CISCO防御冲击波方法

王朝other·作者佚名  2008-05-19
窄屏简体版  字體: |||超大  

! --- block TFTP

access-list 115 deny udp any any eq 69

! --- block W32.Blaster related protocols

access-list 115 deny tcp any any eq 135

access-list 115 deny udp any any eq 135

! --- block other vulnerable MS protocols

access-list 115 deny udp any any eq 137

access-list 115 deny udp any any eq 138

access-list 115 deny tcp any any eq 139

access-list 115 deny udp any any eq 139

access-list 115 deny tcp any any eq 445

access-list 115 deny tcp any any eq 593

! --- block remote access due to W32.Blaster

access-list 115 deny tcp any any eq 4444

! --- Allow all other traffic -- insert

! --- other existing access-list entries here

access-list 115 permit ip any any

interface

ip access-group 115 in

ip access-group 115 out

另外,阻止非法地址的命令是:

Router(config)# interface

Router(if-config)# no ip unreachables

如果此命令不能禁止,可参考下面这个命令:

Elab(config)# ip icmp rate-limit unreachable

VACL on the CatOS

! --- block TFTP

set security acl ip BLASTER deny udp any any eq 69

! --- block vulnerable MS protocols

! --- Blaster related

set security acl ip BLASTER deny tcp any any eq 135

set security acl ip BLASTER deny udp any any eq 135

! --- Non-blaster related

set security acl ip BLASTER deny tcp any any eq 137

set security acl ip BLASTER deny udp any any eq 137

set security acl ip BLASTER deny tcp any any eq 138

set security acl ip BLASTER deny udp any any eq 138

set security acl ip BLASTER deny tcp any any eq 139

set security acl ip BLASTER deny udp any any eq 139

set security acl ip BLASTER deny tcp any any eq 593

! --- block remote access due to W32.Blaster

set security acl ip BLASTER deny tcp any any eq 4444

! --- Allow all other traffic

! --- insert other existing access-list entries here

set security acl ip BLASTER permit any any

! -- applies both inbound and outbound

commit security acl BLASTER

set security acl map BLASTER

PIX

access-list acl_inside deny udp any any eq 69

access-list acl_inside deny tcp any any eq 135

access-list acl_inside deny udp any any eq 135

access-list acl_inside deny tcp any any eq 137

access-list acl_inside deny udp any any eq 137

access-list acl_inside deny tcp any any eq 138

access-list acl_inside deny udp any any eq 138

access-list acl_inside deny tcp any any eq 139

access-list acl_inside deny udp any any eq 139

access-list acl_inside deny tcp any any eq 445

access-list acl_inside deny tcp any any eq 593

access-list acl_inside deny tcp any any eq 4444

! --- insert previously configured acl statements here,

! --- or permit all other traffic out

access-list acl_inside permit ip any any

access-group acl_inside in interface inside

 
 
 
免责声明:本文为网络用户发布,其观点仅代表作者个人观点,与本站无关,本站仅提供信息存储服务。文中陈述内容未经本站证实,其真实性、完整性、及时性本站不作任何保证或承诺,请读者仅作参考,并请自行核实相关内容。
 
 
© 2005- 王朝網路 版權所有 導航