以下是netscreen 防火墙active-passive典型配置：
* U" ^# z4 H3 V8 F6 v) |9 n5 ^! m2_cfg
7 V- a: y$ i _& |* x" \5 Y3 s: S* O! |7 h( N
unset key protection enable
- [2 n6 @ v m3 Eset clock timezone 0
- r$ g2 B# w* }7 Aset vrouter trust-vr sharable
6 Q6 R" P0 U6 z) `set vrouter "untrust-vr"0 J8 }9 ^: s0 S& G7 k
exit
3 C* c" T# O' @7 ^set vrouter "trust-vr"* I3 L( z: J# G% e0 u1 Y
unset auto-route-export% M1 o: P, d7 d4 E! w1 O/ o" z, u
exit; D5 }! }; V' U* [+ G
set service "ACS" protocol tcp src-port 0-65535 dst-port 2002-2002 " f2 U b Y3 C- N+ z
set alg appleichat enable% s; q& K, }8 A7 r! V- j
unset alg appleichat re-assembly enable* H, w; i$ o- L1 }* d
set alg sctp enable F9 P8 \3 N5 v
set auth-server "Local" id 0) h* s$ |* z; v3 \7 r
set auth-server "Local" server-name "Local"
. D- r; Z, p# d! }" F% uset auth default auth server "Local"
8 K' ^! D* ]- c% { kset auth radius accounting port 1646& e$ i. t8 R7 l% H/ }) V% S
set admin name "netscreen"( q3 q7 |" F) n+ J1 V& ?% K
set admin password "nFWvH6rLAaPKcedPuslBexMtM8P5yn"; e: M7 E( B; \* A3 R
set admin auth web timeout 10
: \$ Y: L' u+ U4 rset admin auth server "Local"" ^& |. `4 D, a9 l2 {; ? M: N, M4 Y
set admin format dos
8 Y9 }4 D6 @6 s3 ?- F! {set zone "Trust" vrouter "trust-vr"
! W( q+ l) F2 d% l/ u* Eset zone "Untrust" vrouter "trust-vr"
- }+ P/ w% T, S( e; ?! O# sset zone "DMZ" vrouter "trust-vr"+ f2 K! j8 `* ^- C) z
set zone "VLAN" vrouter "trust-vr"+ m. z$ Q2 Q5 Y6 G/ h( \( \) @
set zone "Untrust-Tun" vrouter "trust-vr"* Q* d* `" F$ b# c0 _
set zone "Trust" tcp-rst
% R/ d8 [5 f9 J6 y% j) W2 xset zone "Untrust" block
: O+ |5 g3 c4 ?3 Y- u O8 {+ x2 qunset zone "Untrust" tcp-rst
& r% G, \. H2 Z' F% ^set zone "MGT" block
- @* ?* d! d1 s punset zone "V1-Trust" tcp-rst
3 U" y/ b/ j( B8 P8 H/ K/ j" K9 @unset zone "V1-Untrust" tcp-rst
9 ~4 y2 i. j$ r) W2 d% wset zone "DMZ" tcp-rst - d4 |0 N% j T: l- J5 A
unset zone "V1-DMZ" tcp-rst
0 A8 w: E7 U3 \ P9 funset zone "VLAN" tcp-rst / x% P+ n. B! K* P
set zone "Untrust" screen tear-drop* n( k8 Z5 ]" s1 @
set zone "Untrust" screen syn-flood* E. G/ Y4 d7 ?% b+ p
set zone "Untrust" screen ping-death
! f ^/ O7 k% e! c. vset zone "Untrust" screen ip-filter-src
& d6 i; m- S- U8 {0 h# Jset zone "Untrust" screen land
& w t- L0 O8 l0 ^! E0 X* jset zone "V1-Untrust" screen tear-drop
* `5 g+ P- V0 v' [" Uset zone "V1-Untrust" screen syn-flood
7 s7 o$ _* O) P3 D% G; j/ kset zone "V1-Untrust" screen ping-death
w* D% Y% p; c$ \set zone "V1-Untrust" screen ip-filter-src9 R' k3 T; G$ V( N. s
set zone "V1-Untrust" screen land
6 {( {' Q0 [& s- Q O Oset interface "ethernet0/0" zone "Null"
* s! B) e# T3 x2 q2 g |6 [set interface "ethernet0/1" zone "Null"5 k+ V1 q- Y) ~
set interface "ethernet0/2" zone "Untrust": G1 S$ ]1 A. y+ y; w) E: B
set interface "ethernet0/3" zone "Untrust"
5 a+ T. d( L! D! l$ w, |- e9 W# g9 Gset interface "ethernet0/4" zone "HA"
2 H, ]& R3 b3 l8 Jset interface "ethernet0/5" zone "HA"
: U# [ z, E- t/ Eset interface "ethernet0/6" zone "DMZ"3 O, t( q- Y1 `: j5 s# K o; j
set interface "ethernet0/8" zone "Trust"
1 X$ W/ Z7 }( U$ ?+ |unset interface vlan1 ip1 |8 x5 @. t7 e9 O4 p
set interface ethernet0/2 ip 116.247.91.98/29" W2 P4 \0 X) Q, l2 T8 P
set interface ethernet0/2 route
V" J! W: `7 Kset interface ethernet0/3 ip 140.206.34.178/30
* [5 l7 j0 n9 p* k `set interface ethernet0/3 route
7 }9 e. p. L7 c5 Z$ F" T6 Yset interface ethernet0/6 ip 10.131.126.18/28( M& ?0 W. v) z9 s
set interface ethernet0/6 nat
3 K6 ]7 u+ V& q2 d7 R3 Iset interface ethernet0/8 ip 10.131.126.4/282 T8 E) ^. _8 {3 B4 @
set interface ethernet0/8 nat
/ Q' v8 }7 I8 d9 M; j( a& _unset interface vlan1 bypass-others-ipsec. q8 g# e6 O/ y, R
unset interface vlan1 bypass-non-ip
' {" A' M5 p7 m9 H* ?% @set interface ethernet0/2 manage-ip 116.247.91.99
: [' [3 t( p; S. C0 @set interface ethernet0/6 manage-ip 10.131.126.20
3 J: }# ~( d* i! G& S1 a! P4 ?set interface ethernet0/8 manage-ip 10.131.126.27 e9 }' o7 |9 e) U; r5 _0 U
set interface ethernet0/2 ip manageable) f- V0 I7 t3 |0 t
unset interface ethernet0/3 ip manageable! Y- w5 |$ J0 n; u2 s7 u, }
set interface ethernet0/6 ip manageable
/ R; Q: F' Y) T5 u5 Wset interface ethernet0/8 ip manageable, L1 @8 D) T: }- L5 j. e
set interface ethernet0/2 manage ping$ E# F, a* t: Z: g. M6 n
set interface ethernet0/2 manage ssh
( c) R/ U) ^# R- Xset interface ethernet0/2 manage telnet
* l# N. N2 C5 b4 S; F$ Lset interface ethernet0/2 manage snmp
4 C- Q3 W- ?. i/ eset interface ethernet0/2 manage ssl
- s8 X0 y B+ I, u1 Iset interface ethernet0/2 manage web
* ]. s$ i8 t8 H& ^$ N! Sset interface ethernet0/3 manage ping6 E5 k$ s0 K+ z0 Z8 G' c4 |: r
set interface ethernet0/3 manage ssh, X& ?! g2 O- v* V. w6 }
set interface ethernet0/3 manage telnet
) y1 G; w$ x# f |+ {: Z9 O. `set interface ethernet0/3 manage snmp8 }- G# y* o+ Q4 `
set interface ethernet0/3 manage ssl
: r. P n# D) k8 l( x. C7 kset interface ethernet0/3 manage web8 R6 c' V4 N8 n7 I6 Z2 e
set interface ethernet0/6 manage ssh8 _, F4 ~+ ?+ ]
set interface ethernet0/6 manage telnet/ n+ Y# I/ k0 ~/ Q. m/ r C
set interface ethernet0/6 manage snmp
8 l2 R( l; J9 _% m+ A; Iset interface ethernet0/6 manage ssl) }2 w* H/ W6 C& p5 k }: B4 T
set interface ethernet0/6 manage web
. S6 b9 q% z1 b' m% mset interface ethernet0/2 monitor track-ip ip
0 l% [7 ~ n# I" [. q3 lset interface ethernet0/2 monitor track-ip threshold 10
N8 o* z$ F5 H1 K jset interface ethernet0/2 monitor track-ip ip 124.74.147.117 interval 3( F% J1 l3 N! C7 U! `5 }6 P
set interface ethernet0/2 monitor track-ip ip 124.74.147.117 weight 12
- u* G" n( u8 v) O: D" N# o7 J1 sunset interface ethernet0/2 monitor track-ip dynamic# v- I8 ?# S1 T& z2 J
unset flow no-tcp-seq-check
* w+ R& A) K0 d% S9 ^/ lset flow tcp-syn-check! O) F+ v! \! @
unset flow tcp-syn-bit-check
* t7 K6 z( ]3 b* t& M& J! yset flow reverse-route clear-text prefer3 n' ^3 s3 w N/ p1 B' J
set flow reverse-route tunnel always
" u! p, {' n, c* T, xset console page 05 R" E/ G5 m5 D/ e) w
set hostname RT3-xzl-1F-S-SSG140-10.131.126.2, J: L( H0 C7 b) C$ C, P+ g# W
set pki authority default scep mode "auto"' a3 ^$ q$ ^ x4 W1 P4 Y# {
set pki x509 default cert-path partial. N ?7 `: D' a" K
set nsrp cluster id 1: ?" A6 V5 z7 X. W4 v
set nsrp cluster name FXGL
' H7 ~9 i1 ~ |* q `set nsrp rto-mirror sync. t6 o6 a3 `5 r, R: `: `
set nsrp rto-mirror route
4 T. |* K( F! c( o# |) n* F$ kset nsrp vsd-group master-always-exist3 x3 d' ~5 B( d3 _- n6 S5 W
set nsrp vsd-group id 0 priority 1005 N2 P' y$ D0 H {
set nsrp vsd-group id 0 preempt) S' U9 e W0 E6 Z4 N0 k& u
set nsrp secondary-path ethernet0/83 y7 p X5 r# N. T
set nsrp vsd-group id 0 monitor interface ethernet0/3 weight 16
1 E( V' \, t% @4 |8 ?# jset nsrp vsd-group id 0 monitor track-ip ip
4 C# y2 _2 H: x( h5 ~6 z6 dset nsrp vsd-group id 0 monitor track-ip threshold 300 a7 Y2 k/ ~: f6 f1 n
set nsrp vsd-group id 0 monitor track-ip ip 124.74.147.117 interface ethernet0/2 I! U6 U3 O/ }6 ]$ B
set nsrp vsd-group id 0 monitor track-ip ip 124.74.147.117 interval 10
0 D5 Q, C9 V& b( | M* Kset nsrp vsd-group id 0 monitor track-ip ip 124.74.147.117 weight 32% g0 h _6 o/ }. f. k$ z _# y1 B
set nsrp vsd-group id 0 monitor track-ip ip 10.131.121.254 interface ethernet0/6: z! u9 ` R6 D# Q D; o$ p
set nsrp vsd-group id 0 monitor track-ip ip 10.131.121.254 interval 10
: l5 p. k6 e O1 [- a- v' M; X2 wset nsrp vsd-group id 0 monitor track-ip ip 10.131.121.254 weight 329 L- j. N2 L, {& w9 {0 `* m8 L, D
set nsrp vsd-group id 0 monitor track-ip ip 10.131.127.249 interface ethernet0/8
! l* X) o* Z9 ?* F: p; Lset nsrp vsd-group id 0 monitor track-ip ip 10.131.127.249 interval 10$ l O6 Z, ]7 s4 g! P3 A
set nsrp vsd-group id 0 monitor track-ip ip 10.131.127.249 weight 325 E9 C$ s& a) x8 R: e
set nsrp ha-link probe3 O3 w+ ?6 D: [% a9 i
set dns host dns1 202.96.209.5 src-interface ethernet0/2
+ R- P- s& z3 }" F/ hset dns host dns2 0.0.0.0
7 ? T5 _& Q2 c! R* `3 p: Y7 [ Rset dns host dns3 0.0.0.0
# n7 @$ k( a6 Zset crypto-policy" @% u% \* a$ x5 h- ^
exit
. h; Z- @+ \ d* f- k1 E: lset ike respond-bad-spi 1
- W! d+ K4 J& Q6 A7 \/ Y5 n$ dset ike ikev2 ike-sa-soft-lifetime 60
$ l& K* H3 P1 |7 Ounset ike ikeid-enumeration: i# W6 D a- E5 [5 Q6 I( c
unset ike dos-protection* b, _; H" ~4 V
unset ipsec access-session enable
1 l- f; p2 S% i3 |/ f& rset ipsec access-session maximum 5000
0 u) j. a+ U. S& q* ]6 \set ipsec access-session upper-threshold 0
1 l4 |& Z0 a! ]/ Vset ipsec access-session lower-threshold 07 u( g) T! ]# G# S
set ipsec access-session dead-p2-sa-timeout 0% x& }" ?' p2 S3 s; h
unset ipsec access-session log-error4 M! \' m+ g: g, A
unset ipsec access-session info-exch-connected& C1 y1 f1 Z8 J, r8 ]
unset ipsec access-session use-error-log
9 k+ `! t+ {+ S$ Q- c* c) Nset vrouter "untrust-vr"
4 ?2 y& N+ n1 C( I4 {4 f5 O; Aexit' ^ V& s) {7 B2 d7 b& h
set vrouter "trust-vr"
; x+ n/ A) g. F) d1 rexit
; V( h7 c7 G: Cset url protocol websense: ~3 h* I5 Y7 n
exit
5 U0 K0 U0 o% k4 j) U( s$ ?8 d, i6 Cset policy id 1 from "Trust" to "Untrust" "Any" "Any" "ANY" permit log
. l9 P" U& i, S6 O4 Xset policy id 1$ t% ~) @* p# K b6 e
exit
' Y) Z, U n4 N' k1 d3 |+ Rset policy id 4 from "DMZ" to "Untrust" "Any" "Any" "ANY" nat src permit log
- x; G- [- o3 O. Uset policy id 4/ y1 v- X- z7 m' s
exit
) z. V# e$ i4 T6 Hset policy id 5 from "Trust" to "DMZ" "Any" "Any" "ANY" permit log
& x6 Q: n3 J% d- s! N. Vset policy id 5! o% [$ y$ k/ Z& {6 q% {) }* f
exit$ u" J! X2 k2 Y, L6 a: |
set policy id 6 from "DMZ" to "Trust" "Any" "Any" "ANY" permit log - N, I n7 [" k: i9 w: h, M
set policy id 6. C8 D( ~( G" V) a4 K9 p
exit
# _# Q% P$ K: {& a/ aset nsmgmt bulkcli reboot-timeout 60
9 r2 y) O/ h, A, @set ssh version v2
* s! u0 T( G9 Y5 ]7 Kset config lock timeout 5
# D7 X* D5 |; j' C; ^7 Aunset license-key auto-update
; [4 k4 Y' l- b+ p+ {0 @set telnet client enable8 O$ j9 t9 |) b5 C
set snmp community "ri-teng@pega" Read-Only Trap-on traffic version v2c
0 q b* ^& e9 Iset snmp host "ri-teng@pega" 0.0.0.0 0.0.0.0 src-interface ethernet0/8
$ r- z; P+ W! |& bset snmp name "RT3-xzl-1F-S-SSG140-10.131.126.2"/ B: a y! J; o/ H; z7 f9 \9 c$ k
set snmp port listen 161! W7 m: {( [/ o4 r: A) f
set snmp port trap 1623 L8 z6 S1 f, e9 i' ~1 W/ Y
set vrouter "untrust-vr"
1 v5 [, L' _ }4 wexit v) O& C' N- b" c
set vrouter "trust-vr"+ H7 d1 E! H# _" d$ l8 q
unset add-default-route2 Y3 d# X# o, {$ R0 R( |
set route 0.0.0.0/0 interface ethernet0/2 gateway 116.247.91.97 description "CT-Internet"
$ P& y; A+ C0 O. F1 a: eset route 10.0.0.0/8 interface ethernet0/8 gateway 10.131.126.13 description "OA"8 O2 M) p8 I& [7 v7 \# m
set route 0.0.0.0/0 interface ethernet0/3 gateway 140.206.34.177 description "CMCC-internet"
) h4 u; I: c* c. B5 oset route 10.131.121.0/24 interface ethernet0/6 gateway 10.131.126.28 description "DMZ") C" Y5 H* j T N5 [
exit0 F5 p0 B7 }6 G" U b" F& \
set vrouter "untrust-vr"
2 f* g+ ?/ Y h3 ]/ Aexit/ E' z6 k5 M2 M c y! m/ B
set vrouter "trust-vr"
% R z; {. O; T7 yexit
?: X' F# a# I- O) I* b
; c' p* o" v) C/ D+ W" V3 H$ r; F- Z& {) m
3_cfg1 L3 P( E/ C+ r* m6 S: z) {
& C! f$ N6 X }3 [; q
unset key protection enable6 _. X$ e) r2 b9 V. s8 s
set clock timezone 0
5 W* F, |* J4 s4 nset vrouter trust-vr sharable
/ o0 g9 |5 q2 D( L% R+ m2 _set vrouter "untrust-vr"
& u N- I/ V% E, u7 K1 s) \exit4 e& y8 I0 Y+ i
set vrouter "trust-vr"
. s! X. J$ z& Aunset auto-route-export' ~% P( Z: Q, Q
exit
* C0 ~. G0 R$ e5 m& V. a1 fset service "ACS" protocol tcp src-port 0-65535 dst-port 2002-2002
/ A; b% ?! f% cset alg appleichat enable; l x1 H( {+ h5 x Q* b
unset alg appleichat re-assembly enable! s& y2 X) H- A9 x, n; T- P
set alg sctp enable3 C* _/ L! C, Z5 @" p8 h
set auth-server "Local" id 0
4 ]; z# l+ K4 R& J1 K/ @* eset auth-server "Local" server-name "Local"
) B \3 Q) ?! R; ^0 O4 r- w' U9 nset auth default auth server "Local"
6 u1 E% p8 T9 ^/ n E0 \# Q* rset auth radius accounting port 16466 w* g% q: W; H( C( s1 q
set admin name "netscreen"
* u: n9 k- B6 ~& t, y: Kset admin password "nFWvH6rLAaPKcedPuslBexMtM8P5yn"
" E2 V( C# y* E1 j) K& Fset admin auth web timeout 103 J- m8 K/ [; j6 C3 w. J1 V5 G6 H
set admin auth server "Local"
3 l4 B& Z5 D# _+ }3 r0 R8 w2 l8 Dset admin format dos
; ]9 ^3 z, V1 K2 Cset zone "Trust" vrouter "trust-vr"
- d% t' t8 d t- bset zone "Untrust" vrouter "trust-vr"
! n$ o. _7 d6 u* Q6 w/ K9 ~set zone "DMZ" vrouter "trust-vr"0 }6 S! u; o$ L, O4 Q, O" x2 N) E
set zone "VLAN" vrouter "trust-vr"
9 K& B0 e9 }+ O3 t: n. M8 |5 Lset zone "Untrust-Tun" vrouter "trust-vr"5 \! \1 y3 F( ]% c
set zone "Trust" tcp-rst 4 ~7 ?4 ]3 b+ f# R& N' P
set zone "Untrust" block , `, Q% E2 ^' `1 M+ _( ]
unset zone "Untrust" tcp-rst
: B0 ?7 x8 k* l6 b' lset zone "MGT" block
$ U& s( k/ ] x% K( p) k0 bunset zone "V1-Trust" tcp-rst $ x, A* Q# d y! }
unset zone "V1-Untrust" tcp-rst
+ [( t/ T3 ?+ B7 B6 { wset zone "DMZ" tcp-rst
8 N [) ~/ B; Q" ]: xunset zone "V1-DMZ" tcp-rst ; Y" N/ I- h8 V- ]1 s
unset zone "VLAN" tcp-rst # r, @5 Y7 ~4 e: D; ]6 Q
set zone "Untrust" screen tear-drop" c& r6 t# Y3 \
set zone "Untrust" screen syn-flood F2 r: }$ n/ D: r& Z
set zone "Untrust" screen ping-death
% s; S7 k# J6 G. eset zone "Untrust" screen ip-filter-src
, {8 H/ d J L2 S, y7 E% Uset zone "Untrust" screen land
. Q( F- A0 n v+ `set zone "V1-Untrust" screen tear-drop
$ X* j( Q/ V B' i4 ?2 k+ X& gset zone "V1-Untrust" screen syn-flood1 V3 w1 K6 W5 }1 l
set zone "V1-Untrust" screen ping-death8 _5 N- F/ [+ M% w
set zone "V1-Untrust" screen ip-filter-src" ~. z6 J A2 K, C2 K
set zone "V1-Untrust" screen land
0 i4 H' U! \3 |set interface "ethernet0/0" zone "Null"
4 T$ J$ ^: E# ~8 Qset interface "ethernet0/1" zone "Null" g0 f1 w- ?: Z y
set interface "ethernet0/2" zone "Untrust", u' P: h9 r. p h d4 S' Z
set interface "ethernet0/3" zone "Untrust"5 Z/ h# ^& q$ ]# y
set interface "ethernet0/4" zone "HA"
- v& r$ @: z' Q" y( S; }/ Eset interface "ethernet0/5" zone "HA"
. ?- |+ b2 g( I* g- jset interface "ethernet0/6" zone "DMZ"( }& _6 @% w8 r+ a7 O
set interface "ethernet0/8" zone "Trust", f8 _! _8 Y$ g0 r0 m
unset interface vlan1 ip
- k8 i/ H9 [( z& Xset interface ethernet0/2 ip 116.247.91.98/29+ y" v w' f n8 p, A- y
set interface ethernet0/2 route7 R% q$ d7 u& v3 m! k/ `$ i$ Q
set interface ethernet0/3 ip 140.206.34.178/30
8 t- X4 {1 H2 E/ Tset interface ethernet0/3 route
$ W& L; L1 s$ e6 r# X* @/ _. G" ]set interface ethernet0/6 ip 10.131.126.18/28
# J( c% l6 o" v- \set interface ethernet0/6 nat
. R# q% {3 p5 J; Oset interface ethernet0/8 ip 10.131.126.4/28
# O$ K, ]9 a2 s$ d( G1 f+ c2 J mset interface ethernet0/8 nat
2 y# a- Y( E7 \8 uunset interface vlan1 bypass-others-ipsec
& E/ _0 M1 |% S# K0 L/ p) Dunset interface vlan1 bypass-non-ip
) f+ L! z7 r Fset interface ethernet0/2 manage-ip 116.247.91.100" A# u$ W: C0 M+ U ]4 k
set interface ethernet0/6 manage-ip 10.131.126.21
. I% Q& i% o) q+ z2 Z! s/ _% Uset interface ethernet0/8 manage-ip 10.131.126.3
+ Q( f* B$ u$ }. \set interface ethernet0/2 ip manageable' w# \& T w. b% j/ R- Z- \$ |
unset interface ethernet0/3 ip manageable' V t6 \& c6 f7 E
set interface ethernet0/6 ip manageable6 n5 {9 c( |+ H
set interface ethernet0/8 ip manageable2 `% Z9 E! H" V# h* v5 Q0 K
set interface ethernet0/2 manage ping5 R+ W/ h* M- [; ?
set interface ethernet0/2 manage ssh
( K/ |& p" h# ^' d# M$ V1 ]5 ]4 R" ]set interface ethernet0/2 manage telnet
9 g: B) m1 u: {: e1 D; v1 n* gset interface ethernet0/2 manage snmp9 O1 q& s Q J7 n+ \. M
set interface ethernet0/2 manage ssl
8 d) d4 @8 Y5 z* u$ a$ jset interface ethernet0/2 manage web
1 r+ p2 L' L: v/ d" `3 _5 T1 g1 eset interface ethernet0/3 manage ping
' C9 h" B7 Z! V, Nset interface ethernet0/3 manage ssh- d5 G$ T6 H! a0 [& y( b) z7 v. O
set interface ethernet0/3 manage telnet
- r( j3 k% _4 Cset interface ethernet0/3 manage snmp
1 @' N7 W: D0 A1 T, z4 Eset interface ethernet0/3 manage ssl# a+ ~3 ?' R& t7 g! V+ T
set interface ethernet0/3 manage web ?. V1 {3 R6 a
set interface ethernet0/6 manage ssh
0 q# f- m! M# ?: Kset interface ethernet0/6 manage telnet: X1 N: z6 m/ C9 B; f: L
set interface ethernet0/6 manage snmp" w; G4 A) g% r
set interface ethernet0/6 manage ssl8 ?; l9 O- T- d% \
set interface ethernet0/6 manage web
, A k9 H: P% {' J9 Hset interface ethernet0/2 monitor track-ip ip. m( f, d5 ?; \; b% G; s0 R8 ~
set interface ethernet0/2 monitor track-ip threshold 10: t8 x. \; l# O2 L3 x
set interface ethernet0/2 monitor track-ip ip 124.74.147.117 interval 3
. @ \0 w9 }+ _; k8 Fset interface ethernet0/2 monitor track-ip ip 124.74.147.117 weight 12
$ q4 Y R/ n& U p! c8 x0 S Kunset interface ethernet0/2 monitor track-ip dynamic: c9 ]- y5 `2 n k
unset flow no-tcp-seq-check
( C0 n8 \1 R8 {% P8 S3 E& Cset flow tcp-syn-check
! X. M4 ~2 R$ {5 Tunset flow tcp-syn-bit-check) l+ F- J4 P5 z, W; K; h
set flow reverse-route clear-text prefer
" A& l2 Y/ N0 }7 J. zset flow reverse-route tunnel always) _# f) {* E$ J: z$ A' i. H& C' o2 S
set console page 0
+ L1 n4 j- U L3 `$ h5 Hset hostname RT3-T2-5F-S-SSG140-10.131.126.3
) L+ t% w+ N4 C. j8 gset pki authority default scep mode "auto"; V4 d- s, X; G# _
set pki x509 default cert-path partial
4 v+ |- ?5 o6 z% L4 n+ [: R6 V {7 Rset nsrp cluster id 1
* G3 t5 i' i% i# I* aset nsrp cluster name FXGL* O' C. t; d, r- G5 V$ G
set nsrp rto-mirror sync
& s7 D- G9 Z4 L0 c/ t7 D! A0 ]set nsrp rto-mirror route
F& v2 V( o. ~. L A( y2 Gset nsrp vsd-group master-always-exist
1 R" K; Y, {! {. f2 dset nsrp vsd-group id 0 priority 150 N; v f4 |" r. w) N) M, |
set nsrp vsd-group id 0 preempt7 c( C7 ~) B1 r
set nsrp secondary-path ethernet0/8
8 v3 r$ u9 Z @; i. Uset nsrp vsd-group id 0 monitor interface ethernet0/3 weight 16
$ k* U$ |+ J2 G: z [+ qset nsrp vsd-group id 0 monitor track-ip ip$ p: @* R4 {* N; X
set nsrp vsd-group id 0 monitor track-ip threshold 30
! ?6 o+ u# M9 ~8 a4 h; lset nsrp vsd-group id 0 monitor track-ip ip 124.74.147.117 interface ethernet0/2" N% X6 R8 b+ W/ q+ T
set nsrp vsd-group id 0 monitor track-ip ip 124.74.147.117 interval 105 e1 c( u5 S) e) U6 M/ S: S7 Q
set nsrp vsd-group id 0 monitor track-ip ip 124.74.147.117 weight 32
6 X. Y7 O+ |- d0 a4 S# T7 \8 I' Pset nsrp vsd-group id 0 monitor track-ip ip 10.131.127.249 interface ethernet0/8; t/ W M- J/ m/ @
set nsrp vsd-group id 0 monitor track-ip ip 10.131.127.249 interval 10: U3 @% a, n. ]- w* s+ s. f& K
set nsrp vsd-group id 0 monitor track-ip ip 10.131.127.249 weight 32% A0 q3 j: m8 |
set nsrp vsd-group id 0 monitor track-ip ip 10.131.121.254 interface ethernet0/6
" L& v. _( t; @set nsrp vsd-group id 0 monitor track-ip ip 10.131.121.254 interval 10
2 E1 U0 [$ f4 ?6 e3 v5 l8 Gset nsrp vsd-group id 0 monitor track-ip ip 10.131.121.254 weight 32. l& `9 I' j/ p8 R" D& q
set nsrp ha-link probe2 q0 Q$ O' @0 A* m; |
set dns host dns1 202.96.209.5 src-interface ethernet0/2# O2 s# b! ^5 b! `) L- W6 G2 U! X
set dns host dns2 0.0.0.0
1 {, j5 ?' b" C9 u( s6 I4 m3 vset dns host dns3 0.0.0.00 `7 I& t7 J5 k
set crypto-policy
* K. K1 o- t. o% a. Gexit' | x1 V, }( V
set ike respond-bad-spi 1
1 ] f) K" u5 Z c+ w1 r% Qset ike ikev2 ike-sa-soft-lifetime 605 {3 u' g; L0 _. e) \, a
unset ike ikeid-enumeration" } g, Y2 ~7 s7 @7 k* p2 f4 D7 f
unset ike dos-protection! \! ]7 F% ^: d5 e" w1 z3 a
unset ipsec access-session enable: V% v P7 p, Q. t
set ipsec access-session maximum 5000
/ i# @) F+ j4 T% lset ipsec access-session upper-threshold 0& o0 T9 _8 ]9 L7 p) D3 P
set ipsec access-session lower-threshold 0
% _8 q0 {/ T3 w1 c) u7 y, L( c/ I6 S; vset ipsec access-session dead-p2-sa-timeout 0- T1 P" o1 u7 Z9 ]
unset ipsec access-session log-error
4 _+ f( O3 U3 dunset ipsec access-session info-exch-connected
0 ^; b: F2 E- E5 U; nunset ipsec access-session use-error-log& ^& g+ o0 c7 b9 q m3 e* @
set vrouter "untrust-vr": k. G! q r7 o0 M+ q! e3 d0 Y
exit
) Z5 } M ?8 d) wset vrouter "trust-vr"
1 Z2 `/ D( l3 e# U; J" A Yexit
6 a, T5 a3 W: _+ p# ?$ sset url protocol websense
: R0 L. O+ C: ~* H' Gexit! T/ y9 c5 |# Y4 X: Y
set policy id 1 from "Trust" to "Untrust" "Any" "Any" "ANY" permit log 3 h: E5 f( m h% e w
set policy id 11 a9 m- B, W8 v* r: w, O
exit
7 ?3 {+ ]# S# k4 pset policy id 4 from "DMZ" to "Untrust" "Any" "Any" "ANY" nat src permit log
% E; v; n. I* lset policy id 4# D3 o8 s; V7 U
exit4 |9 b/ T! m; Q. z8 P9 i
set policy id 5 from "Trust" to "DMZ" "Any" "Any" "ANY" permit log
& }" \7 a e( n: yset policy id 5 b7 X. v0 m9 a# o# n# K7 C
exit
% B' E* l* ]" Z3 P5 Nset policy id 6 from "DMZ" to "Trust" "Any" "Any" "ANY" permit log 1 B- o t: C; R | [( u5 T
set policy id 65 ~+ d* p! h( m5 ~4 W" a/ c+ g( ^& n
exit! ?; l2 h4 f6 q& E2 t9 q; [$ J& k# U
set nsmgmt bulkcli reboot-timeout 60( C; c8 P* L6 u8 I
set ssh version v2
' {7 \9 y A0 n& Q" A9 sset config lock timeout 5
, i0 h: B8 }6 C9 J7 u, iunset license-key auto-update t7 q, g, y4 C9 X% k9 b1 Q! D8 A7 @
set telnet client enable
8 Z3 g* I: j0 C& l3 O" Aset snmp community "ri-teng@pega" Read-Only Trap-on traffic version v2c
$ B/ U2 s) {. z: C" x4 Lset snmp host "ri-teng@pega" 0.0.0.0 0.0.0.0 src-interface ethernet0/8 & H! ] T- |7 D+ a$ N# r
set snmp port listen 161
) E* p D: U9 U: {! y/ ~set snmp port trap 162
' [ ^5 Q# @3 F% B" z {6 zset vrouter "untrust-vr"! c( C# x+ `& D2 C8 R4 d1 D
exit
7 x4 H& p m$ L' ^1 }set vrouter "trust-vr"5 a& ^) @$ m7 u
unset add-default-route7 M. x% K5 Z4 y4 E" [% w7 ~/ B
set route 0.0.0.0/0 interface ethernet0/2 gateway 116.247.91.97 description "CT-Internet"
\6 `% l5 |: k2 q) A9 Q; Uset route 10.0.0.0/8 interface ethernet0/8 gateway 10.131.126.13 description "OA"& A2 R0 a% J0 t
set route 0.0.0.0/0 interface ethernet0/3 gateway 140.206.34.177 description "CMCC-internet"
5 i. Q# }# R0 U8 s& T, e& xset route 10.131.121.0/24 interface ethernet0/6 gateway 10.131.126.28 description "DMZ"- c' k" d9 J# O j+ l- d
exit
/ l1 o. L: Y6 y1 L0 D7 I! @# \& ~* @set vrouter "untrust-vr"
9 D' F, T# p6 h- vexit
) q8 E6 i8 d. K1 n& Vset vrouter "trust-vr"
8 c6 z6 N3 a5 _" Dexit |
所有IT类厂商认证考试题库下载
【新盟教育】2023最新华为HCIA全套视频合集【网工基础全覆盖】---国sir公开课合集
【新盟教育】网工小白必看的！2023最新版华为认证HCIA Datacom零基础全套实战课
原创_超融合自动化运维工具cvTools
重量级~~30多套JAVA就业班全套 视频教程（请尽快下载，链接失效后不补）
链接已失效【超过几百G】EVE 国内和国外镜像 全有了 百度群分享
某linux大佬，积累多年的电子书(约300本)
乾颐堂现任明教教主Python完整版
乾颐堂 教主技术进化论 2018-2019年 最新31-50期合集视频（各种最新技术杂谈视频）
Python学习视频 0起点视频 入门到项目实战篇 Python3.5.2视频教程 共847集 能学102天
约21套Python视频合集 核心基础视频教程（共310G,已压缩）
最新20180811录制 IT爱好者-清风羽毛 - 网络安全IPSec VPN实验指南视频教程
最新20180807录制EVE开机自启动虚拟路由器并桥接物理网卡充当思科路由器
[复制链接]
