华为USG6000系列防火墙共享上网及组网基本配置

公司各楼层通过交换机汇聚到楼宇核心交换机，楼宇核心汇聚到总核心，然后通过USG6000安全策略访问路由器实现共享上网功能。

楼宇核心：划分楼层VLAN 配置网关 上一跳路由

sys

[huawei]sysname hexinjiaohuan

[hexinjiaohuan]vlan batch 10 20 30 40

[hexinjiaohuan]int vlan 10

[hexinjiaohuan-Vlanif10]ip address 192.168.10.254 24

[hexinjiaohuan]int vlan 20

[hexinjiaohuan-Vlanif20]ip address 192.168.20.254 24

[hexinjiaohuan]int vlan 30

[hexinjiaohuan-Vlanif30]ip address 192.168.30.254 24

[hexinjiaohuan]int vlan 40

[hexinjiaohuan-Vlanif40]ip address 192.168.60.1 30

[hexinjiaohuan]int g0/0/3

[hexinjiaohuan-GigabitEthernet0/0/3]port link-type access

[hexinjiaohuan-GigabitEthernet0/0/3]port default vlan 10

[hexinjiaohuan]int g0/0/1

[hexinjiaohuan-GigabitEthernet0/0/1]port link-type access

[hexinjiaohuan-GigabitEthernet0/0/1]port default vlan 20

[hexinjiaohuan]int g0/0/4

[hexinjiaohuan-GigabitEthernet0/0/4]port link-type access

[hexinjiaohuan-GigabitEthernet0/0/4]port default vlan 30

[hexinjiaohuan]int g0/0/2

[hexinjiaohuan-GigabitEthernet0/0/2]port link-type access

[hexinjiaohuan-GigabitEthernet0/0/2]port default vlan 40

[hexinjiaohuan]ip route-static 0.0.0.0 0.0.0.0 192.168.60.2

save

The current configuration will be written to the device.

Are you sure to continue?[Y/N]y

总核心交换机：配置上下访问端口和上下访问路由

sys

[Huawei]sysname zonghexin

[zonghexin]vlan batch 40 50

[zonghexin]int vlan 40

[zonghexin-Vlanif40]ip address 192.168.60.2 30

[zonghexin]int g0/0/2

[zonghexin-GigabitEthernet0/0/2]port link-type access

[zonghexin-GigabitEthernet0/0/2]port default vlan 40

[zonghexin]int vlan 50

[zonghexin-Vlanif50]ip address 192.100.50.2 30

[zonghexin]int g0/0/1

[zonghexin-GigabitEthernet0/0/1]port link-type access

[zonghexin-GigabitEthernet0/0/1]port default vlan 50

[zonghexin]ip route-static 192.168.10.0 255.255.255.0 192.168.60.1

[zonghexin]ip route-static 192.168.20.0 255.255.255.0 192.168.60.1

[zonghexin]ip route-static 192.168.30.0 255.255.255.0 192.168.60.1

[zonghexin]ip route-static 0.0.0.0 0.0.0.0 192.100.50.1

save

The current configuration will be written to the device.

Are you sure to continue?[Y/N]y

防火墙USG6000：配置访问策略 允许内网所有PC访问（路由器）地址

Username:admin

Password: （默认密码Admin@123）

The password needs to be changed. Change now? [Y/N]: y

Please enter old password: （默认密码Admin@123）

Please enter new password: 新密码

Please confirm new password: 新密码确认

[USG6000V1]int g1/0/1                                             //配置内网端口

[USG6000V1-GigabitEthernet1/0/1]ip address 192.100.50.1 255.255.255.252

[USG6000V1-GigabitEthernet1/0/1]service-manage http permit

[USG6000V1-GigabitEthernet1/0/1]service-manage https permit

[USG6000V1-GigabitEthernet1/0/1]service-manage ping permit

[USG6000V1]int g1/0/0                                            //配置端口

[USG6000V1-GigabitEthernet1/0/0]ip address 10.128.60.5 255.255.255.252

[USG6000V1]firewall zone trust                           //把端口加入到安全域

[USG6000V1-zone-trust]add interface GigabitEthernet 1/0/1

[USG6000V1]firewall zone untrust                       //把端口加入到非安全域

[USG6000V1-zone-untrust]add interface GigabitEthernet1/0/0

[USG6000V1]ip route-static 0.0.0.0 0.0.0.0 10.128.60.6 

[USG6000V1]ip route-static 192.168.10.0 255.255.255.0 192.100.50.2

[USG6000V1]ip route-static 192.168.20.0 255.255.255.0 192.100.50.2

[USG6000V1]ip route-static 192.168.30.0 255.255.255.0 192.100.50.2

[USG6000V1]security-policy  //访问策略

[USG6000V1-policy-security]rule name "trust to untrust"

[USG6000V1-policy-security-rule-trust to untrust]

[USG6000V1-policy-security-rule-trust to untrust]source-zone trust

[USG6000V1-policy-security-rule-trust to untrust]destination-zone untrust

[USG6000V1-policy-security-rule-trust to untrust] action permit

[USG6000V1-policy-security-rule-trust to untrust] rule name local

[USG6000V1-policy-security-rule-local]source-zone local

[USG6000V1-policy-security-rule-local]destination-zone trust

[USG6000V1-policy-security-rule-local]action permit

save

路由器：

[Huawei]int g0/0/1

[Huawei-GigabitEthernet0/0/1]ip address 10.128.60.6 255.255.255.252

[Huawei]ip route-static 0.0.0.0 0.0.0.0 10.128.60.5

save

pc>ping 10.128.60.6

Ping 10.128.60.6: 32 data bytes, Press Ctrl_C to break

From 10.128.60.6: bytes=32 seq=1 ttl=252 time=765 ms

From 10.128.60.6: bytes=32 seq=2 ttl=252 time=141 ms

From 10.128.60.6: bytes=32 seq=3 ttl=252 time=78 ms

From 10.128.60.6: bytes=32 seq=4 ttl=252 time=78 ms

From 10.128.60.6: bytes=32 seq=5 ttl=252 time=78 ms time=78 m

PC机测试通过基本功能实现。