华为USG3040防火墙.docxVIP

华为USG3040防火墙：## 配置USG3000的接口（注意升级之后用户名、密码已经更改）Username：adminPassword：Admin@123USG3000system-view[USG3000]firewall mode composite (设置防火墙工作模式为透明)此时提示需要重新启动防火墙This operation will restore the startup configuration file of the firewall to the factory-delivered configuration and restart the system. Are you sure[Y/N]?y（此处输入Y）Board rebooting ...## 重新启动登录后设置防火墙VPN连接IP地址[USG3000]firewall system-ip 10.77.208.5 24//本地VPN网关地址## 给各个接口划分相应的域[USG3000]firewall zone untrust[USG3000-zone-untrust]add interface GigabitEthernet 0/0[USG3000]firewall zone trust[USG3000-zone-untrust]add interface GigabitEthernet 0/1[USG3000-zone-untrust]quit## 配置默认路由[USG3000] ip route-static 0.0.0.0 0.0.0.0 10.77.208.1//本地路由器内口地址## 配置域间默认包过滤[USG3000] firewall packet-filter default permit interzonetrustuntrust[USG3000] firewall packet-filter default permitinterzonetrustlocal[USG3000] firewall packet-filter default permit interzonelocaluntrust## 设置防火墙登录口令[USG3000] user-interface vty 0 4[USG3000-ui-vty0-4] set authentication password simplebaichengguotuzyj注：此时可以检查VPN网关与省厅联想网御VPN网关的互通情况，确保互相之间可以ping通再进行下一步VPN配置。## 配置本地名字[USG3000]ike local-name baichengguotuzyj//本地VPN名称## 配置数据流[USG3000]acl number 3000[USG3000-acl-adv-3000]rule 5 permit ip source 10.77.208.00.0.15.255 destination 10.77.1.0 0.0.0.255//保护子网## 配置IKE proposal[USG3000]ike proposal 1[USG3000-ike-proposal-1]encryption-algorithm 3des-cbc[USG3000-ike-proposal-1]dh group2[USG3000-ike-proposal-1]authentication-algorithm md5## 配置IKE Peer[USG3000]ike peer baicheng1 //都用数字 1[USG3000-ike-peer-baicheng1]exchange-mode aggressive [USG3000-ike-peer-baicheng1]pre-shared-key guotuzyt//预共享密钥,全省一致[USG3000-ike-peer-baicheng1]remote-address 10.77.0.51//省厅VPN网关地址,都一致[USG3000-ike-peer-baicheng1]remote-name jilinguotuzyt//远程VPN名称,都一致[USG3000-ike-peer-baicheng1]ike-proposal 1//调用上面的ike proposal 1## 配置安全提议baichengTunnel+ESP+3DES+MD5[USG3000]ipsec proposal baicheng//都用数字 1[USG3000-ipsec-proposal-baicheng]transformesp[USG3000-ipsec-proposal-baicheng]encapsulation-mode tunnel[