防火墙命令学习总结
华为防火墙:
命令格式
system ip address-set 10.0.0.0/8 type object address 0 10.0.0.0 mask 8 q ip address-set 12.2.7.0/24 type object address 0 12.2.7.0 mask 24 q ip service-set TCP-8443 type object service 0 protocol tcp source-port 0 to 65535 destination-port 8443 q ip service-set TCP-9443 type object service 0 protocol tcp source-port 0 to 65535 destination-port 9443 q security-policy rule name 10168 action permit source-zone inside destination-zone untrust source-address address-set 10.0.0.0/8 destination-address address-set 12.2.7.0/24 service TCP-8443 service TCP-9443 q return save y y
删除命令 undo
地址组中删除地址对象
ip address-set qiyenianjin_server_group type group address 0 address-set 10.1.66.0/24 address 1 address-set 10.1.36.0/26 --想要删除这一行 address 2 address-set ip_10.1.42.172/32 address 3 address-set ip_10.1.42.173/32
ip address-set qiyenianjin_server_group type group
undo address 1 --第一种写法,取num值
undo address address-set 10.1.36.0/26 --第二种写法
策略中删除地址引用
删除源地址
rule name mgt2local_ssh
undo source-address address-set 10.1.36.0/26
删除目的地址
rule name 55
undo destination-address address-set 10.1.36.0/26
山石防火墙:
命令格式
configure address "12.2.0.0/19" ip 12.2.0.0/19 exit address "12.2.7.0/24" ip 12.2.7.0/24 exit rule id 10028 before 3720 src-zone "bg-client" dst-zone "shengchan" src-addr "12.2.0.0/19" dst-addr "12.2.7.0/24" service "TCP-8443" service "TCP-9443" action permit exit save yy
删除命令 no
rule id 20001 no dst-addr "10.197.5.0/24" --删除源地址 exit address Deny-CS1-G no member "10.197.9.0/24" --地址组中删除地址对象 exit
rule id 20002
no src-addr "10.197.5.0/24" --删除目的地址
exit