Quidway S6500系列交換機(jī)防病毒配置方案模板
現(xiàn)在網(wǎng)絡(luò)病毒肆意橫行，給網(wǎng)絡(luò)的正常應(yīng)用帶來(lái)了很大的隱患，下面給出Quidway S6500系列交換機(jī)防病毒配置的一個(gè)模版，僅供大家參考：
acl name anti_worm advanced
rule 0 deny udp destination-port eq tftp
rule 1 deny tcp destination-port eq 135
rule 2 deny udp destination-port eq 135
rule 3 deny udp destination-port eq 137
rule 4 deny udp destination-port eq 138
rule 5 deny tcp destination-port eq 139
rule 6 deny udp destination-port eq netbios-ssn
rule 7 deny tcp destination-port eq 445
rule 8 deny udp destination-port eq 445
rule 9 deny tcp destination-port eq 539
rule 10 deny udp destination-port eq 539
rule 11 deny tcp destination-port eq 593
rule 12 deny udp destination-port eq 593
rule 13 deny udp destination-port eq 1434
rule 14 deny tcp destination-port eq 4444
acl name anti_icmp advanced
rule 0 deny icmp
將以上規(guī)則以not-carefor-interface方式在芯片上全局下發(fā)，如：
int e1/0/1
packet-filter inbound ip-group anti_worm not-care-for-interface
packet-filter inbound ip-group anti_icmp not-care-for-interface
int e2/0/1
packet-filter inbound ip-group anti_worm not-care-for-interface
packet-filter inbound ip-group anti_icmp not-care-for-interface
int e2/0/48
packet-filter inbound ip-group anti_worm not-care-for-interface
packet-filter inbound ip-group anti_icmp not-care-for-interface
注：
1、 not-carefor-interface參數(shù)表示的意思是該規(guī)則在整個(gè)芯片下發(fā)，而不僅僅是在這個(gè)端口下發(fā)，對(duì)于FT48單板來(lái)說(shuō)，一個(gè)有兩個(gè)芯片，前24個(gè)端口為一個(gè)芯片，后24個(gè)端口為一個(gè)芯片，在芯片的任何一個(gè)端口帶該參數(shù)下發(fā)的規(guī)則都在整個(gè)芯片上生效。
2、 其他單板為一塊芯片
