华三防火墙主备ACL

dis cur | in policy 查看

policy-based-route 有线网络 permit node 5

policy-based-route 有线网络 permit node 10

ip policy-based-route 有线网络

nat global-policy

ips apply policy 默认入侵防御策略 mode protect

anti-virus apply policy default mode protect

ips apply policy 默认入侵防御策略 mode protect

anti-virus apply policy default mode protect

apt apply policy default

ips apply policy 默认入侵防御策略 mode protect

security-policy ip

ips policy 默认入侵防御策略

policy-based-route 有线网络 permit node 15

if-match acl 3211 如果匹配acl 3211

apply next-hop 9.9.9.9 则下一跳地址走这个 9.9.9.9 （固定IP地址的网关，固定IP地址的下一跳，问运营商）

---

dis ip policy-based-route 查看 （语句可接 interface g0/0/X，单独查看某一个接口的优先级）

Policy name: 有线网络

node 5 permit:

if-match acl 3000

node 10 permit:

if-match acl 3210

apply next-hop 8.8.8.8

node 15 permit:

if-match acl 3211

apply next-hop 9.9.9.9

int gx/x/x 进入接口

nat outbound address-group 3 此接口nat地址转换为add3

nat outbound 3100 address-group 3 此接口nat地址仅转换3100段为add3

undo nat outbound 3100 取消上一条命令