1 基础配置
1.1配置设备名称和接口IP
<HUAWEI> system-view
[HUAWEI] sysname FW1
[FW1] interface GigabitEthernet 1/0/0
[FW1-GigabitEthernet1/0/0] ip address 12.0.0.1 255.255.255.0
[FW1-GigabitEthernet1/0/0] quit
[FW1] interface GigabitEthernet 1/0/1
[FW1-GigabitEthernet1/0/1] ip address 14.0.0.1 255.255.255.0
[FW1-GigabitEthernet1/0/1] quit
[FW1] interface GigabitEthernet 1/0/2
[FW1-GigabitEthernet1/0/2] ip address 192.168.3.254 255.255.255.0
[FW1-GigabitEthernet1/0/2] quit
 

 1.2配置VLAN接口（连接内网交换机）
[FW1] interface Vlanif 10
[FW1-Vlanif10] ip address 192.168.1.254 255.255.255.0
[FW1-Vlanif10] quit
[FW1] interface Vlanif 20
[FW1-Vlanif20] ip address 192.168.2.254 255.255.255.0
[FW1-Vlanif20] quit

2 安全区域
2.1将接口加入安全区域
[FW1] firewall zone trust
[FW1-zone-trust] add interface Vlanif10
[FW1-zone-trust] add interface Vlanif20
[FW1-zone-trust] add interface GigabitEthernet1/0/2
[FW1-zone-trust] quit

[FW1] firewall zone untrust
[FW1-zone-untrust] add interface GigabitEthernet1/0/0
[FW1-zone-untrust] add interface GigabitEthernet1/0/1
[FW1-zone-untrust] quit
 

3 ISP路由配置
3.1配置静态路由和默认路由
[FW1] ip route-static 101.1.1.0 255.255.255.0 14.0.0.2
[FW1] ip route-static 100.1.1.0 255.255.255.0 14.0.0.2
[FW1] ip route-static 34.0.0.0 255.255.255.0 14.0.0.2
[FW1] ip route-static 102.1.1.0 255.255.255.0 12.0.0.2
[FW1] ip route-static 23.0.0.0 255.255.255.0 12.0.0.2
[FW1] ip route-static 200.1.1.0 255.255.255.0 12.0.0.2

# 配置默认路由（主备负载均衡）
[FW1] ip route-static 0.0.0.0 0.0.0.0 14.0.0.2 preference 60   # 主路由（电信）
[FW1] ip route-static 0.0.0.0 0.0.0.0 12.0.0.2 preference 70   # 备份路由（联通）
 

4路由配置
4.1配置ACL匹配流量
[FW1] acl number 3000
[FW1-acl-adv-3000] rule permit ip source 192.168.1.0 0.0.0.255 destination 50.0.0.0 0.0.0.255
[FW1-acl-adv-3000] quit

[FW1] acl number 3001
[FW1-acl-adv-3001] rule permit ip source 192.168.2.0 0.0.0.255 destination 50.0.0.0 0.0.0.255
[FW1-acl-adv-3001] quit
 

4.2配置策略路由
[FW1] policy-based-route pbr_finance permit node 10
[FW1-policy-pbr-pbr_finance-10] if-match acl 3000
[FW1-policy-pbr-pbr_finance-10] apply ip-address next-hop 14.0.0.2
[FW1-policy-pbr-pbr_finance-10] apply ip-link check enable
[FW1-policy-pbr-pbr_finance-10] quit

[FW1] policy-based-route pbr_rd permit node 10
[FW1-policy-pbr-pbr_rd-10] if-match acl 3001
[FW1-policy-pbr-pbr_rd-10] apply ip-address next-hop 12.0.0.2
[FW1-policy-pbr-pbr_rd-10] apply ip-link check enable
[FW1-policy-pbr-pbr_rd-10] quit
 

4.3在接口上应用策略路由
[FW1] interface Vlanif10
[FW1-Vlanif10] ip policy-based-route pbr_finance
[FW1-Vlanif10] quit

[FW1] interface Vlanif20
[FW1-Vlanif20] ip policy-based-route pbr_rd
[FW1-Vlanif20] quit
 

5 NAT配置
5.1配置源NAT（内网访问外网）
[FW1] nat-policy
[FW1-nat-policy] rule name nat_outbound
[FW1-nat-policy-rule-nat_outbound] source-zone trust
[FW1-nat-policy-rule-nat_outbound] destination-zone untrust
[FW1-nat-policy-rule-nat_outbound] source-address 192.168.1.0 mask 24
[FW1-nat-policy-rule-nat_outbound] source-address 192.168.2.0 mask 24
[FW1-nat-policy-rule-nat_outbound] source-address 192.168.3.0 mask 24
[FW1-nat-policy-rule-nat_outbound] action source-nat easy-ip
[FW1-nat-policy-rule-nat_outbound] quit
[FW1-nat-policy] quit
 

5.2配置目的NAT（外网访问内网Web服务器）
[FW1] nat server  0 protocol tcp global 14.0.0.10 80 inside 192.168.3.1 80
[FW1] nat server 1 protocol tcp global 12.0.0.10 80 inside 192.168.3.1 80

6 安全策略配置
6.1配置安全策略
[FW1] security-policy
[FW1-security-policy] rule name trust_to_untrust
[FW1-security-policy-rule-trust_to_untrust] source-zone trust
[FW1-security-policy-rule-trust_to_untrust] destination-zone untrust
[FW1-security-policy-rule-trust_to_untrust] source-address 192.168.1.0 mask 24
[FW1-security-policy-rule-trust_to_untrust] source-address 192.168.2.0 mask 24
[FW1-security-policy-rule-trust_to_untrust] source-address 192.168.3.0 mask 24
[FW1-security-policy-rule-trust_to_untrust] action permit
[FW1-security-policy-rule-trust_to_untrust] quit

[FW1-security-policy] rule name untrust_to_web
[FW1-security-policy-rule-untrust_to_web] source-zone untrust
[FW1-security-policy-rule-untrust_to_web] destination-zone trust
[FW1-security-policy-rule-untrust_to_web] destination-address 192.168.3.1 mask 32
[FW1-security-policy-rule-untrust_to_web] service http
[FW1-security-policy-rule-untrust_to_web] service https
[FW1-security-policy-rule-untrust_to_web] action permit
[FW1-security-policy-rule-untrust_to_web] quit

[FW1-security-policy] rule name finance_to_ftp
[FW1-security-policy-rule-finance_to_ftp] source-zone trust
[FW1-security-policy-rule-finance_to_ftp] destination-zone untrust
[FW1-security-policy-rule-finance_to_ftp] source-address 192.168.1.0 mask 24
[FW1-security-policy-rule-finance_to_ftp] destination-address 50.0.0.0 mask 24
[FW1-security-policy-rule-finance_to_ftp] service ftp
[FW1-security-policy-rule-finance_to_ftp] action permit
[FW1-security-policy-rule-finance_to_ftp] quit

[FW1-security-policy] rule name default_deny
[FW1-security-policy-rule-default_deny] action deny
[FW1-security-policy-rule-default_deny] quit

[FW1-security-policy] quit
 

7 保存配置
[FW1] return
<FW1> save
The current configuration will be written to the device.
Are you sure? [Y/N] Y
 

8测试验证
8.1内网到网关测试
PC> ping 192.168.1.254
Ping 192.168.1.254: 32 data bytes, Press Ctrl_C to break
From 192.168.1.254: bytes=32 seq=1 ttl=255 time=1 ms
From 192.168.1.254: bytes=32 seq=2 ttl=255 time=1 ms
From 192.168.1.254: bytes=32 seq=3 ttl=255 time=1 ms
From 192.168.1.254: bytes=32 seq=4 ttl=255 time=1 ms
From 192.168.1.254: bytes=32 seq=5 ttl=255 time=1 ms

--- 192.168.1.254 ping statistics ---
  5 packet(s) transmitted
  5 packet(s) received
  0.00% packet loss
 

8.2 内网访问外网测试
PC> ping 14.0.0.2
Ping 14.0.0.2: 32 data bytes, Press Ctrl_C to break
From 14.0.0.2: bytes=32 seq=1 ttl=254 time=5 ms
From 14.0.0.2: bytes=32 seq=2 ttl=254 time=4 ms
From 14.0.0.2: bytes=32 seq=3 ttl=254 time=5 ms
From 14.0.0.2: bytes=32 seq=4 ttl=254 time=4 ms
From 14.0.0.2: bytes=32 seq=5 ttl=254 time=5 ms

--- 14.0.0.2 ping statistics ---
  5 packet(s) transmitted
  5 packet(s) received
  0.00% packet loss

8.4 查看配置命令
# 查看接口IP配置
<FW1> display ip interface brief

# 查看安全区域
<FW1> display firewall zone

# 查看ACL配置
<FW1> display acl 3000
<FW1> display acl 3001

# 查看策略路由
<FW1> display policy-based-route

# 查看NAT策略
<FW1> display nat server
<FW1> display nat policy

# 查看安全策略
<FW1> display security-policy rule all

# 查看路由表
<FW1> display ip routing-table