華為usg6300防火墻，通過命令如何配置上網(wǎng)，懂命令的人，對于防火墻出現(xiàn)故障會更好判斷問題，防火墻基本的上網(wǎng)命令如何去配置？

下圖所示：防火墻硬件設備。

防火墻各個面板名稱作用。

防火墻的基本連接拓撲圖：

防火墻，默認管理IP地址，及默認帳號和密碼。

基本的開局配置規(guī)劃表。

默認密碼表。

網(wǎng)絡拓撲

華為防火墻命令配置過程

1.雖說我們使用命令去調試華為的防火墻，但是我們還是需要將web界面打開的，使用web-manager enable，開啟防火墻的web界面。

2.查看一下防火墻的現(xiàn)有配置，可以看到當前的G0/0/0號口IP地址是默認的192.168.0.1/24，而且默認開啟了http和https登錄，允許被ping。

3.在配置命令時，關閉log響應，這樣配置起來會更順暢。使用undo info-center enable，關閉log日志。

4.劃分防火墻的接口區(qū)域，因為防火墻是接口分區(qū)域的，在之前的文章中已詳細講解防火墻的接口區(qū)域劃分，請興趣的可以參考：小白也能看的懂，網(wǎng)絡防火墻的入門篇

將G0/0/1劃分到外網(wǎng)連接接口，Untrsut。

使用zone untrust進入到untrust區(qū)域，然后使用add添加接口到untrust區(qū)域。

添加完成之后，查看配置，可以看到優(yōu)先級，默認的配置就是5，可以看到Untrust區(qū)域，已經(jīng)添加了一個接口是G0/0/1。

將G0/0/3和G0/0/4添加到Trust區(qū)域。

使用zone trust進入到trust區(qū)域，然后還是使用add添加接口到信任區(qū)域。

添加完成之后，查看Trust區(qū)域配置，可以看到默認的trust區(qū)域的優(yōu)先級是85，里面有一個G0/0/0是默認添加到Trust區(qū)域的，還有兩個接口是手動添加進來的。

5.DHCP配置

為3網(wǎng)段啟用DHCP功能，對于想詳細了解DHCP如何配置的，請參考：什么你還不會用命令行，去配置華為防火墻的DHCP服務？

ip pool dhcp1

gateway-list 192.168.10.1 192.168.3.1

network 192.168.3.0 mask 255.255.255.0

excluded-ip-address 192.168.3.200 192.168.3.254

lease unlimited

dns-list 114.114.114.114

6.配置接口IP地址，公司現(xiàn)在要有兩個網(wǎng)段，一個是192.168.3.0/24網(wǎng)段，一個是192.168.4.0/24網(wǎng)段。

外網(wǎng)口配置，untrust區(qū)域，接口配置：

interface GigabitEthernet0/0/1

undo shutdown

ip address 192.168.10.200 255.255.255.0

內(nèi)網(wǎng)口：trust區(qū)域，物理接口配置：

由于是內(nèi)網(wǎng)口，為了維護方便，直接將所有管理服務允許。

service-manage all permit--允許所有協(xié)議登錄

配置G0/0/3 IP地址。

interface GigabitEthernet0/0/3

undo shutdown

ip address 192.168.3.1 255.255.255.0

service-manage http permit

service-manage https permit

service-manage ping permit

service-manage ssh permit

service-manage snmp permit

service-manage telnet permit

service-manage netconf permit

dhcp select global--使用的全局DHCP功能。

G0/0/4接口啟用的是接口DHCP服務。

interface GigabitEthernet0/0/4

undo shutdown

ip address 192.168.4.1 255.255.255.0

dhcp select interface

dhcp server excluded-ip-address 192.168.4.2 192.168.4.20

dhcp server dns-list 218.2.135.1

7.配置NAT策略

使用Nat-Policy命令，進入到NAT策略配置中。因為我們這里，只有一個外網(wǎng)口，而且是默認將內(nèi)網(wǎng)口轉發(fā)出即可，可以配置easy-IP最簡單。將所有流量，都轉發(fā)到外網(wǎng)口，Untrust接口IP地址。

[USG6300-FW]nat-policy

[USG6300-FW-policy-nat]rule name trust-untrust---定義一下Nat策略的規(guī)則

[USG6300-FW-policy-nat-rule-trust-untrust]egress-interface GigabitEthernet 0/0/1-----定義外網(wǎng)口是G0/0/1接口，英[?i?ɡres]出口、外出

[USG6300-FW-policy-nat-rule-trust-untrust]action nat easy-ip---將內(nèi)網(wǎng)用戶的源地址轉換為外網(wǎng)接口的地址

[USG6300-FW-policy-nat-rule-trust-untrust]dis thi--配置完成之后，查看nat配置

2023-11-07 22:47:10.440+08:00

#

rule name trust-untrust

egress-interface GigabitEthernet0/0/1

action nat easy-ip

#

return

8.安全區(qū)域放行，在防火墻，一共有四個接口區(qū)域，untrust、trust、dmz、local，不同區(qū)域之前通信，都需要在在防火墻上設置安全策略，允許或禁止不同區(qū)域之間的流量訪問。

[USG6300-FW]security-policy---進入安全策略

[USG6300-FW-policy-security]rule name trust-untrust---規(guī)則名稱是trust流量去往untrst

[USG6300-FW-policy-security-rule-trust-untrust]source-zone trust---源區(qū)域是trust

[USG6300-FW-policy-security-rule-trust-untrust]destination-zone untrust---目的區(qū)域是untrust

[USG6300-FW-policy-security-rule-trust-untrust]source-address any--源地地址是任何IP地址

[USG6300-FW-policy-security-rule-trust-untrust]destination-zone any---目的區(qū)域，也是任何地址。

[USG6300-FW-policy-security-rule-trust-untrust]service any---訪問的服務也是任何服務

[USG6300-FW-policy-security-rule-trust-untrust]action permit---動作是允許訪問

[USG6300-FW-policy-security-rule-trust-untrust]quit---退出

[USG6300-FW-policy-security]dis thi---查看配置

2023-11-07 22:37:23.830+08:00

#

security-policy

rule name trust-untrust

source-zone trust

action permit

#

9.配置默認路由

ip route-static 0.0.0.0 0.0.0.0 192.168.10.1

此命令用于配置默認路由，將所有未知目的地的流量發(fā)送到指定的網(wǎng)關地址（192.168.10.1）。

10.這時如你電腦連接到G0/0/3口，會自動獲取一個IP地址，可以正常上網(wǎng)。

11、配置導出。

<USG6300-FW>display current-configuration

2023-11-07 22:55:50.970+08:00

!Software Version V500R001C60SPC300

#

sysname USG6300-FW

#

l2tp domain suffix-separator

#

undo info-center enable

#

authentication-profile name portal_authen_default

#

ipsec sha2 compatible enable

#

undo factory-configuration prohibit

#

undo telnet server enable

undo telnet ipv6 server enable

#

clock timezone Beijing add 08:00:00

#

firewall detect ftp

#

firewall defend action discard

#

log type traffic enable

log type syslog enable

log type policy enable

#

undo dataflow enable

#

undo sa force-detection enable

#

isp name"china mobile"set filename china-mobile.csv

isp name"china unicom"set filename china-unicom.csv

isp name"china telecom"set filename china-telecom.csv

isp name"china educationnet"set filename china-educationnet.csv

#

user-manage web-authentication security port 8887

password-policy

level high

user-manage single-sign-on ad

user-manage single-sign-on tsm

user-manage single-sign-on radius

user-manage auto-sync online-user

page-setting

user-manage security version tlsv1.1 tlsv1.2

#

firewall ids authentication type aes256

#

web-manager security version tlsv1.1 tlsv1.2

web-manager enable

web-manager security enable

#

firewall dataplane to manageplane application-apperceive default-action drop

#

dhcp enable

#

update schedule ips-sdb daily 23:51

update schedule av-sdb daily 23:51

update schedule sa-sdb daily 23:51

update schedule cnc daily 23:51

update schedule file-reputation daily 23:51

#

ip vpn-instance default

ipv4-family

#

time-range worktime

period-range 08:00:00 to 18:00:00 working-day

#

ike proposal default

encryption-algorithm aes-256 aes-192 aes-128

dh group14

authentication-algorithm sha2-512 sha2-384 sha2-256

authentication-method pre-share

integrity-algorithm hmac-sha2-256

prf hmac-sha2-256

#

web-auth-server default

port 50100

#

portal-access-profile name default

#

ip pool dhcp1

gateway-list 192.168.10.1 192.168.3.1

network 192.168.3.0 mask 255.255.255.0

excluded-ip-address 192.168.3.200 192.168.3.254

lease unlimited

dns-list 114.114.114.114

#

aaa

authentication-scheme default

authentication-scheme admin_local

authentication-scheme admin_radius_local

authentication-scheme admin_hwtacacs_local

authentication-scheme admin_ad_local

authentication-scheme admin_ldap_local

authentication-scheme admin_radius

authentication-scheme admin_hwtacacs

authentication-scheme admin_ad

authentication-scheme admin_ldap

authorization-scheme default

accounting-scheme default

domain default

service-type internetaccess ssl-vpn l2tp ike

internet-access mode password

reference user current-domain

manager-user audit-admin password cipher % %obQy~*k~^:Q9m28jiBtU'D&1sXlH&cLD4LRuBpM"=^77D&4' % %

service-type web terminal

level 15

manager-user api-admin password cipher % %Gx`}94O*X3tzPf&N~.t6OPhfHYp_LDQ{{7\

3m'MWZULPhiO % %

service-type api

level 15

manager-user adminpassword cipher % %yW9x%WZ

z"hm[>T=85R>fsE`hi%w5mvXG<ugJX0*Sc;2sEcf % %

service-type web terminal

level 15

role system-admin

role device-admin

role device-admin

monitor

role audit-admin

bind manager-user audit-admin role audit-admin

bind manager-user admin role system-admin

#

interface Vlanif1

dhcp select global

#

l2tp-group default-lns

#

interface GigabitEthernet0/0/0

undo shutdown

ip binding vpn-instance default

ip address 192.168.0.1 255.255.255.0

service-manage http permit

service-manage https permit

service-manage ping permit

#

interface GigabitEthernet0/0/1

undo shutdown

ip address 192.168.10.200 255.255.255.0

#

interface GigabitEthernet0/0/2

undo shutdown

#

interface GigabitEthernet0/0/3

undo shutdown

ip address 192.168.3.1 255.255.255.0

service-manage http permit

service-manage https permit

service-manage ping permit

service-manage ssh permit

service-manage snmp permit

service-manage telnet permit

service-manage netconf permit

dhcp select global

#

interface GigabitEthernet0/0/4

undo shutdown

ip address 192.168.4.1 255.255.255.0

dhcp select interface

dhcp server excluded-ip-address 192.168.4.2 192.168.4.20

dhcp server dns-list 218.2.135.1

#

interface GigabitEthernet0/0/5

undo shutdown

#

interface GigabitEthernet0/0/6

undo shutdown

#

interface GigabitEthernet0/0/7

portswitch

undo shutdown

port link-type access

#

interface Virtual-if0

#

interface Cellular0/0/0

#

interface NULL0

#

firewall zone local

set priority 100

#

firewall zone trust

set priority 85

add interface GigabitEthernet0/0/0

add interface GigabitEthernet0/0/3

add interface GigabitEthernet0/0/4

#

firewall zone untrust

set priority 5

add interface GigabitEthernet0/0/1

#

firewall zone dmz

set priority 50

#

api

#

ip route-static 0.0.0.0 0.0.0.0 192.168.10.1

#

undo ssh server compatible-ssh1x enable

#

user-interface con 0

authentication-mode aaa

user-interface vty 0 4

authentication-mode aaa

protocol inbound ssh

user-interface vty 16 20

#

pki realm default

undo crl auto-update enable

#

sa

#

location

#

nat address-group 3test 1

mode pat

#

multi-interface

mode proportion-of-weight

#

right-manager server-group

#

agile-network

#

device-classification

device-group pc

device-group mobile-terminal

device-group undefined-group

#

user-manage server-sync tsm

#

security-policy

rule name trust-untrust

source-zone trust

action permit

#

auth-policy

#

traffic-policy

#

policy-based-route

#

nat-policy

rule name trust-untrust

egress-interface GigabitEthernet0/0/1

action nat easy-ip

#

proxy-policy

#

quota-policy

#

pcp-policy

#

dns-transparent-policy

mode based-on-multi-interface

#

rightm-policy

#

sms

#

return

<USG6300-FW>