华为防火墙配置手册 华为USG防火墙NAT配置
拓扑图
场景：
你是公司的网络管理员。公司使用网络防火墙隔离成三个区域。现在要将dmz区域中的一台服务器（ip地址：10.0.3.3）提供的telnet服务发布出去，对外公开的地址是10.0.10.20、24.并且内部网络trust区域的用户通过easy-ip的方式访问外部区域。其它方向的访问被禁止。
在交换机上将g0/0/1与g0/0/21接口定义到vlan11，将g0/0/2与g0/0/22接口定义到vlan12，将g0/0/3与g0/0/23接口定义到vlan13.分别规划了三个网段。
学习任务
步骤一.基本配置与ip编址
首先给三个路由器配置地址信息。
[huawei]sysname r1
[r1]interface g0/0/1
[r1-gigabitethernet0/0/1]ip add 10.0.10.124
[r1-gigabitethernet0/0/1]desc this portconnect to s1-g0/0/1
[r1-gigabitethernet0/0/1]interfaceloopback0
[r1-loopback0]ip add 10.0.1.1 24
[r1-loopback0]q
[huawei]sysname r2
[r2]interface g0/0/1
[r2-gigabitethernet0/0/1]ip add 10.0.20.224
[r2-gigabitethernet0/0/1]desc this portconnect to s1-g0/0/2
[r2-gigabitethernet0/0/1]interfaceloopback0
[r2-loopback0]ip add 10.0.2.2 24
[r2-loopback0]q
[huawei]sysname r3
[r3]interface g0/0/1
[r3-gigabitethernet0/0/1]ip add 10.0.30.324
[r3-gigabitethernet0/0/1]desc this portconnect to s1-g0/0/3
[r3-gigabitethernet0/0/1]interfaceloopback0
[r3-loopback0]ip add 10.0.3.3 24
[r3-loopback0]q
给防火墙配置地址时，g0/0/1配置10.0.20.254/24.
[srg]sysname fw
13:06:03 2014/07/08
[fw]interface g0/0/1
13:06:30 2014/07/08
[fw-gigabitethernet0/0/1]ip add 10.0.20.25424
13:07:01 2014/07/08
[fw-gigabitethernet0/0/1]desc this portconnect to s1-g0/0/22
13:07:52 2014/07/08
[fw-gigabitethernet0/0/1]interface g0/0/0
13:08:23 2014/07/08
[fw-gigabitethernet0/0/0]dis this
13:08:31 2014/07/08
#
interface gigabitethernet0/0/0
alias ge0/mgmt
ipaddress 192.168.0.1 255.255.255.0
dhcpselect interface
dhcpserver gateway-list 192.168.0.1
#
return
[fw-gigabitethernet0/0/0]undo ip add
13:08:42 2014/07/08
info: the dhcp server configuration on thisinterface will be deleted.
[fw-gigabitethernet0/0/0]display this
13:08:46 2014/07/08
#
interface gigabitethernet0/0/0
alias ge0/mgmt
#
return
[fw-gigabitethernet0/0/0]ip add 10.0.10.25424
13:09:29 2014/07/08
[fw-gigabitethernet0/0/0]desc this portconnect to s1-g0/0/21
13:10:05 2014/07/08
[fw-gigabitethernet0/0/0]interface g0/0/2
13:10:15 2014/07/08
[fw-gigabitethernet0/0/2]ip add 10.0.30.25424
13:10:28 2014/07/08
[fw-gigabitethernet0/0/2]desc this portconnect to s1-g0/0/23
13:10:53 2014/07/08
[fw-gigabitethernet0/0/2]q
交换机上需要按照需求定义vlan
[huawei]sysname s1
[s1]vlan batch 11 to 13
info: this operation may take a fewseconds. please wait for a moment...done.
[s1]interface g0/0/1
[s1-gigabitethernet0/0/1]port link-typeaccess
[s1-gigabitethernet0/0/1]port default vlan11
[s1]interface g0/0/2
[s1-gigabitethernet0/0/2]port link-typeaccess
[s1-gigabitethernet0/0/2]port default vlan12
[s1-gigabitethernet0/0/2]interface g0/0/3
[s1-gigabitethernet0/0/3]port link-typeaccess
[s1-gigabitethernet0/0/3]port default vlan13
[s1-gigabitethernet0/0/3]interface g0/0/21
[s1-gigabitethernet0/0/21]port link-typeaccess
[s1-gigabitethernet0/0/21]port default vlan11
[s1-gigabitethernet0/0/21]interface g0/0/22
[s1-gigabitethernet0/0/22]port link-typeaccess
[s1-gigabitethernet0/0/22]port default vlan12
[s1-gigabitethernet0/0/22]interface g0/0/23
[s1-gigabitethernet0/0/23]port link-typeaccess
[s1-gigabitethernet0/0/23]port default vlan13
步骤二.将接口配置到安全区域
防火墙默认有四个区域，分别是“local”、“trust"、“untrust”、“dmz”。
实验中我们用到“trust”、'untrust"、“dmz”三个区域。将g0/0/0加入untrust区域、g/0/0/2加入dmz和g/0/0/1加入trust。
[fw]firewall zone trust
13:45:31 2014/07/08
[fw-zone-trust]dis this
13:45:35 2014/07/08
#
firewall zone trust
setpriority 85
addinterface gigabitethernet0/0/0
#
return
[fw-zone-trust]undo add inter
[fw-zone-trust]undo add interface g0/0/0
13:46:01 2014/07/08
[fw-zone-trust]add interface g0/0/1
13:46:22 2014/07/08
[fw-zone-trust]firewall zone untrust
[fw-zone-untrust]add interface g0/0/0
13:47:24 2014/07/08
[[fw-zone-untrust]firewall zone dmz
13:48:06 2014/07/08
[fw-zone-dmz]add interface g0/0/2
13:48:13 2014/07/08
[fw-zone-dmz]q
默认情况下，防火墙并不允许出local区域外的其它区域之间进行通信。为了便于验证配置的正确性，我们首先将防火墙区域之间的默认过滤规则配置为允许所有区域间通信。配置完成后在fw设备上测试连通性。