H3C S9500 Series Operation Manual page 103

Operation Manual – Port
H3C S9500 Series Routing Switches
Note:
Controlling means that the IDS monitors traffic data from mirroring ports. When
detecting suspicious traffic data, the IDS device sends to a switch (router) or firewall the
traffic data protocol header information (IP/TCP/UDP/ICMP) and action information.
The switch (router) or firewall blocks the specified traffic or port.
II. Network diagram
IDS 192.168.1.247 IDS 192.168.1.247 IDS 192.168.1.247 IDS 192.168.1.247
Attacking computer Attacking computer Attacking computer Attacking computer
Attacked computer Attacked computer Attacked computer Attacked computer
192.168.1.205 192.168.1.205 192.168.1.205 192.168.1.205
被 攻 击 机 192.168.1.205 被 攻 击 机 192.168.1.205 被 攻 击 机 192.168.1.205 被 攻 击 机 192.168.1.205 被 攻 击 机 192.168.1.205 被 攻 击 机 192.168.1.205 被 攻 击 机 192.168.1.205 被 攻 击 机 192.168.1.205
192.168.1.205 192.168.1.205 192.168.1.205 192.168.1.205 192.168.1.205 192.168.1.205 192.168.1.205 192.168.1.205
Figure 6-1 Network diagram for IDS linkage configuration
III. Configuration procedure
Note:
Only the commands related to the switch (router) are listed here.
<H3C> system-view
[H3C] mirroring-group 1 inbound Ethernet 3/1/1 mirrored-to Ethernet 3/1/48
[H3C]vlan 192
[H3C-vlan192]port Ethernet3/1/1 Ethernet3/1/3 Ethernet3/1/5 Ethernet3/1/47
[H3C-vlan192]interface vlan-interface 192
[H3C-Vlan-interface192]ip add 192.168.1.1 255.255.255.0
[H3C] interface Ethernet 3/1/1
[H3C-Ethernet3/1/1] ids-acl enable
[H3C-Ethernet3/1/1] display ids all
IDS IDS IDS IDS IDS IDS IDS IDS
192.168.1.2 192.168.1.2 192.168.1.2 192.168.1.2 192.168.1.2 192.168.1.2 192.168.1.2 192.168.1.2
47 47 47 47 47 47 47 47
Detecting port Detecting port Detecting port Detecting port
Ethernet3/1/48 Ethernet3/1/48 Ethernet3/1/48 Ethernet3/1/48
攻 击 机 192.168.1.20 攻 击 机 192.168.1.20 攻 击 机 192.168.1.20 攻 击 机 192.168.1.20 攻 击 机 192.168.1.20 攻 击 机 192.168.1.20 攻 击 机 192.168.1.20 攻 击 机 192.168.1.20 攻 击 机 192.168.1.20 攻 击 机 192.168.1.20 攻 击 机 192.168.1.20 攻 击 机 192.168.1.20
192.168.1.20 192.168.1.20 192.168.1.20 192.168.1.20 192.168.1.20 192.168.1.20 192.168.1.20 192.168.1.20
192.168.1.20 192.168.1.20 192.168.1.20 192.168.1.20
Ethernet3/1/3 Ethernet3/1/3 Ethernet3/1/3 Ethernet3/1/3
Management port Management port Management port Management port
Ethernet3/1/47 Ethernet3/1/47 Ethernet3/1/47 Ethernet3/1/47
Ethernet3/1/3 Ethernet3/1/3 Ethernet3/1/3 Ethernet3/1/3
6-4
Chapter 6 IDS Linkage Configuration
Ethernet3/1/5 Ethernet3/1/5 Ethernet3/1/5 Ethernet3/1/5