H3C防火墙ACL设置的批处理脚本

ejzhang

因为工作需要频繁开启关闭互联网终端权限，特编写了H3C防火墙ACL设置脚本方便值班人员操作。
现放出来供大家参考，防火墙为F1070，软件版本CMW 7.1.064 Release 9360P27，其他设备未测试，需开启SSH登录，脚本使用plink连接防火墙。

1. @echo off
   
2. 
   
3. plink -V>nul 2>&1
   
4. if ERRORLEVEL 9009 (echo 未找到 plink 程序！&& pause>nul && goto end)
   
5. 
   
6. set acl=2000
   
7. set userid="admin"
   
8. set passwd="admin123"
   
9. set router="192.168.1.1"
   
10. 
    
11. ping -n 1 %router%>nul 2>&1
    
12. if ERRORLEVEL 1 (echo 无法访问路由器！ && pause>nul && goto end)
    
13. 
    
14. :begin
    
15. if EXIST "%TEMP%" (set rulesfile="%TEMP%\rules.h3c") else (set rulesfile="rules.h3c")
    
16. 
    
17. type nul> %rulesfile%.tmp
    
18. for /f "tokens=2-5*" %%i in ('plink -batch -l %userid% -pw %passwd% %router% "display acl %acl%" ^| findstr /rc:" *rule *[0-9][0-9]* *[\<permit\> \<deny\> \<comment\>]"') do @if "%%j"=="permit" (echo %%i: %%l ^(Yes^)) else (if "%%j"=="deny" (echo %%i: %%l ^(No^)) else (echo %%i: %%k%%l%%m))>> %rulesfile%.tmp
    
19. 
    
20. type nul> %rulesfile%
    
21. for /f "tokens=1* delims=:" %%i in ('findstr "\(Yes\)$ \(No\)$" %rulesfile%.tmp') do (
    
22.     set comment=
    
23.     for /f "skip=1 tokens=2*" %%x in ('findstr "^%%i:" %rulesfile%.tmp') do set comment=true && echo %%i:%%j //%%x%%y
    
24.     if not defined comment echo %%i:%%j
    
25. )>> %rulesfile%
    
26. del /q %rulesfile%.tmp
    
27. 
    
28. :repeat
    
29. echo.
    
30. echo 互联网终端开通/关闭情况（Yes:开，No:关）：
    
31. type %rulesfile%
    
32. set /p no=请输入要开通/关闭的互联网终端编号（可用“,”分割输入多个编号，0:退出）：
    
33. 
    
34. set "tt=%time::=%"
    
35. set "tt=%tt:.=%"
    
36. set "tt=%tt: =0%"
    
37. if EXIST "%TEMP%" (set cmdfile="%TEMP%\inet-updown-%tt%.h3c") else (set cmdfile="inet-updown-%tt%.h3c")
    
38. echo system> %cmdfile%
    
39. echo acl basic %acl%>> %cmdfile%
    
40. 
    
41. set openNodes=
    
42. set closeNodes=
    
43. setlocal enableDelayedExpansion
    
44. :loop
    
45. for /f "tokens=1* delims=, " %%i in ("%no%") do (
    
46.     if %%i equ 0 goto end
    
47.     set id=%%i
    
48.     set no=%%j
    
49.     set ip=
    
50.     for /f "tokens=2" %%x in ('findstr "^%%i:" %rulesfile%') do set ip=%%x
    
51.     if defined ip goto found
    
52.     echo 终端编号 %%i 无效！
    
53.     goto loop
    
54. :found
    
55.     findstr "^%id%:.*\(Yes\)" %rulesfile%>nul 2>&1 && (set closeNodes=%closeNodes%，%id%) || (set openNodes=%openNodes%，%id%)
    
56.     (findstr "^%id%:.*\(Yes\)" %rulesfile%>nul 2>&1 && (echo rule %id% deny source %ip% 0) || (echo rule %id% permit source %ip% 0))>> %cmdfile%
    
57. )
    
58. if defined no goto loop
    
59. if defined openNodes echo 正在开通 %openNodes:~1% 号互联网终端...
    
60. if defined closeNodes echo 正在关闭 %closeNodes:~1% 号互联网终端...
    
61. endlocal
    
62. 
    
63. echo return>> %cmdfile%
    
64. echo quit>> %cmdfile%
    
65. plink -batch -l %userid% -pw %passwd% %router% -m %cmdfile%>nul 2>&1
    
66. del /q %cmdfile%>nul 2>&1
    
67. 
    
68. goto begin
    
69. :end
    
70. del /q %cmdfile%>nul 2>&1
    
71. del /q %rulesfile%>nul 2>&1

复制代码