华为5500&6000v防火墙配置命令简介

随笔一篇，如有错误欢迎留言指正
ensp版本：1.3.00.100

---

---

5500

---

命令

1.  [1/0/0] service-manage service permit ：接口视图下开启对应服务
2.  [SRG] firewall zone (name) trust / dmz / untrust / xxxx ：系统视图下进入对应安全区域视图

    firewall zone name xxxx ：自定义策略名字

3.  [trust / dmz / untrust / xxxx] add int g1/0/0 ：区域视图下将接口加入对应安全区域
4.  [SRG] policy interzone trust untrust outbound ：系统视图下选择 源区域、目的区域、方向 进行配置
5.  [SRG-policy-interzone-trust-untrust-outbound] policy 1 ：自定义规则序号（防火墙从上到下按照序号从小到大依次匹配规则）
6.  [SRG-policy-interzone-trust-untrust-outbound-1] policy source 192.168.1.0  0.0.0.255（反掩码）：添加源地址
7.  [SRG-policy-interzone-trust-untrust-outbound-1] policy destination 192.168.2.0  0.0.0.255（反掩码）：添加目的地址
8.  [SRG-policy-interzone-trust-untrust-outbound-1] action permit / deny：设置动作允许/拒绝
9.  [SRG] dis firewall session table (verbose) ：查看会话表五元组（协议、源地址、源端口、目的地址、目的端口）信息，加上“verbose”即查看详细信息

---

简例

要求：

• trust (PC1) ——> untrust (Server1) √
• trust (PC1) ——> untrust (PC2) ×
  

<SRG>sy
[SRG]undo info-center enable		#关闭消息中心
Info: Information center is disabled

#配置接口IP并加入相应的安全区域
[SRG] int g0/0/1
[SRG-GigabitEthernet0/0/1] ip add 192.168.1.254 24
[SRG-GigabitEthernet0/0/1] service-manage ping permit		#开启ping服务
[SRG-GigabitEthernet0/0/1] interface GigabitEthernet0/0/2
[SRG-GigabitEthernet0/0/2] ip address 192.168.2.254 24
[SRG-GigabitEthernet0/0/2] service-manage ping permit
[SRG-GigabitEthernet0/0/2] interface GigabitEthernet0/0/3
[SRG-GigabitEthernet0/0/3] ip add 192.168.3.254 24
[SRG-GigabitEthernet0/0/2] service-manage ping permit
[SRG-GigabitEthernet0/0/3] q

[SRG] firewall zone trust		#进入trust安全区域
[SRG-zone-trust] add int g0/0/1		#将接口加入安全区域
[SRG-zone-trust] q
[SRG] firewall zone untrust 
[SRG-zone-untrust] add int g0/0/2
[SRG-zone-untrust] q
[SRG] firewall zone untrust 
[SRG-zone-untrust] add int g0/0/3
[SRG-zone-untrust] q

#配置安全策略：允许源地址为192.168.1.0网段的报文通过，拒绝目的地址为192.168.3.0网段的报文通过
[SRG] policy interzone trust untrust outbound					#添加由trust到untrust区域出方向的规则
[SRG-policy-interzone-trust-untrust-outbound] policy 1			#添加规则1（按照规则序号从小到大依次执行）
[SRG-policy-interzone-trust-untrust-outbound-1] policy destination 192.168.3.0 0.0.0.255		#添加目的地址
[SRG-policy-interzone-trust-untrust-outbound-1] action deny		#设置动作拒绝

[SRG-policy-interzone-trust-untrust-outbound] policy 2			#添加规则2（按照规则序号从小到大依次执行）
[SRG-policy-interzone-trust-untrust-outbound-2] policy source 192.168.1.0 0.0.0.255		#添加源地址
[SRG-policy-interzone-trust-untrust-outbound-2] policy destination 192.168.2.0 0.0.0.255		#添加目的地址
[SRG-policy-interzone-trust-untrust-outbound-2] action permit	#设置动作允许
[SRG-policy-interzone-trust-untrust-outbound-2] q

#检查配置
[SRG-policy-interzone-trust-untrust-outbound] dis this

#
policy interzone trust untrust outbound
 policy 1 
  action deny 
  policy destination 192.168.3.0 0.0.0.255

 policy 2 
  action permit 
  policy source 192.168.1.0 0.0.0.255
  policy destination 192.168.2.0 0.0.0.255
#
return

#ping命令验证
<PC1>ping 192.168.2.1

Ping 192.168.2.1: 32 data bytes, Press Ctrl_C to break
From 192.168.2.1: bytes=32 seq=1 ttl=254 time=62 ms
From 192.168.2.1: bytes=32 seq=2 ttl=254 time=32 ms
From 192.168.2.1: bytes=32 seq=3 ttl=254 time=32 ms
From 192.168.2.1: bytes=32 seq=4 ttl=254 time=31 ms
From 192.168.2.1: bytes=32 seq=5 ttl=254 time=15 ms

--- 192.168.2.1 ping statistics ---
  5 packet(s) transmitted
  5 packet(s) received
  0.00% packet loss
  round-trip min/avg/max = 15/34/62 ms

<PC1>ping 192.168.3.1

Ping 192.168.3.1: 32 data bytes, Press Ctrl_C to break
Request timeout!
Request timeout!
Request timeout!
Request timeout!
Request timeout!

--- 192.168.3.1 ping statistics ---
  5 packet(s) transmitted
  0 packet(s) received
  100.00% packet loss

注意：华为5500防火墙安全策略的匹配是存在顺序之分的，依照从上到下逐条查找区域间存在的安全策略，如果报文命中了某一条策略，防火墙就会执行该策略的动作，并且不会再继续向下查找重复的部分，否则继续查找。所以配置策略时应遵循“先精细，后粗犷”的原则，先配置匹配范围较小，条件更精确的策略，然后再配置匹配范围大、条件宽泛的策略（和ACL匹配机制同理）。

---

6000V

命令

1.  [1/0/0] service-manage service permit ：接口视图下开启对应服务
2.  [USG6000V] firewall zone (name) trust / dmz / untrust / xxxx ：系统视图下进入对应安全区域视图

    firewall zone name xxxx ：自定义策略名字

3.  [trust / dmz / untrust / xxxx] add int g1/0/0 ：区域视图下将接口加入对应安全区域
4.  [USG6000V] security-policy ：进入安全策略视图
5.  [USG6000V-policy-security] rule name xxxx ：创建并命名规则
6.  [USG6000V-policy-security-rule-xxxx] source-zone trust / dmz / untrust / xxxx ：设置源区域
7.  [USG6000V-policy-security-rule-xxxx] destination-zone trust / dmz / untrust / xxxx ：设置目的区域
8.  [USG6000V-policy-security-rule-xxxx] source-address 192.168.1.0 0.0.0.255(反掩码) ：设置源地址
9.  [USG6000V-policy-security-rule-xxxx] destination-address 192.168.2.0 0.0.0.255(反掩码) ：设置目的地址
10.  [USG6000V-policy-security-rule-xxxx] action permit / deny ：设置动作允许 / 拒绝
11.  [USG6000V-policy-security] dis firewall session table (verbose) ：查看会话表五元组（协议、源地址、源端口、目的地址、目的端口）信息，加上“verbose”即查看详细信息

---

简例

要求：

• trust (PC1) ——> dmz √
• trust (PC1) ——> untrust √
• trust (PC2) ——> dmz ×
• trust (PC2) ——> untrust ×
• dmz ——> untrust ×
  

<