h3c secpath f100-c-G2 配置问题

您好，1、关于高危端口的封堵，可通过ACL来实现，以下是配置脚本，请参考：

acl advanced 3999
description gaoweiduankou_lanjie
rule 0 deny tcp destination-port eq 135
rule 1 deny tcp destination-port eq 137
rule 2 deny tcp destination-port eq 138
rule 3 deny tcp destination-port eq 139
rule 4 deny tcp destination-port eq 445
rule 5 deny tcp destination-port eq 3389

rule 6 deny udp destination-port eq 135
rule 7 deny udp destination-port eq 137
rule 8 deny udp destination-port eq 138
rule 9 deny udp destination-port eq 139
rule 10 deny udp destination-port eq 445
rule 11 deny udp destination-port eq 3389


rule 12 deny tcp source-port eq 135
rule 13 deny tcp source-port eq 137
rule 14 deny tcp source-port eq 138
rule 15 deny tcp source-port eq 139
rule 16 deny tcp source-port eq 445
rule 17 deny tcp source-port eq 3389

rule 18 deny udp source-port eq 135
rule 19 deny udp source-port eq 137
rule 20 deny udp source-port eq 138
rule 21 deny udp source-port eq 139
rule 22 deny udp source-port eq 445
rule 23 deny udp source-port eq 3389

quit

int gi 1/0/1

packet-filter 3999 inbound

packet-filter 3999 outbound

quit

1，mac加ip地址绑定在下端做就行

2，做安全策略，UNtrust-trust，只允许部分外网ip可以访问内网，在源ip地址那里加就行，

3.关闭高危端口，通过安全策略或上边的ACL都可以