Cisco交换机中封锁445端口

原因：

一些HP  Thin Client PC在注册表中封锁445端口后，仍然有大量攻击其他电脑445端口的记录，于是想到在交换机封锁其流量端口。

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters]
"SMBDeviceEnabled"=dword:00000000

解决方法：

注意点：

1、源端口是随机的，目的端口是445

2、acl的方向，到达本接口网段的是outbound方向，从本接口出去，是inbound方向

ip access-group deny_port445_acl in

ip access-group deny_port445_acl out

//定义ACL规则

A2-EAST(config)#ip access-list extended deny_port445_acl

A2-EAST(config-ext-nacl)#deny tcp any any eq 445

A2-EAST(config-ext-nacl)#permit ip any any

A2-EAST(config-ext-nacl)#end

A2-EAST#sh ip access-lists

Extended IP access list deny_port445_acl

    10 deny tcp any any eq 445

    20 permit ip any any

//将ACL应用到端口上

A2-EAST#conf t

Enter configuration commands, one per line.  End with CNTL/Z.

A2-EAST(config)#int fa 0/2

A2-EAST(config-if)#ip access-group deny_port445_acl in

A2-EAST(config-if)#end

A2-EAST#wr

//查找相关主机的端口

A3-EAST#ping 172.16.1.134

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 172.16.1.134, timeout is 2 seconds:

!!!!!

Success rate is 100 percent (5/5), round-trip min/avg/max = 1/4/9 ms

A3-EAST#sh ip arp | in 172.16.1.134

Internet  172.16.1.134           0   78ac.c092.a5ec  ARPA   Vlan43

A3-EAST#sh mac add | in 78ac.c092.a5ec

  43    78ac.c092.a5ec    DYNAMIC     Fa0/13

A3-EAST#

//封锁该主机IP的445端口后，防火墙不再报相关的错误。