华为S5720交换机如何对其进行勒索病毒防范

1.配置ACL
# 配置需要在ACL中进行端口封禁的安全策略。
<HUAWEI> system-view
[HUAWEI] sysname Switch
[Switch] acl 4000
[Switch-acl-L2-4000] rule deny tcp destination-port eq 135
[Switch-acl-L2-4000] rule deny udp destination-port eq 135
[Switch-acl-L2-4000] rule deny tcp destination-port eq 137
[Switch-acl-L2-4000] rule deny udp destination-port eq 137 //封禁netbios-ns端口
[Switch-acl-L2-4000] rule deny tcp destination-port eq 138
[Switch-acl-L2-4000] rule deny udp destination-port eq 138 //封禁netbios-dgm端口
[Switch-acl-L2-4000] rule deny tcp destination-port eq 139
[Switch-acl-L2-4000] rule deny udp destination-port eq 139 //封禁netbios-ssn端口
[Switch-acl-L2-4000] rule deny tcp destination-port eq 445
[Switch-acl-L2-4000] rule deny udp destination-port eq 445
[Switch-acl-L2-4000] rule permit ip
[Switch-acl-L2-4000] quit

2.配置基于ACL的流分类
# 配置流分类tc1，对匹配ACL 4000的报文进行分类。
[Switch] traffic classifier tc1
[Switch-classifier-tc1] if-match acl 4000
[Switch-classifier-tc1] quit

3.配置流行为
# 配置流行为tb1，动作为拒绝报文通过。
[Switch] traffic behavior tb1
[Switch-behavior-tb1] deny
[Switch-behavior-tb1] quit

4.配置流策略
# 配置流策略tp1，将流分类tc1与流行为tb1关联。
[Switch] traffic policy tp1
[Switch-trafficpolicy-tp1] classifier tc1 behavior tb1
[Switch-trafficpolicy-tp1] quit

5.应用流策略到端口（上行端口或下行端口）
例如在下行接口GE0/0/2的入方向应用流策略tp1。
[Switch] interface gigabitethernet 0/0/2
[Switch-GigabitEthernet0/0/2] traffic-policy tp1 inbound
[Switch-GigabitEthernet0/0/2] quit

6.验证配置结果
# 查看ACL规则的配置信息。
[Switch] display acl 4000
L2 ACL 4000, 1 rule
Acl's step is5
rule 5 deny source-mac 00e0-f201-0101
# 查看流分类的配置信息。
[Switch] display traffic classifier user-defined
User Defined Classifier Information:
Classifier: tc1
Operator: OR
Rule(s) : if-match acl 4000

Total classifier number is 1
# 查看流策略的配置信息。
[Switch] display traffic policy user-defined tp1
User Defined Traffic Policy Information:
Policy: tp1
Classifier: tc1
Operator: OR
Behavior: tb1
Deny
# 查看流策略的应用信息。
[Switch] display traffic-policy applied-record
#
-------------------------------------------------
Policy Name:   tp1
Policy Index:  0
Classifier:tc1     Behavior:tb1
-------------------------------------------------
*interface GigabitEthernet0/0/2
traffic-policy tp1 inbound
slot 0    :  success
-------------------------------------------------
Policy total applied times: 1.
#