电信WAP网关SSG550配置手册

4.10 版本升级步骤

升级前请将原有配置文件备份，保证电源供应正常，建议升级过程中使用超级终端连接到防火墙的Console 端口上。

选择Configuration > Update > ScreenOS/KEY > Fireware Update (ScreenOS) > 浏览

选择FLASH文件存放位置 > 打开 > Apply 。

第36页 共42页

电信WAP网关SSG550配置手册

4.11 常用排错步骤及命令汇总

? ? ? ? ?

Get config 全局查看当前设备运行配置 Get interface 查看接口配置及状态

Get config | inc nsrp 检查安全设备NSRP配置 Exec policy verify 检查策略是否有重复

Ping x.x.x.x from ethx/x 通过源接口PING目的检查路由是否可达

? Get system 查看当前设备系统运行的参数

第37页 共42页

电信WAP网关SSG550配置手册

5 附录：防火墙配置文件

5.1 SSG-550M-1防火墙配置

set clock timezone 0

set vrouter trust-vr sharable set vrouter \exit

set vrouter %unset auto-route-export exit

set service \ set service \ set alg appleichat enable

unset alg appleichat re-assembly enable set alg sctp enable

set auth-server \

set auth-server \set auth default auth server \set auth radius accounting port 1646 set admin name \

set admin password \set admin auth web timeout 10 set admin auth server \set admin format dos

set zone \set zone \set zone \set zone \

set zone \set zone \ set zone \ unset zone \ set zone \ set zone \ set zone \ unset zone \

set zone \set zone \set zone \set zone \set zone \

第38页 共42页

电信WAP网关SSG550配置手册 set zone \set zone \set zone \set zone \set zone \

set interface \set interface \set interface \set interface bgroup0/0 port ethernet0/3 set interface bgroup0/0 port ethernet0/4 set interface bgroup0/0 port ethernet0/5 set interface bgroup0/1 port ethernet0/6 set interface bgroup0/1 port ethernet0/7 set interface bgroup0/1 port ethernet0/8 set interface ethernet0/0 ip 192.168.0.1/24 set interface ethernet0/0 route unset interface vlan1 ip

set interface ethernet0/1 ip 10.0.0.167/28 set interface ethernet0/1 nat

set interface ethernet0/2 ip 211.136.136.4/28 set interface ethernet0/2 route

unset interface vlan1 bypass-others-ipsec unset interface vlan1 bypass-non-ip set interface ethernet0/0 ip manageable set interface ethernet0/1 ip manageable set interface ethernet0/2 ip manageable set interface ethernet0/1 manage ssh set interface ethernet0/1 manage telnet set interface ethernet0/1 manage snmp set interface ethernet0/1 manage ssl set interface ethernet0/1 manage web set interface ethernet0/1 manage mtrace set interface ethernet0/2 manage ping set interface ethernet0/2 manage ssh set interface ethernet0/2 manage telnet set interface ethernet0/2 manage snmp set interface ethernet0/2 manage ssl set interface ethernet0/2 manage web set interface ethernet0/2 manage mtrace

set interface ethernet0/1 dip 4 10.0.0.165 10.0.0.165 set interface ethernet0/1 dip 9 10.0.0.164 10.0.0.164

set interface ethernet0/2 ext ip 172.16.1.99 255.255.255.252 dip 6 172.16.1.99 172.16.1.99 set interface ethernet0/2 ext ip 172.16.1.100 255.255.255.252 dip 5 172.16.1.100 172.16.1.100

set interface ethernet0/2 ext ip 192.168.200.100 255.255.255.252 dip 7 192.168.200.100

第39页 共42页

电信WAP网关SSG550配置手册 192.168.200.100

set interface ethernet0/2 ext ip 192.168.200.99 255.255.255.252 dip 8 192.168.200.99 192.168.200.99 set interface \mip 211.136.136.2 host 192.168.0.133 netmask 255.255.255.255 vr \

unset flow no-tcp-seq-check set flow tcp-syn-check

unset flow tcp-syn-bit-check

set flow reverse-route clear-text prefer set flow reverse-route tunnel always

set pki authority default scep mode \set pki x509 default cert-path partial

set address \set address \

set address \set address \set address \set address \set ike respond-bad-spi 1

set ike ikev2 ike-sa-soft-lifetime 60 unset ike ikeid-enumeration unset ike dos-protection

unset ipsec access-session enable

set ipsec access-session maximum 5000 set ipsec access-session upper-threshold 0 set ipsec access-session lower-threshold 0 set ipsec access-session dead-p2-sa-timeout 0 unset ipsec access-session log-error

unset ipsec access-session info-exch-connected unset ipsec access-session use-error-log set vrouter \exit

set vrouter \exit

set url protocol websense exit

set policy id 1 from \ \ set policy id 1 exit

set policy id 2 from \ \permit log set policy id 2 exit

set policy id 10 from \to \ \\\nat src dip-id 7 permit log

第40页 共42页