2024年5月21日发(作者：登奇水)
10.10.10.0/24
GE 0/0/1 GE 0/0/2
地址池：
220.10.10.16----20
GE 0/0/3
DMZ
10.10.11.0/24
GE 0/0/1：10.10.10.1/24
GE 0/0/2：220.10.10.16/24
GE 0/0/3：10.10.11.1/24
WWW服务器：10.10.11.2/24（DMZ区域）
FTP服务器：10.10.11.3/24（DMZ区域）
Telnet配置：
配置VTY 的优先级为3
# 进入系统视图。
# 进入用户界面视图
[USG5300] user-interface vty 0 3
# 设置用户界面能够访问的命令级别为level 3
[USG5300-ui-vty0-3] user privilege level 3
配置Password验证
# 配置验证方式为Password验证
[USG5300-ui-vty0] authentication-mode password
# 配置验证密码为lantian
[USG5300-ui-vty0] set authentication password simple lantian
配置空闲断开连接时间
# 设置超时为30分钟
[USG5300-ui-vty0] idle-timeout 30
地址配置：
内网：
进入GigabitEthernet 0/0/1视图
[USG5300] interface GigabitEthernet 0/0/1
配置GigabitEthernet 0/0/1的IP地址
[USG5300-GigabitEthernet0/0/1] ip address 10.10.10.1 255.255.255.0
配置GigabitEthernet 0/0/1加入Trust区域
[USG5300] firewall zone trust
[USG5300-zone-untrust] add interface GigabitEthernet 0/0/1
[USG5300-zone-untrust] quit
外网：
进入GigabitEthernet 0/0/2视图
[USG5300] interface GigabitEthernet 0/0/2
配置GigabitEthernet 0/0/2的IP地址
[USG5300-GigabitEthernet0/0/2] ip address 220.10.10.16 255.255.255.0
配置GigabitEthernet 0/0/2加入Untrust区域
[USG5300] firewall zone untrust
[USG5300-zone-untrust] add interface GigabitEthernet 0/0/2
[USG5300-zone-untrust] quit
DMZ：
进入GigabitEthernet 0/0/3视图
[USG5300] interface GigabitEthernet 0/0/3
配置GigabitEthernet 0/0/3的IP地址。
[USG5300-GigabitEthernet0/0/3] ip address 10.10.11.1 255.255.255.0
[USG5300] firewall zone dmz
[USG5300-zone-untrust] add interface GigabitEthernet 0/0/3
[USG5300-zone-untrust] quit
防火墙策略：
Trust和Untrust域间：
policy 1：允许源地址为10.10.10.0/24的网段的报文通过
配置Trust和Untrust域间出方向的防火墙策略。
[USG5300] policy interzone trust untrust outbound
[USG5300-policy-interzone-trust-untrust-outbound] policy 1
[USG5300-policy-interzone-trust-untrust-outbound-1] policy source 10.10.10.0
0.0.0.255
[USG5300-policy-interzone-trust-untrust-outbound-1] action permit
[USG5300-policy-interzone-trust-untrust-outbound-1] quit
DMZ和Untrust域间：
policy 2：允许目的地址为10.10.11.2，目的端口为21的报文通过
policy 3：允许目的地址为10.10.11.3，目的端口为8080的报文通过
配置Untrust到DMZ域间入方向的防火墙策略。
[USG5300] policy interzone untrust dmz inbound
[USG5300-policy-interzone-dmz-untrust-inbound] policy 2
[USG5300-policy-interzone-dmz-untrust-inbound-2] policy destination 10.10.11.3 0
[USG5300-policy-interzone-dmz-untrust-inbound-2] policy service service-set ftp
[USG5300-policy-interzone-dmz-untrust-inbound-2] action permit
[USG5300-policy-interzone-dmz-untrust-inbound-2] quit
[USG5300-policy-interzone-dmz-untrust-inbound] policy 3
[USG5300-policy-interzone-dmz-untrust-inbound-3] policy destination 10.10.11.2 0
[USG5300-policy-interzone-dmz-untrust-inbound-3] policy service service-set http
[USG5300-policy-interzone-dmz-untrust-inbound-3] action permit
[USG5300-policy-interzone-dmz-untrust-inbound-3] quit
[USG5300-policy-interzone-dmz-untrust-inbound] quit
应用FTP的NAT ALG功能。
[USG5300] firewall interzone dmz untrust
[USG5300-interzone-dmz-untrust] detect ftp
[USG5300-interzone-dmz-untrust] quit
配置内部服务器：
[USG5300] nat server protocol tcp global 220.10.10.16 8080 inside 10.10.11.2 www
[USG5300] nat server protocol tcp global 220.10.10.17 ftp inside 10.10.11.3 ftp
NAT策略：
Trust和Untrust域间：
policy 1：允许网段为10.10.10.0/24的内网用户访问Internet时进行源地址转换
配置地址池
[USG5300]nat address-group 1 220.10.10.16 220.10.10.20
配置Trust和Untrust域间出方向的策略
[USG5300] nat-policy interzone trust untrust outbound
[USG5300--policy-interzone-trust-untrust-outbound] policy 1
[USG5300- nat-policy -interzone-trust-untrust-outbound-1] policy source
10.10.10.0 0.0.0.255
[USG5300- nat-policy -interzone-trust-untrust-outbound-1] action source- nat
[USG5300- nat -policy-interzone-trust-untrust-outbound-1] address-group 1
IP地址和MAC地址绑定：
将MAC地址为0000-e03f-0305的PC机与IP地址10.1.1.1绑定，掩码为255.255.255.0。
[USG5300] dhcp server ip-pool 0
[USG5300-dhcp-0] static-bind ip -address 10.1.1.1 mask 255.255.255.0
[USG5300-dhcp-0] static-bind mac-address 0000-e03f-0305
2024年5月21日发(作者：登奇水)
10.10.10.0/24
GE 0/0/1 GE 0/0/2
地址池：
220.10.10.16----20
GE 0/0/3
DMZ
10.10.11.0/24
GE 0/0/1：10.10.10.1/24
GE 0/0/2：220.10.10.16/24
GE 0/0/3：10.10.11.1/24
WWW服务器：10.10.11.2/24（DMZ区域）
FTP服务器：10.10.11.3/24（DMZ区域）
Telnet配置：
配置VTY 的优先级为3
# 进入系统视图。
# 进入用户界面视图
[USG5300] user-interface vty 0 3
# 设置用户界面能够访问的命令级别为level 3
[USG5300-ui-vty0-3] user privilege level 3
配置Password验证
# 配置验证方式为Password验证
[USG5300-ui-vty0] authentication-mode password
# 配置验证密码为lantian
[USG5300-ui-vty0] set authentication password simple lantian
配置空闲断开连接时间
# 设置超时为30分钟
[USG5300-ui-vty0] idle-timeout 30
地址配置：
内网：
进入GigabitEthernet 0/0/1视图
[USG5300] interface GigabitEthernet 0/0/1
配置GigabitEthernet 0/0/1的IP地址
[USG5300-GigabitEthernet0/0/1] ip address 10.10.10.1 255.255.255.0
配置GigabitEthernet 0/0/1加入Trust区域
[USG5300] firewall zone trust
[USG5300-zone-untrust] add interface GigabitEthernet 0/0/1
[USG5300-zone-untrust] quit
外网：
进入GigabitEthernet 0/0/2视图
[USG5300] interface GigabitEthernet 0/0/2
配置GigabitEthernet 0/0/2的IP地址
[USG5300-GigabitEthernet0/0/2] ip address 220.10.10.16 255.255.255.0
配置GigabitEthernet 0/0/2加入Untrust区域
[USG5300] firewall zone untrust
[USG5300-zone-untrust] add interface GigabitEthernet 0/0/2
[USG5300-zone-untrust] quit
DMZ：
进入GigabitEthernet 0/0/3视图
[USG5300] interface GigabitEthernet 0/0/3
配置GigabitEthernet 0/0/3的IP地址。
[USG5300-GigabitEthernet0/0/3] ip address 10.10.11.1 255.255.255.0
[USG5300] firewall zone dmz
[USG5300-zone-untrust] add interface GigabitEthernet 0/0/3
[USG5300-zone-untrust] quit
防火墙策略：
Trust和Untrust域间：
policy 1：允许源地址为10.10.10.0/24的网段的报文通过
配置Trust和Untrust域间出方向的防火墙策略。
[USG5300] policy interzone trust untrust outbound
[USG5300-policy-interzone-trust-untrust-outbound] policy 1
[USG5300-policy-interzone-trust-untrust-outbound-1] policy source 10.10.10.0
0.0.0.255
[USG5300-policy-interzone-trust-untrust-outbound-1] action permit
[USG5300-policy-interzone-trust-untrust-outbound-1] quit
DMZ和Untrust域间：
policy 2：允许目的地址为10.10.11.2，目的端口为21的报文通过
policy 3：允许目的地址为10.10.11.3，目的端口为8080的报文通过
配置Untrust到DMZ域间入方向的防火墙策略。
[USG5300] policy interzone untrust dmz inbound
[USG5300-policy-interzone-dmz-untrust-inbound] policy 2
[USG5300-policy-interzone-dmz-untrust-inbound-2] policy destination 10.10.11.3 0
[USG5300-policy-interzone-dmz-untrust-inbound-2] policy service service-set ftp
[USG5300-policy-interzone-dmz-untrust-inbound-2] action permit
[USG5300-policy-interzone-dmz-untrust-inbound-2] quit
[USG5300-policy-interzone-dmz-untrust-inbound] policy 3
[USG5300-policy-interzone-dmz-untrust-inbound-3] policy destination 10.10.11.2 0
[USG5300-policy-interzone-dmz-untrust-inbound-3] policy service service-set http
[USG5300-policy-interzone-dmz-untrust-inbound-3] action permit
[USG5300-policy-interzone-dmz-untrust-inbound-3] quit
[USG5300-policy-interzone-dmz-untrust-inbound] quit
应用FTP的NAT ALG功能。
[USG5300] firewall interzone dmz untrust
[USG5300-interzone-dmz-untrust] detect ftp
[USG5300-interzone-dmz-untrust] quit
配置内部服务器：
[USG5300] nat server protocol tcp global 220.10.10.16 8080 inside 10.10.11.2 www
[USG5300] nat server protocol tcp global 220.10.10.17 ftp inside 10.10.11.3 ftp
NAT策略：
Trust和Untrust域间：
policy 1：允许网段为10.10.10.0/24的内网用户访问Internet时进行源地址转换
配置地址池
[USG5300]nat address-group 1 220.10.10.16 220.10.10.20
配置Trust和Untrust域间出方向的策略
[USG5300] nat-policy interzone trust untrust outbound
[USG5300--policy-interzone-trust-untrust-outbound] policy 1
[USG5300- nat-policy -interzone-trust-untrust-outbound-1] policy source
10.10.10.0 0.0.0.255
[USG5300- nat-policy -interzone-trust-untrust-outbound-1] action source- nat
[USG5300- nat -policy-interzone-trust-untrust-outbound-1] address-group 1
IP地址和MAC地址绑定：
将MAC地址为0000-e03f-0305的PC机与IP地址10.1.1.1绑定，掩码为255.255.255.0。
[USG5300] dhcp server ip-pool 0
[USG5300-dhcp-0] static-bind ip -address 10.1.1.1 mask 255.255.255.0
[USG5300-dhcp-0] static-bind mac-address 0000-e03f-0305