华为防火墙配置远程管理设备

你的名字 2021-04-17 16:21 753阅读 0赞

\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\#\# 接口配置和打开Telnet服务\#\#\#\#  
<USG6000V1>sys \#\#\#\#进全局模式  
\[USG6000V1\]int g0/0/0 \#\#\#进端口号  
\[USG6000V1-GigabitEthernet0/0/0\]ip add 192.168.32.10 24配置接口IP地址  
\[USG6000V1-GigabitEthernet0/0/0\]quit \#\#\#退出端口号（也可以简写q退出）

\[USG6000V1\]telnet service enable 打开防火墙Telnet功能

配置防火墙允许远程管理  
\[USG6000V1\]int g0/0/0  
\[USG6000V1-GigabitEthernet0/0/0\]service-manage en 配置接口管理  
\[USG6000V1-GigabitEthernet0/0/0\]service-manage telnet permit 允许Telnet  
\[USG6000V1-GigabitEthernet0/0/0\]quit

\#\#\#\#\#\#\#\#\#将接口加入trust安全区域\#\#\#\#\#\#\#  
\[USG6000V1\]firewall zone trust 进入trust区域  
\[USG6000V1-zone-trust\]add interface G 0/0/0 将接口加入trust区域  
\[USG6000V1-zone-trust\]dis this 查看下接口有没有  
\#  
firewall zone trust  
set priority 85  
add interface GigabitEthernet0/0/0  
\#  
return  
\#\#\#\#\#\#\#\#配置策略\#\#\#\#\#\#  
为什么要配？  
Telnet流量属于防火墙自身流量，  
如果是CRT连接过来是trust到local区，由低到高，所哟要配策略

\[USG6000V1\]security-policy 配置域间包过滤  
\[USG6000V1-policy-security\]rule name allow\_telnet 配置规则用telnet访问  
\[USG6000V1-policy-security-rule-allow\_telnet\]source-zone trust 用trust  
\[USG6000V1-policy-security-rule-allow\_telnet\]destination-zone local 访问local  
\[USG6000V1-policy-security-rule-allow\_telnet\]action permit 允许  
\[USG6000V1-policy-security-rule-allow\_telnet\]q  
\[USG6000V1-policy-security\]q

\#\#\#\#\#\#\#\#配置认证模块\#\#\#\#\#\#  
\[USG6000V1\]user-interface vty 0 4 进入vty模式  
\[USG6000V1-ui-vty0-4\]authentication-mode aaa 三a  
\[USG6000V1-ui-vty0-4\]protocol inbound telnet 从低访问高（inbound）用telnet  
\[USG6000V1-ui-vty0-4\]q  
\[USG6000V1\]aaa  
\[USG6000V1-aaa\]manager-user bdqn 用户名  
\[USG6000V1-aaa-manager-user-bdqn\]password cipher bdqn@123 密码  
\[USG6000V1-aaa-manager-user-bdqn\]service-type telnet 服务类型  
\[USG6000V1-aaa-manager-user-bdqn\]level 3 用户级别  
\[USG6000V1-aaa-manager-user-bdqn\]q

\#\#\#\#\#验证测试\#\#\#\#\#\#  
CRT 配置192.168.32.10 Telnet