当前位置：首页 > news >正文

华为防火墙隧道配置

news 2025/9/15 5:08:51

1 拓扑

拓扑解释首先理解啥叫隧道我们知道在互联网的世界公网是透明的，而我们的数据是跑在互联网上的那么数据的安全性是得不到保证的，所以要想办法把私网的数据能够通过隧道封转的方法，把数据通过公网传送

2 开局配置

1 接口地址配好

2 相关的安全域加好

3 直连网段互通性测试

防火墙的默认密码 admin Admin@123 改为 admin admin@123

fw1 上的配置

#
firewall zone untrust
set priority 5
add interface GigabitEthernet1/0/0
#

#
interface GigabitEthernet1/0/0
undo shutdown
ip address 10.1.1.1 255.255.255.0
service-manage http permit
service-manage https permit
service-manage ping permit
service-manage ssh permit
service-manage snmp permit
service-manage telnet permit
#

security-policy
rule name 10.1.1.0
source-zone local
source-zone untrust
destination-zone local
destination-zone untrust
source-address 10.1.1.0 mask 255.255.255.0
destination-address 10.1.1.0 mask 255.255.255.0
action permit
#

fw2 的配置

firewall zone untrust
set priority 5
add interface GigabitEthernet1/0/0
#

#
interface GigabitEthernet1/0/0
undo shutdown
ip address 10.1.1.2 255.255.255.0
service-manage http permit
service-manage https permit
service-manage ping permit
service-manage ssh permit
service-manage snmp permit
service-manage telnet permit
#
return

#
rule name zhilian
source-zone local
source-zone untrust
destination-zone local
destination-zone untrust
source-address 10.1.1.0 mask 255.255.255.0
destination-address 10.1.1.0 mask 255.255.255.0
action permit

这里说明一下直连互联其实有两个方向本地防火墙到对端 local 到对端

还有个就是对端防火墙到本地 untrust 到 local 这是两个方向
#

测试互联地址能不能通

我们可以看到直链地址可以互通同时产生了会话信息

fw1 的接口配置

这里注意用本地回环接口做测试回环接口默认就是本地区域

3 防火墙隧道配置

fw1

interface Tunnel1
ip address 100.1.1.1 255.255.255.0
tunnel-protocol gre
source 10.1.1.1
destination 10.1.1.2
service-manage http permit
service-manage https permit
service-manage ping permit
service-manage ssh permit
service-manage snmp permit
service-manage telnet permit
#
return

#
firewall zone untrust
set priority 5
add interface GigabitEthernet1/0/0
add interface Tunnel1
#
return

#
rule name suidao
source-zone local
source-zone untrust
destination-zone local
destination-zone untrust
source-address 100.1.1.0 mask 255.255.255.0
destination-address 100.1.1.0 mask 255.255.255.0
action permit

----------------------------------------------------------这是防火墙1 上的配置

#
interface Tunnel1
ip address 100.1.1.2 255.255.255.0
tunnel-protocol gre
source 10.1.1.2
destination 10.1.1.1
service-manage http permit
service-manage https permit
service-manage ping permit
service-manage ssh permit
service-manage snmp permit
service-manage telnet permit
#

#
firewall zone untrust
set priority 5
add interface GigabitEthernet1/0/0
add interface Tunnel1
#
return

测试

测试很明显隧道地址打通了

4 隧道路由配置

#
ip route-static 4.4.4.0 255.255.255.0 Tunnel1
ip route-static 5.5.5.0 255.255.255.0 Tunnel1
ip route-static 6.6.6.0 255.255.255.0 Tunnel1
#

fw2 上的配置

#
ip route-static 1.1.1.0 255.255.255.0 Tunnel1
ip route-static 2.2.2.0 255.255.255.0 Tunnel1
ip route-static 3.3.3.0 255.255.255.0 Tunnel1
#

但是我们发现路由还是不通这是为啥呢，因为策略没有放行啊，放行本地到unbtrust 和untrust和本地

4.1 配置防火墙业务策略

#
rule name yewu
source-zone local
source-zone untrust
destination-zone local
destination-zone untrust
source-address 1.1.1.0 mask 255.255.255.0
source-address 2.2.2.0 mask 255.255.255.0
source-address 3.3.3.0 mask 255.255.255.0
source-address 4.4.4.0 mask 255.255.255.0
source-address 5.5.5.0 mask 255.255.255.0
source-address 6.6.6.0 mask 255.255.255.0
destination-address 1.1.1.0 mask 255.255.255.0
destination-address 2.2.2.0 mask 255.255.255.0
destination-address 3.3.3.0 mask 255.255.255.0
destination-address 4.4.4.0 mask 255.255.255.0
destination-address 5.5.5.0 mask 255.255.255.0
destination-address 6.6.6.0 mask 255.255.255.0
action permit