H3C 防火牆基本配置

防火牆基礎配置

# 修改設備名稱
sysname KL_HC_JT_FW_01

# 賬號密碼修改以及服務權限
local-user admin class manage
 password simple KLL!@#2021
 service-type ssh terminal https
 authorization-attribute user-role level-3
 authorization-attribute user-role network-admin
 authorization-attribute user-role network-operator
 password-control login-attempt 10 exceed lock-time 30

# 開啟遠程ssh，關閉telnet
ssh server enable
undo telnet server enable

# 遠程登錄身份認證
line vty 0 4
 authentication-mode scheme
 user-role network-admin

# 開啟web界面登錄
ip https enable
undo ip http enable

# 開啟lldp
lldp global enable 

# 配置管理口地址,如果出現故障可以直連管理口登錄防火牆
security-zone name Management
import interface GigabitEthernet 1/0/1
quit
# 配置地址
interface GigabitEthernet1/0/11
ip address 192.168.0.1 24
undo shutdown

# 防火牆安全策略配置
# 允許local到所有區域
security-policy ip   # IP策略
 rule 1 name local-any  # 序號1，名稱local-any
  action pass           # 動作pass允許通過
  logging enable        # 記錄日志
  source-zone Local     # 源安全區域
  destination-zone Any  # 目的安全區域
 rule 2 name trust-untrust  # 序號2
  action pass           # 動作pass允許通過
  logging enable        # 記錄日志
  source-zone trust     # 源安全區域
  destination-zone untrust  # 目的安全區域
# 移動安全區域順序
move rule rule-id before insert-rule-id # 移動安全策略到哪條安全策略之前

# 保存配置
save f