勒索病毒,华为/H3C三层交换机/路由器用ACL端口禁用高危端口

勒索病毒,华为/H3C三层交换机/路由器用ACL端口禁用高危端口

 

**************************************
华为

#
acl number 3100         //创建ALC控制规则
 rule 5 deny tcp destination-port eq 445         //禁止TCP 445端口数据
 rule 10 deny tcp destination-port eq 135
 rule 15 deny tcp destination-port eq 137
 rule 20 deny tcp destination-port eq 138
 rule 25 deny tcp destination-port eq 139
 rule 30 deny udp destination-port eq 445
 rule 35 deny udp destination-port eq 135
 rule 40 deny udp destination-port eq 137
 rule 45 deny udp destination-port eq 138
 rule 50 deny udp destination-port eq 139

#
traffic classifier anti_wana operator or precedence 5         //创建流分类
 if-match acl 3100         //将ACL与流分类关联
#
traffic behavior anti_wana         //创建流行为
 deny         //动作为禁止
 statistic enable         //使能流量统计（可选）
#
traffic policy anti_wana match-order config         //创建流策略
 classifier anti_wana behavior anti_wana         //将流分类和流行为进行关联

[全局视图]
traffic-policy anti_wana global inbound         //全局应用入方向流策略
traffic-policy anti_wana global outbound         //全局应用出方向流策略

[接口视图]         //也可以根据使用接口在接口上应用相关流策略
traffic-policy anti_wana inbound
traffic-policy anti_wana outbound

****************************************
H3C

大部分配置相同，毕竟本是同根生啊。
#
acl number 3100
 rule 5 deny tcp destination-port eq 445
 rule 10 deny tcp destination-port eq 135
 rule 15 deny tcp destination-port eq 137
 rule 20 deny tcp destination-port eq 138
 rule 25 deny tcp destination-port eq 139
 rule 30 deny udp destination-port eq 445
 rule 35 deny udp destination-port eq 135
 rule 40 deny udp destination-port eq 137
 rule 45 deny udp destination-port eq 138
 rule 50 deny udp destination-port eq 139
#
traffic classifier anti_wana operator and
 if-match acl 3100
#
traffic behavior anti_wana
 filter deny
#
qos policy anti_wana
 classifier anti_wana behavior anti_wana

#
[接口视图]
 qos apply policy anti_wana inbound
 qos apply policy anti_wana outbound

[全局视图]         //基于全局应用QoS策略仅在MPE单板（仅入方向）和SPC单板上生效；部分设备无法使用此命令，只能在接口上应用。
 qos apply policy anti_wana global inbound
 qos apply policy anti_wana global outbound

==========================================
近期勒索病毒发生了变异，3389端口也在攻击之列中，请在ACL中添加相关规则，以防不测！
rule 55 deny udp destination-port eq 3389
rule 60 deny tcp destination-port eq 3389