h3c secpath f100的配置和管理

[F100-A]dis current-configuration
下面是h3c f100系列防火墙的典型配置，希望对刚接触这款防火墙的朋友们有所帮助，大家有意见，可及时跟我联系。
#
sysname F100-A
#
undo firewall
packet-filter enable
firewall packet-filter default permit
#
undo
insulate
#
undo connection-limit enable
connection-limit default
deny
connection-limit default amount upper-limit 50 lower-limit
20
#
firewall statistic system enable
#
radius scheme
system
server-type extended
#
domain system
#
local-user
egb--aq
password cipher ]#R=WG;'I/ZGL^3L[[\1-A!!
service-type
telnet
level 3
#
aspf-policy 1
detect http
detect
smtp
detect ftp
detect tcp
detect udp
#
acl number
2000
rule 0 permit source 192.168.0.0 0.0.0.255
rule 1
deny
#
interface Virtual-Template1
#
interface Aux0
async mode
flow
#
interface Ethernet0/0
ip address 192.168.0.1
255.255.255.0
#
interface Ethernet1/0
ip address 121.81.231.130
255.255.255.224
ip address 121.81.231.132 255.255.255.224 sub
ip address
121.81.231.133 255.255.255.224 sub
ip address 121.81.231.134 255.255.255.224
sub
ip address 121.81.231.135 255.255.255.224 sub
ip address
121.81.231.136 255.255.255.224 sub
ip address 121.81.231.137 255.255.255.224
sub
ip address 121.81.231.138 255.255.255.224 sub
ip address
121.81.231.139 255.255.255.224 sub
ip address 121.81.231.131 255.255.255.224
sub
nat outbound 2000
nat server protocol tcp global 121.81.231.136 3000
inside 192.168.0.6 3000
nat server protocol tcp global 121.81.231.136 6000
inside 192.168.0.6 6000
nat server protocol tcp global 121.81.231.132 ftp
inside 192.168.0.3 ftp
nat server protocol tcp global 121.81.231.132 5631
inside 192.168.0.3 5631
nat server protocol tcp global 121.81.231.132 43958
inside 192.168.0.3 43958
nat server protocol tcp global 121.81.231.134 ftp
inside 192.168.0.4 ftp
nat server protocol tcp global 121.81.231.134 www
inside 192.168.0.4 www
nat server protocol tcp global 121.81.231.134 5631
inside 192.168.0.4 5631
nat server protocol tcp global 121.81.231.134 43958
inside 192.168.0.4 43958
nat server protocol tcp global 121.81.231.135 ftp
inside 192.168.0.5 ftp
nat server protocol tcp global 121.81.231.135 58169
inside 192.168.0.5 58169
nat server protocol tcp global 121.81.231.135 www
inside 192.168.0.5 www
nat server protocol tcp global 121.81.231.135 43958
inside 192.168.0.5 43958
nat server protocol tcp global 121.81.231.136 ftp
inside 192.168.0.6 ftp
nat server protocol tcp global 121.81.231.136 smtp
inside 192.168.0.6 smtp
nat server protocol tcp global 121.81.231.136 www
inside 192.168.0.6 www
nat server protocol tcp global 121.81.231.136 81
inside 192.168.0.6 81
nat server protocol tcp global 121.81.231.136 82
inside 192.168.0.6 82
nat server protocol tcp global 121.81.231.136 83
inside 192.168.0.6 83
nat server protocol tcp global 121.81.231.136 84
inside 192.168.0.6 84
nat server protocol tcp global 121.81.231.136 pop3
inside 192.168.0.6 pop3
nat server protocol tcp global 121.81.231.136 1433
inside 192.168.0.6 1433
nat server protocol tcp global 121.81.231.136 5150
inside 192.168.0.6 5150
nat server protocol tcp global 121.81.231.136 5631
inside 192.168.0.6 5631
nat server protocol tcp global 121.81.231.136 58169
inside 192.168.0.6 58169
nat server protocol tcp global 121.81.231.136 8080
inside 192.168.0.6 8080
nat server protocol tcp global 121.81.231.136 43958
inside 192.168.0.6 43958
nat server protocol tcp global 121.81.231.138 smtp
inside 192.168.0.8 smtp
nat server protocol tcp global 121.81.231.138 www
inside 192.168.0.8 www
nat server protocol tcp global 121.81.231.138 pop3
inside 192.168.0.8 pop3
nat server protocol tcp global 121.81.231.138 5631
inside 192.168.0.8 5631
nat server protocol tcp global 121.81.231.138 58169
inside 192.168.0.8 58169
nat server protocol tcp global 121.81.231.137 ftp
inside 192.168.0.9 ftp
nat server protocol tcp global 121.81.231.137 www
inside 192.168.0.9 www
nat server protocol tcp global 121.81.231.132 www
inside 192.168.0.3 www
nat server protocol tcp global 121.81.231.137 81
inside 192.168.0.9 81
nat server protocol tcp global 121.81.231.137 82
inside 192.168.0.9 82
nat server protocol tcp global 121.81.231.137 83
inside 192.168.0.9 83
nat server protocol tcp global 121.81.231.137 1433
inside 192.168.0.9 1433
nat server protocol tcp global 121.81.231.137 5631
inside 192.168.0.9 5631
nat server protocol tcp global 121.81.231.137 43958
inside 192.168.0.9 43958
nat server protocol tcp global 121.81.231.137 58169
inside 192.168.0.9 58169
nat server protocol tcp global 121.81.231.136 88
inside 192.168.0.6 88
nat server protocol tcp global 121.81.231.137 84
inside 192.168.0.9 84
nat server protocol tcp global 121.81.231.137 85
inside 192.168.0.9 85
nat server protocol tcp global 121.81.231.137 86
inside 192.168.0.9 86
nat server protocol tcp global 121.81.231.137 87
inside 192.168.0.9 87
nat server protocol tcp global 121.81.231.137 88
inside 192.168.0.9 88
nat server protocol tcp global 121.81.231.137 smtp
inside 192.168.0.9 smtp
nat server protocol tcp global 121.81.231.137 8080
inside 192.168.0.9 8080
nat server protocol tcp global 121.81.231.137 5080
inside 192.168.0.9 5080
nat server protocol tcp global 121.81.231.137 1935
inside 192.168.0.9 1935
nat server protocol udp global 121.81.231.137 5555
inside 192.168.0.9 5555
nat server protocol tcp global 121.81.231.132 58169
inside 192.168.0.3 58169
nat server protocol tcp global 121.81.231.134 58169
inside 192.168.0.4 58169
nat server protocol tcp global 121.81.231.135 5631
inside 192.168.0.5 5631
nat server protocol tcp global 121.81.231.136 6100
inside 192.168.0.6 6100
nat server protocol tcp global 121.81.231.139 www
inside 192.168.0.12 www
nat server protocol tcp global 121.81.231.139 58169
inside 192.168.0.12 58169
nat server protocol tcp global 121.81.231.139
58189 inside 192.168.0.12 58189
nat server protocol tcp global
121.81.231.139 5631 inside 192.168.0.12 5631
nat server protocol tcp global
121.81.231.137 89 inside 192.168.0.9 89
nat server protocol tcp global
121.81.231.134 58269 inside 192.168.0.4 58269
nat server protocol udp global
121.81.231.134 58269 inside 192.168.0.4 58269
nat server protocol tcp global
121.81.231.133 www inside 192.168.0.13 www
nat server protocol tcp global
121.81.231.135 1935 inside 192.168.0.5 1935
nat server protocol tcp global
121.81.231.135 5080 inside 192.168.0.5 5080
nat server protocol tcp global
121.81.231.132 1755 inside 192.168.0.3 1755
nat server protocol tcp global
121.81.231.137 1755 inside 192.168.0.9 1755
nat server protocol tcp global
121.81.231.137 554 inside 192.168.0.9 554
nat server protocol tcp global
121.81.231.135 5551 inside 192.168.0.5 5551
nat server protocol tcp global
121.81.231.131 www inside 192.168.0.204 www
nat server protocol tcp global
121.81.231.134 81 inside 192.168.0.4 81
nat server protocol tcp global
121.81.231.136 1935 inside 192.168.0.6 1935
nat server protocol tcp global
121.81.231.140 www inside 192.168.0.10 www
nat server protocol udp global
121.81.231.137 dns inside 192.168.0.9 dns
nat server protocol tcp global
121.81.231.135 58189 inside 192.168.0.5 58189
nat server protocol tcp global
121.81.231.141 www inside 192.168.0.11 www
#
interface
Ethernet1/1
#
interface Ethernet1/2
#
interface
NULL0
#
firewall zone local
set priority 100
#
firewall zone
trust
add interface Ethernet0/0
set priority 85
statistic enable ip
inzone
statistic enable ip outzone
#
firewall zone untrust
add
interface Ethernet1/0
add interface Ethernet1/1
add interface
Ethernet1/2
set priority 5
statistic enable ip inzone
statistic
enable ip outzone
#
firewall zone DMZ
set priority 50
#
firewall
interzone local trust
#
firewall interzone local untrust
#
firewall
interzone local DMZ
#
firewall interzone trust untrust
#
firewall
interzone trust DMZ
#
firewall interzone DMZ untrust
#
undo
info-center enable
#
FTP server enable
#
ip route-static 0.0.0.0
0.0.0.0 121.81.231.129 preference 1
#
firewall defend
ip-spoofing
firewall defend land
firewall defend smurf
firewall
defend fraggle
firewall defend winnuke
firewall defend
icmp-redirect
firewall defend icmp-unreachable
firewall defend
source-route
firewall defend route-record
firewall defend
tracert
firewall defend ping-of-death
firewall defend
tcp-flag
firewall defend ip-fragment
firewall defend
large-icmp
firewall defend teardrop
firewall defend
ip-sweep
firewall defend port-scan
firewall defend
arp-spoofing
firewall defend arp-reverse-query
firewall defend
arp-flood
firewall defend frag-flood
firewall defend syn-flood
enable
firewall defend udp-flood enable
firewall defend icmp-flood
enable
firewall defend syn-flood zone trust
firewall defend udp-flood
zone trust
firewall defend syn-flood zone untrust
firewall defend
udp-flood zone untrust
#
user-interface con 0
authentication-mode
password
set authentication password cipher
XB-'KG=+=J^UJ;&DL'U46Q!!
user-interface aux 0
user-interface vty 0
4
authentication-mode scheme
#
return
[F100-A]