华为USG6000：NAT与NAT Server设置案例

华为防火墙USG6000：NAT和NAT Server配置案例

• 网络拓扑图
• 通过WEB方式登录到防火墙
• 登录成功
• 配置防火墙使内网用户通过PAT方式上网
• 配置防火墙使得外网用户能访问企业DMZ区域的FTP服务器(双向nat)
• 内网用户与FTP-Server配置
• 配置代码
• 官方参考文档

网络拓扑图

通过WEB方式登录到防火墙

通过Web方式登录USG6000V：教程

登录成功

配置防火墙使内网用户通过PAT方式上网

防火墙上新建一个Nat Pool，供内网用户以NAT方式访问外网

配置Nat策略

配置策略，使得trust区域可以访问untrust区域

配置默认路由，指向R1

设置到达Nat Pool的静态路由，指向一个空接口，防止路由黑洞

配置防火墙使得外网用户能访问企业DMZ区域的FTP服务器(双向nat)

先配置服务器对外静态映射

防火墙上配置一个策略，使得untrust区域能访问DMZ区域

配置nat pool地址池，目的是作为外网用户访问内网服务器后nat的内网地址

配置一个nat策略。注意，这个nat策略和内网nat外网有所不同！！！

最后配置一个到达服务器对外地址的静态路由，防止路由黑洞

WEB界面配置完成

内网用户与FTP-Server配置

• PC1
• FTP-Server

配置代码

• FW

dis current-configuration 显示防火墙的运行配置 1

[USG6000V1]dis current-configuration 2020-12-02 05:10:12.380 !Software Version V500R005C10SPC300 # sysname FW l2tp domain suffix-separator @ # ipsec sha2 compatible enable # undo telnet server enable undo telnet ipv6 server enable # update schedule location-sdb weekly Sun 04:29 # firewall defend action discard # banner enable # user-manage web-authentication security port 8887 undo privacy-statement english undo privacy-statement chinese page-setting user-manage security version tlsv1.1 tlsv1.2 password-policy level high user-manage single-sign-on ad user-manage single-sign-on tsm user-manage single-sign-on radius user-manage auto-sync online-user # web-manager security version tlsv1.1 tlsv1.2 web-manager enable web-manager security enable # firewall dataplane to manageplane application-apperceive default-action drop # undo ips log merge enable # decoding uri-cache disable # feedback type threat-log enable feedback type pdns enable # update schedule ips-sdb daily 01:03 update schedule av-sdb daily 01:03 update schedule sa-sdb daily 01:03 update schedule cnc daily 01:03 update schedule file-reputation daily 01:03 # ip vpn-instance default ipv4-family # ip-link check enable ip-link name Linktest vpn-instance default destination 0.0.0.0/0.0.0.0 interface GigabitEthernet0/0/0 mode icmp next-hop 1 .1.1.2 # ip address-set FTP_Server type object address 0 10.1.2.100 mask 32 # time-range worktime period-range 08:00:00 to 18:00:00 working-day # ike proposal default encryption-algorithm aes-256 aes-192 aes-128 dh group14 authentication-algorithm sha2-512 sha2-384 sha2-256 authentication-method pre-share integrity-algorithm hmac-sha2-256 prf hmac-sha2-256 # aaa authentication-scheme default authentication-scheme admin_local authentication-scheme admin_radius_local authentication-scheme admin_hwtacacs_local authentication-scheme admin_ad_local authentication-scheme admin_ldap_local authentication-scheme admin_radius authentication-scheme admin_hwtacacs authentication-scheme admin_ad authorization-scheme default accounting-scheme default domain default service-type internetaccess ssl-vpn l2tp ike internet-access mode password reference user current-domain manager-user audit-admin password cipher @%@%Zrwy:l}UIX`r(g+IY`OVqb^q${UL$9Sr[@{C_yFj6fV)b^tq@%@% service-type web terminal level 15 manager-user api-admin password cipher @%@%RbIt"

关键词：华为USG6000：NAT与NAT Server设置案例