以下是netscreen 防火墙active-passive典型配置：
! ]3 Y: x Q7 `+ i, ^/ e2_cfg
! w- K8 m+ y, m% D2 c8 A2 i: m% M
unset key protection enable3 m& \3 x9 w% A6 n
set clock timezone 0
( L3 r# ]9 X% g% q' u/ h$ yset vrouter trust-vr sharable
* O/ |1 i# R* Lset vrouter "untrust-vr". }) n1 I& S6 K0 ? D- J( S- y
exit7 d2 u& n/ W" |9 F( }
set vrouter "trust-vr"; M G. j; g1 J3 I- M A( \& Y) p
unset auto-route-export- a* \0 ?) ]5 w- e
exit- ?) Q; O' n2 c$ H, X9 p7 s
set service "ACS" protocol tcp src-port 0-65535 dst-port 2002-2002
- ^( Y, b e/ N1 Pset alg appleichat enable
/ W& M. L. e* s( L1 Dunset alg appleichat re-assembly enable$ g" y& E- i5 @, a! U, y3 p6 t
set alg sctp enable0 o6 B6 W, B' I7 x/ Q
set auth-server "Local" id 0
# T } f* b- p( ^. Zset auth-server "Local" server-name "Local"
% p# b, i* O; n" b+ Z9 Cset auth default auth server "Local": o, |: m2 G' C/ P9 U- [
set auth radius accounting port 1646: l9 P$ b* B% Y- v' H/ |
set admin name "netscreen"4 b' y4 F1 ?) ^" c
set admin password "nFWvH6rLAaPKcedPuslBexMtM8P5yn"5 l& g, q# I W3 V( X/ S' O
set admin auth web timeout 10 H( Y6 F0 ]& V3 }% Y/ l1 p0 H
set admin auth server "Local"
7 L, |) r* P8 ~6 {; N- s, @set admin format dos& W9 o5 B) L3 D& u- g
set zone "Trust" vrouter "trust-vr"+ e% r; c" o& e" H& x3 ?$ I" H. w
set zone "Untrust" vrouter "trust-vr"4 ?0 L- r6 Z6 ]( H1 I0 `
set zone "DMZ" vrouter "trust-vr"
/ T. L; _& w8 p% A5 [, d! cset zone "VLAN" vrouter "trust-vr"
u9 H% H4 T. l2 Yset zone "Untrust-Tun" vrouter "trust-vr"( R q6 A: {. X! c1 [; K- l5 b
set zone "Trust" tcp-rst
: T" v n- U8 c2 n% oset zone "Untrust" block
6 U/ r) }( v8 F9 Yunset zone "Untrust" tcp-rst ; ?! @& v' J3 B9 ~( w- U. h% ~
set zone "MGT" block ; G/ o) n ]" g2 [6 f, M
unset zone "V1-Trust" tcp-rst " j/ d% ~# B# Z& s m! a: c
unset zone "V1-Untrust" tcp-rst
2 O. g' C5 W3 y- _+ }( Uset zone "DMZ" tcp-rst
4 g$ V0 k, k( |9 e2 N9 ounset zone "V1-DMZ" tcp-rst
" Q/ V2 n, z) \5 L$ m8 Z6 |8 Zunset zone "VLAN" tcp-rst $ T, e1 k: h" K1 t$ K/ f. b
set zone "Untrust" screen tear-drop- N1 L, {; s; Z" A" Q& k$ c! E/ g
set zone "Untrust" screen syn-flood. B# L }; j# T$ a0 K* E8 f" L
set zone "Untrust" screen ping-death+ O/ s L) k5 g6 a
set zone "Untrust" screen ip-filter-src; b# k- I. P, O' S2 t- b l
set zone "Untrust" screen land
" i" S6 F! ]. k1 V! x" s' Mset zone "V1-Untrust" screen tear-drop- v6 Y5 d- [- U* _8 O+ B4 J( {3 M* n
set zone "V1-Untrust" screen syn-flood- T( _9 |' u7 C5 a0 L. I- s% T+ H) a
set zone "V1-Untrust" screen ping-death4 i6 ~, A- z! M- y
set zone "V1-Untrust" screen ip-filter-src
4 ~; e) U$ V5 C; `3 m8 r6 w7 lset zone "V1-Untrust" screen land. l4 l4 v0 L1 v% z6 e5 c
set interface "ethernet0/0" zone "Null"
1 k: U' S m1 { p! ~set interface "ethernet0/1" zone "Null"! e7 z4 D+ }- A/ r8 ^. t* l
set interface "ethernet0/2" zone "Untrust"+ h- m4 o1 `0 ?( R- S3 L
set interface "ethernet0/3" zone "Untrust"
* H7 O% E" {' @4 T: l* L, Zset interface "ethernet0/4" zone "HA"
. D8 G* ~7 _; ~set interface "ethernet0/5" zone "HA"3 r9 t; i9 {' ?- u# t" A+ }
set interface "ethernet0/6" zone "DMZ"
/ J7 P( p7 o! x* U1 f# A+ |2 Wset interface "ethernet0/8" zone "Trust"
# g- \) J9 A" d4 @. P+ ]( [unset interface vlan1 ip
6 Z/ O( }# v7 t' I" Z5 dset interface ethernet0/2 ip 116.247.91.98/29
) Y8 C5 Q! L2 y; k7 T9 xset interface ethernet0/2 route1 Y+ k! O1 c/ _8 `9 _. Y
set interface ethernet0/3 ip 140.206.34.178/304 }3 @5 X2 `2 U2 V0 J
set interface ethernet0/3 route% u( O! q( j u' b" }/ Q& D1 p
set interface ethernet0/6 ip 10.131.126.18/286 |6 b A9 Z" G+ p
set interface ethernet0/6 nat
8 E+ ^+ Y% P" R8 Y4 J+ a( u9 H, o) {set interface ethernet0/8 ip 10.131.126.4/28$ Q5 c1 k2 A) i% i
set interface ethernet0/8 nat
% B/ z m: O( i5 Q; Vunset interface vlan1 bypass-others-ipsec
0 a# ~6 y7 p, y' Y3 `* \6 I' ?6 funset interface vlan1 bypass-non-ip
: c4 B& C+ Y6 B p' u' lset interface ethernet0/2 manage-ip 116.247.91.99
8 L2 l. _$ @4 G$ n0 g4 [set interface ethernet0/6 manage-ip 10.131.126.20) t7 N/ T1 K+ R# I) T" Q/ S/ M, }! D, g
set interface ethernet0/8 manage-ip 10.131.126.28 o9 q I4 P7 n3 U
set interface ethernet0/2 ip manageable# v( a$ J# D* u! Z2 t/ j, U
unset interface ethernet0/3 ip manageable0 i. g4 \0 S \5 C6 ^
set interface ethernet0/6 ip manageable
: M- `* x! A% u' gset interface ethernet0/8 ip manageable
: q+ l) [2 ^( R" tset interface ethernet0/2 manage ping
- j9 j. P& @2 H5 nset interface ethernet0/2 manage ssh
~' R; k- Y# f7 Aset interface ethernet0/2 manage telnet2 _+ g) Q: |8 S& m9 I$ R- c7 k' O
set interface ethernet0/2 manage snmp: _8 F B2 N( M
set interface ethernet0/2 manage ssl
5 c, S3 Z9 u( j4 S" Lset interface ethernet0/2 manage web
. P' n+ Y. z( d( {8 E* ^set interface ethernet0/3 manage ping5 j2 Z8 t8 }$ ~. K: z
set interface ethernet0/3 manage ssh7 l- p7 ]' B% T! J6 N
set interface ethernet0/3 manage telnet
# T* t6 V) W* Wset interface ethernet0/3 manage snmp
* _; H# e* V* f. ?, d0 F. J5 hset interface ethernet0/3 manage ssl1 Q. `! M! v# |/ H
set interface ethernet0/3 manage web
$ W+ N2 {- E5 Z0 G2 }( `# T/ Sset interface ethernet0/6 manage ssh
/ y" i' o1 b) Z1 n+ T, {6 j7 f4 Kset interface ethernet0/6 manage telnet
3 Q; ]. c- @9 M$ i/ ?4 M8 Bset interface ethernet0/6 manage snmp6 d0 ] n; h, U* X$ h% L
set interface ethernet0/6 manage ssl9 f% x# K Q# \/ A+ S3 H F3 ~
set interface ethernet0/6 manage web0 p4 \: r4 n( V& q( s% G1 j
set interface ethernet0/2 monitor track-ip ip
- O/ Q4 a5 F* Z! f2 Wset interface ethernet0/2 monitor track-ip threshold 10# w( E* O. k1 H
set interface ethernet0/2 monitor track-ip ip 124.74.147.117 interval 3 S& g; d* Y* k- l
set interface ethernet0/2 monitor track-ip ip 124.74.147.117 weight 12
% W' X7 I. E0 Z5 b% G% G' [7 runset interface ethernet0/2 monitor track-ip dynamic
- t& [% R: l0 j( yunset flow no-tcp-seq-check
; Y h" r0 V* w- ~+ |set flow tcp-syn-check9 t5 e& k6 c: [; _) f9 R
unset flow tcp-syn-bit-check" ]$ \6 j1 v! h i) u- i
set flow reverse-route clear-text prefer" K/ D& k# p( O5 J+ W* g3 F' k" m8 s
set flow reverse-route tunnel always7 G! f9 B8 z/ A5 P/ b
set console page 0
* B ^. W% W$ q+ A9 o9 e Cset hostname RT3-xzl-1F-S-SSG140-10.131.126.2
6 b0 g4 g: d( M' r# [- ]) Xset pki authority default scep mode "auto"* @- s v$ l. Q% R D
set pki x509 default cert-path partial
: m/ M4 ~: b+ s1 B! ~3 U2 f0 fset nsrp cluster id 1
! f& c8 ~0 T7 L% L: `# Aset nsrp cluster name FXGL3 {+ t7 G* e8 K) a2 v- ^
set nsrp rto-mirror sync4 _& J0 h7 i' F6 Q. f
set nsrp rto-mirror route8 F* _7 b, F# O& I; M
set nsrp vsd-group master-always-exist
- f* I* M* \8 c5 Y3 u% J; \' rset nsrp vsd-group id 0 priority 100- O& Y h' t; `# g, ~$ Y. X
set nsrp vsd-group id 0 preempt4 ]: Q# s5 O* @. n" Y
set nsrp secondary-path ethernet0/83 n# a# B: S) G* q
set nsrp vsd-group id 0 monitor interface ethernet0/3 weight 16. a" [3 `9 u% B$ V- s# H6 Z
set nsrp vsd-group id 0 monitor track-ip ip
: v9 j. r' L" b! bset nsrp vsd-group id 0 monitor track-ip threshold 30, P6 T( o, ~' k2 k
set nsrp vsd-group id 0 monitor track-ip ip 124.74.147.117 interface ethernet0/2
4 J; T% J- L$ ~* ^set nsrp vsd-group id 0 monitor track-ip ip 124.74.147.117 interval 10% d$ v1 ]3 b( G0 m
set nsrp vsd-group id 0 monitor track-ip ip 124.74.147.117 weight 32' F8 r8 J* H7 F7 N w5 y# z% a
set nsrp vsd-group id 0 monitor track-ip ip 10.131.121.254 interface ethernet0/6
1 x* b0 Q" K! D/ ^+ Y# K" @set nsrp vsd-group id 0 monitor track-ip ip 10.131.121.254 interval 10. c* |9 g6 e. ?$ R5 P' R
set nsrp vsd-group id 0 monitor track-ip ip 10.131.121.254 weight 32( i1 z) ?( R( {7 k* m
set nsrp vsd-group id 0 monitor track-ip ip 10.131.127.249 interface ethernet0/80 {, p0 b, n" r- K
set nsrp vsd-group id 0 monitor track-ip ip 10.131.127.249 interval 10
7 m4 o& u! I" K t" L4 f6 [set nsrp vsd-group id 0 monitor track-ip ip 10.131.127.249 weight 32! P# _* |/ G% R: N
set nsrp ha-link probe
_9 d# Z3 |2 i$ }5 B/ k' {set dns host dns1 202.96.209.5 src-interface ethernet0/23 t0 B$ @5 b* E0 f; K9 C
set dns host dns2 0.0.0.0
: w' ]6 F( T8 Y# c4 ^, j6 V' Vset dns host dns3 0.0.0.0$ ~) V4 ^, s! u+ k& K8 F! i1 _
set crypto-policy/ n1 m& k2 q! q/ k( H
exit
& E% l/ T9 L$ k' }+ O# Gset ike respond-bad-spi 1
* G. f" I n4 c5 rset ike ikev2 ike-sa-soft-lifetime 60; K" c) p# E5 ^8 }( f, w$ E
unset ike ikeid-enumeration
# e; F2 n# j& S0 y$ Aunset ike dos-protection. W0 Q% y- K2 U. I( M
unset ipsec access-session enable
$ \$ \( u2 E' f5 w0 Z9 u j. j1 tset ipsec access-session maximum 5000) I, O( m5 O6 G6 A
set ipsec access-session upper-threshold 0
) v5 X) S4 e/ C9 zset ipsec access-session lower-threshold 0
0 I: j! [1 c8 mset ipsec access-session dead-p2-sa-timeout 0! O/ m5 a) u' L" |: `8 a
unset ipsec access-session log-error
0 X/ r3 ]% L* K, y: P3 lunset ipsec access-session info-exch-connected
2 {- ^" x( Y0 L' b; S' u5 g6 Cunset ipsec access-session use-error-log
2 q% F8 I# S. ]* v& y7 {set vrouter "untrust-vr"
$ k1 N' y5 |3 a2 q* b* z8 bexit& j/ s1 d4 o* J& ^: @
set vrouter "trust-vr"
) h1 z! ]$ C# Sexit
1 l$ X% m9 J; o, K$ t' R9 T4 iset url protocol websense8 Y& Y) Q/ G, L6 ^5 ]2 t7 W) P
exit
/ H9 w1 K5 P* ^/ z" A6 @set policy id 1 from "Trust" to "Untrust" "Any" "Any" "ANY" permit log 7 K( u4 @5 j& Y. S/ f
set policy id 1
5 }: Y3 D w5 b* Y' Sexit
4 \" J( Z) H. x$ p4 H- Vset policy id 4 from "DMZ" to "Untrust" "Any" "Any" "ANY" nat src permit log 7 D# o% n! \4 I
set policy id 48 I/ e [3 P& q
exit/ _; H* T* ], B
set policy id 5 from "Trust" to "DMZ" "Any" "Any" "ANY" permit log
( I/ H' f. z! b* a; Gset policy id 5
* u- g- Z$ ~8 M! V. e0 {" Oexit N9 o/ d3 S6 \, G$ m5 G1 a1 F# w! q
set policy id 6 from "DMZ" to "Trust" "Any" "Any" "ANY" permit log
3 A% A5 }/ C. vset policy id 6* t% n. N0 j0 E9 n0 c! O- c
exit& V2 i$ j4 Y7 n% p0 q. i
set nsmgmt bulkcli reboot-timeout 604 J) P. n3 a; `# j( ]* _( V! v) K p
set ssh version v2
% j+ z/ @; e" J9 K# ~set config lock timeout 5
5 C* p9 X6 T" k7 Iunset license-key auto-update
% H9 Q1 A/ ?( V6 F. p; p7 j; _8 `set telnet client enable3 Y4 u, E( u( d) |4 v6 w8 f0 W+ _
set snmp community "ri-teng@pega" Read-Only Trap-on traffic version v2c
$ G$ h- @5 S0 j0 `* q9 Hset snmp host "ri-teng@pega" 0.0.0.0 0.0.0.0 src-interface ethernet0/8 3 f( W o6 I; ?' B7 d2 J# ]
set snmp name "RT3-xzl-1F-S-SSG140-10.131.126.2"& X N& L. E. r3 R" T) k* S( E
set snmp port listen 1610 [* o" `% s4 V7 M! z: n3 ^
set snmp port trap 162
8 T4 N# K; c8 a' i! Q# A0 Mset vrouter "untrust-vr"! [& Z! y0 m5 k8 K4 X. x# G
exit+ y& k! t% x- ~& m8 g9 M$ N5 ?' }6 A
set vrouter "trust-vr"
8 @- @' I3 @: {5 @; gunset add-default-route- ~2 K d0 o) m3 o& }$ x% a
set route 0.0.0.0/0 interface ethernet0/2 gateway 116.247.91.97 description "CT-Internet"
8 P3 C& j9 U; V+ I1 K1 ], vset route 10.0.0.0/8 interface ethernet0/8 gateway 10.131.126.13 description "OA"$ k% T" D! e1 L, B: A2 F; {
set route 0.0.0.0/0 interface ethernet0/3 gateway 140.206.34.177 description "CMCC-internet"
/ s7 x6 L4 r& w8 w/ kset route 10.131.121.0/24 interface ethernet0/6 gateway 10.131.126.28 description "DMZ"* [2 w* S& F) {5 W- ]* g. A0 G
exit
, ~& Q4 ?4 I1 ^* Gset vrouter "untrust-vr"* z4 e7 V1 k$ A4 w
exit
2 I! t) B' D3 U0 q! I) g7 k9 p, `2 [set vrouter "trust-vr"
& j7 {" A. \) @8 y0 nexit
, P% @! P+ w, c0 D% U9 i) ?1 d8 N* O0 U/ o5 ]) U
& S$ \- F6 g/ W2 b5 j
3_cfg- h4 g% i I, v
; b, k2 [/ R4 W1 W& \unset key protection enable
4 l& u8 G5 \# r/ v, Z, Kset clock timezone 0
- W: u5 E* i1 Z& A' ~2 Aset vrouter trust-vr sharable
+ D g# l0 }9 H& V, J# ~. Xset vrouter "untrust-vr"/ ^0 l. E7 g6 x3 }6 C, i
exit7 _. |; d. _* n, R/ g5 h- m
set vrouter "trust-vr"1 F) C' Q( m( H% v C( _- u3 {2 J
unset auto-route-export
# Z1 l1 P8 R/ |1 I; hexit
& `" r% a% j' ?; q8 `set service "ACS" protocol tcp src-port 0-65535 dst-port 2002-2002 ' U: m* C% Y: Q. p# E. e
set alg appleichat enable r; Y' Y1 e1 V" E2 F c
unset alg appleichat re-assembly enable
' E( Y: g! t& B' S2 x/ [8 Qset alg sctp enable
D6 W) l/ f- ~ t- [) ` Nset auth-server "Local" id 0( l: R9 w8 a3 Z. K" f8 l* e
set auth-server "Local" server-name "Local"
' Q# O" N: \6 E5 g. Bset auth default auth server "Local"& S F: W$ l# K( F% g3 x
set auth radius accounting port 1646" ]! [9 \1 |: ~( y
set admin name "netscreen"4 b5 K' Q0 T, d) k
set admin password "nFWvH6rLAaPKcedPuslBexMtM8P5yn"
( u a4 P& L& b* ^8 @% X' }" y" }set admin auth web timeout 10
0 T& Q2 n N3 R z, Q1 { t$ ^set admin auth server "Local"
+ b; y, P0 k' Q) l& R' Cset admin format dos
, f0 ?3 I; ~" U" eset zone "Trust" vrouter "trust-vr"* Q, x: R$ a* }. `
set zone "Untrust" vrouter "trust-vr"
; R4 e1 {# W) H+ i9 u/ _1 _set zone "DMZ" vrouter "trust-vr"# J- y* k u5 f3 M
set zone "VLAN" vrouter "trust-vr"7 U3 n0 Z9 H" _0 F
set zone "Untrust-Tun" vrouter "trust-vr"* S: w& Z6 k% [: ]) b0 F
set zone "Trust" tcp-rst " U3 }! U- }, Q$ Y9 D7 i5 y& l
set zone "Untrust" block
2 N/ Q% a. U0 ~# r6 w0 Eunset zone "Untrust" tcp-rst
W6 W6 o# a7 O; c3 F0 p) wset zone "MGT" block
( |4 K2 m7 @4 G& j) S9 i: h; B$ E% hunset zone "V1-Trust" tcp-rst
5 }5 g3 a3 q" \unset zone "V1-Untrust" tcp-rst
0 X5 P z( t. o+ Y( @& m8 Aset zone "DMZ" tcp-rst 3 _& Q* u) d1 ?) {6 M' u" B/ [4 R
unset zone "V1-DMZ" tcp-rst
8 r) L" X# C* m$ gunset zone "VLAN" tcp-rst 9 y/ O1 `$ F; k, ?
set zone "Untrust" screen tear-drop& R& q! b$ j% s- K4 ~
set zone "Untrust" screen syn-flood
6 T: L( N1 p( e* F# ^: B; a Yset zone "Untrust" screen ping-death3 ]% c- E6 x5 \. K5 j1 I) P3 {$ {
set zone "Untrust" screen ip-filter-src0 V$ D+ }2 N+ k5 _! n
set zone "Untrust" screen land" g1 ?# X1 O& O R
set zone "V1-Untrust" screen tear-drop
$ _% {* `& T! ^) pset zone "V1-Untrust" screen syn-flood
+ u; m5 P' c" l! f7 C7 E) Zset zone "V1-Untrust" screen ping-death- ?& s' V ~0 a$ o* H8 S; I, `
set zone "V1-Untrust" screen ip-filter-src/ r/ L9 W" s& \# y h6 t
set zone "V1-Untrust" screen land
6 H; ?2 K6 f5 x7 J* u* ^. Bset interface "ethernet0/0" zone "Null"
& ]- F1 Z0 N& M* c n( aset interface "ethernet0/1" zone "Null"
6 h3 c7 O# o/ G' U3 Yset interface "ethernet0/2" zone "Untrust"9 S+ T B+ f. [) a6 V$ P2 l& b
set interface "ethernet0/3" zone "Untrust"
1 S6 z g9 S2 j8 Y& i7 }* qset interface "ethernet0/4" zone "HA"
6 d5 T; [6 ^% v; c+ L* kset interface "ethernet0/5" zone "HA"# Z9 }, t9 u' J) {+ a0 D; M
set interface "ethernet0/6" zone "DMZ"" N* b8 X p/ p
set interface "ethernet0/8" zone "Trust"% |) Z# H( @1 z# B$ C6 K
unset interface vlan1 ip# y y8 }# i- n
set interface ethernet0/2 ip 116.247.91.98/295 {- Y4 z; R! B _; v! `
set interface ethernet0/2 route
- K J/ @6 C4 o$ }0 tset interface ethernet0/3 ip 140.206.34.178/30
! l" V2 {9 F5 o. C6 u4 Lset interface ethernet0/3 route) w' z5 r& F/ O. g5 z
set interface ethernet0/6 ip 10.131.126.18/282 w H* T; Q' X- ^ s: C
set interface ethernet0/6 nat
0 s( j$ c V! B1 V7 Iset interface ethernet0/8 ip 10.131.126.4/28- q5 d% t6 I4 ^6 g$ c- f. g
set interface ethernet0/8 nat
/ P& G7 e0 y- ?. s2 A" C1 Eunset interface vlan1 bypass-others-ipsec* q f. G" b2 x4 h# ^
unset interface vlan1 bypass-non-ip
* B7 `; q( C& M8 fset interface ethernet0/2 manage-ip 116.247.91.100
4 v7 s* ?: @7 x3 y7 i2 Bset interface ethernet0/6 manage-ip 10.131.126.21
# x3 w1 |9 ~& bset interface ethernet0/8 manage-ip 10.131.126.3( w: J, z% w& d: j
set interface ethernet0/2 ip manageable
5 v* _8 n' o- ]3 Eunset interface ethernet0/3 ip manageable( P5 ?" y5 y4 Y" X" r! y: ~
set interface ethernet0/6 ip manageable8 \% I9 ]& W6 V$ y: I
set interface ethernet0/8 ip manageable
9 O G5 s, k5 B' @3 y% w& Xset interface ethernet0/2 manage ping/ m: T. {% f3 G% e# d4 n
set interface ethernet0/2 manage ssh# ]: u% k! m' k g4 O; ]
set interface ethernet0/2 manage telnet
8 Y5 |% r0 a# f9 D1 t6 ]2 [set interface ethernet0/2 manage snmp8 e! x; p. h% Z ]& x' o
set interface ethernet0/2 manage ssl
* Z: c |, v% I O' t5 jset interface ethernet0/2 manage web
) T0 @/ r' B [& ^% W# Nset interface ethernet0/3 manage ping+ ]3 W- r4 v; o% `. x2 |; _% S0 C
set interface ethernet0/3 manage ssh2 b( v4 [, z1 ]( f) o U$ r# ]
set interface ethernet0/3 manage telnet
9 K! k6 G- \: [ r/ s* |9 {set interface ethernet0/3 manage snmp9 B3 ~5 c$ `' |3 m0 J
set interface ethernet0/3 manage ssl& s! P( r8 b! v( ]1 {2 }3 F- A
set interface ethernet0/3 manage web' t; O% f- s- Q7 {
set interface ethernet0/6 manage ssh5 q" s. g1 p5 m5 m$ }. [
set interface ethernet0/6 manage telnet
n4 r" h3 i9 O( b( P2 sset interface ethernet0/6 manage snmp
1 x6 F6 F! _4 {set interface ethernet0/6 manage ssl% q0 S/ z+ }! U5 T& e) X) D( R
set interface ethernet0/6 manage web
. z; t8 X; Q2 D7 r( cset interface ethernet0/2 monitor track-ip ip4 b; b G( D! d8 T* N9 l5 t8 N! O
set interface ethernet0/2 monitor track-ip threshold 103 ^/ |% }9 ~5 `$ ?& _) w+ G
set interface ethernet0/2 monitor track-ip ip 124.74.147.117 interval 3
i* k9 F+ Z; Kset interface ethernet0/2 monitor track-ip ip 124.74.147.117 weight 12# P O6 R' w. Q' O" s/ q
unset interface ethernet0/2 monitor track-ip dynamic) Y4 S" p# T# N8 l( c3 A. F) m3 w; d
unset flow no-tcp-seq-check/ G2 g O8 [; X* R$ A$ \9 F) D: D1 Z) F) C
set flow tcp-syn-check" k' V2 f( V) n0 R, g
unset flow tcp-syn-bit-check+ I. w+ }2 C& [) n$ |" T5 s
set flow reverse-route clear-text prefer
" D" `5 k H }' wset flow reverse-route tunnel always
, Y/ U. [/ M* C: N* o3 p2 N4 h9 [set console page 0
* j2 k! X7 r4 x H) `$ l3 Uset hostname RT3-T2-5F-S-SSG140-10.131.126.3
6 o w3 N. }0 x4 _, ~set pki authority default scep mode "auto"# H. l6 ? a8 H
set pki x509 default cert-path partial
: S, @" K, z4 R& e7 C3 `set nsrp cluster id 1
0 U4 `8 P6 B# U' y2 Mset nsrp cluster name FXGL, V3 ^. a7 i& A! \4 ]; @
set nsrp rto-mirror sync0 s2 }: ]4 ]- @/ j
set nsrp rto-mirror route
' a; e+ l& W. K' x. k- sset nsrp vsd-group master-always-exist/ g# S# i3 n) M9 m, I6 k: k- `
set nsrp vsd-group id 0 priority 150
4 y4 N# l5 v( q. u# d* T6 i( Cset nsrp vsd-group id 0 preempt
$ j" u4 Y. o" \& f$ T5 n, d1 P/ m1 jset nsrp secondary-path ethernet0/8
5 L& l7 H* r0 ~set nsrp vsd-group id 0 monitor interface ethernet0/3 weight 16
4 x" y% Z0 }. z" C3 Xset nsrp vsd-group id 0 monitor track-ip ip7 T& m6 P& S0 e4 s$ ]9 ]
set nsrp vsd-group id 0 monitor track-ip threshold 306 z& z% ?! d E5 {. Z, a
set nsrp vsd-group id 0 monitor track-ip ip 124.74.147.117 interface ethernet0/2
8 e3 D0 e% b& s/ ~8 T g3 K. bset nsrp vsd-group id 0 monitor track-ip ip 124.74.147.117 interval 10
" r- ?' l' }; @& ^4 {4 B! Z# y7 gset nsrp vsd-group id 0 monitor track-ip ip 124.74.147.117 weight 32
: `- [; B4 ~- h. `* R4 K* t/ J/ ~set nsrp vsd-group id 0 monitor track-ip ip 10.131.127.249 interface ethernet0/8
0 H! C' J- \* T' p$ W8 qset nsrp vsd-group id 0 monitor track-ip ip 10.131.127.249 interval 10
5 q0 Z$ Q' |6 [set nsrp vsd-group id 0 monitor track-ip ip 10.131.127.249 weight 32
. t. v# S- [" P& t7 mset nsrp vsd-group id 0 monitor track-ip ip 10.131.121.254 interface ethernet0/6
' f$ K1 X( [" _/ J5 _set nsrp vsd-group id 0 monitor track-ip ip 10.131.121.254 interval 10
, D+ t2 ~5 I" zset nsrp vsd-group id 0 monitor track-ip ip 10.131.121.254 weight 32
7 L* v/ ^- h7 V; E0 mset nsrp ha-link probe7 O( _( q* M8 S
set dns host dns1 202.96.209.5 src-interface ethernet0/2' P- g6 O9 M J9 [6 `1 U
set dns host dns2 0.0.0.02 R; f {& X" \2 e5 h& z( Y
set dns host dns3 0.0.0.0
# @ t3 G" ^5 s4 d2 Nset crypto-policy2 A7 ~7 x) V5 d; u4 F% {" d( F
exit- T- C- t2 t: O$ i& L' T
set ike respond-bad-spi 1
# Y. Q) d# ^& M' L5 Q2 ]( \set ike ikev2 ike-sa-soft-lifetime 604 T( G+ i) t _9 d, z" \
unset ike ikeid-enumeration+ t. X# _# d G! G0 u4 n4 {( l
unset ike dos-protection. X2 x7 `0 M: \; z; y0 l
unset ipsec access-session enable
* @) J9 |; N' uset ipsec access-session maximum 5000
8 K8 }7 G6 ^6 _set ipsec access-session upper-threshold 0
9 T6 T) [7 M- N* r/ z) \/ }set ipsec access-session lower-threshold 0
4 _ U& C; {. P3 V) Z& {set ipsec access-session dead-p2-sa-timeout 05 @& p4 j4 j6 K- A3 G# ]0 [
unset ipsec access-session log-error
( ]# h8 m# c; V' P* ^" Gunset ipsec access-session info-exch-connected+ V. P v$ @2 Z* Z9 f+ H
unset ipsec access-session use-error-log9 ?5 y+ D( }# H3 E* Q5 h D
set vrouter "untrust-vr"
, D. E; Z2 j. H; o# oexit. I0 Z, O$ r0 F5 h/ A
set vrouter "trust-vr"
+ h9 F" A8 q1 A7 ~6 t: Vexit7 L. L L) n, G" [( _2 i
set url protocol websense ^# s( N0 ]1 V" v6 p) I9 J# E' y W
exit' f- Z3 L" p/ t! F2 Q7 {0 w7 e
set policy id 1 from "Trust" to "Untrust" "Any" "Any" "ANY" permit log
* c' M6 s+ o5 r8 `) g* Xset policy id 1. W& k. k+ {- r6 p
exit
5 v* P2 A0 H X9 A( a! y7 _! Kset policy id 4 from "DMZ" to "Untrust" "Any" "Any" "ANY" nat src permit log
; l+ Q9 o H% @0 ?set policy id 4
5 L3 R2 B7 R" a# }9 ?4 P1 j0 cexit/ d% U; t& l. Z. ^/ r- q& l* ^
set policy id 5 from "Trust" to "DMZ" "Any" "Any" "ANY" permit log , F+ b5 B3 [1 f8 _* `( N8 G; O9 v
set policy id 5! y7 V% P5 @: P7 s3 ` b8 D+ i& O
exit# a/ L9 X3 L. V8 I. h
set policy id 6 from "DMZ" to "Trust" "Any" "Any" "ANY" permit log
/ _" W8 ]9 L& [- c- W0 \' _set policy id 6
7 V( ?) \ Z4 v9 [2 C8 V* Y1 jexit
# m- W. j7 q- X' B- {. qset nsmgmt bulkcli reboot-timeout 60
8 {( f0 K' h. G5 Tset ssh version v2
! R" V8 V$ _3 {9 Cset config lock timeout 5( S7 Y, |4 z( _9 {
unset license-key auto-update5 E/ k8 `- ?5 ]9 z# t+ p
set telnet client enable
) a F) v. ?! G) fset snmp community "ri-teng@pega" Read-Only Trap-on traffic version v2c
( I1 O ~& l& K1 s& N tset snmp host "ri-teng@pega" 0.0.0.0 0.0.0.0 src-interface ethernet0/8
6 O4 q, K/ |! t F) Lset snmp port listen 1616 D" k; O- B( l$ L
set snmp port trap 162
- ~! N2 E p* F$ X* Dset vrouter "untrust-vr"& S/ A; O$ B; @8 j
exit
! ^' g0 V- ]+ X/ [' Q% v [, Fset vrouter "trust-vr"
* L1 A1 h2 H l* Munset add-default-route2 _; }2 k' Y* r( M1 Y" y. K$ V
set route 0.0.0.0/0 interface ethernet0/2 gateway 116.247.91.97 description "CT-Internet"0 K' L, Z0 P) C6 q
set route 10.0.0.0/8 interface ethernet0/8 gateway 10.131.126.13 description "OA"- H" H/ d+ o, V( O# k. o8 d0 f
set route 0.0.0.0/0 interface ethernet0/3 gateway 140.206.34.177 description "CMCC-internet"
" l+ C; U, W9 T/ I1 s# Nset route 10.131.121.0/24 interface ethernet0/6 gateway 10.131.126.28 description "DMZ") I0 y0 [& }# }7 u3 U# {9 l
exit
" [% A7 h+ ~8 |: nset vrouter "untrust-vr"( C& _- ]7 c5 [/ S0 G
exit
L/ I3 n, F, _+ N4 J7 Z% L+ Oset vrouter "trust-vr"+ K/ W0 |8 K3 V; f2 E9 H9 ^
exit |
所有IT类厂商认证考试题库下载
【新盟教育】2023最新华为HCIA全套视频合集【网工基础全覆盖】---国sir公开课合集
【新盟教育】网工小白必看的！2023最新版华为认证HCIA Datacom零基础全套实战课
原创_超融合自动化运维工具cvTools
重量级~~30多套JAVA就业班全套 视频教程（请尽快下载，链接失效后不补）
链接已失效【超过几百G】EVE 国内和国外镜像 全有了 百度群分享
某linux大佬，积累多年的电子书(约300本)
乾颐堂现任明教教主Python完整版
乾颐堂 教主技术进化论 2018-2019年 最新31-50期合集视频（各种最新技术杂谈视频）
Python学习视频 0起点视频 入门到项目实战篇 Python3.5.2视频教程 共847集 能学102天
约21套Python视频合集 核心基础视频教程（共310G,已压缩）
最新20180811录制 IT爱好者-清风羽毛 - 网络安全IPSec VPN实验指南视频教程
最新20180807录制EVE开机自启动虚拟路由器并桥接物理网卡充当思科路由器
[复制链接]
