大型园区网络内网安全部署一般方法和配置案例(7)

大型园区网络内网安全部署一般方法和配置案例

# 配置端口防攻击功能示例

<HUAWEI> system-view
[HUAWEI] acl number 2001
[HUAWEI-acl-basic-2001] rule permit source 10.1.1.0 0.0.0.255
[HUAWEI-acl-basic-2001] quit
[HUAWEI] cpu-defend policy test                                      # 创建防攻击策略，并进入防攻击策略视图
[HUAWEI-cpu-defend-policy-test] auto-port-defend enable              # 使能端口防攻击功能
[HUAWEI-cpu-defend-policy-test] auto-port-defend alarm enable        # 使能端口防攻击事件上报功能
[HUAWEI-cpu-defend-policy-test] auto-defend whitelist 1 acl 2001     # 配置端口防攻击白名单

# 配置用户级限速功能示例

<HUAWEI> system-view
[HUAWEI] cpu-defend host-car enable               # 使能用户级限速功能

# 配置ARP报文限速功能示例

<HUAWEI> system-view
[HUAWEI] arp anti-attack rate-limit enable                           # 使能全局ARP报文限速功能
[HUAWEI] arp speed-limit source-mac 00e0-fc01-0001 maximum 20        # 配置根据源MAC地址进行ARP报文限速的限速值
[HUAWEI] arp speed-limit source-ip 10.1.1.1 maximum 20               # 配置根据源IP地址进行ARP报文限速的限速值

# 配置ARP Miss消息限速功能示例

<HUAWEI> system-view
[HUAWEI] arp-miss anti-attack rate-limit enable                       # 使能全局ARP Miss报文限速功能
[HUAWEI] arp-miss speed-limit source-mac 00e0-fc01-0001 maximum 20    # 配置根据源MAC地址进行ARP Miss报文限速的限速值
[HUAWEI] arp-miss speed-limit source-ip 10.1.1.1 maximum 20           # 配置根据源IP地址进行ARP Miss报文限速的限速值

# 配置临时ARP表项的老化功能示例

<HUAWEI> system-view
[HUAWEI] interface gigabitethernet 0/0/1
[HUAWEI-GigabitEthernet0/0/1] arp-fake expire-time 3                  # 配置临时ARP表项的老化时间

# 配置禁止过路ARP报文上送CPU功能示例

<HUAWEI> system-view
[HUAWEI] interface vlanif 10 
[HUAWEI-Vlanif10] arp optimized-passby enable                         # 配置禁止过路ARP报文上送CPU

# 配置ARP优化应答功能示例

<HUAWEI> system-view
[HUAWEI] undo arp optimized-reply disable                              # 使能ARP优化应答功能

# 配置ARP表项严格学习功能示例

<HUAWEI> system-view
[HUAWEI] arp learning strict                                           # 使能全局ARP表项严格学习功能
[HUAWEI] quit

# 配置ARP表项限制功能示例

<HUAWEI> system-view
[HUAWEI] interface gigabitethernet 0/0/1
[HUAWEI-GigabitEthernet0/0/1] arp-limit maximum 20                     # 配置限制接口能够学习到的最大动态ARP表项数目