H3C-某单位网络配置实现

第一部分：网络架构

 

第二部分：配置

防火墙

[F1050]dis cu
#
 version 7.1.064, Release 9313P15
#
 sysname F1050
#
 clock timezone Beijing add 08:00:00
 clock protocol ntp context 1
#
context Admin id 1
#
 telnet server enable
#
 irf mac-address persistent timer
 irf auto-update enable
 undo irf link-delay
 irf member 1 priority 1
#
 security-zone intra-zone default permit
#
 password-recovery enable
#
vlan 1
#
interface NULL0
#
interface Vlan-interface1
#
interface GigabitEthernet1/0/0
 port link-mode route
 ip address 183.129.146.66 255.255.255.248
 nat outbound
 nat server protocol tcp global current-interface 443 inside 192.168.2.202 443 disable
 nat server protocol tcp global current-interface 5060 inside 192.168.2.3 5060
 nat server protocol tcp global current-interface 8001 inside 192.168.90.135 8000
 nat server protocol tcp global current-interface 8091 inside 192.168.90.152 8091
 nat server protocol tcp global current-interface 10010 inside 192.168.2.3 10010
 nat server protocol tcp global current-interface 23690 inside 192.168.2.3 23690
 nat server protocol tcp global current-interface 26161 inside 192.168.30.101 8161
 nat server protocol tcp global current-interface 26306 inside 192.168.30.101 3306
 nat server protocol tcp global current-interface 26613 26614 inside 192.168.30.102 26613 26614
 nat server protocol tcp global current-interface 26616 26617 inside 192.168.30.101 26616 26617
 nat server protocol tcp global current-interface 26999 inside 192.168.2.202 9999 disable
 nat server protocol tcp global current-interface 58100 inside 192.168.90.202 80
 nat server protocol tcp global current-interface 61613 inside 192.168.2.3 61613 disable
 nat server protocol tcp global current-interface 64001 inside 192.168.90.152 21 disable
 nat server protocol tcp global current-interface 64002 inside 192.168.90.152 3389 disable
 nat static enable
#
interface GigabitEthernet1/0/1
 port link-mode route
 nat outbound disable
#
interface GigabitEthernet1/0/2
 port link-mode route
 ip address 192.168.102.1 255.255.255.0
 nat hairpin enable
#
interface GigabitEthernet1/0/3
 port link-mode route
#
interface GigabitEthernet1/0/4
 port link-mode route
#
interface GigabitEthernet1/0/5
 port link-mode route
#
interface GigabitEthernet1/0/6
 port link-mode route
#
interface GigabitEthernet1/0/7
 port link-mode route
#
interface GigabitEthernet1/0/8
 port link-mode route
#
interface GigabitEthernet1/0/9
 port link-mode route
#
interface GigabitEthernet1/0/10
 port link-mode route
#
interface GigabitEthernet1/0/11
 port link-mode route
#
interface GigabitEthernet1/0/12
 port link-mode route
#
interface GigabitEthernet1/0/13
 port link-mode route
#
interface GigabitEthernet1/0/14
 port link-mode route
#              
interface GigabitEthernet1/0/15
 port link-mode route
 ip address 192.168.100.1 255.255.255.0
#
interface GigabitEthernet1/0/16
 port link-mode route
#
interface GigabitEthernet1/0/17
 port link-mode route
#
interface GigabitEthernet1/0/18
 port link-mode route
#
interface GigabitEthernet1/0/19
 port link-mode route
#
interface GigabitEthernet1/0/20
 port link-mode route
#
interface GigabitEthernet1/0/21
 port link-mode route
#
interface GigabitEthernet1/0/22
 port link-mode route
#
interface GigabitEthernet1/0/23
 port link-mode route
#
security-zone name Local
#
security-zone name Trust
 import interface GigabitEthernet1/0/2
#
security-zone name DMZ
#
security-zone name Untrust
 import interface GigabitEthernet1/0/0
 import interface GigabitEthernet1/0/1
#
security-zone name Management
 import interface GigabitEthernet1/0/15
#
security-zone name vlan1
#
security-zone name vlan10
#              
security-zone name vlan100
#
security-zone name vlan2
#
security-zone name vlan3
#
security-zone name vlan4
#
security-zone name vlan5
#
security-zone name vlan6
#
security-zone name vlan7
#
security-zone name vlan8
#
security-zone name vlan9
#
zone-pair security source Any destination Any
 packet-filter 3000
#
zone-pair security source vlan10 destination vlan100
 packet-filter 3000
#
zone-pair security source vlan3 destination vlan1
 packet-filter 3000
#
zone-pair security source vlan3 destination vlan100
 packet-filter 3000
#
zone-pair security source vlan4 destination vlan100
 packet-filter 3000
#
zone-pair security source vlan5 destination vlan100
 packet-filter 3000
#
zone-pair security source vlan7 destination vlan100
 packet-filter 3000
#
zone-pair security source vlan8 destination vlan100
 packet-filter 3000
#
zone-pair security source vlan9 destination vlan100
 packet-filter 3000
#
 scheduler logfile size 16
#
line class aux
 user-role network-operator
#
line class console
 user-role network-admin
#
line class vty
 user-role network-operator
#
line aux 0
 user-role network-admin
#
line con 0
 authentication-mode scheme
 user-role network-admin
#
line vty 0 63
 authentication-mode scheme
 user-role network-admin
#
 ip route-static 0.0.0.0 0 183.129.146.65
 ip route-static 192.168.0.0 16 192.168.102.2
#
 snmp-agent
 snmp-agent local-engineid 800063A28038ADBE31EB8600000001
 snmp-agent community write private
 snmp-agent community read public
 snmp-agent community read ysHQ
 snmp-agent sys-info version all 
 snmp-agent target-host trap address udp-domain 192.168.0.1 params securityname public v3
#
acl advanced 3000
 rule 0 permit ip
#
domain system
#
 aaa session-limit ftp 16
 aaa session-limit telnet 16
 aaa session-limit ssh 16
 domain default enable system
#
role name level-0
 description Predefined level-0 role
#
role name level-1
 description Predefined level-1 role
#
role name level-2
 description Predefined level-2 role
#
role name level-3
 description Predefined level-3 role
#
role name level-4
 description Predefined level-4 role
#
role name level-5
 description Predefined level-5 role
#
role name level-6
 description Predefined level-6 role
#
role name level-7
 description Predefined level-7 role
#
role name level-8
 description Predefined level-8 role
#              
role name level-9
 description Predefined level-9 role
#
role name level-10
 description Predefined level-10 role
#
role name level-11
 description Predefined level-11 role
#
role name level-12
 description Predefined level-12 role
#
role name level-13
 description Predefined level-13 role
#
role name level-14
 description Predefined level-14 role
#
user-group system
#
local-user admin class manage
 password hash $h$6$FG4htub0v98xNPMT$HgJCfACzSktkTchPjc+cV6rkZ2AFR+eMMHNDAtvcjoH1ZeTzrpeCxQBW0Fuf+pc3+QJ/WWN6JFZqXF5HNXZkBg==
 service-type ssh telnet terminal https
 authorization-attribute user-role level-3
 authorization-attribute user-role network-admin
 authorization-attribute user-role network-operator
#
local-user h3c class network
 password cipher $c$3$HsrCmtM2uW1aaWwsNo/KQ714Q2P2kw==
 service-type portal
 authorization-attribute user-role level-15
 authorization-attribute user-role network-operator
#
 session top-statistics enable
#
app-group yyall
 description 
#
 portal free-rule 1 destination ip 114.114.114.114 255.255.255.255
#
 ip https enable
#
 attack-defense signature log non-aggregate
#
inspect block-source parameter-profile ips_block_default_parameter
#              
inspect capture parameter-profile ips_capture_default_parameter
#
inspect logging parameter-profile ips_logging_default_parameter
#
inspect redirect parameter-profile av_redirect_default_parameter
#
inspect redirect parameter-profile ips_redirect_default_parameter
#
inspect redirect parameter-profile url_redirect_default_parameter
#
traffic-policy 
 rule name xunlei 
  action qos profile Ѹ
                         source-zone Any 
  destination-zone Any 
  application app Thunder 
 rule name any 
  action qos profile any 
  source-zone Any 
  destination-zone Any 
  application app-group yyall 
 profile name any
  bandwidth downstream guaranteed 10000 
  bandwidth downstream maximum 100000000 
  bandwidth upstream guaranteed 10000 
  bandwidth upstream maximum 100000000 
  connection-limit rate per-rule 300 
  connection-limit rate per-ip 300 
  connection-limit count per-rule 120000 
  connection-limit count per-ip 300 
  bandwidth upstream maximum per-ip 5000 
  bandwidth downstream maximum per-ip 5000 
 profile name Ѹ
  bandwidth downstream guaranteed 10000 
  bandwidth downstream maximum 100000000 
  bandwidth upstream guaranteed 10000 
  bandwidth upstream maximum 100000000 
  traffic-priority 3 
  connection-limit rate per-rule 30 
  connection-limit rate per-ip 30 
  connection-limit count per-rule 30 
  connection-limit count per-ip 30 
  bandwidth upstream maximum per-ip 2000 
  bandwidth downstream maximum per-ip 2000 
#
ips policy default
#
anti-virus policy default
#
return