1. SW2交换机的配置[Huawei]vlan batch 10 20[Huawei]int GigabitEthernet 0/0/2[Huawei-GigabitEthernet0/0/2]port link-type access[Huawei-GigabitEthernet0/0/2]port default vlan 10[Huawei]interface GigabitEthernet 0/0/3[Huawei-GigabitEthernet0/0/3]port link-type access[Huawei-GigabitEthernet0/0/3]port default vlan 20[Huawei]int GigabitEthernet 0/0/1[Huawei-GigabitEthernet0/0/1]port link-type trunk[Huawei-GigabitEthernet0/0/1]port trunk allow-pass vlan 10 202. FW防火墙配置--接口与vlan配置[FW]interface GigabitEthernet1/0/1.1[FW-GigabitEthernet1/0/1.1]vlan-type dot1q 10[FW-GigabitEthernet1/0/1.1]ip address 172.16.1.254 24[FW]interface GigabitEthernet1/0/1.2[FW-GigabitEthernet1/0/1.2]vlan-type dot1q 20[FW-GigabitEthernet1/0/1.2]ip address 172.16.2.254 24[FW]interface GigabitEthernet1/0/0[FW-GigabitEthernet1/0/0]ip address 10.0.0.254 24[FW]interface GigabitEthernet1/0/2[FW-GigabitEthernet1/0/2]ip address 100.1.1.10 24--DHCP配置[FW]dhcp enable [FW]ip pool dhcp-a[FW-ip-pool-dhcp-a]network 172.16.1.0 mask 255.255.255.0[FW-ip-pool-dhcp-a]gateway-list 172.16.1.254[FW-ip-pool-dhcp-a]dns-list 10.0.0.30[FW-ip-pool-dhcp-a]static-bind ip-address 172.16.1.90 mac-address 5489-9833-7586[FW]ip pool dhcp-b [FW-ip-pool-dhcp-b]network 172.16.2.0 mask 255.255.255.0[FW-ip-pool-dhcp-b]gateway-list 172.16.2.254[FW]interface GigabitEthernet1/0/1.1[FW-GigabitEthernet1/0/1.1]dhcp select global[FW]interface GigabitEthernet1/0/1.2[FW-GigabitEthernet1/0/1.2]dhcp select global--安全区域配置[FW]firewall zone name Trust_A[FW-zone-Trust_A]set priority 70[FW-zone-Trust_A]add interface GigabitEthernet1/0/1.1[FW]firewall zone name Trust_B[FW-zone-Trust_B]set priority 80[FW-zone-Trust_B]add interface GigabitEthernet1/0/1.2[FW]firewall zone dmz[FW-zone-dmz]add interface GigabitEthernet1/0/0[FW]firewall zone untrust[FW-zone-untrust]add interface GigabitEthernet1/0/2--地址对象与地址组地址对象[FW]ip address-set OA_Server type object[FW-object-address-set-OA_Server]address 10.0.0.10 mask 32[FW]ip address-set Web_Server type object[FW-object-address-set-Web_Server]address 10.0.0.20 mask 32[FW]ip address-set DNS_Server type object[FW-object-address-set-DNS_Server]address 10.0.0.30 mask 32[FW]ip address-set Client1 type object[FW-object-address-set-Client1]address 172.16.1.90 mask 32[FW]ip address-set Client2 type object[FW-object-address-set-Client2]address 172.16.1.100 mask 32[FW]ip address-set Client3 type object[FW-object-address-set-Client3]address 172.16.1.1 172.16.1.89[FW-object-address-set-Client3]address 172.16.1.91 172.16.1.99[FW-object-address-set-Client3]address 172.16.1.101 172.16.1.254[FW]ip address-set PC1 type object[FW-object-address-set-PC1]address 172.16.2.100 mask 32[FW-object-address-set-PC1]ip address-set PC2 type object[FW]address 172.16.2.1 172.16.2.99[FW-object-address-set-PC2]address 172.16.2.101 172.16.2.254[FW]ip address-set Admin_PC type object[FW-object-address-set-Admin_PC]address 172.16.1.10 mask 32地址池[FW]ip address-set DMZ_Server type group[FW-group-address-set-DMZ_Server]add address-set OA_Server[FW-group-address-set-DMZ_Server]add address-set Web_Server[FW-group-address-set-DMZ_Server]add address-set DNS_Server[FW]ip address-set Trust_A_address type group[FW-group-address-set-Trust_A_address]add address-set Client1[FW-group-address-set-Trust_A_address]add address-set Client2[FW-group-address-set-Trust_A_address]add address-set Admin_PC[FW]ip address-set Trust_B_address type group[FW-group-address-set-Trust_B_address]add address-set PC1[FW-group-address-set-Trust_B_address]add address-set PC2--管理员配置[FW]telnet server enable[FW]user-interface vty 0 4[FW-ui-vty0-4]authentication-mode aaa[FW-ui-vty0-4]protocol inbound telnet[FW]interface GigabitEthernet1/0/1.1[FW-GigabitEthernet1/0/1.1]service-manage enable[FW-GigabitEthernet1/0/1.1]service-manage telnet permit[FW]aaa[FW-aaa]manager-user vtyadmin[FW-aaa-manager-user-vtyadmin]password cipher admin123[FW-aaa-manager-user-vtyadmin]service-type telnet[FW-aaa-manager-user-vtyadmin]level 3[FW-aaa]role service-admin[FW-aaa-role-service-admin]policy read-write[FW-aaa-role-service-admin]object read-write[FW-aaa-role-service-admin]object read-write[FW-aaa-role-service-admin]network read-write[FW-aaa-role-service-admin]dashboard none[FW-aaa-role-service-admin]monitor none[FW-aaa-role-service-admin]system none[FW-aaa]bind manager-user vtyadmin role service-admin--用户认证配置--认证域配置[FW] aaa[FW-aaa]security-policy[FW-policy-security]rule name Allow_Telnet[FW-policy-security-rule-Allow_Telnet]source-zone trust[FW-policy-security-rule-Allow_Telnet] destination-zone local[FW-policy-security-rule-Allow_Telnet]service telnet[FW-policy-security-rule-Allow_Telnet]action permit--安全策略配置--时间段配置[FW]time-range no_worktime[FW-time-range-no_worktime]period-range 00:00:00 to 08:00:00 working-day[FW-time-range-no_worktime]period-range 18:00:00 to 23:59:59 working-day[FW]time-range weekend[FW-time-range-weekend]period-range 00:00:00 to 23:59:59 off-day--自定义服务[FW]security-policy[FW-policy-security]rule name trust_dhcp[FW-policy-security-rule-trust_dhcp]source-zone trust[FW-policy-security-rule-trust_dhcp]destination-zone local[FW-policy-security-rule-trust_dhcp]action permit--安全策略[FW]security-policy[FW-policy-security]rule name policy_01[FW-policy-security-rule-policy_01]source-zone Trust_A[FW-policy-security-rule-policy_01]destination-zone local[FW-policy-security-rule-policy_01]source-address address-set Admin_PC[FW-policy-security-rule-policy_01]service telnet[FW-policy-security-rule-policy_01]action permit[FW-policy-security]rule name policy_02[FW-policy-security-rule-policy_02]source-zone Trust_A[FW-policy-security-rule-policy_02]source-zone Trust_B[FW-policy-security-rule-policy_02]destination-zone local[FW-policy-security-rule-policy_02]action permit[FW-policy-security]rule name policy_03[FW-policy-security-rule-policy_03]source-zone Trust_A[FW-policy-security-rule-policy_03]source-zone Trust_B[FW-policy-security-rule-policy_03]destination-zone dmz[FW-policy-security-rule-policy_03]source-address address-set Trust_A_address[FW-policy-security-rule-policy_03]source-address address-set Trust_B_address[FW-policy-security-rule-policy_03]destination-address address-set DNS_Server[FW-policy-security-rule-policy_03]service dns[FW-policy-security-rule-policy_03]action permit[FW-policy-security]rule name policy_04[FW-policy-security-rule-policy_04]source-zone Trust_A[FW-policy-security-rule-policy_04]destination-zone dmz[FW-policy-security-rule-policy_04]source-address address-set Client3[FW-policy-security-rule-policy_04]destination-address address-set DMZ_Server[FW-policy-security-rule-policy_04]action permit[FW-policy-security]rule name policy_05[FW-policy-security-rule-policy_05]source-zone Trust_A[FW-policy-security-rule-policy_05]destination-zone dmz[FW-policy-security-rule-policy_05]source-address address-set Client1[FW-policy-security-rule-policy_05]source-address address-set Client2[FW-policy-security-rule-policy_05]destination-address address-set OA_Server[FW-policy-security-rule-policy_05]destination-address address-set Web_Server[FW-policy-security-rule-policy_05]service https[FW-policy-security-rule-policy_05]action permit[FW-policy-security]rule name policy_06[FW-policy-security-rule-policy_06]source-zone Trust_A[FW-policy-security-rule-policy_06]destination-zone untrust[FW-policy-security-rule-policy_06]source-address address-set Client3[FW-policy-security-rule-policy_06]time-range no_worktime[FW-policy-security-rule-policy_06]action permit[FW-policy-security]rule name policy_07[FW-policy-security-rule-policy_07]source-zone Trust_A、[FW-policy-security-rule-policy_07]destination-zone untrust[FW-policy-security-rule-policy_07]source-address address-set Client1[FW-policy-security-rule-policy_07]action permit[FW-policy-security]rule name policy_08[FW-policy-security-rule-policy_08]source-zone Trust_B[FW-policy-security-rule-policy_08]destination-zone dmz[FW-policy-security-rule-policy_08]source-address address-set PC1[FW-policy-security-rule-policy_08]destination-address address-set Web_Server[FW-policy-security-rule-policy_08]action permit[FW-policy-security]rule name policy_09[FW-policy-security-rule-policy_09]source-zone Trust_B[FW-policy-security-rule-policy_09]destination-zone dmz[FW-policy-security-rule-policy_09]source-address address-set PC1[FW-policy-security-rule-policy_09]source-address address-set PC2[FW-policy-security-rule-policy_09]destination-address address-set OA_Server[FW-policy-security-rule-policy_09]service httpsver[FW-policy-security-rule-policy_09]action permit[FW-policy-security]rule name policy_10[FW-policy-security-rule-policy_10]source-zone Trust_B[FW-policy-security-rule-policy_10]destination-zone untrust[FW-policy-security-rule-policy_10]source-address address-set PC2[FW-policy-security-rule-policy_10]action permit[FW-policy-security]rule name policy_11[FW-policy-security-rule-policy_11]source-zone Trust_A[FW-policy-security-rule-policy_11]source-zone Trust_B[FW-policy-security-rule-policy_11]destination-zone dmz[FW-policy-security-rule-policy_11]source-address address-set Client1[FW-policy-security-rule-policy_11]source-address address-set Client2[FW-policy-security-rule-policy_11]source-address address-set PC1[FW-policy-security-rule-policy_11]source-address address-set PC2[FW-policy-security-rule-policy_11]destination-address address-set DMZ_Server[FW-policy-security-rule-policy_11]time-range weekend[FW-policy-security-rule-policy_11]action deny--默认路由与NAT[FW]ip route-static 0.0.0.0 0.0.0.0 100.1.1.1[FW]nat-policy [FW-policy-nat]rule name nat_to_internet[FW-policy-nat-rule-nat_to_internet]source-zone Trust_A[FW-policy-nat-rule-nat_to_internet]source-zone Trust_B[FW-policy-nat-rule-nat_to_internet]destination-zone untrust[FW-policy-nat-rule-nat_to_internet]action source-nat easy-ip