H3C SecPath 防火墙培训 ppt课件

H3C 防火墙产品培训（Comware V5）ISSUE 1.0日期：2011.08UnRegisteredn H3C Comware V5平台防火墙采用H3C 公司最新的硬件平台和体系架构，是H3C 公司面向大中型企业和运营商用户开发的新一代防火墙设备。

引入Un Re gi st er ed课程目标n V5 防火墙产品介绍n V5 防火墙基本配置管理n V5 防火墙转发方式介绍n V5 防火墙安全特性简介n V5 防火墙基本维护目录Un Re gi st er ed1个Console 接口、1个AUX 接口1个CF 卡接口，支持容量为256M 、512M 、1G 的CF 卡2个USB 接口（预留）2个HIM 扩展槽位电源接口Console/AUX系统指示灯4GE Combo （背面）CF 卡Un Re gi st er ed1个Console 接口12个千兆Combo （光电复合）接口1个USB 接口（预留）1个HIM 扩展槽位2个电源模块插槽电源模块槽位Console系统指示灯12GE Combo 口Un Re gi st er ed1个Console 接口，1个AUX 接口，1个管理口，业务板一：8个千兆电接口+4个Combo （光电复合）接口业务板二：2个万兆光接口1个风扇框1个CF 卡接口，支持容量为256M 、512M 、1G 2个电源模块插槽业务板Un Re gi st er ed1个Console 接口1个CF 卡接口，支持容量为256M 、512M 、1G 的CF 卡2个USB 接口（预留）2个10/100/1000BASE-T 电接口2个千兆Combo （光电复合）接口后插板10GE 接口(内部互联)CF 卡Console 口2GE 电口2GE Combo 口Un Re gi st er edFW Module ChassisH3C S9500H3C S7500EH3C S9500EH3C S12500SecBlade FW ModuleH3C S5800SecBlade II 与路由交换主机的配合H3C SR6600H3C SR8800SecBlade For S5800SecBlade For S7500E/S9500/S9500E/S12500SecBlade For SR6600/SR8800Un Re gi st er edSecBlade II FW 型号标识型号描述LST M1FW2A1H3C S12500防火墙业务板模块LSR M1FW2A1H3C S9500E 防火墙业务板LSB 1FW2A0H3C S9500防火墙业务板LSQ M1FWBSC0H3C S7500E 防火墙业务板模块LSW M1FW10H3C S5800系列-防火墙模块SPE -FWMH3C SR6600千兆防火墙业务板模块SPE -FWM-200IM -FW H3C SR8800防火墙业务处理板IM -FW-IIUn Re gi st er ed丰富的NAT 特性：NAT 、ALG领先的虚拟化技术：虚拟防火墙高可靠性：VRRP 、双机热备集中统一管理：Log 、SNMP 、FWM全面的安全防护：L2-L7安全防护Sec完善的VPN 功能：GRE 、L2TP 、IPSec 良好的易用性：CLI 、Web先进的硬件架构：多核多线程Comware V5 FW 功能特点Un Re gi st er edn V5 防火墙产品介绍n V5 防火墙基本配置管理n V5 防火墙转发方式介绍n V5 防火墙安全特性简介n V5 防火墙基本维护目录Un Re gi st er edCLI 与Web 管理方式的选择lComware V5防火墙集成强大的WEB 管理功能，大部分配置都能通过WEB 完成，推荐使用WEB 方式进行配置lComware V5防火墙同时也支持命令行管理，但很多安全特性不支持在命令行方式下配置。

H3C SecPath F100系列防火墙配置教程初始化配置〈H3C〉system-view开启防火墙功能[H3C]firewall packet-filter enable[H3C]firewall packet-filter default permit分配端口区域[H3C] firewall zone untrust[H3C-zone-trust] add interface GigabitEthernet0/0[H3C] firewall zone trust[H3C-zone-trust] add interface GigabitEthernet0/1工作模式firewall mode transparent 透明传输firewall mode route 路由模式http 服务器使能HTTP 服务器 undo ip http shutdown关闭HTTP 服务器 ip http shutdown添加WEB用户[H3C] local-user admin[H3C-luser-admin] password simple admin[H3C-luser-admin] service-type telnet[H3C-luser-admin] level 3开启防范功能firewall defend all 打开所有防范切换为中文模式 language-mode chinese设置防火墙的名称 sysname sysname配置防火墙系统IP 地址 firewall system-ip system-ip-address [ address-mask ] 设置标准时间 clock datetime time date设置所在的时区 clock timezone time-zone-name { add | minus } time取消时区设置 undo clock timezone配置切换用户级别的口令 super password [ level user-level ] { simple | cipher } password取消配置的口令 undo super password [ level user-level ]缺缺省情况下，若不指定级别，则设置的为切换到3 级的密码。

H3C SecPath F100系列防火墙配置教程初始化配置〈H3C〉system-view开启防火墙功能[H3C]firewall packet-filter enable[H3C]firewall packet-filter default permit分配端口区域[H3C] firewall zone untrust[H3C-zone-trust] add interface GigabitEthernet0/0[H3C] firewall zone trust[H3C-zone-trust] add interface GigabitEthernet0/1工作模式firewall mode transparent 透明传输firewall mode route 路由模式http 服务器使能HTTP 服务器 undo ip http shutdown关闭HTTP 服务器 ip http shutdown添加WEB用户[H3C] local-user admin[H3C-luser-admin] password simple admin[H3C-luser-admin] service-type telnet[H3C-luser-admin] level 3开启防范功能firewall defend all 打开所有防范切换为中文模式 language-mode chinese设置防火墙的名称 sysname sysname配置防火墙系统IP 地址 firewall system-ip system-ip-address [ address-mask ] 设置标准时间 clock datetime time date设置所在的时区 clock timezone time-zone-name { add | minus } time取消时区设置 undo clock timezone配置切换用户级别的口令 super password [ level user-level ] { simple | cipher } password取消配置的口令 undo super password [ level user-level ]缺缺省情况下，若不指定级别，则设置的为切换到3 级的密码。

H3C SecPath F100系列防火墙配置教程初始化配置〈H3C〉system-view开启防火墙功能[H3C]firewall packet-filter enable[H3C]firewall packet-filter default permit分配端口区域[H3C] firewall zone untrust[H3C-zone-trust] add interface GigabitEthernet0/0[H3C] firewall zone trust[H3C-zone-trust] add interface GigabitEthernet0/1工作模式firewall mode transparent 透明传输firewall mode route 路由模式http 服务器使能HTTP 服务器 undo ip http shutdown关闭HTTP 服务器 ip http shutdown添加WEB用户[H3C] local-user admin[H3C-luser-admin] password simple admin[H3C-luser-admin] service-type telnet[H3C-luser-admin] level 3开启防范功能firewall defend all 打开所有防范切换为中文模式 language-mode chinese设置防火墙的名称 sysname sysname配置防火墙系统IP 地址 firewall system-ip system-ip-address [ address-mask ] 设置标准时间 clock datetime time date设置所在的时区 clock timezone time-zone-name { add | minus } time取消时区设置 undo clock timezone配置切换用户级别的口令 super password [ level user-level ] { simple | cipher } password取消配置的口令 undo super password [ level user-level ]缺缺省情况下，若不指定级别，则设置的为切换到3 级的密码。

目录1路由设置 ············································································································································ 1-11.1 概述 ··················································································································································· 1-11.2 配置静态路由····································································································································· 1-11.3 查看激活路由表 ································································································································· 1-21.4 静态路由典型配置举例 ······················································································································ 1-31.5 注意事项············································································································································ 1-61 路由设置•本章所指的路由器代表了一般意义下的路由器，以及运行了路由协议的三层交换机。

目录1 简介...................................................................................................................................................1-11.1 分册简介............................................................................................................................................1-12 业务特性明晰.....................................................................................................................................2-12.1 概述...................................................................................................................................................2-12.2 特性功能索引.....................................................................................................................................2-12.3 特性功能明晰.....................................................................................................................................2-22.3.1 防火墙功能Web配置分册........................................................................................................2-22.3.2 SSL VPN功能Web配置分册...................................................................................................2-82.3.3 安全分册.................................................................................................................................2-92.3.4 接入分册...............................................................................................................................2-102.3.5 IP业务分册............................................................................................................................2-102.3.6 IP路由分册............................................................................................................................2-112.3.7 系统分册...............................................................................................................................2-112.3.8 VPN分册...............................................................................................................................2-132.3.9 IP组播分册............................................................................................................................2-131 简介z本手册当前适用于H3C SecPath F1000-E（F3166）、F1000-S-EI（E5114）及SecBlade防火墙插卡（F3166）产品。