H3C 交换机封锁445端口防御病毒和漏洞

低档交换机如H3C E552/E528 交换机

1）ACL规则

acl number 3000 name hack
 rule 0 deny tcp destination-port eq 135
 rule 5 deny tcp destination-port eq 139
 rule 10 deny tcp destination-port eq 445
 rule 15 deny udp destination-port eq 135
 rule 20 deny udp destination-port eq netbios-ssn
 rule 25 deny udp destination-port eq 445
 rule 30 deny udp destination-port eq netbios-dgm
 rule 40 deny udp destination-port eq netbios-ns
 rule 45 deny tcp destination-port eq 138
 rule 50 deny tcp destination-port eq 137

2）

traffic classifier anti_wanna operator and    回车
 if-match acl 3000
#
traffic behavior anti_wanna   回车
 filter deny
#
qos policy anti_wanna   回车
 classifier anti_wanna behavior anti_wanna

3）接口视图例如如int g1/0/22 ，非INT VLAN 接口

qos apply policy anti_wanna inbound

有多少个接口就要输入多少次，好麻烦吧？ 

------------------------------------------------------------------------------------------------

中高档交换机如H3C 5880的配置如下：

1）

acl number 3000 name hack
 rule 0 deny tcp destination-port eq 135
 rule 2 deny tcp destination-port eq 5024
 rule 5 deny tcp destination-port eq 139
 rule 10 deny tcp destination-port eq 445
 rule 15 deny udp destination-port eq 135
 rule 20 deny udp destination-port eq netbios-ssn
 rule 25 deny udp destination-port eq 445
 rule 30 deny udp destination-port eq netbios-dgm
 rule 40 deny udp destination-port eq netbios-ns
 rule 45 deny tcp destination-port eq 138
 rule 50 deny tcp destination-port eq 137

2）VLAN 接口视图

interface Vlan-interface79
 ip address 116.13.179.1 255.255.255.0
 packet-filter 3000 inbound
 packet-filter 3000 outbound

有多少个接口，就设置packet-filter  3000 inbound /outbound   好简单吧？

-------------------------------------------

效果检查，使用Portscan类似端口工具，发现跨VLAN或者相同VLAN下的所有电脑相互无法扫码这些端口了吧？