实验案例：远程管理防火墙(华为USG6600防火墙)

实验环境
随着业务的拓展，xxx公司对网络安全要求较高，管理员小王新购置了一台华为USG6600防火墙，已经连接在企业边界，并投入使用，为了方面后续对设备的管理，小王需要对防火墙开启Web管理及SSH管理功能。
需求描述
在Win7上可以通过浏览器监控及配置防火墙。
在Win7上可以通过CRT软件SSH连接防火墙，通过命令行配置防火墙。

配置使用Web方式管理
配置接口IP地址允许http和https连接
[F1]interface g1/0/0
[F1-GigabitEthernet1/0/0]ip address 172.16.1.4 16
[F1-GigabitEthernet1/0/0]undo shutdown
[F1-GigabitEthernet1/0/0]service-manage http permit
[F1-GigabitEthernet1/0/0]service-manage https permit
接口加入到trust区域
[F1]firewall zone trust
[F1-zone-trust]add interface g1/0/0
配置安全策略
[F1]security-policy
[F1-policy-security]rule name allow_web
[F1-policy-security-rule-allow_web]source-zone
[F1-policy-security-rule-allow_web]source-zone trust
[F1-policy-security-rule-allow_web]destination-zone local
[F1-policy-security-rule-allow_web]action permit
配置WEB身份验证的账户和密码
[F1]web-manager security enable
[F1]aaa
[F1-aaa]manager-user web
[F1-aaa-manager-user-web]password

Enter Password:

Confirm Password:
[F1-aaa-manager-user-web]service-type web
[F1-aaa-manager-user-web]level 15
客户端访问https://172.16.1.4:8443,







配置SSH远程管理
接口配置ssh
[F1]interface g1/0/0
[F1-GigabitEthernet1/0/0]service-manage enable
[F1-GigabitEthernet1/0/0]service-manage ssh permit
配置安全策略
[F1]security-policy
[F1-policy-security]rule name allow_ssh
[F1-policy-security-rule-allow_ssh]source-zone trust
[F1-policy-security-rule-allow_ssh]destination-zone local
[F1-policy-security-rule-allow_ssh]action permit
[F1]rsa local-key-pair create
The key name will be: F1_Host
The range of public key size is (512 ~ 2048).
NOTES: If the key modulus is greater than 512,
it will take a few minutes.
Input the bits in the modulus[default = 2048]:
Generating keys…
.+++++
…++
…++++
…++
配置SSH验证账户和密码
[F1]user-interface vty 0 4
[F1-ui-vty0-4]authentication-mode aaa
[F1-ui-vty0-4]protocol inbound ssh
[F1]ssh user test
[F1]ssh user test authentication-type password
[F1]ssh user test service-type stelnet
[F1]aaa
[F1-aaa-manager-user-test]password cipher ssh@1234
[F1-aaa-manager-user-test]service-type ssh
[F1-aaa-manager-user-test]level 15
[F1]stelnet server enable
验证