JUNOS防止DDOS攻击的配置SAMPLE[转自ITAA原创]

system {
    host-name provider;
    root-authentication {
        encrypted-password "$1$LZn..$5wu/mQL3Y07YWodOqBl5S1"; # SECRET-DATA
    }
    login {
        user lab {
             uid 2000;
             class super-user;
             authentication {
                 encrypted-password "$1$cfuC.$vLPgSA7peoy/UzF7bIJJA0"; # SECRET-DATA
             }
        }
    }
    services {
        ftp;
        telnet;
    }
}
interfaces {
    fxp0 {
        unit 0 {
             family inet {
                 address 172.17.3.232/23;
             }
        }
    }
    ge-0/1/0 {
        gigether-options {
             no-flow-control;
        }
        unit 0 {
             family inet {
                 address 10.0.1.2/24;
             }
        }
    }
    ge-7/1/0 {
        gigether-options {
             no-flow-control;
        }
        unit 0 {
             family inet {
                 filter {
                     output ftp-www-only;
                 }
                 address 10.0.0.2/24;
             }
        }
    }
    lo0 {
        unit 0 {
             family inet {
                 address 10.0.200.1/32;
             }
        }
    }
    so-3/1/3 {
        sonet-options {
             no-payload-scrambler;
        }
        unit 0 {
             family inet {
                 address 10.0.3.2/24;
             }
        }
    }
}
forwarding-options {
    sampling {
        input {
             family inet {
                 rate 50;
             }
        }
        output {
             file filename dos-attack world-readable;
        }
    }
}
routing-options {
    static {
        route 192.168.0.0/24 nexthop 10.0.0.1;
    }
}
protocols {
    ospf {
        export static-ospf;
        area 0.0.0.0 {
             interface ge-0/1/0.0;
             interface ge-7/1/0.0 {
                 passive;
             }
             interface so-3/1/3.0;
             interface lo0.0;
        }
    }
}
policy-options {
    policy-statement static-ospf {
        from protocol static;
        then accept;
    }
}
firewall {
    filter ftp-www-only {
        term temporary-dos-filter {
             from {
                 destination-address {
                     192.168.0.10/32;
                 }
                 protocol tcp;
                 tcp-initial;
             }
             then {
                 count dos-attack;
                 sample;
                 reject;
             }
        }
        term allow-ftp-www {
             from {
                 destination-address {
                     192.168.0.10/32;
                 }
                 protocol tcp;
                 destination-port [ ftp ftp-data http ];
             }
             then accept;
        }
        term reject-other {
             from {
                 destination-address {
                     192.168.0.10/32;
                 }
             }
             then {
                 count unauthorized-service-request;
                 log;
                 discard;
             }
        }
        term accept {
             then accept;
        }
    }
}