问题描述：
[MSR3660]di cu # version 7.1.064, Release 0615P13 # sysname MSR3660 # telnet server enable # dhcp enable dhcp server always-broadcast # dns proxy enable # password-recovery enable # vlan 1 # dhcp server ip-pool lan1 gateway-list 192.168.0.1 network 192.168.0.0 mask 255.255.254.0 address range 192.168.1.2 192.168.1.254 dns-list 192.168.0.1 # controller Cellular0/0 # controller Cellular0/1 # interface Aux0 # interface NULL0 # interface GigabitEthernet0/0 port link-mode route combo enable copper ip address 192.168.0.1 255.255.254.0 tcp mss 1280 # interface GigabitEthernet0/1 port link-mode route bandwidth 50000 combo enable copper ip address 123.178.18.238 255.255.255.252 dns server 222.74.1.200 nat outbound nat server protocol tcp global current-interface 8989 inside 10.10.10.3 443 # interface GigabitEthernet0/2 port link-mode route ip address 10.10.10.1 255.255.255.240 nat hairpin enable # scheduler logfile size 16 # line class aux user-role network-admin # line class tty user-role network-operator # line class vty user-role network-operator # line aux 0 user-role network-admin # line vty 0 63 authentication-mode scheme user-role network-operator # ip route-static 0.0.0.0 0 123.178.18.237 ip route-static 192.168.200.0 24 10.10.10.4 # ssh server enable # password-control enable undo password-control aging enable undo password-control history enable password-control length 6 password-control login-attempt 3 exceed lock-time 10 password-control update-interval 0 password-control login idle-time 0 password-control complexity user-name check # domain system # domain default enable system # role name level-0 description Predefined level-0 role # role name level-1 description Predefined level-1 role # role name level-2 description Predefined level-2 role # role name level-3 description Predefined level-3 role # role name level-4 description Predefined level-4 role # role name level-5 description Predefined level-5 role # role name level-6 description Predefined level-6 role # role name level-7 description Predefined level-7 role # role name level-8 description Predefined level-8 role # role name level-9 description Predefined level-9 role # role name level-10 description Predefined level-10 role # role name level-11 description Predefined level-11 role # role name level-12 description Predefined level-12 role # role name level-13 description Predefined level-13 role # role name level-14 description Predefined level-14 role # user-group system # local-user admin class manage service-type ssh telnet http authorization-attribute user-role network-admin # public-key peer 10.10.10.2 public-key-code begin 30819F300D06092A864886F70D010101050003818D0030818902818100D5D4D8AD063BA081 32B4B1FE51FA7C3A5724249D967A78DE4F4B23090E14869328810C518C8B81801DBA1EC9AE 4AB29E5D6365ED632928CEA17BB62BB79CD0DC1A01874302F2C54E01150BF6541E0A3B4D89 8A574831E310A059A822AE2C17A2926496B3D6F1F99C7A192F01551C52617CBA813154A44C 491C63729F4D8FF75B0203010001 public-key-code end peer-public-key end # ip http enable # wlan global-configuration # wlan ap-group default-group # return [MSR3660] %Nov 24 15:42:41:933 2019 MSR3660 PWDCTL/6/ADDBLACKLIST: admin was added to the blacklist for failed login attempts. %Nov 24 15:42:42:020 2019 MSR3660 WEB/5/LOGIN_FAILED: admin 92.168.0.100 ʧ %Nov 24 15:42:43:017 2019 MSR3660 PWDCTL/6/ADDBLACKLIST: admin was added to the blacklist for failed login attempts. %Nov 24 15:42:43:106 2019 MSR3660 WEB/5/LOGIN_FAILED: admin 92.168.0.100 ʧ %Nov 24 15:42:53:598 2019 MSR3660 SSHS/6/SSHS_LOG: Authentication failed for root from 149.56.122.6 port 53400 because of invalid username or wrong password . %Nov 24 15:42:53:892 2019 MSR3660 SSHS/6/SSHS_DISCONNECT: SSH user root (IP: 149.56.122.6) disconnected from the server. %Nov 24 15:42:58:390 2019 MSR3660 SSHS/6/SSHS_LOG: Authentication failed for root from 149.56.122.6 port 55242 because of invalid username or wrong password . %Nov 24 15:42:59:553 2019 MSR3660 SSHS/6/SSHS_DISCONNECT: SSH user root (IP: 149.56.122.6) disconnected from the server. %Nov 24 15:43:02:444 2019 MSR3660 SSHS/6/SSHS_LOG: Authentication failed for root from 149.56.122.6 port 58056 because of invalid username or wrong password . %Nov 24 15:43:02:724 2019 MSR3660 SSHS/6/SSHS_DISCONNECT: SSH user root (IP: 149.56.122.6) disconnected from the server. %Nov 24 15:43:02:942 2019 MSR3660 LOGIN/5/LOGIN_FAILED: shell failed to log in from 58.182.19.120. %Nov 24 15:43:08:164 2019 MSR3660 SSHS/6/SSHS_LOG: Authentication failed for root from 149.56.122.6 port 60348 because of invalid username or wrong password . %Nov 24 15:43:08:590 2019 MSR3660 SSHS/6/SSHS_DISCONNECT: SSH user root (IP: 149.56.122.6) disconnected from the server. %Nov 24 15:43:11:826 2019 MSR3660 SSHS/6/SSHS_LOG: Authentication failed for root from 149.56.122.6 port 35856 because of invalid username or wrong password . %Nov 24 15:43:12:104 2019 MSR3660 SSHS/6/SSHS_DISCONNECT: SSH user root (IP: 149.56.122.6) disconnected from the server. %Nov 24 15:43:14:392 2019 MSR3660 SSHS/6/SSHS_LOG: Authentication failed for root from 149.56.122.6 port 38256 because of invalid username or wrong password . %Nov 24 15:43:14:670 2019 MSR3660 SSHS/6/SSHS_DISCONNECT: SSH user root (IP: 149.56.122.6) disconnected from the server. %Nov 24 15:43:14:851 2019 MSR3660 LOGIN/5/LOGIN_FAILED: shell failed to log in from 58.182.19.120. %Nov 24 15:43:18:157 2019 MSR3660 IFNET/3/PHY_UPDOWN: Physical state on the interface GigabitEthernet0/0 changed to down. %Nov 24 15:43:18:157 2019 MSR3660 IFNET/5/LINK_UPDOWN: Line protocol state on the interface GigabitEthernet0/0 changed to down. [MSR3660]%Nov 24 15:43:23:489 2019 MSR3660 PWDCTL/6/ADDBLACKLIST: admin was added to the blacklist for failed login attempts. %Nov 24 15:43:23:490 2019 MSR3660 SSHS/6/SSHS_LOG: Authentication failed for admin from 149.56.122.6 port 39908 because of invalid username or wrong password . %Nov 24 15:43:23:778 2019 MSR3660 SSHS/6/SSHS_DISCONNECT: SSH user admin (IP: 149.56.122.6) disconnected from the server. [MSR3660] [MSR3660] [MSR3660] [MSR3660]%Nov 24 15:43:27:622 2019 MSR3660 PWDCTL/6/ADDBLACKLIST: admin was added to the blacklist for failed login attempts. %Nov 24 15:43:27:623 2019 MSR3660 SSHS/6/SSHS_LOG: Authentication failed for admin from 149.56.122.6 port 45862 because of invalid username or wrong password . %Nov 24 15:43:27:976 2019 MSR3660 SSHS/6/SSHS_DISCONNECT: SSH user admin (IP: 149.56.122.6) disconnected from the server. %Nov 24 15:43:30:328 2019 MSR3660 LOGIN/5/LOGIN_FAILED: shell failed to log in from 58.182.19.120. %Nov 24 15:43:30:442 2019 MSR3660 SSHS/6/SSHS_LOG: Authentication failed for test from 149.56.122.6 port 48656 because of invalid username or wrong password . %Nov 24 15:43:30:763 2019 MSR3660 SSHS/6/SSHS_DISCONNECT: SSH user test (IP: 149.56.122.6) disconnected from the server. %Nov 24 15:43:33:160 2019 MSR3660 SSHS/6/SSHS_LOG: Authentication failed for guest from 149.56.122.6 port 50344 because of invalid username or wrong password . %Nov 24 15:43:33:469 2019 MSR3660 SSHS/6/SSHS_DISCONNECT: SSH user guest (IP: 149.56.122.6) disconnected from the server.
组网及组网描述：
这是什么配置！路由器下联防火墙下联acg下联交换机！
- 2019-11-27提问
- 举报
-
(0)
最佳答案
您好，请知：
这是路由器的配置。
配置的内容如下：
1、配置了DHCP服务
dhcp server ip-pool lan1 gateway-list 192.168.0.1 network 192.168.0.0 mask 255.255.254.0 address range 192.168.1.2 192.168.1.254 dns-list 192.168.0.1
2、 G0/1口是外网口，并配置了端口映射，将内网服务器10.10.10.3转换为G0/1口的外网IP，对外网提供8989的端口服务。
interface GigabitEthernet0/1 port link-mode route bandwidth 50000 combo enable copper ip address 123.178.18.238 255.255.255.252 dns server 222.74.1.200 nat outbound nat server protocol tcp global current-interface 8989 inside 10.10.10.3 443
3、配置了路由的指向，采用了默认路由和静态路由：
ip route-static 0.0.0.0 0 123.178.18.237 //指向了外网
ip route-static 192.168.200.0 24 10.10.10.4 //内网的指向
4、G0/0口和G0/1口都是内网口的互联。
5、此设备开启了telnet和SSH远程登录
- 2019-11-27回答
- 评论(14)
- 举报
-
(0)
[F100-S-HI]dis cu # version 7.1.064, Release 9514P1801 # sysname F100-S-HI # context Admin id 1 # telnet server enable # irf mac-address persistent timer irf auto-update enable undo irf link-delay irf member 1 priority 1 # security-zone intra-zone default permit # dns server 222.74.1.200 # password-recovery enable # vlan 1 # vlan 100 # interface NULL0 # interface Vlan-interface100 description guanli ip address 10.10.10.2 255.255.255.240 # interface GigabitEthernet1/0/0 port link-mode route combo enable copper ip address 192.168.0.1 255.255.255.0 # interface GigabitEthernet1/0/1 port link-mode route combo enable fiber # interface GigabitEthernet1/0/4 port link-mode route # interface GigabitEthernet1/0/5 port link-mode route # interface GigabitEthernet1/0/6 port link-mode route # interface GigabitEthernet1/0/7 port link-mode route # interface GigabitEthernet1/0/8 port link-mode route # interface GigabitEthernet1/0/9 port link-mode route # interface GigabitEthernet1/0/10 port link-mode route # interface GigabitEthernet1/0/11 port link-mode route # interface GigabitEthernet1/0/2 port link-mode bridge port access vlan 100 # interface GigabitEthernet1/0/3 port link-mode bridge port access vlan 100 # security-zone name Local # security-zone name Trust import interface Vlan-interface100 import interface GigabitEthernet1/0/2 vlan 100 import interface GigabitEthernet1/0/3 vlan 100 # security-zone name DMZ # security-zone name Untrust # security-zone name Management import interface GigabitEthernet1/0/0 # scheduler logfile size 16 # line class aux user-role network-operator # line class console authentication-mode scheme user-role network-admin # line class vty user-role network-operator # line aux 0 user-role network-admin # line con 0 user-role network-admin # line vty 0 63 authentication-mode scheme user-role network-admin # ip route-static 0.0.0.0 0 10.10.10.1 ip route-static 192.168.200.0 24 10.10.10.4 # ssh server enable # acl advanced 3000 rule 5 deny tcp destination-port eq 135 rule 10 deny tcp destination-port eq 137 rule 15 deny tcp destination-port eq 139 rule 20 deny tcp destination-port eq 445 rule 25 deny udp destination-port eq 135 rule 30 deny udp destination-port eq netbios-ns rule 35 deny udp destination-port eq netbios-ssn rule 40 deny udp destination-port eq 445 # domain system # aaa session-limit ftp 16 aaa session-limit telnet 16 aaa session-limit ssh 16 domain default enable system # role name level-0 description Predefined level-0 role # role name level-1 description Predefined level-1 role # role name level-2 description Predefined level-2 role # role name level-3 description Predefined level-3 role # role name level-4 description Predefined level-4 role # role name level-5 description Predefined level-5 role # role name level-6 description Predefined level-6 role # role name level-7 description Predefined level-7 role # role name level-8 description Predefined level-8 role # role name level-9 description Predefined level-9 role # role name level-10 description Predefined level-10 role # role name level-11 description Predefined level-11 role # role name level-12 description Predefined level-12 role # role name level-13 description Predefined level-13 role # role name level-14 description Predefined level-14 role # user-group system # local-user admin class manage password hash $h$6$fkEeDiwaA4uLKHOj$aSsEIMIX4ay8cIaVHQW1kPRtIUMH+MMJkJj/2w0wU5xH5myFcwZXLXyiNKIqkeCVj4JFHlc1/5zC9cUVYqnrsA== service-type ssh telnet terminal https authorization-attribute user-role level-3 authorization-attribute user-role network-admin authorization-attribute user-role network-operator # ip https enable webui log enable # attack-defense policy atack scan detect level medium action logging syn-flood detect non-specific syn-flood action logging drop http-flood detect non-specific http-flood action logging drop signature detect fragment action drop logging signature detect impossible action drop logging signature detect teardrop action drop logging signature detect tiny-fragment action drop logging signature detect ip-option-abnormal action drop logging signature detect smurf action drop logging signature detect traceroute action drop logging signature detect ping-of-death action drop logging signature detect large-icmp action drop logging signature detect large-icmpv6 action drop logging signature detect tcp-invalid-flags action drop logging signature detect tcp-null-flag action drop logging signature detect tcp-all-flags action drop logging signature detect tcp-syn-fin action drop logging signature detect tcp-fin-only action drop logging signature detect land action drop logging signature detect winnuke action drop logging signature detect udp-bomb action drop logging signature detect snork action drop logging signature detect fraggle action drop logging # ips signature auto-update update schedule weekly sun start-time 02:00:00 tingle 120 # app-profile 0_IPv4 ips apply policy default mode protect anti-virus apply policy default mode protect # security-policy ip rule 0 name local-trust action pass profile 0_IPv4 source-zone Local source-zone Trust destination-zone Trust destination-zone Local # anti-virus signature auto-update update schedule weekly sun start-time 02:00:00 tingle 120 # return [F100-S-HI] [F100-S-HI] [F100-S-HI] [F100-S-HI] [F100-S-HI] [F100-S-HI] [F100-S-HI] [F100-S-HI]
大哥，看再帮忙看看这个路由器下联防火墙的设备！
1、这部分是将各接口加入了安全域 security-zone name Local # security-zone name Trust import interface Vlan-interface100 import interface GigabitEthernet1/0/2 vlan 100 import interface GigabitEthernet1/0/3 vlan 100 # security-zone name DMZ # security-zone name Untrust # security-zone name Management import interface GigabitEthernet1/0/0 2、配置了访问控制列表： acl advanced 3000 rule 5 deny tcp destination-port eq 135 rule 10 deny tcp destination-port eq 137 rule 15 deny tcp destination-port eq 139 rule 20 deny tcp destination-port eq 445 rule 25 deny udp destination-port eq 135 rule 30 deny udp destination-port eq netbios-ns rule 35 deny udp destination-port eq netbios-ssn rule 40 deny udp destination-port eq 445
举例说一下哦。 security-zone name Management import interface GigabitEthernet1/0/0 //G1/0/0端口加入了防火墙的管理域 2、访问控制列表acl advanced 3000封堵了 135、137、139、445等高危关口
好的，好的明白了！
这个防火墙的配置是三层模式！是路由模式是不是！
attack-defense policy atack scan detect level medium action logging syn-flood detect non-specific syn-flood action logging drop http-flood detect non-specific http-flood action logging drop signature detect fragment action drop logging signature detect impossible action drop logging signature detect teardrop action drop logging signature detect tiny-fragment action drop logging signature detect ip-option-abnormal action drop logging
这些是什么配置！attack-defense policy atack scan detect level medium action logging syn-flood detect non-specific syn-flood action logging drop http-flood detect non-specific http-flood action logging drop signature detect fragment action drop logging signature detect impossible action drop logging signature detect teardrop action drop logging signature detect tiny-fragment action drop logging signature detect ip-option-abnormal action drop logging
这个防火墙是路由模式，因为看到了三层接口及静态路由
上面的命令都是防御检测，比如http-flood detect是http的
蒙哥，我再问一下啊！他这个2口和3口加入了vlan 100，加入好人trust域里面，这个2口和3口是不是接上联路由器和下联acg的！
由于您提供的配置里面没有做描述，还是现场看一下线路哦。
亲~登录后才可以操作哦!
确定你的邮箱还未认证，请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
- 1. 您举报的内容是什么？（请在邮件中列出您举报的内容和链接地址）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
- 3. 是哪家企业？（营业执照，单位登记证明等证件）
- 4. 您与该企业的关系是？（您是企业法人或被授权人，需提供企业委托授权书）
抄袭了我的内容
×
原文链接或出处
诽谤我
×
- 1. 您举报的内容以及侵犯了您什么权益？（请在邮件中列出您举报的内容、链接地址，并给出简短的说明）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
对根叔社区有害的内容
×
不规范转载
×
举报说明
由于您提供的配置里面没有做描述，还是现场看一下线路哦。