USG防火墙V3平台与V5平台配置命令比较

一、包过滤方面
1、允许192.168.0.2访问222.100.1.1。
V3平台配置命令，基于1条ACL规则：
[USG]acl 3001
[USG-acl-adv-3001]rule permit ip source 192.168.0.2 0 destination 222.100.1.1 0
[USG]firewall interzone trust untrust
[USG-interzone-trust-untrust]packet-filter 3001 outbound

V5平台配置命令，基于1条策略：
[USG]policy interzone trust untrust outbound
[USG-policy-interzone-trust-untrust-outbound]policy 10
[USG-policy-interzone-trust-untrust-outbound-10]policy source 192.168.0.2 0
[USG-policy-interzone-trust-untrust-outbound-10]action permit
[USG-policy-interzone-trust-untrust-outbound-10]policy destination 222.100.1.1 0
[USG-policy-interzone-trust-untrust-outbound-10]quit
[USG-policy-interzone-trust-untrust-outbound]policy 10 enable #可选，默认启用

2、允许内网访问互联网的www服务、ftp服务、udp 7000端口,其余全部禁止。
V3平台配置命令，基于4条ACL规则：
[USG]acl 3002
[USG-acl-adv-3002]rule permit tcp source 192.168.0.0 0.0.0.255 destination-port eq www
[USG-acl-adv-3002]rule permit tcp source 192.168.0.0 0.0.0.255 destination-port eq 21
[USG-acl-adv-3002]rule permit udp source 192.168.0.0 0.0.0.255 destination-port eq 7000
[USG-acl-adv-3002]rule deny ip
[USG]firewall interzone trust untrust
[USG-interzone-trust-untrust]packet-filter 3002 outbound

V5平台配置命令，基于服务集和2条策略：
[USG]ip service-set test1 type object #预定义的服务中不包含UDP7000服务，在此创建一个服务。
[USG-object-service-set-test1]service protocol udp destination-port 7000
[USG]policy interzone trust untrust outbound
[USG-policy-interzone-trust-untrust-outbound]policy 11
[USG-policy-interzone-trust-untrust-outbound-11]policy service service-set http ftp test1
[USG-policy-interzone-trust-untrust-outbound-11]policy source 192.168.0.0 0.0.0.255
[USG-policy-interzone-trust-untrust-outbound-11]policy destination any
[USG-policy-interzone-trust-untrust-outbound-11]action permit
[USG-policy-interzone-trust-untrust-outbound-11]quit
[USG-policy-interzone-trust-untrust-outbound]policy 12
[USG-policy-interzone-trust-untrust-outbound]action deny

二、网络地址转换（NAT）方面
1、域间NAT
要求对192.168.0.2不做NAT，对其余主机均做NAT。
V3平台配置命令，基于2条ACL规则、地址组（接口）:
[USG]ACL 2020
[USG-acl-basic-2020]rule deny source 192.168.0.2 0
[USG-acl-basic-2020]rule permit source 192.168.0.0 0.0.0.255
[USG]nat address-group 10 222.100.1.2 222.100.1.2
[USG]firewall interzone trust untrust
[USG-interzone-trust-untrust]nat outbound 2020 address-group 10
或
[USG-interzone-trust-untrust]nat outbound 2020 interface GigabitEthernet0/0/0

V5平台配置命令，基于2条策略：
[USG]nat address-group 10 222.100.1.2 222.100.1.2
[USG]nat-policy interzone trust untrust outbound
[USG-nat-policy-interzone-trust-untrust-outbound]policy 1
[USG-nat-policy-interzone-trust-untrust-outbound-1]policy source 192.168.0.2 0
[USG-nat-policy-interzone-trust-untrust-outbound-1]action no-nat
[USG-nat-policy-interzone-trust-untrust-outbound]policy 3
[USG-nat-policy-interzone-trust-untrust-outbound-3]policy source 192.168.0.0 0.0.0.255
[USG-nat-policy-interzone-trust-untrust-outbound-3]address-group 10

2、基于目的NAT，仅对到100.0.0.0 /24的情况做地址转换
[USG]ACL 3020
[USG-acl-basic-3020]rule permit ip source 192.168.0.0 0.0.0.255 destination 100.0.0.0 0.255.255.255
[USG]nat address-group 10 222.100.1.2 222.100.1.2
[USG]firewall interzone trust untrust
[USG-interzone-trust-untrust]nat outbound 3020 address-group 10
或[USG-interzone-trust-untrust]nat outbound 3020 interface GigabitEthernet0/0/0

V5平台配置命令，基于1条策略：
[USG]nat address-group 1 9.9.9.9 9.9.9.9
[USG]nat-policy zone trust
[USG-nat-policy-zone-trust-1]policy source 192.168.0.0 0.0.0.255
[USG-nat-policy-zone-trust-1]policy destination 100.0.0.0 0.255.255.255
[USG-nat-policy-zone-trust-1]address-group 1
[USG-nat-policy-zone-trust-1]action source-nat

3、域内NAT
V3平台配置命令，基于含1条规则ACL、地址组:
[USG]nat address-group 1 9.9.9.9 9.9.9.9
[USG]ACL 2020
[USG-acl-basic-2020]rule permit source 192.168.0.0 0.0.0.255
[USG]firewall zone trust
[USG-zone-trust]nat 2020 address-group 1

V5平台配置命令，基于1条策略：
[USG]nat address-group 1 9.9.9.9 9.9.9.9
[USG]nat-policy zone trust
[USG-nat-policy-zone-trust-1]policy source 192.168.0.0 0.0.0.255
[USG-nat-policy-zone-trust-1]address-group 1
[USG-nat-policy-zone-trust-1]action source-nat