一、在NE40和NE80上配置如下
1、rule-map
rule-map intervlan vir-1 tcp any any eq 4444
rule-map intervlan vir-2 udp any any eq 69
rule-map intervlan vir-3 tcp any any eq 135
rule-map intervlan vir-4 udp any any eq 135
rule-map intervlan vir-5 tcp any any eq 139
rule-map intervlan vir-6 udp any any eq 139
rule-map intervlan vir-7 tcp any any eq 445
rule-map intervlan vir-8 udp any any eq 445
rule-map intervlan vir-9 tcp any any eq 593
rule-map intervlan vir-10 udp any any eq 593
rule-map intervlan vir-12 udp any any eq 1434
rule-map intervlan vir-13 tcp any any eq 5554
rule-map intervlan vir-14 tcp any any eq 9995
rule-map intervlan vir-15 tcp any any eq 9996
rule-map intervlan vir-normal ip any any
2、编写eacl
eacl anti-vir vir-1 deny
eacl anti-vir vir-2 deny
eacl anti-vir vir-3 deny
eacl anti-vir vir-4 deny
eacl anti-vir vir-5 deny
eacl anti-vir vir-6 deny
eacl anti-vir vir-7 deny
eacl anti-vir vir-8 deny
eacl anti-vir vir-9 deny
eacl anti-vir vir-10 deny
eacl anti-vir vir-11 deny
eacl anti-vir vir-12 deny
eacl anti-vir vir-13 deny
eacl anti-vir vir-14 deny
eacl anti-vir vir-15 deny
eacl anti-vir vir-normal permit
QQread.com
推出各大专业服务器评测 Linux服务器的安全性能
SUN服务器
HP服务器
DELL服务器
IBM服务器
联想服务器
浪潮服务器
曙光服务器
同方服务器
华硕服务器
宝德服务器
3、应用eacl
该eacl 应用在NE40或NE80与城域网接入设备相连的端口上应用，以就是说eacl只能在in方向起作用。
在NE80上：
<M-R-NE80-LZ-BAIYUN-01>sys
[M-R-NE80-LZ-BAIYUN-01]int gig 1/0/0
[M-R-NE80-LZ-BAIYUN-01- GigabitEthernet1/0/3]Access-group eacl anti-vir
在NE40上：
[M-R-NE40-HC-SHUIDONG-01]int gig 1/0/2
[M-R-NE40-HC-SHUIDONG-01-GigabitEthernet1/0/2]access-group router eacl anti-vir
在NE40二层板上：
[M-R-NE40-HC-SHUIDONG-01]int ether 3/0/11
[M-R-NE40-HC-SHUIDONG-01-Ethernet3/0/11]access-group switch eacl anti-vir
其他端口配置一样。
二、6509上配置如下
1、编写ACL
access-list 110 deny tcp any any eq 4444
access-list 110 deny udp any any eq 69
access-list 110 deny tcp any any eq 135
access-list 110 deny udp any any eq 135
access-list 110 deny tcp any any eq 139
access-list 110 deny udp any any eq 139
access-list 110 deny tcp any any eq 445
access-list 110 deny udp any any eq 445
access-list 110 deny tcp any any eq 593
access-list 110 deny udp any any eq 593
access-list 110 deny udp any any eq 1434
access-list 110 deny tcp any any eq 5554
access-list 110 deny tcp any any eq 9995
access-list 110 deny tcp any any eq 9996
access-list 110 permit ip any any
2、应用ACL到接口
interface Vlan12
ip access-group 110 out
