現(xiàn)網(wǎng)1臺(tái)山石SG6000防火墻，配置都可以通過GUI實(shí)現(xiàn)。
但有一些配置在命令行下配置效率更高，比如在1個(gè)已有策略中添加1個(gè)host或端口。

下面的雙引號(hào)可以不加

1 創(chuàng)建服務(wù)

1.1 單個(gè)端口

service "tcp-901"tcp dst-port 901 

1.2 端口范圍

service "tcp-10000-65535"tcp dst-port 10000 65535 

1.3 group （包含多個(gè)service， 就是思科ASA的object-group service)

servgroup "Management"service "SSH"service "xdmcp_UDP_177"service "HTTPS"service "tcp-901"

2 創(chuàng)建Ip

2.1 single ip

address "RDM-WaiGua-System-10.248.68.114"ip 10.248.68.114/32

2.2 ip range

address "10.248.68.5-40"range 10.248.68.5 10.248.68.40

2.3 ip subnet

address 10.248.1.0/2410.248.1.0/24

2.4 當(dāng)然下面可以接多個(gè)條目 ，比如

address "Logistics"ip 10.248.33.89/32ip 10.248.33.88/32

2.5 查看方法

show address xxx

Hillstone # show address   10.248.1.0/24
Name:           10.248.1.0/24
Address family: IPv4
Member count:   1
Address members:10.248.1.0/24
Excluded members:
Total IP count: 256
IP subnet in this entry: 110.248.1.0/24

3 schedule (時(shí)間范圍）

可以指定只有結(jié)束，
也可以包含開始+結(jié)束

schedule "2025.1.17"absolute  end 01/18/2025 00:00:00schedule "2021/7/1"absolute start 01/01/1970 00:00:00 end 07/01/2021 23:59:00
exit

4 rule

包含ID，行為，zone，源目IP， 端口，名稱 ，時(shí)間范圍

rule id 401action permitsrc-zone "SC"dst-zone "CR"src-addr "Data-1"dst-addr "wan-1"service httpservice httpsname Colasoft

rule id 3019action permitsrc-zone "INSIDE"dst-zone "OUTSIDE"src-ip 10.248.1.1/32dst-addr "AI-10.248.1.1-10"service "tcp-1521"schedule "2025.1.17"

怎樣查看rule， 不能show rule, 而是show policy,
** 示例 ：**

hillstone  #    show policy id 3019
Rule id: 3019
Rule sequence: 12
Status: E
From zone "CS" to zone "SC"
Type: 0
Fragment: N/A
Source addresses:10.248.1.1/32
Destination addresses:Oracle-10.248.200.1
Services:tcp-1521
Application:
Schedules:2025.1.17
Action: PERMIT 
Roles:
Users:
User-groups:
assistant: disable
Hit 1353 times

創(chuàng)建1條rule在最前面

rule top
action permit
src-ip 1.1.1.1/32
dst-ip 2.1.1.1/32
service any

刪除1條rule

no rule 3029

disable一條rule（失效，而不是刪除）

rule id 3029
disable

Enable一條rule（重新生效）

rule id 3029
enable

5 路由配置

5.1帶外接口配置

interface MGT0zone  "mgt"ip address 10.19.254.84 255.255.255.0manage ip 10.19.254.85manage sshmanage pingmanage snmpmanage https
exit

5.1 靜態(tài)路由

ip vrouter "mgt-vr"ip route 0.0.0.0/0 10.19.254.254

6 接口配置

6.1 聚合接口

interface xethernet1/0aggregate aggregate1mirror enable bothdescription "To_Core"
exit
interface xethernet1/1aggregate aggregate1mirror enable bothdescription "To_Core"
exit
interface xethernet1/2aggregate aggregate1mirror enable bothdescription "To_Core"
exit
interface xethernet1/3aggregate aggregate1mirror enable bothdescription "To_Core"
exit

6.2子接口配置

下面是2臺(tái)山石的子接口配置，因?yàn)樽隽穗p機(jī)，
所以是每1臺(tái)有獨(dú)立的IP，虛擬出來1個(gè)VIP

** 第1臺(tái)**

interface aggregate1.1101zone  "SC"ip address 10.19.255.161 255.255.255.248    		// 10.19.255.16 是VIPmanage ip 10.19.255.162									// 10.19.255.162 是本機(jī)的實(shí)IPmanage pingdescription "ShengChan"

** 第2臺(tái)**

interface aggregate1.1101zone  "SC"ip address 10.19.255.161 255.255.255.248    		// 10.19.255.16 是VIPmanage ip 10.19.255.163									// 10.19.255.163 是本機(jī)的實(shí)IPmanage pingdescription "ShengChan"

7 DNS timezone

clock zone china
ip name-server 223.5.5.5 vrouter "mgt-vr"

8 創(chuàng)建用戶名

admin user "hillstone"password 123123123password-expiration 1673230455role "admin"access consoleaccess telnetaccess sshaccess httpaccess https
exit