（一）實(shí)驗(yàn)簡介
如拓樸圖所示误墓，為防止 FTP 服務(wù)器受攻擊，在防火墻上限制從服務(wù)器受攻擊赂苗，在防火墻上限制從 Trust區(qū)域和 Untrust區(qū)域 到 FTP 端口的連接數(shù)上限為 20 清女，并且限制其上傳 ，并且限制其上傳 /下載帶寬為： 5Mbps/10Mbps租悄。限制trust域內(nèi)每個 PC 到Internet的上傳 /下載帶寬為：400kbps/600kbps。
網(wǎng)絡(luò)拓樸結(jié)構(gòu)
（二）實(shí)驗(yàn)?zāi)康?/h3>
- 掌握網(wǎng)關(guān)對網(wǎng)關(guān)的組網(wǎng)恩袱；
- 掌握手工方式配置兩個網(wǎng)絡(luò)的IPSecVPN泣棋；
（三）實(shí)驗(yàn)條件
- 一臺CPU支持VT技術(shù)，內(nèi)存4GB以上的計算機(jī)畔塔；
- 安裝eNSP模擬器B510版潭辈，導(dǎo)入USG6000V鏡像；
- 終端工具：SecuretyCRT澈吨，Putty把敢，Psftp，XShell等谅辣。
（四）網(wǎng)絡(luò)拓樸圖
打開ENSP軟件修赞，按如下拓樸圖創(chuàng)建實(shí)驗(yàn)環(huán)境，設(shè)置地址:
- LAN地址：192.168.10.0/24屈藐；
- WAN地址：10.9.9.0/24榔组；
- DMZ地址：10.10.10.0/24熙尉；
實(shí)驗(yàn)9拓樸
（五）配置思路
- 配置LAN/DMZ/WAN網(wǎng)絡(luò)联逻；
- 配置防火墻接口，安全域检痰，安全策略包归；
- 配置IP帶寬通道，配置帶寬策略铅歼；
（六）配置步驟
(1)配置LAN網(wǎng)絡(luò)
先設(shè)置Client1的IP地址
Client1的網(wǎng)絡(luò)信息
配置LAN交換機(jī)：
The device is running!
<Huawei>system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]sysname LSW1
[LSW1]interface Vlanif 1
[LSW1-Vlanif1]ip address 192.168.10.254 24
[LSW1-Vlanif1]quit
[LSW1]
[LSW1]ospf 1
[LSW1-ospf-1]area 0
[LSW1-ospf-1-area-0.0.0.0]network 192.168.10.0 0.0.0.255
[LSW1-ospf-1-area-0.0.0.0]quit
[LSW1-ospf-1]quit
[LSW1]
[LSW1]quit
<LSW1>
(2)配置DMZ網(wǎng)絡(luò)
先設(shè)置Server1的IP地址
Server1的網(wǎng)絡(luò)信息
配置DMZ交換機(jī)：
The device is running!
<Huawei>system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]sysname LSW2
[LSW2]interface Vlanif 1
[LSW2-Vlanif1]ip address 10.10.10.254 24
[LSW2-Vlanif1]quit
[LSW2]
[LSW2]ospf 1
[LSW2-ospf-1]area 0
[LSW2-ospf-1-area-0.0.0.0]network 10.10.10.0 0.0.0.255
[LSW2-ospf-1-area-0.0.0.0]quit
[LSW2-ospf-1]quit
[LSW2]
[LSW2]quit
<LSW2>
<LSW2>
(3)配置WAN網(wǎng)絡(luò)
配置AR1路由器
The device is running!
<Huawei>system-view
Enter system view, return user view with Ctrl+Z.
[Huawei]undo info-center enable
Info: Information center is disabled.
[Huawei]sysname AR2
[AR2]interface GigabitEthernet 0/0/0
[AR2-GigabitEthernet0/0/0]
[AR2-GigabitEthernet0/0/0]ip address 10.9.9.2 24
[AR2-GigabitEthernet0/0/0]
[AR2-GigabitEthernet0/0/0]quit
[AR2]ospf 1
[AR2-ospf-1]
[AR2-ospf-1]area 0
[AR2-ospf-1-area-0.0.0.0]
[AR2-ospf-1-area-0.0.0.0]network 10.9.9.0 0.0.0.255
[AR2-ospf-1-area-0.0.0.0]
[AR2-ospf-1-area-0.0.0.0]quit
[AR2-ospf-1]
[AR2-ospf-1]quit
[AR2]quit
<AR2>
(4)配置FW的網(wǎng)絡(luò)及策略
The device is running!
An initial password is required for the first login via the console.
Set a password and keep it safe. Otherwise you will not be able to login via the
console.
Please configure the login password (8-16)
Enter Password:
Confirm Password:
Warning: The authentication mode was changed to password authentication and the
user level was changed to 15 on con0 at the first user login.
Warning: There is a risk on the user-interface which you login through. Please c
hange the configuration of the user-interface as soon as possible.
*************************************************************************
* Copyright (C) 2014-2015 Huawei Technologies Co., Ltd. *
* All rights reserved. *
* Without the owner's prior written consent, *
* no decompiling or reverse-engineering shall be allowed. *
*************************************************************************
<USG6000V1>system-view
Enter system view, return user view with Ctrl+Z.
[USG6000V1]undo info en
Info: Information center is disabled.
[USG6000V1]sysname FW1
[FW1]
[FW1]int g 1/0/1
[FW1-GigabitEthernet1/0/1]ip addr 192.168.10.1 24
[FW1-GigabitEthernet1/0/1]service-manage ping permit
[FW1-GigabitEthernet1/0/1]service-manage http permit
[FW1-GigabitEthernet1/0/1]quit
[FW1]
[FW1]int g 1/0/2
[FW1-GigabitEthernet1/0/2]ip addr 10.10.10.1 24
[FW1-GigabitEthernet1/0/2]service-manage ping permit
[FW1-GigabitEthernet1/0/2]service-manage http permit
[FW1-GigabitEthernet1/0/2]quit
[FW1]
[FW1]int g 1/0/3
[FW1-GigabitEthernet1/0/3]ip addr 10.9.9.1 24
[FW1-GigabitEthernet1/0/3]service-manage ping permit
[FW1-GigabitEthernet1/0/3]service-manage http permit
[FW1-GigabitEthernet1/0/3]quit
[FW1]
[FW1]firewall zone trust
[FW1-zone-trust]add int g 1/0/1
[FW1-zone-trust]quit
[FW1]
[FW1]firewall zone dmz
[FW1-zone-dmz]add int g 1/0/2
[FW1-zone-dmz]quit
[FW1]
[FW1]firewall zone untrust
[FW1-zone-untrust]add int g 1/0/3
[FW1-zone-untrust]quit
[FW1]
[FW1]ospf 1
[FW1-ospf-1]area 0
[FW1-ospf-1-area-0.0.0.0]network 10.10.10.0 0.0.0.255
[FW1-ospf-1-area-0.0.0.0]network 10.9.9.0 0.0.0.255
[FW1-ospf-1-area-0.0.0.0]network 192.168.10.0 0.0.0.255
[FW1-ospf-1-area-0.0.0.0]quit
[FW1-ospf-1]quit
[FW1]
[FW1]security-policy
[FW1-policy-security]rule name trust_dmz
[FW1-policy-security-rule-trust_dmz]source-zone trust local
[FW1-policy-security-rule-trust_dmz]destination-zone dmz local
[FW1-policy-security-rule-trust_dmz]action permit
[FW1-policy-security-rule-trust_dmz]quit
[FW1-policy-security]
[FW1-policy-security]rule name trust_untrust
[FW1-policy-security-rule-trust_untrust]source-zone trust local
[FW1-policy-security-rule-trust_untrust]destination-zone untrust local
[FW1-policy-security-rule-trust_untrust]action permit
[FW1-policy-security-rule-trust_untrust]quit
[FW1-policy-security]
[FW1-policy-security]security-policy
[FW1-policy-security]rule name untrust_dmz
[FW1-policy-security-rule-untrust_dmz]source-zone untrust local
[FW1-policy-security-rule-untrust_dmz]destination-zone dmz local
[FW1-policy-security-rule-untrust_dmz]action permit
[FW1-policy-security-rule-untrust_dmz]quit
[FW1-policy-security]quit
[FW1]
[FW1]traffic-policy //配置帶寬通道及帶寬策略
[FW1-policy-traffic]profile profile_traffic_1 //配置帶寬通道1
[FW1-policy-traffic-profile-profile_traffic_1]bandwidth maximum-bandwidth whole
upstream 5000
[FW1-policy-traffic-profile-profile_traffic_1]bandwidth maximum-bandwidth whole
downstream 10000
[FW1-policy-traffic-profile-profile_traffic_1]bandwidth connection-limit whole b
oth 20
[FW1-policy-traffic-profile-profile_traffic_1]quit
[FW1-policy-traffic]
[FW1-policy-traffic]profile profile_traffic_2 //配置帶寬通道2
[FW1-policy-traffic-profile-profile_traffic_2]bandwidth maximum-bandwidth whole
upstream 400
[FW1-policy-traffic-profile-profile_traffic_2]bandwidth maximum-bandwidth whole
downstream 600
[FW1-policy-traffic-profile-profile_traffic_2]quit
[FW1-policy-traffic]
[FW1-policy-traffic]rule name policy_traffic_1 //配置帶寬策略1公壤，引用帶寬通道1
[FW1-policy-traffic-rule-policy_traffic_1]source-zone trust
[FW1-policy-traffic-rule-policy_traffic_1]source-zone untrust
[FW1-policy-traffic-rule-policy_traffic_1]destination-zone dmz
[FW1-policy-traffic-rule-policy_traffic_1]action qos profile profile_traffic_1
[FW1-policy-traffic-rule-policy_traffic_1]quit
[FW1-policy-traffic]
[FW1-policy-traffic]rule name policy_traffic_2 //配置帶寬策略2换可，引用帶寬通道2
[FW1-policy-traffic-rule-policy_traffic_2]source-zone trust
[FW1-policy-traffic-rule-policy_traffic_2]destination-zone untrust
[FW1-policy-traffic-rule-policy_traffic_2]action qos profile profile_traffic_2
[FW1-policy-traffic-rule-policy_traffic_2]quit
[FW1-policy-traffic]
[FW1-policy-traffic]quit
[FW1]
(5)測試
服務(wù)器啟動FTP服務(wù)，并用FTP客戶端登錄厦幅，但因ENSP是模擬器沾鳄，無法測試使用traffic-policy前后的速度變化：
啟動FTP服務(wù)
（七）參考資料
華為模擬器eNSP軟件，
華為模擬器eNSP社區(qū)确憨，
HCNA-Security 華為認(rèn)證網(wǎng)絡(luò)安全工程師译荞，
HCNP-Security 華為認(rèn)證網(wǎng)絡(luò)安全資深工程師，
HUAWEI USG6000V V500R001C10SPC100 典型配置案例休弃，
HUAWEI USG6000V V500R001C10SPC100 管理員指南吞歼，
HUAWEI USG6000V V500R001C10SPC100 命令參考 ，
華為ICT相關(guān)的英文簡稱 塔猾。
