我这里一台F1000-S，3个接口分别连接内网（eth0/0：trust）和外网（e0/1：untrust）以及DMZ区（e1/0：DMZ）。
/ w+ m/ Q# K0 Z( r2 ^8 M# V+ g 我的环境比较特殊，DMZ区有多台服务器对外提供应用；而内网也有一些服务器，特别是DNS服务器在内网，DNS提供内网PC的域名解析以及对DMZ区的服务器的域名解析。就是外网用户访问DMZ区服务器也是通过内网的DNS服务器提供域名解析功能。我目前可以实现内网和外网访问intelnet，以及内网通过IP地址（包括私有地址和公网映射地址）对DMZ区的访问。* H8 I8 \7 m) M
但是内网用户无法通过域名解析访问DMZ区的服务器，外网用户也只能通过公网映射地址访问DMZ服务器，而无法用过域名访问。
+ _: a; m7 U* \1 H3 M6 X 另外，我感觉在外网口附加上公网映射地址好像没有什么作用。实际访问时好像访问的是防火墙，而不是服务器。1 ]* q5 e# g5 @3 B# G
以下是我防火墙的配置，麻烦大家帮忙看看，怎么解决以上问题。（DNS 服务器为172.30.1.1 ）/ e8 A* `2 p1 x: v* Z
" ^, ^1 J! a. n9 @. A5 t#
# _9 u8 f& l5 u: k; o) _( z* Z$ P" esysname H3C6 o7 ]" _1 Y, O' N) Z
#9 i: d# r) t; q# P4 F
firewall packet-filter enable
7 h, i/ R3 I$ b% E2 r5 ?: \firewall packet-filter default permit! B3 ?0 B( J1 u+ R }4 a
#& T% y- h+ k( Z) U$ \4 y% G0 `9 p
nat address-group 1 10.10.61.86 10.10.61.94
+ \# j) \! L0 A: [$ r#
1 H/ T: H4 B( `/ Z5 ^firewall statistic system enable
9 V' y& D9 N0 B2 r#2 T" |% z1 H1 e* P
radius scheme system
: Y- N1 X8 `2 c3 }server-type extended; P. D- w) A, V& U4 K F2 T6 K
#% y3 `, ^% }# V0 @! w4 \
domain system& j& C C7 ?: I5 b
#
9 `8 W% M- M X; I6 }9 L' ~local-user admin
1 ?* i9 ], Q& x: W) m1 S2 ipassword cipher [ZW_)V:R.]7=3S**GNA"_Q!!
0 W1 M* X: z) y& Aservice-type telnet
, v6 N, H" q1 d- {2 dlevel 3: V, p. @4 ^) V8 n
#3 n$ l, ~ Q3 [+ H& h
object address all 0.0.0.0 0.0.0.0
5 s% k; z8 Z( n) {) cobject address dmz 192.168.100.0 255.255.255.0
! x1 U+ n7 G: ? iobject address inside 172.16.0.0 255.240.0.0' D/ R( v) d* w$ o# ~
#
- A3 d/ f. v) Sacl number 2000
1 |7 G. `3 M; ~$ s) Krule 0 permit/ ]9 s+ F. C( n+ {4 Z7 m) \
rule 1 deny
2 a. N7 I! g& v( ~8 n; k#8 p! w7 @7 e5 o- h. ~
inte**ce Aux0& n: C- y8 v( r' A5 Q
async mode flow! H4 Z4 |* a7 b) |% i' {
#
, O) w6 s+ j0 y: U! e2 N8 j4 finte**ce GigabitEthernet0/0
0 e$ u9 G U) f1 w! J0 Ldescription WCN_INTE**CE_LAN
7 W# S; z* b4 A( |. R, B8 Rip address 172.31.2.2 255.255.255.248) T9 j" I" p- y/ \7 |
nat server protocol tcp global 10.10.61.77 any inside 192.168.100.3 any
+ _! D. u0 _) O5 Lnat server protocol tcp global 10.10.61.75 any inside 172.30.1.1 any
, v n# i% I# Y8 z+ Fnat server protocol tcp global 10.10.61.67 any inside 192.168.100.112 any. T: y8 ?! R6 [2 s" k- _
nat server protocol tcp global 10.10.61.70 any inside 192.168.100.32 any
9 a/ i# v( L* B: ?nat server protocol tcp global 10.10.61.79 any inside 192.168.100.100 any
& e, d6 ?- w- I* S0 H( m% B1 Qnat server protocol tcp global 10.10.61.74 any inside 172.30.1.4 any
$ h, i; w* J* B% Q f/ fnat server protocol tcp global 10.10.61.68 any inside 192.168.100.60 any" }0 |. `* m, N$ G
nat server protocol tcp global 10.10.61.78 any inside 172.22.1.5 any
: ]- x2 v5 E4 A9 o9 k+ S: R" hnat server protocol tcp global 10.10.61.80 any inside 172.16.51.189 any
; a& b( k) v0 e3 v/ Lnat server protocol tcp global 10.10.61.81 any inside 172.16.51.182 any
. B' E6 l% q3 |( L. B% a0 V; @3 R" Unat server protocol tcp global 10.10.61.82 any inside 172.30.100.150 any
) }- d9 M8 L& d0 S6 x, ]nat server protocol tcp global 10.10.61.72 any inside 172.30.102.53 any
' w* m7 \- H; \- w! T1 S+ N/ `nat server protocol tcp global 10.10.61.73 any inside 172.21.144.253 any: E, R, z0 O0 o ]
nat server protocol tcp global 10.10.61.76 www inside 172.23.129.199 www
* O5 d3 e9 }+ F F- anat server protocol tcp global 10.10.61.76 8001 inside 172.23.129.2 80011 D4 [8 R- O9 A4 x4 R
#4 R2 |) u4 |! \5 E4 q
inte**ce GigabitEthernet0/1
( u: i- ]4 R' i. H' ]" ldescription WCN_INTE**CE_WAN
" Z% {1 D% R8 p% V* I# Z( tip address 10.10.61.66 255.255.255.224
) x7 j9 E$ z5 [$ J% B! J, ~ip address 10.10.61.77 255.255.255.224 sub
# i- p' G' N/ d+ nip address 10.10.61.75 255.255.255.224 sub1 ]0 w3 f; n: L" L$ {0 Q4 j, W
ip address 10.10.61.67 255.255.255.224 sub" u9 n$ H$ b8 \+ u7 G
ip address 10.10.61.70 255.255.255.224 sub
. K" S+ L# r3 \+ z- ]4 rip address 10.10.61.79 255.255.255.224 sub7 f" `4 m( |* Y4 h8 t& L# s
ip address 10.10.61.74 255.255.255.224 sub9 r. P1 n, d! `* t; B
ip address 10.10.61.68 255.255.255.224 sub; x% Z7 T1 n, ^3 P/ U5 E
ip address 10.10.61.78 255.255.255.224 sub
' x" y6 E/ Y. L' ~1 m% a! ?0 wip address 10.10.61.80 255.255.255.224 sub
+ R9 x! j1 }: D5 g( Z1 aip address 10.10.61.81 255.255.255.224 sub
+ e* u" I2 k. w g7 T& dip address 10.10.61.82 255.255.255.224 sub
9 ^- _- C; `7 O6 P+ Kip address 10.10.61.72 255.255.255.224 sub
$ j' i' v' H& h, D7 Q% B& Oip address 10.10.61.73 255.255.255.224 sub5 S7 p$ Q! r% c/ ]2 E
ip address 10.10.61.76 255.255.255.224 sub
4 r2 L+ x& E5 O+ a( C: Qnat outbound 2000 address-group 1- ?+ Z- u. U/ [8 `
nat server protocol tcp global 10.10.61.77 any inside 192.168.100.3 any) S$ H. ?5 r8 i3 s v f. `. B. U
nat server protocol tcp global 10.10.61.75 any inside 172.30.1.1 any3 m0 |" J! _/ R M, B/ m e) g
nat server protocol tcp global 10.10.61.67 any inside 192.168.100.112 any
7 E: y, J: v. f4 I7 }0 C! pnat server protocol tcp global 10.10.61.70 any inside 192.168.100.32 any, o) D, @7 C" T h; F
nat server protocol tcp global 10.10.61.79 any inside 192.168.100.100 any" z& [/ l1 P4 p$ l
nat server protocol tcp global 10.10.61.74 any inside 172.30.1.4 any* ^* [! Y6 F. r9 @( ^: r3 `
nat server protocol tcp global 10.10.61.68 any inside 192.168.100.60 any
- l: y* I* C' n8 H8 f5 ~! Onat server protocol tcp global 10.10.61.78 any inside 172.22.1.5 any
$ I) b7 w! m+ b+ A1 }- Z4 J- mnat server protocol tcp global 10.10.61.80 any inside 172.16.51.189 any
& M# R' P+ R" O4 X0 x D$ S" onat server protocol tcp global 10.10.61.81 any inside 172.16.51.182 any7 E1 x, P+ s# d
nat server protocol tcp global 10.10.61.82 any inside 172.30.100.150 any
3 W# J1 P& D/ D) d7 w$ h& _. Enat server protocol tcp global 10.10.61.72 any inside 172.30.102.53 any
. h# I2 J$ ^2 k! a" m; @nat server protocol tcp global 10.10.61.73 any inside 172.21.144.253 any
7 Z ?! H) H' F* g& K( _! I g8 pnat server protocol tcp global 10.10.61.76 www inside 172.23.129.199 www" j! Q6 C- V1 k* i' i4 d: r1 {9 |
nat server protocol tcp global 10.10.61.76 8001 inside 172.23.129.2 8001
7 `* H6 f/ ~1 ^, h8 y#
, S) s7 P4 ^5 Binte**ce GigabitEthernet1/0& Z% o& I$ @+ V
description WCN_INTE**CE_DMZ3 A$ K/ ^, X2 P2 M
ip address 192.168.100.254 255.255.255.0
# C, [+ n! X' j' n, m#
! F5 R" I) ?( L {inte**ce GigabitEthernet1/1* `0 s& E& n: g2 f
#( d0 s, L. I. t: D4 S
inte**ce Encrypt2/0; w, B( _8 v" X9 r( ^
#% r% i3 p( W) i; ?5 n
inte**ce NULL0
) S# O" F7 d% b; f#3 v7 C- n1 B" B. g$ b1 T
firewall zone local
6 m. c( }! Q& b+ sset priority 100
7 a% a8 }2 d8 h#
1 K5 q x/ X x! S( B/ z, Efirewall zone trust) r' Y" s; \# J& _
add inte**ce GigabitEthernet0/0
Z7 p4 q4 S) [$ { Fadd inte**ce GigabitEthernet1/18 S: t8 Z4 O. a" B
set priority 85
' L6 I9 y! ? M. l: S#) ?( B" Y3 E. p4 A# d8 U) F
firewall zone untrust
" \$ U* m: `+ O& P, C% Dadd inte**ce GigabitEthernet0/18 `- K& g9 ]: R% L
set priority 5& L! s( a( ]( j: `, ]% H( c
#
3 y a- E7 f5 Y0 F J$ Z, g% J" sfirewall zone DMZ4 Y. J" L; A0 T8 R4 V
add inte**ce GigabitEthernet1/0
1 t# d4 ~/ |1 P, ] ^set priority 50* F& i& f; p4 }. W5 w
#. L( H) G& o) \# G6 h5 q
firewall interzone local trust/ U$ H2 r+ w4 A7 T4 N4 {
#
# |( R8 |, f9 ~; K2 B% Ifirewall interzone local untrust, D1 m2 O6 A% d; d* f
#
$ D/ K$ h" } H& `4 g6 Ofirewall interzone local DMZ) b8 Q2 K- i% X+ a9 A
#
/ X: O) Y, x1 Z2 Qfirewall interzone trust untrust
) }8 p8 @# ~) ^, F3 L0 h7 T#8 G$ C# \% k& y8 }, z
firewall interzone trust DMZ% q: i( V+ [4 b+ {/ Q9 @8 ^
#3 f Q) L$ L3 `
firewall interzone DMZ untrust5 O( x1 p- o; O, a
#- x/ `( z/ J. {" T* U5 \- F
ip route-static 0.0.0.0 0.0.0.0 GigabitEthernet 0/1 10.10.61.65 preference 60, I3 {0 d$ ^5 y% L* D
ip route-static 172.16.0.0 255.240.0.0 GigabitEthernet 0/0 172.31.2.1 preference 60; v* N) N1 h$ p) z. e. w, O
#
2 y; c' I" h yuser-inte**ce con 0
- G# Z0 A( W/ e0 ]* R% suser-inte**ce aux 0
1 K" _8 I8 j5 Quser-inte**ce vty 0 4
8 s: M3 M" M8 z% g) c3 d3 h#
* P% |: o& X; p* mreturn |
|
所有IT类厂商认证考试题库下载
【新盟教育】2023最新华为HCIA全套视频合集【网工基础全覆盖】---国sir公开课合集
【新盟教育】网工小白必看的！2023最新版华为认证HCIA Datacom零基础全套实战课
原创_超融合自动化运维工具cvTools
重量级~~30多套JAVA就业班全套 视频教程（请尽快下载，链接失效后不补）
链接已失效【超过几百G】EVE 国内和国外镜像 全有了 百度群分享
某linux大佬，积累多年的电子书(约300本)
乾颐堂现任明教教主Python完整版
乾颐堂 教主技术进化论 2018-2019年 最新31-50期合集视频（各种最新技术杂谈视频）
Python学习视频 0起点视频 入门到项目实战篇 Python3.5.2视频教程 共847集 能学102天
约21套Python视频合集 核心基础视频教程（共310G,已压缩）
最新20180811录制 IT爱好者-清风羽毛 - 网络安全IPSec VPN实验指南视频教程
最新20180807录制EVE开机自启动虚拟路由器并桥接物理网卡充当思科路由器
