华为USG防火墙NAT

拓扑:

wKioL1TDGabSTYIzAAETLffhCNI579.jpg

基本配参照华为防火墙USG基本配置(http://692344.blog.51cto.com/682344/1607629)

下面只给出客户端和服务器端配置:

wKiom1TDGVjRExsXAAFgoGJIYo8904.jpg

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

wKioL1TDGmHgqv53AAFmUj2gK50657.jpg

wKiom1TDGd_TC2LMAAF6Xe8f2pE273.jpg

wKioL1TDGrmwuU_OAAIP31UVTnA376.jpg

wKiom1TDGeDRgNZEAAEWawOOwU8427.jpg

防火墙配置:

  策略配置:

wKiom1TDGyLRjTs3AADTP5ZPNrw656.jpg

 

监控FTP配置(FTP是动态协议):

wKioL1TDHC_D3NulAAAyjAONtZA934.jpg

测试:

wKiom1TDG6Oi0FcuAAINyLZOwTc023.jpg

wKioL1TDHH3Aa6jtAAFI5CMxDTo564.jpg

 

 ----------------------------------

如果FTP使用特殊端口要配置如下:

acl number 2001
 rule 5 permit source 192.168.1.100 0

port-mapping ftp port 2121 acl 2001

ip service-set newftp type object
 service 0 protocol tcp description 2121

firewall interzone dmz untrust
 detect ftp
policy interzone dmz untrust inbound
 policy 0
  action permit
  policy service service-set http
  policy service service-set newftp
  policy destination 192.168.1.100 0

 

你可能感兴趣的:(防火墙,华为,USG)