华为安全策略配置举例.pdfVIP

华华为为安安全全策策略略配配置置举举例例

配置步骤

#定义⾼级ACL3000，对⽬的IP地址为192.168.0.1的报⽂进⾏分类。system-view

[Device]aclnmber3000

[Device-acl-adv-3000]rlepermitipdestination192.168.0.10

[Device-acl-adv-3000]qit

#定义⾼级ACL3001，对⽬的IP地址为192.168.0.2的报⽂进⾏分类。[Device]aclnmber3001

[Device-acl-adv-3001]rlepermitipdestination192.168.0.20

[Device-acl-adv-3001]qit

#定义⾼级ACL3002，对⽬的IP地址为192.168.0.3的报⽂进⾏分类。[Device]aclnmber3002

[Device-acl-adv-3002]rlepermitipdestination192.168.0.30

[Device-acl-adv-3002]qit

#定义类classifier_dbserver，匹配⾼级ACL3000。

[Device]trafficclassifierclassifier_dbserver

[Device-classifier-classifier_dbserver]if-matchacl3000

[Device-classifier-classifier_dbserver]qit

#定义类classifier_mserver，匹配⾼级ACL3001。

[Device]trafficclassifierclassifier_mserver

[Device-classifier-classifier_mserver]if-matchacl3001

[Device-classifier-classifier_mserver]qit

#定义类classifier_fserver，匹配⾼级ACL3002。

[Device]trafficclassifierclassifier_fserver

[Device-classifier-classifier_fserver]if-matchacl3002

[Device-classifier-classifier_fserver]qit

#定义流⾏为behavior_dbserver，作为重标记报⽂的本地优先级为4。[Device]trafficbehaviorbehavior_dbserver

[Device-behavior-behavior_dbserver]remarklocal-precedence4

[Device-behavior-behavior_dbserver]qit

#定义流⾏为behavior_mserver，作为重标记报⽂的本地优先级为3。[Device]trafficbehaviorbehavior_mserver

[Device-behavior-behavior_mserver]remarklocal-precedence3

[Device-behavior-behavior_mserver]qit

#定义流⾏为behavior_fserver，作为重标记报⽂的本地优先级为2。[Device]trafficbehaviorbehavior_fserver

[Device-behavior-behavior_fserver]remarklocal-precedence2

[Device-behavior-behavior_fserver]qit

#定义策略policy_server，为类指定流⾏为。

[Device]qospolicypolicy_server

[Device-qospolicy-policy_server]classifierclassifier_dbserverbehaviorbehavior_dbserver[Device-qospolicy-policy_server]

classifierclassifier_mserverbehaviorbeh