snmp扫描防火墙F1020，发现UDP161、500端口开放，如何关闭

 通过安全策略屏蔽外网访问UDP 161、UDP 500、TCP 8840端口：

1. 创建服务对象

[Device] object-group service udp_161

[Device-obj-service-udp_161] service 0 protocol udp destination-port 161

[Device-obj-service-udp_161] quit

[Device] object-group service udp_500

[Device-obj-service-udp_500] service 0 protocol udp destination-port 500

[Device-obj-service-udp_500] quit

[Device] object-group service tcp_8840

[Device-obj-service-tcp_8840] service 0 protocol tcp destination-port 8840

[Device-obj-service-tcp_8840] quit

2. 配置安全策略阻断流量

[Device] security-policy ip

[Device-security-policy-ip] rule name block_external_ports

[Device-security-policy-ip-1-block_external_ports] source-zone untrust  # 假设外网接口在untrust域

[Device-security-policy-ip-1-block_external_ports] destination-zone local  # 若屏蔽防火墙自身服务

[Device-security-policy-ip-1-block_external_ports] service udp_161 udp_500 tcp_8840

[Device-security-policy-ip-1-block_external_ports] action deny

[Device-security-policy-ip-1-block_external_ports] quit

[Device-security-policy-ip] quit

关键配置说明：

源区域untrust对应外网接口所在安全域，目的区域local表示防火墙自身服务。

服务对象需正确定义端口和协议类型

拒绝策略需放置在允许规则之前（策略按自上而下顺序匹配）

建议将这条拒绝规则放置在安全策略列表的顶部，确保在允许其他流量前优先阻断这三个端口的访问。