交换机通过acl过滤病毒端口

acl number 3210

 rule 0 deny tcp destination-port eq 135

 rule 1 deny udp destination-port eq 135

 rule 2 deny tcp destination-port eq 137

 rule 3 deny udp destination-port eq netbios-ns

 rule 4 deny tcp destination-port eq 138

 rule 5 deny udp destination-port eq netbios-dgm

 rule 6 deny udp destination-port eq netbios-ssn

 rule 7 deny tcp destination-port eq 139

 rule 8 deny tcp destination-port eq 445

 rule 9 deny udp destination-port eq 445

 rule 10 deny tcp destination-port eq 3389

 rule 11 deny udp destination-port eq 3389

 rule 20 deny tcp source-port eq 135

 rule 21 deny udp source-port eq 135                                                               

 rule 22 deny tcp source-port eq 137

 rule 23 deny udp source-port eq netbios-ns

 rule 24 deny tcp source-port eq 138

 rule 25 deny udp source-port eq netbios-dgm

 rule 26 deny udp source-port eq netbios-ssn

 rule 27 deny tcp source-port eq 139

 rule 28 deny tcp source-port eq 445

 rule 29 deny udp source-port eq 445

 rule 30 deny tcp source-port eq 3389

 rule 31 deny udp source-port eq 3389

 rule 1500 permit ip

2、将ACL下发到端口：

int range gi 1/0/1 gi 1/0/24

packet-filter 3210 inbound

packet-filter 3210 outbound

quit

H3C 接入交换机(针对 H3C s5120-EI 系列)
通过 telnet（需要设备用户名和密码）或 Console 线登录：
<H3C> //进入用户视图界面
<H3C>system //进入系统视图界面
[H3C]

[H3C-acl-3999] rule deny udp destination-port eq 137 //创建规则拒绝 tcp 137 端口
[H3C-acl-3999] rule deny udp destination-port eq 138 //创建规则拒绝 tcp 138 端口
[H3C-acl-3999] rule deny udp destination-port eq 139 //创建规则拒绝 tcp 139 端口
[H3C-acl-3999] rule permit ip //创建规则允许其他通行
[H3C-acl-3999] quit //输入 quit 回车键退出
[H3C]

The current configuration will be written to the device. Are you sure? [Y/N]:Y
//输入 Y 回车键
Please input the file name(*.cfg)[flash:/startup.cfg]
(To leave the existing filename unchanged, press the enter key):
Validating file. Please wait...
Saved the current configuration to mainboard device successfull