Netscreen防火牆常用指令-接口篇

Netscreen防火牆常用指令-接口篇

ns25-> get interface //檢視接口資訊

A - Active, I - Inactive, U - Up, D - Down, R - Ready

Interfaces in vsys Root: 

Name IP Address Zone MAC VLAN State VSD 

eth1 192.168.0.2/24 Trust 0014.f642.7c20 - U - 

eth2 0.0.0.0/0 DMZ 0014.f642.7c25 - D - 

eth3 116.233.11.11/32 Untrust 0014.f642.7c26 - U - 

eth4 0.0.0.0/0 Trust 0014.f642.7c27 - D - 

vlan1 0.0.0.0/0 VLAN 0014.f642.7c2f 1 D -

ns25-> get int eth1 //檢視接口1的配置

Interface ethernet1:

number 0, if_info 0, if_index 0, mode nat

link up, phy-link up/full-duplex

vsys Root, zone Trust, vr trust-vr

dhcp client disabled

PPPoE disabled

*ip 192.168.0.2/24 mac 0014.f642.7c20

*manage ip 192.168.0.2, mac 0014.f642.7c20

route-deny disable

ping enabled, telnet enabled, SSH enabled, SNMP enabled

web enabled, ident-reset disabled, SSL enabled

webauth disabled, webauth-ip 0.0.0.0

OSPF disabled BGP disabled RIP disabled

bandwidth: physical 100000kbps, configured 0kbps, current 0kbps

total configured gbw 0kbps, total allocated gbw 0kbps

DHCP-Relay disabled

DHCP-server enabled, status on

ns25-> set zone name office //建立一個3層的zone，名為Office

ns25-> set zone name L2-office L2 1 //建立一個2層的zone，名為L2-Office（二層接口必須以L2-開始命名），vlan id 為1。

ns25-> set interface eth4 zone office //将接口4設定為office zone的接口。

ns25-> set interface vlan1 ip 10.10.10.10/24 //将vlan1的ip設定為10.10.10.10

ns25-> set interface vlan1 manage web //開通vlan1接口的web管理功能

ns25-> set interface vlan1 manage ping //開通vlan1接口的ping功能

ns25-> set interface eth4 nat //将接口4設定為nat模式

ns25-> set interface eth4 route //将接口4設定為路由模式

set interface ethernet1 dhcp server service //在接口1開啟dhcp服務

set interface ethernet1 dhcp server enable //在接口1開啟dhcp服務

set interface ethernet1 dhcp server option lease 1440000 //設定dhcp服務租期

set interface ethernet1 dhcp server option gateway 192.168.0.2 

set interface ethernet1 dhcp server option netmask 255.255.255.0 

set interface ethernet1 dhcp server option dns1 202.96.209.5 

set interface ethernet1 dhcp server option dns2 202.96.209.133 

set interface ethernet1 dhcp server ip 192.168.0.10 to 192.168.0.100 //dhcp位址池

ns25-> set interface eth3 mip 1.1.1.1 host 2.2.2.2 vrouter trust-vr //設定mip，外網ip1.1.1.1 綁定到内網ip 2.2.2.2上

ns25-> unset interface eth3 mip 1.1.1.1 //取消1.1.1.1的mip設定

ns25-> set interface eth3 vip untrust-ip + 21 ftp 192.168.0.10 //設定vip

ns25-> set interface eth3 vip untrust-ip + 8000 ftp 192.168.0.10

本文轉自 msft 51CTO部落格，原文連結：http://blog.51cto.com/victorly/1845942，如需轉載請自行聯系原作者