防火墙配置基本

域：默认有几个系统自定义的区域local、trust、untrust、dmz，每个区域有各自的优先级；

域间安全策略

outbound代表数据包出方向，即从设备的某接口出去的方向

inbound代表数据包进方向，即由设备的某接口进来的方向

端口配置IP、vrrpIP：

interface GigabitEthernet0/0/6

 combo enable fiber

 description TO_6505_F5

 ip address 10.10.18.2 255.255.255.128 

 vrrp vrid 3 virtual-ip 10.10.18.1 master

配置zone的端口、优先级：

firewall zone trust

 set priority 85

 add interface GigabitEthernet0/0/0

 add interface GigabitEthernet0/0/6

自定义zone：

firewall zone name dmz2

 set priority 55

 detect ftp

 detect rtsp

 detect pptp

firewall interzone命令用来创建安全域间，并进入安全域间视图。

firewall interzone zone-name1 zone-name2

firewall zone dmz

 set priority 50

 add interface GigabitEthernet0/0/2

firewall interzone ha untrust2

 detect ftp

 detect pptp

 detect rtsp

ip route-static 0.0.0.0 0.0.0.0 18.23.3.201 

ip address-set report type group

 description all report

ip address-set _10.0.14.0 type object

 address 0 10.0.14.0 mask 24

ip service-set hh_service type group

 description hh_service

 service 0 service-set ftp

 service 1 service-set telnet
ip service-set new_tcp type object

 service 0 protocol tcp source-port 0 to 65535 destination-port 9090

 service 1 protocol tcp source-port 0 to 65535 destination-port 8008

policy interzone trust untrust inbound

 policy 12 

  action permit 

  policy logging 

  policy service service-set dns服务器端口

  policy source address-set dns服务器1

  policy source address-set dns服务器2

  policy source address-set dns服务器3

  policy destination address-set mip(28.3.63.16)

policy interzone trust untrust outbound

 policy 3 

  action permit 

  policy logging 

  policy service service-set dsmp

  policy source address-set inter_mmsc

  policy destination address-set dsmp