华为USG6000V防火墙学习
实验示例：
实验要求：
1、登录防火墙，修改初始密码并保存保存设置；
2、开启对应接口https服务功能，修改端口IP地址，使用浏览器登录防火墙的web控制台；
格式：https://端口IP地址:8443
3、开启对用接口ping服务功能，使用本地Windows PowerShell命令行ping通对应端口的IP地址；
4、制定防火墙策略，用本地Windows PowerShell命令行ping通对应端口的IP地址，使得可以和本地通信。
实验配置：
User interface con0 is available Please Press ENTER. Login authentication Username:admin Password: ************************************************************************* * Copyright (C) 2014-2018 Huawei Technologies Co., Ltd. * * All rights reserved. * * Without the owner's prior written consent, * * no decompiling or reverse-engineering shall be allowed. * ************************************************************************* <USG6000V1> <USG6000V1>system-view Enter system view, return user view with Ctrl+Z. [USG6000V1]interface GigabitEthernet 0/0/0 [USG6000V1-GigabitEthernet0/0/0]dis thi 2020-09-04 01:01:49.780 # interface GigabitEthernet0/0/0 undo shutdown ip binding vpn-instance default ip address 192.168.100.15 255.255.255.0 alias GE0/METH service-manage https permit service-manage ping permit # return [USG6000V1-GigabitEthernet0/0/0]
在端口内，允许ping功能开启。使得端口可以和本地通信。
开启https服务功能，使用浏览器登录防火墙后台。
制定防火墙策略，端口和本地正常通信
配置如下：
<USG6000V1>system-view Enter system view, return user view with Ctrl+Z. [USG6000V1]security-policy [USG6000V1-policy-security]rule name T2L_ping Sep 4 2020 01:13:35 USG6000V1 DS/4/DATASYNC_CFGCHANGE:OID 1.3.6.1.4.1.2011.5.25.191.3.1 configurations have been changed. The current change number is 6, the change loop count is 0, and the maximum number of records is 4095. [USG6000V1-policy-security-rule-T2L_ping]source-zone trust [USG6000V1-policy-security-rule-T2L_ping]destination-zone local [USG6000V1-policy-security-rule-T2L_ping] Sep 4 2020 01:13:55 USG6000V1 DS/4/DATASYNC_CFGCHANGE:OID 1.3.6.1.4.1.2011.5.25.191.3.1 configurations have been changed. The current change number is 8, the change loop count is 0, and the maximum number of records is 4095. [USG6000V1-policy-security-rule-T2L_ping]source-address 192.168.100.1 32 Sep 4 2020 01:14:25 USG6000V1 DS/4/DATASYNC_CFGCHANGE:OID 1.3.6.1.4.1.2011.5.25.191.3.1 configurations have been changed. The current change number is 9, the change loop count is 0, and the maximum number of records is 4095. [USG6000V1-policy-security-rule-T2L_ping]service icmp [USG6000V1-policy-security-rule-T2L_ping]dis thi 2020-09-04 01:15:02.670 # rule name T2L_ping source-zone trust destination-zone local source-address 192.168.100.1 mask 255.255.255.255 service icmp (not configure the action) # return [USG6000V1-policy-security-rule-T2L_ping] Sep 4 2020 01:15:05 USG6000V1 DS/4/DATASYNC_CFGCHANGE:OID 1.3.6.1.4.1.2011.5.25.191.3.1 configurations have been changed. The current change number is 10, the change loop count is 0, and the maximum number of records is 4095. [USG6000V1-policy-security-rule-T2L_ping]action permit [USG6000V1-policy-security-rule-T2L_ping]dis thi 2020-09-04 01:15:34.550 # rule name T2L_ping source-zone trust destination-zone local source-address 192.168.100.1 mask 255.255.255.255 service icmp action permit # return
制定防火墙出接口流量策略。
配置如下
[USG6000V1]security-policy [USG6000V1-policy-security]rule name L2T_ping [USG6000V1-policy-security-rule-L2T_ping]source-zone local [USG6000V1-policy-security-rule-L2T_ping]destination-zone trust [USG6000V1-policy-security-rule-L2T_ping]source-address 192.168.100.15 32 [USG6000V1-policy-security-rule-L2T_ping]destination-address 192.168.100.1 32 [USG6000V1-policy-security-rule-L2T_ping]service icmp [USG6000V1-policy-security-rule-L2T_ping]action permit [USG6000V1-policy-security-rule-L2T_ping]dis thi 2020-09-04 01:41:04.390 # rule name L2T_ping source-zone local destination-zone trust source-address 192.168.100.15 mask 255.255.255.255 destination-address 192.168.100.1 mask 255.255.255.255 service icmp action permit # return [USG6000V1-policy-security-rule-L2T_ping]
修改iCMP会话超时时间并查询。
