这几天针对“勒索病毒”全世界都是限制445端口,现在工作单位也利用了这次机会对接入交换机进行了处理。现在将这些解决方案总结如下,希望能帮到需要的同行。
设备一:H3C S3528
版本信息:
Huawei Versatile Routing Platform Software
VRP Software, Version 5.20, Release 5309
Copyright (c) 1998-2009 Huawei Tech. Co., Ltd. All rights reserved.
Quidway S3528P-EA uptime is 155 weeks, 3 days, 4 hours, 51 minutes
Quidway S3528P-EA
128M bytes DRAM
32M bytes Flash Memory
Config Register points to FLASH
Hardware Version is REV.D
CPLD Version is CPLD 002
Bootrom Version is 206
[SubSlot 0] 24FE Hardware Version is REV.D
[SubSlot 1] 4GE Hardware Version is REV.D
配置方法:
1、创建ACL,限制指定的端口(注意:若最后加上了any到any的允许或拒绝,在流行为中配置了filter deny会导致断网)
acl number 3200
rule 0 deny tcp destination-port eq 135
rule 5 deny tcp destination-port eq 136
rule 10 deny tcp destination-port eq 137
rule 15 deny tcp destination-port eq 138
rule 20 deny tcp destination-port eq 139
rule 25 deny tcp destination-port eq 445
rule 30 deny udp destination-port eq 445
2、通过流量分类、行为、QOS策略进行关联
1)、流分类:
traffic classifier AntiVirus operator and