dis cu
16:26:33  2010/12/30
#
 sysname USG2100
#
  enable
#
 firewall packet-filter default permit interzone local trust direction inbound
 firewall packet-filter default permit interzone local trust direction outbound
 firewall packet-filter default permit interzone local untrust direction inbound
 firewall packet-filter default permit interzone local untrust direction outbound
 firewall packet-filter default permit interzone trust untrust direction inbound
 firewall packet-filter default permit interzone trust untrust direction outbound
#
 dialer-rule 1 acl 2000
#
 vlan batch 1
#
 firewall session link-state check
#
#
 dns proxy enable
#
 web-manager enable
#
 l2fwdfast enable                        
#
acl number 2000
 rule 5 permit source address-set intranet
#
acl number 3000
 rule 5 permit ip source 10.134.0.0 0.0.0.255 destination 10.1.230.0 0.0.0.255
 rule 10 permit ip source 10.134.1.0 0.0.0.255 destination 10.1.230.0 0.0.0.255
 rule 15 permit ip source 10.1.230.0 0.0.0.255 destination 10.134.0.0 0.0.0.255
 rule 20 permit ip source 10.1.230.0 0.0.0.255 destination 10.134.1.0 0.0.0.255
#
ike proposal 1
 encryption-algorithm aes-cbc
 dh group2
 authentication-algorithm md5
 sa duration 3600
 sa reauth duration 3600
#
ike peer beijing
 exchange-mode aggressive
 pre-shared-key 58382000
 ike-proposal 1
 undo version 2
 remote-address 219.141.230.212          
#
ipsec proposal prop21121332815
 esp encryption-algorithm aes
#
ipsec policy beijing 10 isakmp
 security acl 3000
 ike-peer beijing
 proposal prop21121332815
 local-address 124.234.239.182
 sa duration traffic-based 1843200
 sa duration time-based 3600
#
interface Dialer0
 link-protocol ppp
 ppp pap local-user n0431zzf30312345 password simple 123456
 ip address ppp-negotiate
 dialer user pppoe
 dialer-group 1
 dialer bundle 1
 ipsec policy beijing
#
interface Vlanif1
 ip address 10.134.0.1 255.255.255.0     
 dhcp select interface
 dhcp server dns-list 10.1.230.1
#
interface Cellular5/0/0
 link-protocol ppp
#
interface Ethernet0/0/0
 pppoe-client dial-bundle-number 1
#
interface Ethernet1/0/0
 portswitch
 port link-type access
#
interface Ethernet1/0/1
 portswitch
 port link-type access
#
interface Ethernet1/0/2
 portswitch
 port link-type access
#
interface Ethernet1/0/3
 portswitch                              
 port link-type access
#
interface Ethernet1/0/4
 portswitch
 port link-type access
#
interface Ethernet1/0/5
 portswitch
 port link-type access
#
interface Ethernet1/0/6
 portswitch
 port link-type access
#
interface Ethernet1/0/7
 portswitch
 port link-type access
#
interface Virtual-Template1
 ppp authentication-mode pap
 ip address 10.134.1.1 255.255.255.0
 remote address pool 1
#                                        
interface NULL0
#
firewall zone local
 set priority 100
#
firewall zone trust
 set priority 85
 add interface Vlanif1
 add interface Virtual-Template1
#
firewall zone untrust
 set priority 5
 add interface Ethernet0/0/0
 add interface Dialer0
#
firewall zone dmz
 set priority 50
#
-group 1
 undo tunnel authentication
 allow virtual-template 1
#
aaa                                      
 local-user root password simple root@123
 local-user root service-type ppp
 local-user admin password cipher ]MQ;4\]B+4Z,YWX*NZ55OA!!
 local-user admin service-type web terminal telnet
 local-user admin level 3
 ip pool 1 10.134.1.1 10.134.1.100
 #
 authentication-scheme default
 #
 authorization-scheme default
 #
 accounting-scheme default
 #
 domain default
 domain dot1x
 #
#
nqa-jitter tag-version 1

#
 ip route-static 0.0.0.0 0.0.0.0 Dialer0
 ip route-static 10.1.230.0 255.255.255.0 Dialer0
 ip route-static 10.134.1.0 255.255.255.0 Virtual-Template1
#
 banner enable
#
user-interface con 0
user-interface tty 2
 authentication-mode none
 modem both
user-interface vty 0 4
 authentication-mode aaa
#
ip address-set intranet type object
 address 0 10.134.0.0 mask 23
#
ip address-set internet type object
 address 0 range 1.0.0.1 9.255.255.255
 address 1 range 11.0.0.1 223.255.255.255
#
 slb
#
cwmp
#
right-manager server-group
#                                        
nat-policy interzone trust untrust outbound
 policy 0
 action source-nat
 policy source address-set intranet
 policy destination address-set internet
 easy-ip Dialer0
#
return