1.通過ACL封禁高危端口及按需放通訪問內容
可在端口下調用ACL或者在端口對應vlan的三層口下調用ACL
#
acl number 3200
rule 210 deny tcp destination-port eq 135
rule 220 deny tcp destination-port eq 137
rule 230 deny tcp destination-port eq 138
rule 240 deny tcp destination-port eq 139
rule 250 deny tcp destination-port eq 445
rule 260 deny udp destination-port eq 135
rule 270 deny udp destination-port eq netbios-ns
rule 280 deny udp destination-port eq netbios-dgm
rule 290 deny udp destination-port eq netbios-ssn
rule 300 deny udp destination-port eq 445
rule 400 permit ip source 192.168.10.0 0.0.0.255 destination 192.168.20.0 0.0.0.255
rule 1000 deny tcp
rule 2000 deny udp
#
2.端口下綁定IP地址和MAC地址，防止非法用戶接入
#
ip verify source ip-address mac-address
ip source binding ip-address 192.168.1.1 mac-address 0021-5236-3250
#
3.端口下開啟廣播和組播風暴抑制功能，本例限制的是每秒允許轉發的最大廣播包數
#
broadcast-suppression pps 6400
multicast-suppression pps 6400
#
4.若交換機開啟STP，端口下將端口設置為邊緣端口並開啟BPDU保護
#
stp edged-port enable
stp port bpdu-protection enable
#