大型园区网络内网安全部署一般方法和配置案例(8)

大型园区网络内网安全部署一般方法和配置案例

# 配置禁止接口学习ARP表项功能示例

<HUAWEI> system-view
[HUAWEI] interface vlanif 10 
[HUAWEI-Vlanif10] arp learning disable                                 # 配置禁止接口学习动态ARP表项

# 配置ARP表项固化功能示例

<HUAWEI> system-view
[HUAWEI] arp anti-attack entry-check fixed-mac enable                 # 使能全局的ARP表项固化功能

# 配置ARP防网关冲突功能示例

<HUAWEI> system-view
[HUAWEI] arp anti-attack gateway-duplicate enable                     # 使能ARP防网关冲突攻击功能

# 配置发送ARP免费报文功能示例

<HUAWEI> system-view
[HUAWEI] arp gratuitous-arp send enable                               # 使能发送免费ARP报文的功能
[HUAWEI] arp gratuitous-arp send interval 60                          # 使能发送免费ARP报文的时间间隔

# 配置ARP报文内MAC地址一致性检查功能示例

<HUAWEI> system-view
[HUAWEI] interface gigabitethernet 0/0/1
[HUAWEI-GigabitEthernet0/0/1] arp validate source-mac destination-mac  # 使能ARP报文内MAC地址一致性检查功能

# 配置ARP报文合法性检查功能示例

<HUAWEI> system-view
[HUAWEI] arp anti-attack packet-check ip dst-mac sender-mac            # 使能ARP报文合法性检查功能

# 配置DHCP触发ARP学习功能示例

<HUAWEI> system-view
[HUAWEI] interface vlanif 10 
[HUAWEI-Vlanif10] arp learning dhcp-trigger                           # 使能DHCP触发ARP学习功能

2.4、无线业务安全配置

通过对非法入侵的设备和非法攻击的用户进行检测和反制，保护无线网络边界的安全；

对用户接入的合法性和安全性进行认证，保证用户无线业务数据的安全。

# 配置WIDS/WIPS功能

• 配置设备检测和反制

<Huawei> system-view
[Huawei] wlan
[Huawei-wlan-view] ap-id 0
[Huawei-wlan-ap-0] radio 0
[Huawei-wlan-radio-0/0] wids device detect enable                # 使能设备检测功能
[Huawei-wlan-radio-0/0] wids contain enable                       # 使能设备反制功能
[Huawei-wlan-radio-0/0] quit
[Huawei-wlan-ap-0] quit
[Huawei-wlan-view] wids-profile name wlan-wids                   # 创建WIDS模板
[Huawei-wlan-wids-prof-wlan-wids] contain-mode spoof-ssid-ap         # 配置对非法设备或干扰设备的反制模式
[Huawei-wlan-wids-prof-wlan-wids] quit                         
[Huawei-wlan-view] ap-id 0
[Huawei-wlan-ap-0] wids-profile wlan-wids                        # 在AP中引用WIDS模板

• 配置攻击检测和动态黑名单功能

<Huawei> system-view
[Huawei] wlan
[Huawei-wlan-view] ap-id 0
[Huawei-wlan-ap-0] radio 0
[Huawei-wlan-radio-0/0] wids attack detect enable all           # 使能攻击检测功能
[Huawei-wlan-radio-0/0] quit
[Huawei-wlan-ap-0] quit
[Huawei-wlan-view] wids-profile name wlan-wids                  # 创建WIDS模板
[Huawei-wlan-wids-prof-wlan-wids] dynamic-blacklist enable          # 使能动态黑名单功能
[Huawei-wlan-wids-prof-wlan-wids] quit                         
[Huawei-wlan-view] ap-id 0
[Huawei-wlan-ap-0] wids-profile wlan-wids                       # 在AP中引用WIDS模板