H3C F100C防火墙配置IPSEC VPN+PPPOEWord下载.docx

1、 DNS server 219.141.136.10 DNS server 219.150.32.132 DNS server 221.5.88.88 DNS-proxy enableradius scheme system server-type extendeddomain systemlocal-user admin password cipher %=H2a4C5）;Q=QMAF41! service-type telnet terminal level 3 service-type ftplocal-user croco service-type telnetlocal-user g

2、onggu password simple gg2009local-user libin password cipher -Z17,-WZX;ike dpd 1ike peer g_bjdc exchange-mode aggressive pre-shared-key gonggu id-type name remote-name bjdc remote-address 219.141.188.57 nat traversal dpd 1ike peer g_shenzhen remote-name shenzhen remote-address 121.35.247.177ipsec pr

3、oposal esp-md5-desipsec policy ikepol 1 isakmp security acl 3000 pfs dh-group1 ike-peer g_bjdc proposal esp-md5-desipsec policy ikepol 2 isakmp security acl 3001 ike-peer g_shenzhendhcp server ip-pool lan network 10.80.151.0 mask 255.255.255.0 gateway-list 10.80.151.254 dns-list 10.2.1.1 10.2.1.2 61

4、.139.2.69acl number 3000 rule 10 permit ip source 10.80.151.0 0.0.0.255 destination 10.0.0.0 0.63.255.255 logging rule 20 deny ip loggingacl number 3001 rule 10 permit ip source 10.80.151.0 0.0.0.255 destination 10.80.0.0 0.0.127.25acl number 3002 rule 10 deny ip source 10.80.151.0 0.0.0.255 destina

5、tion 10.0.0.0 0.63.255.255logging rule 20 deny ip source 10.80.151.0 0.0.0.255 destination 10.80.0.0 0.0.127.255 rule 30 permit ip source 10.80.151.0 0.0.0.255interface Aux0 async mode flowinterface Dialer1 link-protocol ppp 0771* mtu 1400 tcp mss 1300 ip address ppp-negotiate dialer user fh dialer-

6、group 1 dialer bundle 1 nat outbound 3002 ipsec policy ikepolinterface Ethernet0/0 ip address 10.80.151.254 255.255.255.0interface Ethernet0/1interface Ethernet0/2interface Ethernet0/3interface Ethernet0/4 speed 10 duplex full pppoe-client dial-bundle-number 1 mtu 1370 tcp mss 1340 ip address dhcp-a

7、llocinterface Encrypt1/0interface NULL0firewall zone local set priority 100firewall zone trust add interface Ethernet0/0 set priority 85firewall zone untrust add interface Ethernet0/4 add interface Dialer1 set priority 5firewall zone DMZ set priority 50firewall interzone local trustfirewall interzon

8、e local untrustfirewall interzone local DMZfirewall interzone trust untrustfirewall interzone trust DMZfirewall interzone DMZ untrustddns-server 3322.org ddns username guangxi01 ddns password 88888888 ddns domainname guangxi01.3322.org ddns source-interface Dialer1 FTP server enable dhcp server forb

9、idden-ip 10.80.151.200 10.80.151.254 ip route-static 0.0.0.0 0.0.0.0 Dialer 1 preference 60user-interface con 0user-interface aux 0user-interface vty 0 4 authentication-mode schemereturnGGGXNanNing* Copyright（c） 2004-2009 Hangzhou H3C Technologies Co., Ltd. All rights reserved.* Without the owners prior written consent, * no decompiling or reverse-engineering shall be allowed. *User interface con0 is available.Please press ENTER.%Nov 9 17:03:55:756 2010 GGGXNanNing SHELL/4/LOGIN: Console login from con0dis cur