VLAN2子接口 办公区PC1网关
interface GigabitEthernet 1/0/1.2
 vlan-type dot1q 2
 ip address 192.168.1.126 255.255.255.0

 VLAN3子接口 生产区PC2、PC3网关
interface GigabitEthernet 1/0/1.3
 vlan-type dot1q 3
 ip address 192.168.1.125 255.255.255.0

# DMZ区域接口，连接LSW2
interface GigabitEthernet 0/0/1
 ip address 10.0.0.254 255.255.255.0

# 安全区域绑定子接口
firewall zone trust
 set interface GigabitEthernet 1/0/1.2
 set interface GigabitEthernet 1/0/1.3

firewall zone dmz
 set interface GigabitEthernet 0/0/1

# 时间段
time-range worktime 08:00 to 18:00 working-day
time-range pc3-update 10:00 to 11:00 monday

# 地址对象
ip address-object vlan2 office
 ip 192.168.1.1 mask 255.255.255.255

ip address-object  vlan3 all
 ip 192.168.1.128 mask 255.255.255.254

ip address-object PC3
 ip 192.168.1.130 mask 255.255.255.255

ip address-object 
 ip 10.0.0.1 mask 255.255.255.255

ip address-object  web serve
 ip 10.0.0.0 mask 255.255.255.255

security-policy
 rule name pc3
  source-zone trust
  destination-zone dmz
  source-address pc3
  destination-address web server
  time-range pc3-update
  action permit

 rule name vlan3
  source-zone trust
  destination-zone dmz
  source-address vlan3 all
  destination-addressweb server
  action deny

 rule name vlan 3
  source-zone trust
  destination-zone dmz
  source-address vlan3 all
  destination-address 
  action permit

 rule name vlan 2
  source-zone trust
  destination-zone dmz
  source-address vlan2
  destination-address 
  time-range worktime
  action permit

 rule name vlan 2
  source-zone trust
  destination-zone dmz
  source-address vlan2
  destination-address 
  action deny

 rule name vlan 2
  source-zone trust
  destination-zone dmz
  source-address vlan 2
  destination-address web server
  action permit

commit

system-view
sysname LSW1
vlan batch 2 3

# 防火墙GE0/0/1 配置Trunk，允许VLAN2、3标签通过
interface GigabitEthernet 0/0/1
 port link-type trunk
 port trunk allow-pass vlan 2 3

# PC1 办公区 VLAN2
interface Ethernet 0/0/1
 port link-type access
 port default vlan 2

# PC2 生产区 VLAN3
interface Ethernet 0/0/2
 port link-type access
 port default vlan 3

# PC3 生产区 VLAN3
interface Ethernet 0/0/4
 port link-type access
 port default vlan 3

system-view
sysname LSW2

# 防火墙接口
interface GigabitEthernet 0/0/1
 port link-type access
 port default vlan 1

# OA Server
interface Ethernet 0/0/0
 port link-type access
 port default vlan 1

# Web Server
interface Ethernet 0/0/3
 port link-type access
 port default vlan 1