原因:
一些HP Thin Client PC在注册表中封锁445端口后,仍然有大量攻击其他电脑445端口的记录,于是想到在交换机封锁其流量端口。
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters]
"SMBDeviceEnabled"=dword:00000000
解决方法:
注意点:
1、源端口是随机的,目的端口是445
2、acl的方向,到达本接口网段的是outbound方向,从本接口出去,是inbound方向
ip access-group deny_port445_acl in
ip access-group deny_port445_acl out
//定义ACL规则
A2-EAST(config)#ip access-list extended deny_port445_acl
A2-EAST(config-ext-nacl)#deny tcp any any eq 445
A2-EAST(config-ext-nacl)#permit ip any any
A2-EAST(config-ext-nacl)#end
A2-EAST#sh ip access-lists
Extended IP access list deny_port445_acl
10 deny tcp any any eq 445
20 permit ip any any
//将ACL应用到端口上
A2-EAST#conf t
Enter configuration commands, one per line. End with CNTL/Z.
A2-EAST(config)#int fa 0/2
A2-EAST(config-if)#ip access-group deny_port445_acl in
A2-EAST(config-if)#end
A2-EAST#wr
//查找相关主机的端口
A3-EAST#ping 172.16.1.134
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 172.16.1.134, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/4/9 ms
A3-EAST#sh ip arp | in 172.16.1.134
Internet 172.16.1.134 0 78ac.c092.a5ec ARPA Vlan43
A3-EAST#sh mac add | in 78ac.c092.a5ec
43 78ac.c092.a5ec DYNAMIC Fa0/13
A3-EAST#
//封锁该主机IP的445端口后,防火墙不再报相关的错误。