H3C S5552P-EI-D-H3, Version 7.1.070高危端口限制
- 0关注
- 0收藏，72浏览
acl进行限制
这个型号的，这样可以吗？ system-view acl advanced 3000 rule 5 deny tcp destination-port range 80 445 rule 10 deny tcp destination-port eq 593 rule 15 deny tcp destination-port range 1434 4444 rule 20 deny tcp destination-port range 5554 8080 rule 25 deny udp destination-port range 80 445 rule 30 deny udp destination-port eq 593 rule 35 deny udp destination-port range 1434 4444 rule 40 deny udp destination-port range 5554 8080 rule 100 permit ip quit traffic classifier HighRiskPorts operator or if-match acl 3000 quit traffic behavior DropHighRisk car cir 0 quit qos policy Control-Plane-Protect classifier HighRiskPorts behavior DropHighRisk quit control-plane slot 0 qos apply policy ProtectCPU inbound quit save force
1. 定义高危端口对象组
object-group port H3C_HighRisk_Ports
port 80
port 135 to 139
port 443
port 445
port 593
port 1434
port 4444
port 5554
port 8080
2. 配置高级ACL
明确区分“目的是设备”和“经过设备”的流量，先放行业务/管理源，再拒绝高危端口。
acl advanced 3000
rule 10 permit ip source 192.168.0.0 0.0.255.255 // 放行管理网段
rule 11 permit ip source 10.0.0.0 0.255.255.255 // 放行业务网段（可选）
rule 20 deny tcp destination-port object-group H3C_HighRisk_Ports
rule 30 deny udp destination-port object-group H3C_HighRisk_Ports
rule 100 permit ip // 确保其他协议（OSPF/BGP等）不受控
3. 应用到控制平面
control-plane
packet-filter 3000 inbound
注意
确认管理源：请先将 rule 10/11 换成实际的管理网段，以免断连。
Web/HTTPS：80/443若用于Web登录，请修改规则或改非标准端口。
您好，这个型号的交换机无法创建对象组： object-group port H3C_HighRisk_Ports
您好，这个型号的交换机无法创建对象组： object-group port H3C_HighRisk_Ports
设备：S5552P-EI-D-H3 CMW7.1.070
需求：只拦访问交换机本机的高危端口，不影响业务转发流量
方案：用control-plane控制平面 QoS 策略（仅对上 CPU 报文生效）
- 定义流分类匹配目标高危 TCP/UDP 端口
- 流行为配置丢弃
- 策略绑定后应用到 control-plane inbound
- 可选：不需要 Web 就直接关闭 http/https 服务；也可加 ACL 限制管理源 IP
验证：
display qos policy control-plane inbound
核心要点：不要在接口下配 packet-filter，会拦截转发业务。
回退删除整套策略命令：
control-plane
undo qos apply policy Control-Plane-Protect inbound
quit
undo qos policy Control-Plane-Protect
undo traffic behavior Local-Drop
undo traffic-classifier Local-Danger-Port修改一下，这样可以吗？ system-view acl advanced 3000 rule 5 deny tcp destination-port range 80 445 rule 10 deny tcp destination-port eq 593 rule 15 deny tcp destination-port range 1434 4444 rule 20 deny tcp destination-port range 5554 8080 rule 25 deny udp destination-port range 80 445 rule 30 deny udp destination-port eq 593 rule 35 deny udp destination-port range 1434 4444 rule 40 deny udp destination-port range 5554 8080 rule 100 permit ip quit traffic classifier HighRiskPorts operator or if-match acl 3000 quit traffic behavior DropHighRisk car cir 0 quit qos policy Control-Plane-Protect classifier HighRiskPorts behavior DropHighRisk quit control-plane slot 0 qos apply policy Control-Plane-Protect inbound quit save force
您看这样配置可以吗？ system-view acl advanced 3000 rule 5 deny tcp destination-port range 80 445 rule 10 deny tcp destination-port eq 593 rule 15 deny tcp destination-port range 1434 4444 rule 20 deny tcp destination-port range 5554 8080 rule 25 deny udp destination-port range 80 445 rule 30 deny udp destination-port eq 593 rule 35 deny udp destination-port range 1434 4444 rule 40 deny udp destination-port range 5554 8080 rule 100 permit ip quit traffic classifier HighRiskPorts operator or if-match acl 3000 quit traffic behavior DropHighRisk car cir 0 quit qos policy Control-Plane-Protect classifier HighRiskPorts behavior DropHighRisk quit control-plane slot 0 qos apply policy ProtectCPU inbound quit save force
修改一下，这样可以吗？ system-view acl advanced 3000 rule 5 deny tcp destination-port range 80 445 rule 10 deny tcp destination-port eq 593 rule 15 deny tcp destination-port range 1434 4444 rule 20 deny tcp destination-port range 5554 8080 rule 25 deny udp destination-port range 80 445 rule 30 deny udp destination-port eq 593 rule 35 deny udp destination-port range 1434 4444 rule 40 deny udp destination-port range 5554 8080 rule 100 permit ip quit traffic classifier HighRiskPorts operator or if-match acl 3000 quit traffic behavior DropHighRisk car cir 0 quit qos policy Control-Plane-Protect classifier HighRiskPorts behavior DropHighRisk quit control-plane slot 0 qos apply policy Control-Plane-Protect inbound quit save force
编辑答案
亲~登录后才可以操作哦!
确定你的邮箱还未认证，请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
- 1. 您举报的内容是什么？（请在邮件中列出您举报的内容和链接地址）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
- 3. 是哪家企业？（营业执照，单位登记证明等证件）
- 4. 您与该企业的关系是？（您是企业法人或被授权人，需提供企业委托授权书）
抄袭了我的内容
×
原文链接或出处
诽谤我
×
- 1. 您举报的内容以及侵犯了您什么权益？（请在邮件中列出您举报的内容、链接地址，并给出简短的说明）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
对根叔社区有害的内容
×
不规范转载
×
举报说明
这个型号的，这样可以吗？ system-view acl advanced 3000 rule 5 deny tcp destination-port range 80 445 rule 10 deny tcp destination-port eq 593 rule 15 deny tcp destination-port range 1434 4444 rule 20 deny tcp destination-port range 5554 8080 rule 25 deny udp destination-port range 80 445 rule 30 deny udp destination-port eq 593 rule 35 deny udp destination-port range 1434 4444 rule 40 deny udp destination-port range 5554 8080 rule 100 permit ip quit traffic classifier HighRiskPorts operator or if-match acl 3000 quit traffic behavior DropHighRisk car cir 0 quit qos policy Control-Plane-Protect classifier HighRiskPorts behavior DropHighRisk quit control-plane slot 0 qos apply policy ProtectCPU inbound quit save force