防火墙设置内容.doc

https://219.145.108.250/ superman talent

1、

2、运行信息

3、

4、

5、

6、

7、

8、

9、

10、

11、

12、

13、

14、

15、

16、

17、

18、

19、

20、

21、

22、

23、

24、

25、

25、
helpmode chinese
system time set timezone +8
system devname set TopsecOS

network start
network reset

ID 7000 network attribute add name eth0
ID 7001 network attribute add name eth1
ID 7002 network attribute add name eth2
ID 7003 network attribute add name eth3
ID 7004 network attribute add name eth4
ID 7005 network attribute add name eth5
ID 7006 network attribute add name eth6
ID 7007 network attribute add name eth7
ID 7008 network attribute add name adsl
ID 7009 network attribute add name ipsec0
ID 7010 network attribute add name ipsec1
ID 7011 network attribute add name ipsec2
ID 7012 network attribute add name ipsec3
ID 7013 network attribute add name wan
ID 7014 network attribute add name lan
ID 7015 network attribute add name ssn
ID 7016 network attribute add name ppp
ID 7017 network attribute add name l2tp
ID 7018 network attribute add name pptp
ID 7019 network attribute add name bond0
ID 7020 network attribute add name bond1
ID 7021 network attribute add name bond2
ID 7022 network attribute add name bond3

network interface eth0 description 'intranet'
network interface eth0 mtu 1500
network interface eth0 ip add 192.168.1.254 mask 255.255.255.0 label 0
network interface eth0 speed auto
network interface eth0 duplex auto
network interface eth0 no switchport
network interface eth0 switchport mode access
network interface eth0 switchport trunk encapsulation dot1q
network interface eth0 switchport trunk native-vlan 1
network interface eth0 switchport access-vlan 1
network interface eth0 switchport trunk allowed-vlan 1-1000
network interface eth0 ha-metric 0
network interface eth0 attribute add eth0
network interface eth0 mss-adjust off
network interface eth0 mode-set ips
network interface eth0 reverse-path off
network interface eth0 gratuitous-arp-interval 0
network interface eth0 vsid 0
network interface eth0 vrid 0
network interface eth0 no shutdown

network interface eth1 description 'T0-彬县内网'
network interface eth1 mtu 1500
network interface eth1 ip add 10.61.120.254 mask 255.255.255.0 label 0
network interface eth1 speed auto
network interface eth1 duplex auto
network interface eth1 no switchport
network interface eth1 switchport mode access
network interface eth1 switchport trunk encapsulation dot1q
network interface eth1 switchport trunk native-vlan 1
network interface eth1 switchport access-vlan 1
network interface eth1 switchport trunk allowed-vlan 1-1000
network interface eth1 ha-metric 0
network interface eth1 attribute add eth1
network interface eth1 mss-adjust off
network interface eth1 mode-set ips
network interface eth1 reverse-path off
network interface eth1 gratuitous-arp-interval 0
network interface eth1 vsid 0
network interface eth1 vrid 0
network interface eth1 no shutdown

network interface eth2 description 'TO-市局'
network interface eth2 mtu 1500
network interface eth2 ip add 172.16.1.1 mask 255.255.255.0 label 0
network interface eth2 speed auto
network interface eth2 duplex auto
network interface eth2 no switchport
network interface eth2 switchport mode access
network interface eth2 switchport trunk encapsulation dot1q
network interface eth2 switchport trunk native-vlan 1
network interface eth2 switchport access-vlan 1
network interface eth2 switchport trunk allowed-vlan 1-1000
network interface eth2 ha-metric 0
network interface eth2 attribute add eth2
network interface eth2 mss-adjust off
network interface eth2 mode-set ips
network interface eth2 reverse-path off
network interface eth2 gratuitous-arp-interval 0
network interface eth2 vsid 0
network interface eth2 vrid 0
network interface eth2 no shutdown

network interface eth3 description 'TO-INTERNET'
network interface eth3 mtu 1500
network interface eth3 ip add 219.145.108.250 mask 255.255.255.252 label 0
network interface eth3 speed auto
network interface eth3 duplex auto
network interface eth3 no switchport
network interface eth3 switchport mode access
network interface eth3 switchport trunk encapsulation dot1q
network interface eth3 switchport trunk native-vlan 1
network interface eth3 switchport access-vlan 1
network interface eth3 switchport trunk allowed-vlan 1-1000
network interface eth3 ha-metric 0
network interface eth3 attribute add eth3
network interface eth3 mss-adjust off
network interface eth3 mode-set ips
network interface eth3 reverse-path off
network interface eth3 gratuitous-arp-interval 0
network interface eth3 vsid 0
network interface eth3 vrid 0
network interface eth3 no shutdown

network interface eth4 mtu 1500
network interface eth4 speed auto
network interface eth4 duplex auto
network interface eth4 no switchport
network interface eth4 switchport mode access
network interface eth4 switchport trunk encapsulation dot1q
network interface eth4 switchport trunk native-vlan 1
network interface eth4 switchport access-vlan 1
network interface eth4 switchport trunk allowed-vlan 1-1000
network interface eth4 ha-metric 0
network interface eth4 attribute add eth4
network interface eth4 mss-adjust off
network interface eth4 mode-set ips
network interface eth4 reverse-path off
network interface eth4 gratuitous-arp-interval 0
network interface eth4 vsid 0
network interface eth4 vrid 0
network interface eth4 no shutdown

network interface eth5 mtu 1500
network interface eth5 speed auto
network interface eth5 duplex auto
network interface eth5 no switchport
network interface eth5 switchport mode access
network interface eth5 switchport trunk encapsulation dot1q
network interface eth5 switchport trunk native-vlan 1
network interface eth5 switchport access-vlan 1
network interface eth5 switchport trunk allowed-vlan 1-1000
network interface eth5 ha-metric 0
network interface eth5 attribute add eth5
network interface eth5 mss-adjust off
network interface eth5 mode-set ips
network interface eth5 reverse-path off
network interface eth5 gratuitous-arp-interval 0
network interface eth5 vsid 0
network interface eth5 vrid 0
network interface eth5 no shutdown

network interface eth6 mtu 1500
network interface eth6 speed auto
network interface eth6 duplex auto
network interface eth6 no switchport
network interface eth6 switchport mode access
network interface eth6 switchport trunk encapsulation dot1q
network interface eth6 switchport trunk native-vlan 1
network interface eth6 switchport access-vlan 1
network interface eth6 switchport trunk allowed-vlan 1-1000
network interface eth6 ha-metric 0
network interface eth6 attribute add eth6
network interface eth6 mss-adjust off
network interface eth6 mode-set ips
network interface eth6 reverse-path off
network interface eth6 gratuitous-arp-interval 0
network interface eth6 vsid 0
network interface eth6 vrid 0
network interface eth6 no shutdown

network interface eth7 mtu 1500
network interface eth7 speed auto
network interface eth7 duplex auto
network interface eth7 no switchport
network interface eth7 switchport mode access
network interface eth7 switchport trunk encapsulation dot1q
network interface eth7 switchport trunk native-vlan 1
network interface eth7 switchport access-vlan 1
network interface eth7 switchport trunk allowed-vlan 1-1000
network interface eth7 ha-metric 0
network interface eth7 attribute add eth7
network interface eth7 mss-adjust off
network interface eth7 mode-set ips
network interface eth7 reverse-path off
network interface eth7 gratuitous-arp-interval 0
network interface eth7 vsid 0
network interface eth7 vrid 0
network interface eth7 no shutdown

network spantree set mode off

network cdp_neighbors set cdpthru on
network mpls handle off

network session timeout default
network session protocol default
network session icmp-redirect off
network session tcp-reset off
network session session-integrity on
network session only-syn-create on
network session packet-checksum off
network session syn-reset off
network session log-op delete on
network session log-op create off
network session log-op statistics off
network session quota tcp 0
network session quota udp 0
network session quota other 0
network session count off
network session count interval 5

network port-statistic off
network port-statistic set port1 80 port2 8080 port3 20 port4 21 port5 110 port6 25
network port-statistic set statistic 1800
network port-statistic set send 1

network arp limit off
network route add dst 192.168.1.0/24 gw 172.16.1.2 metric 1 id 102
network route add dst 10.61.112.0/24 gw 172.16.1.2 metric 1 id 103
network route add dst 10.0.0.0/8 gw 172.16.1.2 metric 1 id 101
network route add dst 0.0.0.0/0 gw 219.145.108.249 metric 1 id 100
network route intelligent-opt off

system authset setdefault
system authset authfail set maxnum 5
system authset usermaxlogin set maxnum 10
system authset maxonlineadm set maxnum 5
system authset managermaxlogin set maxnum 5
system authset faillock set time 60
system authset passwd-type set type cipher
system authset timeout set num 100
aaa config reset
aaa auth-map modify server cert mapping-type default status valid

system top-policy set-ip ip 0.0.0.0 notify-port 2010 policy-port 2010 type master local no
system top-policy set-ip ip 0.0.0.0 notify-port 2010 policy-port 2010 type slave local no

network mroute clean

network dns clear
network suitstate disable

ID 8002 define area add name area_eth0 attribute 'eth0 ' access on vsid 0
ID 8028 define area add name 外网 attribute 'eth3 ' access on vsid 0
ID 8029 define area add name 市局 attribute 'eth2 ' access on vsid 0
ID 8030 define area add name 彬县 attribute 'eth1 ' access on vsid 0

ID 8001 define range add name any ip1 0.0.0.0 ip2 255.255.255.255 vsid 0

qos config clean
dpi ar im-account set type msn account '' default-access deny
dpi ar im-account set type qq account '' default-access deny
dpi ar statistics type ip set srcip 0.0.0.0
dpi policy clean
ID 8020 dpi policy add net 0.0.0.0 mask 0.0.0.0 protocol tcp port 21 name ftp enable yes
ID 8021 dpi policy add net 0.0.0.0 mask 0.0.0.0 protocol tcp port 25 name smtp enable yes
ID 8022 dpi policy add net 0.0.0.0 mask 0.0.0.0 protocol udp port 69 name tftp enable yes
ID 8023 dpi policy add net 0.0.0.0 mask 0.0.0.0 protocol tcp port 80 name http enable yes
ID 8024 dpi policy add net 0.0.0.0 mask 0.0.0.0 protocol tcp port 110 name pop3 enable yes
ID 8025 dpi policy add net 0.0.0.0 mask 0.0.0.0 protocol tcp port 1521 name sqlnet enable yes
ID 8026 dpi policy add net 0.0.0.0 mask 0.0.0.0 protocol tcp port 23 name telnet enable yes

dpi max-connection set 60000
ID 8037 nat policy add srcarea '彬县 ' dstarea '外网 ' trans_src eth3 vsid 0

firewall enhancement switch overlap-exam off accelerate off

log log set ipaddr '192.168.1.253' port UDP:514 logtype syslog trans disable
log log log_key set
log log log_crypt disable
log log type_set add none
log log level_set 0

ids clean
ids attack clear
ids source-check off
ids white-list-check off
ids sessions set 3
ids list-expire-time set 30
ids packet set 0
ids max-source set 10000
ids max-destination set 5000
ids expire-time set 60
ids log on

pf service log off
ID 8010 pf service add name gui area area_eth0 addressname any
ID 8012 pf service add name update area area_eth0 addressname any
ID 8013 pf service add name ping area area_eth0 addressname any
ID 8014 pf service add name webui area area_eth0 addressname any
ID 8031 pf service add name webui area 外网 addressname any
ID 8032 pf service add name ping area 外网 addressname any
ID 8033 pf service add name webui area 市局 addressname any
ID 8034 pf service add name ping area 市局 addressname any
ID 8035 pf service add name webui area 彬县 addressname any
ID 8036 pf service add name ping area 彬县 addressname any
ID 8039 pf service add name telnet area 外网 addressname any

pf idbprule log off
pf idbprule drop-log off
pf rule set default action accept log no

pki clean
pki usb set uktype none
pki remoteauth disable proto ldap
pki remoteauth disable proto ocsp
pki cacert crltimer interval 86400

vpn ifbind clean

vpn localnet clear
vpn localnet add ip 112.107.105.32 mask 117.115.98.32
vpn localnet add ip 115.101.116.32 mask 117.107.116.121
vpn localnet add ip 112.101.32.110 mask 111.110.101.32
vpn localnet add ip 10.112.107.105 mask 32.114.101.109
vpn localnet add ip 111.116.101.97 mask 117.116.104.32
vpn localnet add ip 100.105.115.97 mask 98.108.101.32
vpn localnet add ip 112.114.111.116 mask 111.32.108.100
vpn localnet add ip 97.112.10.112 mask 107.105.32.114
vpn localnet add ip 101.109.111.116 mask 101.97.117.116
vpn localnet add ip 104.32.100.105 mask 115.97.98.108
vpn vdc timer set notify_timer 15 down_policy_timer 15 syn_tunnel_timer 20 resolv_name_timer 60
vpn vdc setup-rate set max 20
vpn device-priority set priority 0

vpn tunnel clean

vpn vrc clean
vpn vrc config set auth_mode local check_time 30 expired_time 120 timeout 60 dhcp-pool - dhcp-if - dns1 0.0.0.0 dns2 0.0.0.0 wins1 0.0.0.0 wins2 0.0.0.0 max_authnum 20 vip_control off fw-control off version-control off version standard
vpn vrc cert_access set acc off control off cn on mail off

vpn ddns clean

vpn vroute clean

vpn ipsec-config reset

ha clean
ha mode as
ha as-vrid 100
ha gratuitous-arp 90
ha hello-interval 1
ha rtosync ack disable
ha rtosync ack time-out 10
ha rtosync ack resend-count 2
ha rtconfig-sync disable
ha disable

network probeha stop

network pptp set port 1723
dpi global mail-warning subject ''
dpi global mail-warning body ''

system telnetd start
system httpd start
system monitord stop

system probe-time set 10
system probe-server-time set 3
system probe-package set 1

system webui idle-timeout 180
system webui ssl-verify-client no
system webui max-client 5
system netflow set ipaddr '4.3.2.1'
system netflow set port udp:9991
system netflow set transfer disable
system config implement