阿国运维网技术分享平台：桌面运维、网络运维、系统运维、服务器运维(及云服务器)，精品软件分享、阿国网络、尽在北京运维网
拓扑图：
以上图为例，PC1或者PC3能访问PC5，防火墙代替路由器的配置
//三层交换机配置(vlan配置省略)
[Huawei]vlan 100
[Huawei-vlan100]int vlan 100
[Huawei-Vlanif100]ip add 10.10.10.1 255.255.255.0
[Huawei]int g0/0/3
[Huawei-GigabitEthernet0/0/3]port link-type access
[Huawei-GigabitEthernet0/0/3]port default vlan 100
[Huawei-GigabitEthernet0/0/3]quit
//配置路由
[Huawei]ip route-static 6.6.6.0 255.255.255.0 10.10.10.2
//防火墙基本配置
[USG6000V1]int g1/0/5
[USG6000V1-GigabitEthernet1/0/5]ip add 10.10.10.2 255.255.255.0
[USG6000V1-GigabitEthernet1/0/5]quit
[USG6000V1]int g1/0/6
[USG6000V1-GigabitEthernet1/0/6]ip add 64.1.1.1 255.255.255.0
[USG6000V1-GigabitEthernet1/0/6]quit
//配置路由
[USG6000V1]ip route-static 6.6.6.0 255.255.255.0 64.1.1.10
[USG6000V1]ip route-static 192.168.1.0 255.255.255.0 10.10.10.1
[USG6000V1]ip route-static 192.168.2.0 255.255.255.0 10.10.10.1
//安全域配置
[USG6000V1]firewall zone trust
[USG6000V1-zone-trust]add int g1/0/5
[USG6000V1-zone-trust]firewall zone untrust
[USG6000V1-zone-untrust]add int g1/0/6
[USG6000V1-zone-untrust]quit
//安全策略配置
[USG6000V1]security-policy
[USG6000V1-policy-security]rule name Bjityw-ISP
[USG6000V1-policy-security-rule-Bjityw-ISP]source-zone trust
[USG6000V1-policy-security-rule-Bjityw-ISP]destination-zone untrust
[USG6000V1-policy-security-rule-Bjityw-ISP]action permit
//nat策略配置
[USG6000V1]nat-policy
[USG6000V1-policy-nat]rule name Bjityw-ISP
[USG6000V1-policy-nat-rule-Bjityw-ISP]source-zone trust
[USG6000V1-policy-nat-rule-Bjityw-ISP]destination-zone untrust
[USG6000V1-policy-nat-rule-Bjityw-ISP]action source-nat easy-ip
