manage-admin]service-typehttp https
[H3C-luser-manage-admin]password simple 123456
轉載於:https://blog.51cto.com/wangjiakai/1945364