firwall防止网络攻击

《firwall防止网络攻击》由会员上传分享，免费在线阅读，更多相关内容在行业资料-天天文库。

1、SecPath防火墙攻击防范典型配置一、组网需求SecPath开启攻击防范，对内外网的双向流量进行监控，对攻击进行告警和阻断。二、组网图软件版本如下：SecPath100F：VRP3.40ESS1604；三、配置步骤[Quidway]#sysnameQuidway#firewallpacket-filterenablefirewallpacket-filterdefaultpermit#undoconnection-limitenableconnection-limitdefaultdenyconnection-limitdefaultamountupper-limit50lower-li

2、mit20#firewallstatisticsystemenable#radiusschemesystem#domainsystem#local-useradminpasswordcipher.]@USE=B,53Q=^Q`MAF4<1!!service-typetelnetterminallevel3service-typeftp#interfaceEthernet1/0ipaddress192.168.1.254255.255.255.0#interfaceEthernet2/0ipaddress202.38.1.1255.255.0.0#interfaceNULL0#firewal

3、lzonelocalsetpriority100#firewallzonetrustaddinterfaceEthernet1/0setpriority85#firewallzoneuntrustaddinterfaceEthernet2/0setpriority5#firewallzoneDMZsetpriority50#firewallinterzonelocaltrust#firewallinterzonelocaluntrust#firewallinterzonelocalDMZ#firewallinterzonetrustuntrust#firewallinterzonetrus

4、tDMZ#firewallinterzoneDMZuntrust#FTPserverenable#firewalldefendip-spoofing\防范IP欺骗firewalldefendland\防范Land攻击firewalldefendsmurf\防范Smurf攻击firewalldefendfraggle\防范Fraggle攻击firewalldefendwinnuke\防范Winnuke攻击firewalldefendicmp-redirect\防范ICMP重定向攻击firewalldefendicmp-unreachable\防范ICMP不可达攻击firewal

5、ldefendsource-route\防范源路由攻击firewalldefendroute-record\防范记录路由攻击firewalldefendtracert\防范Tracert攻击firewalldefendping-of-death\防范死亡之Ping攻击firewalldefendtcp-flag\防范TCP-flag攻击firewalldefendip-fragment\防范IP分片攻击firewalldefendlarge-icmp\防范超大ICMP包攻击firewalldefendteardrop\防范teardrop(泪滴)攻击firewalldefe

6、ndip-sweep\防范IP扫描攻击firewalldefendport-scan\防范端口扫描攻击firewalldefendarp-spoofing\防范arp欺骗攻击firewalldefendarp-reverse-query\防范反向arp请求攻击firewalldefendarp-flood\防范arp洪水攻击firewalldefendfrag-flood\防范分片洪水攻击firewalldefendsyn-floodenable\使能syn-flood攻击防范firewalldefendudp-floodenable\使能udp-flood攻击防范fire

7、walldefendicmp-floodenable\使能icmp-flood攻击防范#user-interfacecon0user-interfacevty04authentication-modescheme#return四、配置关键点1．在全局模式下使用firewalldefendxx打开对xx攻击的防范；2．注意：对于syn-flood、udp-flood和icmp-flood的攻击防范，情况有所不同。除了使能