【正文】 sc、]，配置帶地址池的NAT Outbound。seqnumberb、系統(tǒng)視圖下執(zhí)行命令ipsec policyacl]，或槽位視圖下執(zhí)行命令cpudefendpolicypolicyname，應(yīng)用防攻擊策略。系統(tǒng)視圖下執(zhí)行命令cpudefendpolicypolicyname，創(chuàng)建防攻擊策略并進(jìn)入防攻擊策略視圖。c、node|cost，設(shè)置路由的開銷值等。limit||isiscostroutepolicy|processid2000～2999Filter Policy路由協(xié)議不同，過濾方向不同，命令行不同。ipprefixinterfacenumberipprefixnameinterfacetypeinterfacenumber] [基于ACL的報(bào)文過濾配置通過配置基于ACL的報(bào)文過濾，對匹配ACL規(guī)則報(bào)文進(jìn)行禁止/允許動作，進(jìn)而實(shí)現(xiàn)對網(wǎng)絡(luò)流量的控制。 inbound inbound acl INTEGER40004999[Huawei]trafficfilter vlan 2 outbound acl 3000 rule ?aclname ipv6 name[HuaweiGigabitEthernet0/0/2]trafficfilter outbound acl 3000 ?inbound|命令參數(shù)說明參數(shù)說明vlan outbound[Huawei]trafficlimit vlan 3 ? Specify ACL to match ipv6 name[Huawei]trafficlimit vlan 3 outbound acl 2000 ? Value of CIR (Unit: Kbps)crinboundSpecify ACL to matchcpuSpecify the nexthop IPSpecify the ID of acl ruleaclRemark cvlan idRemark DSCP (DiffServ CodePoint)Specify the ID of acl rule基于ACL的流量統(tǒng)計(jì)配置通過配置基于ACL的流量統(tǒng)計(jì)，對匹配指定ACL規(guī)則的報(bào)文進(jìn)行流量統(tǒng)計(jì)。outbound[Huawei]trafficstatistic inbound acl ?Advanced accesslistUserdefined accesslist[Huawei]tcrVirtual LAN[Huawei]trafficmirror inbound acl ?Advanced accesslistUserdefined accesslist[Huawei]trafficmirror inbound acl 2000 rule ?INTEGER1在接口上配置流鏡像配置基于ACL的流鏡像命令與在全局或VLAN上配置基于ACL的流鏡像類似，不同之處在于需在接口視圖下配置。[Huawei]trafficmirror inbound acl 2000 rule 2 to observeport ?INTEGER50005999INTEGER30003999Statistics by bytesINTEGER50005999INTEGER30003999Apply the acl on inbound packets、在接口上配置基于ACL報(bào)文重標(biāo)記命令與在全局或VLAN上配置基于acl報(bào)文重標(biāo)記類似，不同之處是在接口視圖下配置。cvlanid[Huawei]trafficremark outbound ?inboundrule[Huawei]trafficredirect vlan 5 inbound acl 3000 ?aclVLAN ID、在全局或VLAN上配置基于ACL重定向[Huawei]trafficredirect ? PIR Peak information rate Committed burst size[Huawei]trafficlimit vlan 3 outbound acl 2000 cir ? INTEGER40004999[Huawei]trafficlimit vlan 3 outbound ?]| INTEGER04294967294 INTEGER40004999 acl、在接口上配置基于簡化流策略ACL報(bào)文過濾[HuaweiGigabitEthernet0/0/2]trafficfilter ?l2–acl] INTEGER30003999 VLAN ID當(dāng)trafficfilter和其他基于ACL的簡化流策略同時配置，且ACL規(guī)則中的動作為Permit時，先配置的簡化流策略生效。如果配置trafficredirect命令將流量重定向到接口時，建議ACL規(guī)則匹配二層流量。versionprocessid|[aclname]|isis|tagprocessidospf] |] |例如針對OSPF協(xié)議，可以在OSPF視圖下，執(zhí)行命令importroute{deny]，或槽位視圖下執(zhí)行命令cpudefendpolicypolicyname，應(yīng)用防攻擊策略。aclb、policyname[執(zhí)行命令whitelist3000～3999本機(jī)防攻擊策略白名單a、系統(tǒng)視圖下執(zhí)行命令ipsec policytemplatetemplatenameb、aclnumber，在安全策略中引用ACL。系統(tǒng)視圖下執(zhí)行命令ipsec policyb、[interfacetype系統(tǒng)視圖下執(zhí)行命令nat addressgroup{config報(bào)文過濾有兩種流動作：deny或permit。aclnumberandFilter logout connections from the current user interfaceSFTP中應(yīng)用ACL配置[Huawei]ssh server acl ?或[Huaweiuivty04]acl ?INTEGER20002999Filter login connections from the current user interfaceApply basic or advanced ACL設(shè)備接口板提供擴(kuò)展表項(xiàng)空間寄存器，通過配置擴(kuò)展表項(xiàng)空間資源的分配模式，可以選擇性擴(kuò)大MAC、ACL和FIB表項(xiàng)的底層空間大小。缺省情況下，擴(kuò)展表項(xiàng)空間寄存器的資源模式為1，僅擴(kuò)展MAC表項(xiàng)。slotid 配置接口板擴(kuò)展表項(xiàng)空間資源的分配模式，用來靜態(tài)分配MAC、ACL和FIB表項(xiàng)的底層空間大小。upperlimit User Datagram Protocol(17) ospf icmpv6 1255 permit logging X:X::X:X/M Specify source addressSpecify matched packet permit description number name具體配置及參數(shù)同前。 Specify a special time[Huaweiacluser5000]rule 1 deny ?cvlan8021p cr l2protocol doubletag Specify matched packet deny deny啟用此命令表示過濾。tcpflag指定acl規(guī)則匹配TCP報(bào)文中的SYN標(biāo)志的類型timerange指定acl規(guī)則生效時間段destinationport{eq prot|gt port|lt port|rage portstart port end}指定acl規(guī)則匹配報(bào)文的UDP或TCP的目的端口，僅在報(bào)文協(xié)議是UDP或TCP時生效。、高級acl常用功能說明參數(shù)說明deny拒絕符合條件的報(bào)文permit允許符合條件的報(bào)文source{souraddr sourwildcard|any}souraddr sourwildcard:源ip地址 Specify tos timerange[Huaweiacladv3000]rule 1 permit udp source any destination 0 destinationport eq xdmcp syslog SNMPTRAP (162) Network Time Protocol (123) netbiosdgm bootpc neq[Huaweiacladv3000]rule 1 permit udp source any destination 0 destinationport ? Specify dscp[Huaweiacladv3000]rule 1 permit udp source any destination 0 ? Specify tos dscp tos timerangeSpecify source address fragmenttype destinationport[Huaweiacladv3000]rule 1 permit udp ? Transmission Control Protocol (6)高級acl主要對源/目的IP地址、端口號、優(yōu)先級、時間段等報(bào)文進(jìn)行過濾。在ACL中配置首條規(guī)則時，如果未指定參數(shù)ruleid，設(shè)備使用步長值作為規(guī)則的起始編號。 Specify a VPNInstance timerange Any source[Huaweiaclbasictest]rule 1 deny source ? vpninstance Specify the fragment type of packet TEXT、ACL步長設(shè)置（可選）[Huaweiaclbasictest]step ? 高級acl[Huawei]acl name test advance ? crs match order auto[Huawei]timerange test from 8:00 2016/1/17 to 18:00 2016/11/17 Tue Monday 星期一 hh:mm The ending point of periodic timerange Starting time hh:mm to[Huawei]timerange test 8:00 to ? Mon星期四 offday Monday to Friday 工作日每一天 Config order或[Huawei]acl number 2000 matchorder ? advance Set ACL39。 Specify a number for the named ACL INTEGER20002999 INTEGER20002999 Advanced accesslist(add to current using rules) ACL IPv6 deny fragmenttype Specify a special time 對分組片段類型有效 ACL description (no more than 127 characters)高級ACL規(guī)則配置高級ACL編號aclnumber的范圍是3000～3999。 igmp Specify destination address Specify dscp Specify source port Specify a special time vpninstance any destination Specify destination port cr any Wildcard of destination L