防火墙配置：
<SRG>dis current-configuration #显示当前配置
[SRG]stp region-configuration #进入MST视图
[SRG]active region-configuration #激活MST配置
[SRG]interface GigabitEthernet 0/0/0 #进入GE0/0/0端口
[SRG-GigabitEthernet0/0/0]alias GE0/GMT #别名GE0管理
[SRG-GigabitEthernet0/0/0]ip add 192.168.100.1 255.255.255.0 #端口配置IP
[SRG-GigabitEthernet0/0/0]dhcp select interface #客户端从接口地址池中通过dhcp自动获取IP地址[SRG-GigabitEthernet0/0/0]dhcp server gateway-list 192.168.100.1 #DHCP服务默认网关
[SRG-GigabitEthernet0/0/0]dhcp server dns-list 8.8.8.8 #DNCP默认DNS
[SRG-GigabitEthernet0/0/1]ip add 192.168.200.1 255.255.255.0 #配置端口IP
[SRG-GigabitEthernet0/0/2]ip add 211.1.1.1 255.255.255.0 #配置公网IP
[SRG]interface NULL0 #建立伪接口，进行包的分发。
当宝的目的和路由不匹配时候，则通过NULL0丢弃ps:如果通过默认路由进行分发的话就会形成环路
[SRG]firewall zone untrust #进入防火墙不信任区域
[SRG-zone-trust]add interface GigabitEthernet 0/0/2 #添加不信任区域端口
[SRG]firewall zone trust #进入防火墙信任区域
[SRG-zone-trust]add interface GigabitEthernet 0/0/0 #添加信任区域端口
[SRG]firewall zone dmz #进入防火墙了隔离区域
[SRG-zone-trust]add interface GigabitEthernet 0/0/1 #添加隔离区域端口
[SRG]firewall zone name usr1 #添加区域
[SRG-zone-usr1]set priority 86 #设置优先级
[SRG-zone-usr1]add interface GigabitEthernet 0/0/8 #添加端口
[SRG-zone-usr1]aaa #aaa认证协议
[SRG-aaa]local-user admin password cipher 123456 #设置用户名和加密密码
[SRG-aaa]local-user admin service-type web terminal telnet #允许三种登入方式
[SRG-aaa]local-user admin level 15 #设置等级为15级
[SRG-aaa]authentication-scheme default #验证方式默认及本地设备验证
[SRG-aaa]authorization-scheme default #验证方式默认及本地设备验证
[SRG-aaa]accounting-scheme default #验证方式默认及本地设备验证
[SRG-aaa]domain default #域缺省
[SRG]nqa-jitter tag-version 1
[SRG]banner enable
[SRG]user-interface con 0
[SRG-ui-console0]authentication-mode aaa 允许登陆模式为aaa
[SRG]user-interface vty 0 4
[SRG-ui-vty0-4]uthentication-mode aaa
[SRG-ui-vty0-4]protocol inbound all # 允许所有登陆协议
[SRG]slb #负载均衡
[SRG-slb]rserver 1 rip 192.168.200.201 weight 32 healthchk
[SRG-slb]rserver 2 rip 192.168.200.202 weight 32 healthchk
[SRG-slb]rserver 3 rip 192.168.200.203 weight 32 healthchk
[SRG-slb]group g1
[SRG-slb-group-g1]metric roundrobin #加权轮询算法分配连接
[SRG-slb-group-g1]addrserver 1
[SRG-slb-group-g1]addrserver 2
[SRG-slb-group-g1] addrserver 3
[SRG-slb] vserver ser1 vip 211.1.1.200 group g1
[SRG]firewall packet-filter default permit interzone local trust direction inbound
[SRG]firewall packet-filter default permit interzone local trust direction outbound #开启域间包过滤规则使得local和trust能ping通
[SRG]firewall packet-filter default permit interzone local untrust direction inbound
[SRG]firewall packet-filter default permit interzone local untrust direction outbound
[SRG]firewall packet-filter default permit interzone local dmz direction inbound
[SRG]firewall packet-filter default permit interzone local dmz direction outbound
[SRG]firewall packet-filter default permit interzone dmz untrust direction outbound。