华为防火墙的基本配置

配置基本的IP地址
[FW1-GigabitEthernet1/0/0]ip add 10.1.2.1 24
[FW1-GigabitEthernet1/0/6]ip add 20.1.1.1 24
[Internet-GigabitEthernet0/0/1]ip address 20.1.1.2 24
在接口上开启ping功能后，并将接口加入相关zone,PC可以ping通与防火墙相连的接口
[FW1-GigabitEthernet1/0/0]service-manage enable
[FW1-GigabitEthernet1/0/0]service-manage ping permit
[FW1]firewall zone trust
[FW1-zone-trust]add interface GigabitEthernet 1/0/0

配置untrust区域
[FW1]firewall zone untrust
[FW1-zone-untrust]add interface GigabitEthernet 1/0/6
配置trust和untrust之间的转发策略(配置顺序很重要)
[FW1]security-policy
[FW1-policy-security]rule name deny_internet
[FW1-policy-security-rule-deny_internet]source-zone trust
[FW1-policy-security-rule-deny_internet]source-address 10.1.2.254 0.0.0.0
[FW1-policy-security-rule-deny_internet]destination-zone untrust
[FW1-policy-security-rule-deny_internet]destination-address any
[FW1-policy-security-rule-deny_internet]action deny
[FW1-policy-security]rule name policy_trust_untrust
[FW1-policy-security-rule-policy_trust_untrust]source-zone trust
[FW1-policy-security-rule-policy_trust_untrust]source-address 10.1.2.0 0.0.0.255
[FW1-policy-security-rule-policy_trust_untrust]destination-zone untrust
[FW1-policy-security-rule-policy_trust_untrust]destination-address any
[FW1-policy-security-rule-policy_trust_untrust]action permit
配置NAT策略（easy-ip）
[FW1-policy-nat]rule name to_internet
[FW1-policy-nat-rule-to_internet]destination-zone untrust
[FW1-policy-nat-rule-to_internet]source-zone trust
[FW1-policy-nat-rule-to_internet]action source-nat easy-ip
PC1可以ping通Internet

PC2 ping不通Internet

查看nat转换