【文章內(nèi)容簡介】 description MANRoutersLoopbacks match srcip exit exit entry 10 create action accept description Radius Server match srcip exit exit entry 200 create action accept description permit direct connect ip telnet match protocol tcp dstport 23 65535 srcip exit exit entry 205 create action accept description permit loopback address ip telnet match protocol tcp dstport 23 65535 srcip exit exit entry 210 create action accept description permit outband network management ip telnet match protocol tcp dstport 23 65535 srcip exit exit entry 215 create action accept description permit inband network management ip telnet match protocol tcp dstport 23 65535 srcip exit exit entry 299 create action drop description Deny other ip address telnet match protocol tcp dstport 23 65535 exit exit entry 300 create action accept description permit omc server outband management ip snmp match protocol udp dstport 161 65535 srcip exit exit entry 305 create action accept description permit omc server inband management ip snmp match protocol udp dstport 161 65535 srcip exit exit entry 310 create action accept description permit UNMP server inband management ip snmp match protocol udp dstport 161 65535 srcip exit exit entry 399 create action drop description Deny other ip address snmp match protocol udp dstport 161 65535 exit exit no shutdown 防病毒配置n 配置內(nèi)容：252。 配置ACL過濾常見病毒。n 規(guī)范要求：252。 ACL編號設(shè)為3000；252。 ACL描述設(shè)為Antivirus；252。 在與CMNET核心路由器互聯(lián)的接口上應(yīng)用。n 配置示例：對常見病毒的ACL，應(yīng)用到端口。ACL配置實例，entry步長為5GDYJMCIPMANTRT017750configure filteripfilter 3000 create /* 固定為3000 */ describtion For Antivirus defaultaction forward /* 必須添加確保正常業(yè)務(wù)流通過 */ entry 5 create match protocol tcp dstport eq 4444 exit action drop exit entry 10 create match protocol tcp dstport eq 135 exit action drop exit entry 15 create match protocol udp dstport eq 135 exit action drop exit entry 20 create match protocol tcp dstport eq 139 exit action dropexit entry 25 create match protocol tcp dstport eq 445 exit action drop exit entry 30 create match protocol udp dstport eq 445 exit action drop exit entry 35 create match protocol tcp dstport eq 1434 exit action drop exit entry 40 create match protocol udp dstport eq 1434 exit action drop exit entry 45 create match protocol tcp dstport eq 5554 exit action dropexit entry 50 create match protocol tcp dstport eq 9996 exit action drop exit entry 55 create match protocol 255 action drop exit entry 60 create match protocol 0 action drop exitexit配置實例：用戶側(cè)接入端口應(yīng)用filter（一般只在業(yè)務(wù)接口的in方向配置）GDYJMCIPMANTRT017750configure service ies 10 interface ge1/1/1 sap 1/1/1 ingress filter 3000 exitNetwork接口側(cè)應(yīng)用filterGDYJMCIPMANTRT017750configure router interface “ge3/2/1” ingress filter ip 3000 exit egress filter ip 3000 exit/* CR上一般在CR連接CMNET端口上進(jìn)行配置，inbound防止CMNET向城域網(wǎng)傳播病毒，outbound則反之?？稍谡麄€城域網(wǎng)邊界都做inbound方向 */ 防攻擊配置n 配置內(nèi)容：252。 關(guān)閉不必要的服務(wù)；252。 配置過濾常見病毒的端口及容易受攻擊的端口。n 規(guī)范要求：252。 在全局模式下需關(guān)閉finger、pad、tcpsmallservers、udpsmallservers等服務(wù)進(jìn)程；252。 在接口模式下需關(guān)閉proxyarp、ip directbroadcast和ip redirects等功能；252。 在用戶網(wǎng)段或服務(wù)器網(wǎng)段上啟用URPF。n 配置示例關(guān)閉SSH服務(wù)GDYJMCIPMANTRT017750configure system security ssh servershutdown /* 關(guān)閉sshserver */關(guān)閉ft