华为USG防火墙配置

组网需求：需求1
该公司Trust区域的10.1.1.0/24网段的用户可以访问Internet，该安全区域其它网段
的用户不能访问。提供的访问外部网络的合法IP地址范围为202.1.1.100–202.1.1.200。需求2
提供FTP和Web服务器供外部网络用户访问。其中FTP Server的内部IP地址为
192.168.1.200，端口号为缺省值21，Web Server的内部IP地址为192.168.1.100，端口为80。两
者对外公布的地址均为202.1.1.10，对外使用的端口号均为缺省值，即21和80。拓扑：防火墙配置：#
interface GigabitEthernet0/0/1
ip address 10.1.1.254 255.255.255.0
#
interface GigabitEthernet0/0/2
ip address 202.1.1.254 255.255.255.0
#
interface GigabitEthernet0/0/3
ip address 192.168.1.254 255.255.255.0
#
firewall zone trust
set priority 85
add interface GigabitEthernet0/0/0
add interface GigabitEthernet0/0/1
#
firewall zone untrust
set priority 5
add interface GigabitEthernet0/0/2
#
firewall zone dmz
set priority 50
add interface GigabitEthernet0/0/3
#
nat address-group 1 202.1.1.100 202.1.1.200
nat server 0 protocol tcp global 202.1.1.10 ftp inside 192.168.1.200 ftp
nat server 1 protocol tcp global 202.1.1.10 www inside 192.168.1.100 www
#
policy interzone trust untrust outbound
policy 0
action permit
免费云主机域名policy source 10.1.1.0 0.0.0.255
#
policy interzone dmz untrust inbound
policy 0
action permit
policy service service-set http
policy destination 192.168.1.100 0policy 1
action permit
policy service service-set ftp
policy destination 192.168.1.200 0
#
nat-policy interzone trust untrust outbound
policy 0
action source-nat
policy source 10.1.1.0 0.0.0.255
address-group 1

相关推荐: LDP的快速收敛—LDP会话保护(高级feature)

Technorati 标签: MPLS,CCIE,LDP,LDP session protection,收敛LDP收敛总结Summary:如果一个有冗余链路的网络，主链路down了，那么LDP的收敛时间=IGP的收敛时间.(约等于)当主链路恢复以后，LDP的收…