配置下联接口;配置上联接口;配置端口区域;配置域间策略;配置静态路由;配置NAT
操作步骤: 一、防火墙1、配置下联接口
<usg>system-view[usg]sysname FW1[FW1]interface GigabitEthernet 0/0/1[FW1-GigabitEthernet0/0/1]ip address 192.168.7.254 255.255.255.0[FW1-GigabitEthernet0/0/1]description connecct to SW1[FW1-GigabitEthernet0/0/1]quit[FW1]interface GigabitEthernet 0/0/2[FW1-GigabitEthernet0/0/2]ip address 192.168.6.254 255.255.255.0[FW1-GigabitEthernet0/0/2]description connecct to SW2[FW1-GigabitEthernet0/0/2]quit2、配置上联接口
[FW1]interface GigabitEthernet 0/0/0[FW1-GigabitEthernet0/0/0]ip address 100.1.1.1 255.255.255.248[FW1-GigabitEthernet0/0/0]description connect to ISP1[FW1-GigabitEthernet0/0/0]quit3、配置端口区域
trust区域[FW1]firewall zone trust[FW1-zone-trust]set priority 85[FW1-zone-trust]add interface GigabitEthernet 0/0/1[FW1-zone-trust]add interface GigabitEthernet 0/0/2[FW1-zone-trust]quituntrust区域[FW1]firewall zone untrust[FW1-zone-untrust]set priority 5[FW1-zone-untrust]add interface GigabitEthernet 0/0/0[FW1-zone-untrust]quit4、配置域间策略(生产环境根据实际情况选择)
[FW1]firewall packet-filter default permit all5、配置静态路由
[FW1]ip route-static 192.168.0.0 255.255.0.0 192.168.7.253[FW1]ip route-static 192.168.0.0 255.255.0.0 192.168.6.253[FW1]ip route-static 0.0.0.0 0.0.0.0 100.1.1.56、配置NAT
[FW1]nat-policy interzone trust untrust outbound[FW1-nat-policy-interzone-trust-untrust-outbound]policy 1[FW1-nat-policy-interzone-trust-untrust-outbound]action source-nat[FW1-nat-policy-interzone-trust-untrust-outbound]policy source 192.168.0.0 mask 16[FW1-nat-policy-interzone-trust-untrust-outbound]easy-ip GigabitEthernet0/0/0[FW1-nat-policy-interzone-trust-untrust-outbound-1]quit[FW1-nat-policy-interzone-trust-untrust-outbound]quit 二、客户端测试1、PC端口设置自动获取IP
2、相互ping测试
3、内网访问ISP,查看防火墙NAT转发记录