Appearance
shell
system-view
interface GigabitEthernet 0/0/5
undo ip address
portswitch
description To_Company_Network
quit
interface Eth-Trunk 1
portswitch
mode lacp-static
description To_H3C_Stack
quit
# 将物理口加入聚合组
interface GigabitEthernet 0/0/6
eth-trunk 1
quit
interface GigabitEthernet 0/0/7
eth-trunk 1
quit
vlan 30
quit
interface Vlanif 30
ip address 192.168.30.23 255.255.255.0
description Management_IP
quit
firewall zone untrust
add interface GigabitEthernet 0/0/5
quit
firewall zone trust
add interface Eth-Trunk 1
quit
interface Vlanif 30
service-manage ping permit
service-manage https permit
service-manage ssh permit
quit
security-policy
rule name internal_to_external
source-zone trust
destination-zone untrust
action permit
rule name external_to_internal
source-zone untrust
destination-zone trust
destination-address 192.168.30.0 24
action permit
quit
interface Eth-Trunk 1
portswitch
port link-type trunk
port trunk allow-pass vlan 30
quit
system-view
interface Vlanif 30
service-manage ping permit
service-manage https permit
quit
interface Eth-Trunk 1
port link-type trunk
# 这一行是关键：让不带标签的包默认进入 VLAN 30
port trunk pvid vlan 30
port trunk allow-pass vlan 30
quit[HUAWEI-10GE0/0/0]# 2. 开启自协商功能（VRP V600 版本中通常使用以下命令） [HUAWEI-10GE0/0/0]undo negotiation disable
中唐球团 防火墙
display current-configuration > 1784705271077.cfg
!Software Version V600R024C10SPC100
!Last configuration was updated at 2026-07-22 15:27:11+08:00 by admin123
!Last configuration was saved at 2026-07-22 15:27:39+08:00 by admin123
!ase VRPV800R006C00B016D0127-0.0.1
!ase_decryption_res VRPV800R006C00B016D0127-0.0.1
!grpc VRPV800R006C00B016D0127-0.0.1
!kms_feature --
!md_tlm VRPV800R006C00B016D0127-0.0.1
!telem VRPV800R006C00B016D0127-0.0.1
#
pki realm default
#
clock timezone Beijing add 08:00:00
#
sysname HUAWEI
#
undo ftp server source all-interface
undo ftp ipv6 server source all-interface
#
ssl policy default
pki-domain default
ssl minimum version tls1.2
cipher-suite exclude key-exchange rsa
cipher-suite exclude cipher mode cbc
cipher-suite exclude hmac sha1
diffie-hellman modulus 3072
ecdh group curve brainpool
signature algorithm-list ed25519 ed448 rsa-pss-pss-sha256 rsa-pss-pss-sha384 rsa-pss-pss-sha512 rsa-pss-rsae-sha256 rsa-pss-rsae-sha384 rsa-pss-rsae-sha512
#
firewall defend action alert
#
firewall fragment-bypass enable
#
firewall ipv6 fragment-bypass enable
#
authentication-profile name default_authen_profile
authentication-profile name dot1x_authen_profile
authentication-profile name dot1xmac_authen_profile
authentication-profile name mac_authen_profile
#
dns relay enable
#
dhcp enable
#
firewall log encrypt-algorithm aes256-gcm
#
hrp escape enable
#
undo firewall packet-filter from-local-zone enable
#
firewall feature-bypass bandwidth-policy enable level 2 priority 1
#
drop-profile default
#
ntp server source-interface all disable
ntp ipv6 server source-interface all disable
#
vlan batch 1 20 102 702 1000
#
arp learning on-different-segment disable
#
telnet ipv6 server disable
undo telnet server-source all-interface
undo telnet ipv6 server-source all-interface
#
diffserv domain default
#
ip vpn-instance _management_vpn_
ipv4-family
#
vlan 1
#
vlan 20
#
vlan 702
#
time-range worktime 08:00 to 18:00 working-day
#
aaa
authentication-scheme default
authentication-mode local
authorization-scheme default
authorization-mode local
accounting-scheme default
accounting-mode none
local-aaa-user password policy administrator
password complexity two-of-kinds
domain default
authentication-scheme default
accounting-scheme default
local-aaa-user user-name complexity-check disable
local-user admin123 password irreversible-cipher $1d$>YeJE]T5,I44,BQ'$Fy/a88z4ON0<D=;p7t7$eiuL>TQ5,Tg6vL"tX}&($
local-user admin123 password-force-change disable
local-user admin123 privilege level 3
local-user admin123 service-type telnet ssh http
#
free-rule-template name default_free_rule
#
dot1x-access-profile name dot1x_access_profile
#
license
#
warranty
#
interface Vlanif20
ip address 10.0.2.39 255.255.255.0
service-manage http permit
service-manage https permit
service-manage ping permit
service-manage ssh permit
#
interface Vlanif702
ip address 10.7.2.10 255.255.255.0
ip address 172.18.3.150 255.255.255.0 sub
ip address 192.168.85.150 255.255.255.0 sub
ip address 192.168.91.90 255.255.255.0 sub
service-manage http permit
service-manage https permit
service-manage ping permit
service-manage ssh permit
#
interface Eth-Trunk1
portswitch
description 接口汇聚10-11
port link-type trunk
port trunk pvid vlan 20
port trunk allow-pass vlan 20 102 702 1000
mode lacp-static
#
interface GE0/0/0
ip binding vpn-instance _management_vpn_
ip address 192.168.0.1 255.255.255.0
service-manage http permit
service-manage https permit
service-manage netconf permit
service-manage ping permit
service-manage snmp permit
service-manage ssh permit
service-manage telnet permit
#
interface GE0/0/1
portswitch
port default vlan 702
#
interface GE0/0/2
#
interface GE0/0/3
portswitch
port default vlan 702
#
interface GE0/0/4
portswitch
port default vlan 702
#
interface GE0/0/5
portswitch
port default vlan 702
#
interface GE0/0/6
portswitch
port default vlan 702
#
interface GE0/0/7
portswitch
port default vlan 702
#
interface GE0/0/8
#
interface GE0/0/9
#
interface 10GE0/0/0
eth-trunk 1
device transceiver 1000BASE-X
#
interface 10GE0/0/1
eth-trunk 1
#
interface Virtual-if0
#
interface NULL0
#
ip route-static 10.1.0.0 255.255.0.0 10.7.2.1
#
snmp-agent local-engineid 800007DB03E8A660774CBA
#
snmp-agent sys-info version v3
#
undo snmp-agent protocol source-status all-interface
undo snmp-agent protocol source-status ipv6 all-interface
#
undo snmp-agent proxy protocol source-status all-interface
undo snmp-agent proxy protocol source-status ipv6 all-interface
#
lldp enable
#
stelnet server enable
ssh server rsa-key min-length 3072
ssh user admin123
ssh user admin123 authentication-type password
ssh user admin123 service-type all
ssh user admin123 sftp-directory flash:
ssh server-source all-interface
undo ssh ipv6 server-source all-interface
ssh authorization-type default aaa
#
ssh server cipher aes256_gcm aes128_gcm aes256_ctr aes192_ctr aes128_ctr
ssh server hmac sha2_512 sha2_256 sha2_512_etm sha2_256_etm
ssh server key-exchange dh_group_exchange_sha256
#
ssh server publickey ecc rsa_sha2_256 rsa_sha2_512
#
ssh server dh-exchange min-len 3072
#
ssh client publickey ecc rsa_sha2_256 rsa_sha2_512
#
ssh client cipher aes256_gcm aes128_gcm aes256_ctr aes192_ctr aes128_ctr
ssh client hmac sha2_512 sha2_256 sha2_512_etm sha2_256_etm
ssh client key-exchange dh_group_exchange_sha256
#
header shell information "
****************************************************************
* Copyright (C) 2012-2025 *
* Huawei Technologies Co., Ltd. *
* All rights reserved. *
* Without the owner's prior written consent, *
* no decompiling or reverse-engineering shall be allowed. *
****************************************************************
"
#
user-interface maximum-vty 21
#
timestamp enable
#
user-interface con 0
#
user-interface vty 0 4
authentication-mode aaa
protocol inbound ssh
#
ztp domain-type registration-center domain register.naas.huawei.com port 10020
#
ike proposal default
encryption-algorithm aes-gcm-256 aes-gcm-192 aes-gcm-128
dh group14
authentication-algorithm sha2-512 sha2-384 sha2-256
authentication-method pre-share
integrity-algorithm hmac-sha2-256
prf hmac-sha2-256
#
firewall log service log-type syslog
#
security-telemetry
#
firewall zone local
set priority 100
#
firewall zone trust
set priority 85
add interface GE0/0/0
add interface GE0/0/1
add interface GE0/0/3
add interface GE0/0/8
add interface GE0/0/9
#
firewall zone untrust
set priority 5
add interface Eth-Trunk1
add interface Vlanif20
add interface Vlanif702
#
firewall zone dmz
set priority 50
#
firewall zone name Zone_5 id 4
set priority 55
add interface GE0/0/5
#
firewall zone name Zone_6 id 5
set priority 56
add interface GE0/0/6
#
firewall zone name Zone_7 id 6
set priority 57
add interface GE0/0/7
#
firewall zone name Zone_4 id 7
set priority 54
add interface GE0/0/4
#
sa
asset-filter
#
nat address-group 10.7.2.10 0
mode pat
section 0 10.7.2.10 10.7.2.10
#
nat address-group 172.18.3.150 1
mode pat
section 0 172.18.3.150 172.18.3.150
#
nat static-mapping
#
security-policy
rule name GuideAllowAccessToInternet
description 允许Trust、Local区的设备访问互联网
source-zone local
source-zone trust
destination-zone untrust
profile av default
profile ips default
action permit
rule name Trust_To_Untrust
source-zone trust
destination-zone untrust
action permit
rule name Untrust_To_Trust
source-zone untrust
destination-zone trust
action permit
rule name Trust_To_Trust
source-zone trust
destination-zone trust
action permit
rule name Allow_Mgmt_from_Vlan20
description 允许通过VLAN20访问防火墙管理
source-zone untrust
destination-zone local
service https
service icmp
service ssh
action permit
rule name Allow_Mgmt_from_Vlan1000
source-zone trust
destination-zone local
destination-address 10.0.2.39 mask 255.255.255.255
service https
service icmp
service ssh
action permit
rule name Zone5_to_Untrust
source-zone Zone_5
destination-zone untrust
action permit
rule name Untrust_to_Zone5
source-zone untrust
destination-zone Zone_5
action permit
rule name Zone6_to_Untrust
source-zone Zone_6
source-zone untrust
destination-zone Zone_6
destination-zone untrust
action permit
rule name Untrust_to_Zone6
source-zone untrust
destination-zone Zone_6
action permit
rule name Zone7_to_Untrust
source-zone Zone_7
destination-zone untrust
action permit
rule name Untrust_to_Zone7
source-zone untrust
destination-zone Zone_7
action permit
rule name Temp_Ping_Test
source-zone Zone_5
source-zone local
destination-zone Zone_5
destination-zone local
action permit
rule name Zone4_to_Untrust
source-zone Zone_4
destination-zone untrust
action permit
rule name Untrust_to_Zone4
source-zone untrust
destination-zone Zone_4
action permit
rule name Untrust_to_Untrust
source-zone untrust
destination-zone untrust
action permit
rule name 6to6
source-zone Zone_6
destination-zone Zone_6
action permit
rule name local_to_6
source-zone Zone_6
source-zone local
destination-zone Zone_6
destination-zone local
action permit
#
bandwidth-policy
#
policy-based-route
#
nat-policy
rule name GuideNatPolicy
source-zone trust
destination-zone untrust
action source-nat easy-ip
rule name test
source-zone untrust
destination-zone untrust
source-address 10.1.0.0 mask 255.255.0.0
destination-address 192.168.85.0 mask 255.255.255.0
destination-address 192.168.91.0 mask 255.255.255.0
action source-nat address-group 10.7.2.10
rule name test2
source-zone untrust
destination-zone untrust
source-address 10.1.0.0 mask 255.255.0.0
destination-address 172.18.3.0 mask 255.255.255.0
action source-nat address-group 172.18.3.150
#
dns-transparent-policy
mode based-on-multi-interface
#
auth-policy
#
multi-interface
#
identity-management
sso-radius
sso-tsm
#
web-manager enable port 8443
web-manager http forward enable
web-manager server-source -i GE0/0/0
web-manager server-source -i GE0/0/4
web-manager server-source -i Vlanif1
web-manager server-source -i Vlanif20
web-manager server-source -i Vlanif702
undo web-manager captcha enable
#
return![[Pasted image 20260722161818.png]]