華爲防火牆基礎
一、防火牆的工作原理
1、防火牆的工作模式
1、路由模式：如果華爲防火牆連接網絡的接口配置IP地址，則認爲防火牆工作在路由模式下。
2、透明模式：如果華爲防火牆通過第二層對外連接（接口無IP地址），則防火牆工作在透明模式下。
3、混合模式：如果華爲防火牆既存在工作在路由模式的接口（接口具有IP地址） 又存在工作在透明模式的接口（接口無P地址） 則防火牆工作在混合模式下。
2、華爲防火牆的安全區域劃分
1、Trust區域：主要用於連接公司內部網絡，優先級爲85，安全等級較高。
2、 DMZ區域：在防火牆中通常定義爲需要對外提供服務的網絡，其安全性介於Trust區域和Untrust區域之 間優先級爲50，安全等級中等 。
3、Untrust區域：通常定義外部網絡，優先級功5，安全級別很低，Untrust區域表示不受信任的區域。
4、Local區域：通常定義防火牆本身，優先級爲100。防火牆除了轉發區域之間的報文之外還需要自身接收或發送流量。
5、其他區域：用戶自定義區域，默認最多自定義16個區域，自定義區域沒有默認優先級，所以需要手工指定。
3、防火牆Inbound和Outbound
入方向(Inbound)：數據由低級別的安全區域向高級別的安全區域傳輸的方向 。
出方向(Outbound)：數據由高級別的安全區域向低級別的安全區域傳輸的方向。
二、設備管理方式
1、Telnet管理方式及配置
1、配置初始管理密碼
Please Press ENTER.
An initial password is required for the first login via the console.
Set a password and keep it safe. Otherwise you will not be able to login via the
console.
Please configure the login password (8-16)
Enter Password: //8-16位密碼
Confirm Password:
Warning: The authentication mode was changed to password authentication and the
user level was changed to 15 on con0 at the first user login.
Warning: There is a risk on the user-interface which you login through. Please c
hange the configuration of the user-interface as soon as possible.
*************************************************************************
* Copyright (C) 2014-2015 Huawei Technologies Co., Ltd. *
* All rights reserved. *
* Without the owner's prior written consent, *
* no decompiling or reverse-engineering shall be allowed. *
*************************************************************************
2、配置防火牆的接口IP地址
[USG6000V1]int g0/0/0
[USG6000V1-GigabitEthernet0/0/0]ip add 192.168.0.1 24
Error: The address already exists.
[USG6000V1-GigabitEthernet0/0/0]un sh
Info: Interface GigabitEthernet0/0/0 is not shutdown.
[USG6000V1-GigabitEthernet0/0/0]int g1/0/0
[USG6000V1-GigabitEthernet1/0/0]ip add 192.168.1.1 24
[USG6000V1-GigabitEthernet1/0/0]un sh
Info: Interface GigabitEthernet1/0/0 is not shutdown.
[USG6000V1-GigabitEthernet1/0/0]int g1/0/1
[USG6000V1-GigabitEthernet1/0/1]ip add 192.168.2.1 24
[USG6000V1-GigabitEthernet1/0/1]un sh
Info: Interface GigabitEthernet1/0/1 is not shutdown.
[USG6000V1-GigabitEthernet1/0/1]int g1/0/2
[USG6000V1-GigabitEthernet1/0/2]ip add 192.168.3.1 24
[USG6000V1-GigabitEthernet1/0/2]un sh
Info: Interface GigabitEthernet1/0/2 is not shutdown.
[USG6000V1-GigabitEthernet1/0/2]quit
3、打開防火牆的Telnet功能
[USG6000V1]telnet server enable
Warning: Telnet is not a secure protocol, and it is recommended to use Stelnet.
4、配置防火牆允許遠程管理
[USG6000V1]int g0/0/0
[USG6000V1-GigabitEthernet0/0/0]service-manage enable //配置接口管理模式
[USG6000V1-GigabitEthernet0/0/0]service-manage telnet permit //允許Telnet
[USG6000V1-GigabitEthernet0/0/0]quit
5、將防火牆接口GigabitEthernet0/0/0加入安全區域
[USG6000V1]firewall zone trust
[USG6000V1-zone-trust]add int g0/0/0
Error: The interface has been added to trust security zone. //該接口默認在安全區域
[USG6000V1-zone-trust]quit
6、將接口加入安全區域
[USG6000V1]firewall zone trust //信任區域
[USG6000V1-zone-trust]add int g1/0/0
[USG6000V1-zone-trust]quit
[USG6000V1]firewall zone untrust //不信任區域
[USG6000V1-zone-untrust]add int g1/0/1
[USG6000V1-zone-untrust]quit
7、將防火牆配置域間包過濾，以保證網絡基本通信正常
[USG6000V1]security-policy
[USG6000V1-policy-security]rule name allow_telnet //配置名爲allow_telnet的規則
[USG6000V1-policy-security-rule-allow_telnet]source-zone trust //從trust
[USG6000V1-policy-security-rule-allow_telnet]destination-zone local //到達目的地local
[USG6000V1-policy-security-rule-allow_telnet]action permit //配置動作
[USG6000V1-policy-security-rule-allow_telnet]quit
[USG6000V1-policy-security]quit
8、配置認證模式及本地用戶信息
[USG6000V1]user-interface vty 0 4
[USG6000V1-ui-vty0-4]authen aaa //用戶接口的驗證方式爲AAA
Warning: The level of the user-interface(s) will be the default level of AAA use
rs, please check whether it is correct.
[USG6000V1-ui-vty0-4]protocol inbound telnet //允許telnet連接虛擬終端
[USG6000V1-ui-vty0-4]quit
[USG6000V1]aaa
[USG6000V1-aaa]manager-user demo // 配置本地用戶demo
[USG6000V1-aaa-manager-user-demo]password cipher demo@1234 // 配置密碼
Info: You are advised to config on man-machine mode.
[USG6000V1-aaa-manager-user-demo]service-type telnet // 配置服務類型telnet
Warning: The user access modes include Telnet or FTP, so security risks exist.
[USG6000V1-aaa-manager-user-demo]level 3 //配置用戶權限級別
[USG6000V1-aaa-manager-user-demo]quit
9、測試從telnet登錄防火牆，首次登錄需要修改密碼，然後再重新用新密碼連接
2、配置Web方式登錄設備
[USG6000V1]int g0/0/0
[USG6000V1-GigabitEthernet0/0/0]service-manage http permit //打開接口的http和https管理
[USG6000V1-GigabitEthernet0/0/0]service-manage https permit
[USG6000V1-GigabitEthernet0/0/0]quit
[USG6000V1]firewall zone trust
[USG6000V1-zone-trust]add int g0/0/0 //接口加入trust區域
Error: The interface has been added to trust security zone.
[USG6000V1-zone-trust]quit
[USG6000V1]security-policy // 配置安全策略
[USG6000V1-policy-security]rule name allow_web //配置名爲allow_web的規則
[USG6000V1-policy-security-rule-allow_web]source-zone trust
[USG6000V1-policy-security-rule-allow_web]destination-zone local //指定條件
[USG6000V1-policy-security-rule-allow_web]action permit // 指定動作
[USG6000V1-policy-security-rule-allow_web]quit
[USG6000V1-policy-security]quit
[USG6000V1]web-manager security enable // 開啓https功能
Info: Web security-server has been enabled.
[USG6000V1]aaa //配置aaa以及本地用戶
[USG6000V1-aaa]manager-user demo //以man-machine 的方式配置密碼， 在此模式下， 輸入的密碼屏幕上不可見
[USG6000V1-aaa-manager-user-demo]password
Enter Password:
Confirm Password:
[USG6000V1-aaa-manager-user-demo]service-type web //指定用戶類型
[USG6000V1-aaa-manager-user-demo]level 3 //指定權限級別
[USG6000V1-aaa-manager-user-demo]quit
[USG6000V1-aaa]quit
3、配置SSH方式登錄設備
[USG6000V1]int g0/0/0
[USG6000V1-GigabitEthernet0/0/0]service-manage enable
[USG6000V1-GigabitEthernet0/0/0]service-manage ssh permit
[USG6000V1-GigabitEthernet0/0/0]quit
[USG6000V1]firewall zone trust
[USG6000V1-zone-trust]add int g0/0/0
Error: The interface has been added to trust security zone.
[USG6000V1-zone-trust]quit
[USG6000V1]security-policy
[USG6000V1-policy-security]rule name allow_ssh
[USG6000V1-policy-security-rule-allow_ssh]source-zone trust
[USG6000V1-policy-security-rule-allow_ssh]destination-zone local
[USG6000V1-policy-security-rule-allow_ssh]action permit
[USG6000V1-policy-security-rule-allow_ssh]quit
[USG6000V1-policy-security]quit
[USG6000V1]rsa local-key-pair create //創建所需的密鑰對
The key name will be: USG6000V1_Host
The range of public key size is (512 ~ 2048).
NOTES: If the key modulus is greater than 512,
it will take a few minutes.
Input the bits in the modulus[default = 2048]:
Generating keys...
.+++++
........................++
....++++
...........++
[USG6000V1]user-manage vty 0 4
[USG6000Vl-ui-vty0-4]authentication-mode aaa
[USG6000Vl-ui-vty0-4]protocol inbound ssh
[USG6000Vl-ui-vty0-4Jquit
[USG6000Vl]ssh user test
[USG6000Vl]ssh user test authentication-type password
[USG6000Vl]ssh user test service-type stelnet //配置服務類型
[USG6000Vl]aaa
[USG6000Vl-aaa]rnanager-user test //創建本地用戶test
[USG6000Vl-aaa-manager-user-test]password cipher test@123 //指定密碼
[USG6000Vl-aaa-manager-user-test]service-type ssh
[USG6000Vl-aaa-manager-user-test]level 3
[USG6000Vl-aaa-manager-user-test]quit
[USG6000Vl-aaa]quit
[USG6000Vl]stelnet server enable //開啓SSH
4、配置安全策略
1、讓內部的pc1可以ping通外部的主機
[USG6000V1]security-policy
[USG6000V1-policy-security]rule name pc1toout
[USG6000V1-policy-security-rule-pc1toout]source 192.168.1.2 32
[USG6000V1-policy-security-rule-pc1toout]destination-zone untrust
[USG6000V1-policy-security-rule-pc1toout]service icmp
[USG6000V1-policy-security-rule-pc1toout]action permit
[USG6000V1-policy-security-rule-pc1toout]quit
[USG6000V1-policy-security]quit
查看會話
[USG6000V1]display firewall session table
Current Total Sessions : 1
netbios-data VPN: default --> default 192.168.0.2:138 --> 192.168.0.255:138
2、讓外部的主機可以訪問dmz中的ftp，http以及ping
[USG6000V1]security-policy
[USG6000V1-policy-security]rule name outtodmz
[USG6000V1-policy-security-rule-outtodmz]source-zone untrust
[USG6000V1-policy-security-rule-outtodmz]destination-address 192.168.3.2 32
[USG6000V1-policy-security-rule-outtodmz]service icmp
[USG6000V1-policy-security-rule-outtodmz]service http
[USG6000V1-policy-security-rule-outtodmz]service ftp
[USG6000V1-policy-security-rule-outtodmz]action permit
[USG6000V1-policy-security-rule-outtodmz]quit
[USG6000V1-policy-security]quit
三、NAT概述
1、NAT分類
1、NAT No- PAT：類似於Cisco的動態轉換，只轉換源IP地址不轉換端口，屬於多對多轉換。
2、NAPT（網絡地址和端口轉換） ：類似於Cisco 的PAT轉換，NAPT既轉換報文的源地址，又轉換源端口。轉換後的地址不能是外網接口IP地址，屬於多對多或多對一轉換。
3、出接口地址（Easy-IP）：和NAPT— 樣，既轉換源IP地址又轉換源端口。區別是出接口地址方式轉換後的地址只能是NAT設備外網接口所配置的IP地址，屬於多對—轉換。
4、Smart NAT (智能轉換）：通過預留一個公網地址進行NAPT轉換而其他的公網地址用來進行NAT No-PAT轉換。
5、三元組NAT：與源IP地址源端口和協議類型有關的—種轉換，將源IP地址和源端口轉換爲固定公網IP地址和端口。
2、NAT配置
1、NAT No- PAT方式的地址轉換
配置網絡參數及路由
[USG6000V1]int g1/0/1
[USG6000V1-GigabitEthernet1/0/1]ip add 192.168.1.254 24
[USG6000V1-GigabitEthernet1/0/1]un sh
Info: Interface GigabitEthernet1/0/1 is not shutdown.
[USG6000V1-GigabitEthernet1/0/1]int g1/0/0
[USG6000V1-GigabitEthernet1/0/0]ip add 202.96.1.1 24
[USG6000V1-GigabitEthernet1/0/0]un sh
Info: Interface GigabitEthernet1/0/0 is not shutdown.
[USG6000V1-GigabitEthernet1/0/0]quit
[USG6000V1]ip route-static 0.0.0.0 0.0.0.0 202.96.1.2
配置安全策略
[USG6000V1]firewall zone trust
[USG6000V1-zone-trust]add int g1/0/1 //內網接口加入trust區域
[USG6000V1-zone-trust]quit
[USG6000V1]firewall zone untrust
[USG6000V1-zone-untrust]add int g1/0/0 //外網接口加入untrust區域
[USG6000V1-zone-untrust]quit
[USG6000V1]security-policy //配置安全策略
[USG6000V1-policy-security]rule name sec_1 //配置第 一 個規則並指定規則名sec_1
[USG6000V1-policy-security-rule-sec_1]source-zone trust //指定條件
[USG6000V1-policy-security-rule-sec_1]destination-zone untrust //內網到外網
[USG6000V1-policy-security-rule-sec_1]source-address 192.168.1.0 24 //允許192.168.1.0網段通過
[USG6000V1-policy-security-rule-sec_1]action permit //指定動作
[USG6000V1-policy-security-rule-sec_1]quit
[USG6000V1-policy-security]quit
配置NAT地址組
[USG6000V1]nat address-group natgroup //配置NAT地址組，指定名稱natgroup
[USG6000V1-address-group-natgroup]section 0 202.96.1.10 202.96.1.11 //指定地址組的起始地址和結束地址
[USG6000V1-address-group-natgroup]mode no-pat local //指定地址組的模式爲no-pat
[USG6000V1-address-group-natgroup]quit
配置NAT策略
[USG6000V1]nat-policy //配置NAT策略
[USG6000V1-policy-nat]rule name natpolicy //配置名稱爲natpolicy的NAT規則
[USG6000V1-policy-nat-rule-natpolicy]source-address 192.168.1.0 24 //192.168.1.0網段
[USG6000V1-policy-nat-rule-natpolicy]source-zone trust //來自trust
[USG6000V1-policy-nat-rule-natpolicy]destination-zone untrust //去往untrust
[USG6000V1-policy-nat-rule-natpolicy]action nat address-group natgroup //滿足條件的數據包將依據地址組做NAT No-PAT方式的源地址轉換
[USG6000V1-policy-nat-rule-natpolicy]quit
[USG6000V1-policy-nat]quit
針對轉換後的全局地址（NAT地址組中的地址）配置黑洞路由
[USG6000V1]ip route-static 202.96.1.10 32 NULL 0 //將轉換後的地址所在的網絡指向空接口
[USG6000V1]ip route-static 202.96.1.11 32 NULL 0 //防火牆接收到的數據包匹配黑洞路由時將被丟棄
所以不會形成環路
2、出接口地址（easy-ip）方式的地址轉換
之前同上，配置NAT策略
[USG6000V1]nat-policy //配置NAT策略
[USG6000V1-policy-nat]rule name natpolicy //配置名稱爲natpolicy的NAT規則
[USG6000V1-policy-nat-rule-natpolicy]source-address 192.168.1.0 24 //192.168.1.0網段
[USG6000V1-policy-nat-rule-natpolicy]source-zone trust //來自trust
[USG6000V1-policy-nat-rule-natpolicy]destination-zone untrust //去往untrust
[USG6000V1-policy-nat-rule-natpolicy]action nat easy-ip //配置出接口方式
[USG6000V1-policy-nat-rule-natpolicy]quit
[USG6000V1-policy-nat]quit
3、NAT Server
配置網絡參數及路由
[USG6000V1]int g1/0/1
[USG6000V1-GigabitEthernet1/0/1]ip add 192.168.1.254 24
[USG6000V1-GigabitEthernet1/0/1]un sh
Info: Interface GigabitEthernet1/0/1 is not shutdown.
[USG6000V1-GigabitEthernet1/0/1]int g1/0/0
[USG6000V1-GigabitEthernet1/0/0]ip add 202.96.1.1 24
[USG6000V1-GigabitEthernet1/0/0]un sh
Info: Interface GigabitEthernet1/0/0 is not shutdown.
[USG6000V1-GigabitEthernet1/0/0]quit
[USG6000V1]ip route-static 0.0.0.0 0.0.0.0 202.96.1.2
配置安全策略
[USG6000V1]firewall zone trust
[USG6000V1-zone-trust]add int g1/0/1
[USG6000V1-zone-trust]quit
[USG6000V1]firewall zone untrust
[USG6000V1-zone-untrust]add int g1/0/0
[USG6000V1-zone-untrust]quit
[USG6000V1]security-policy
[USG6000V1-policy-security]rule name sec_1
[USG6000V1-policy-security-rule-sec_1]source-zone untrust
[USG6000V1-policy-security-rule-sec_1]destination-zone trust
[USG6000V1-policy-security-rule-sec_1]destination-address 192.168.1.0 24
[USG6000V1-policy-security-rule-sec_1]service permit
Error: The specified object permit does not exist.
[USG6000V1-policy-security-rule-sec_1]service ftp //配置條件爲ftp協議
[USG6000V1-policy-security-rule-sec_1]action permit
[USG6000V1-policy-security-rule-sec_1]quit
[USG6000V1-policy-security]quit
配詈FTP應用層檢測（默認已開啓）
[USG6000V1]firewall interzone trust untrust
[USG6000V1-interzone-trust-untrust]detect ftp
[USG6000V1-interzone-trust-untrust]quit
配置 NAT Server
[USG6000V1]nat server natserver_ftp protocol tcp global 202.96.10.10 21 inside
192.168.1.10 21 //外網用戶訪問202.96.10.10: 21瑞口時，將轉換地址和端口爲192.168.1.10:21發送到內網服務器
配置黑洞路由
[USG6000V1]ip route-static 202.96.10.10 32 NULL 0
查看名稱爲natpolicy的NAT策略
[USG6000V1]display nat-policy rule natpolicy
四、防火牆雙機熱備
雙機熱備配置
模式
1、熱備模式：同一時間只有一臺防火場轉發數據包，其他防火牆不轉發數據包，但是會同步會話表及Server-map表。
2、負載均衡模式：同一時間，多臺防火姍同時轉發數據，但每個防火牆又作爲其他防火牆的備用設備，即每個防火牆既是主用設備也是備用設備，防火牆之間同步會話表及Server-map表。
接口加入安全區域並配置安全策略
[FW1]firewall zone trust
[FW1-zone-trust]add int g1/0/2
[FW1-zone-trust]firewall zone dmz
[FW1-zone-dmz]add int g1/0/1
[FW1-zone-dmz]firewall zone untrust
[FW1-zone-untrust]add int g1/0/0
[FW1-zone-untrust]quit
[FW1]security-policy
[FW1-policy-security]rule name permit_head
[FW1-policy-security-rule-permit_head]source-zone local
[FW1-policy-security-rule-permit_head]destination-zone dmz
[FW1-policy-security-rule-permit_head]action permit
[FW1-policy-security-rule-permit_head]quit
[FW1-policy-security]rule name permit_trust_untrust
[FW1-policy-security-rule-permit_trust_untrust]source-zone trust
[FW1-policy-security-rule-permit_trust_untrust]destination-zone untrust
[FW1-policy-security-rule-permit_trust_untrust]action permit
[FW1-policy-security-rule-permit_trust_untrust]quit
[FW1-policy-security]quit
[FW2]security-policy
[FW2-policy-security]rule name permit_head
[FW2-policy-security-rule-permit_head]source-zone local
[FW2-policy-security-rule-permit_head]destination-zone dmz
[FW2-policy-security-rule-permit_head]action permit
[FW2-policy-security-rule-permit_head]quit
[FW2-policy-security]rule name permit_trust_untrust
[FW2-policy-security-rule-permit_trust_untrust]source-zone trust
[FW2-policy-security-rule-permit_trust_untrust]destination-zone untrust
[FW2-policy-security-rule-permit_trust_untrust]action permit
[FW2-policy-security-rule-permit_trust_untrust]quit
[FW2-policy-security]quit
配置VRRP備份組
[FW1]int g1/0/2
[FW1-GigabitEthernet1/0/2]vrrp vrid 1 virtual-ip 192.168.1.100 active //設置本端狀態
[FW1-GigabitEthernet1/0/2]quit
[FW1]int g1/0/0
[FW1-GigabitEthernet1/0/0]vrrp vrid 2 virtual-ip 10.1.1.100 active //設置本端狀態
[FW1-GigabitEthernet1/0/0]quit
[FW1]hrp interface GigabitEthernet 1/0/1 remote 172.16.1.2 //配置心跳接口
[FW1]hrp enable //啓動雙機熱備
HRP_M[FW1]hrp auto-sync //配置自動備份模式
[FW2]int g1/0/2
[FW2-GigabitEthernet1/0/2]vrrp vrid 1 virtual-ip 192.168.1.100 standby //設置對端狀態
[FW2-GigabitEthernet1/0/2]quit
[FW2]int g1/0/0
[FW2-GigabitEthernet1/0/0]vrrp vrid 2 virtual-ip 10.1.1.100 standby //設置對端狀態
[FW2-GigabitEthernet1/0/0]quit
[FW2]hrp interface GigabitEthernet 1/0/1 remote 172.16.1.1 //配置心跳接口
[FW2]hrp enable //啓用雙機熱備
HRP_S[FW2]hrp auto-sync //配置自動備份模式
查看雙機熱備的狀態信息
HRP_M[FW1]display hrp state
Role: active, peer: standby
Running priority: 45000, peer: 45000
Core state: normal, peer: normal
Backup channel usage: 0.00%
Stable time: 0 days, 0 hours, 0 minutes
Last state change information: 2020-03-25 7:14:52 HRP core state changed, old_s
tate = abnormal(standby), new_state = normal, local_priority = 45000, peer_prior
ity = 45000.
查看心跳接口狀態
HRP_M[FW1]disp
HRP_M[FW1]display hrp int
GigabitEthernet1/0/1 : running