Table of Contents
Advertisement
SmartAX MA5616 Multi-service Access Module
Configuration Guide
l
----End
Example
To add IP address 192.168.10.18 to the firewall blacklist with the aging time of 100 min, do as
follows:
huawei(config)#firewall blacklist item 192.168.10.18 timeout 100
huawei(config)#firewall blacklist enable
To add the IP addresses in network segment 10.10.10.0 to the firewall blacklist and bind ACL
3000 to these IP addresses, do as follows:
huawei(config)#acl 3000
huawei(config-acl-adv-3000)#rule deny ip source 10.10.10.0 0.0.0.255 destination
10.10.10.20 0
huawei(config-acl-adv-3000)#quit
huawei(config)#firewall blacklist enable acl-number 3000
Issue 04 (2011-10-30)
NOTE
The firewall blacklist function only takes effect to the service packets that are sent from the user side.
– Configure the firewall blacklist function by using advanced ACLs.
1.
Run the acl command to create an ACL. Only advanced ACLs can be used when
the black list function is enabled. Therefore, the range of the ACL ID is
3000-3999.
2.
Run the rule(adv acl) command to create an advanced ACL.
3.
Run the quit command to return to the global config mode.
4.
Run the firewall blacklist enable acl-number acl-number command to enable
the firewall blacklist function.
– Configure the firewall blacklist function by adding the source IP addresses of untrusted
packets.
1.
Run the firewall blacklist item command to add the source IP addresses of
untrusted packets to the blacklist.
2.
Run the firewall blacklist enable command to enable the firewall blacklist
function.
Configure the firewall (filtering packets based on the ACL).
1.
Run the acl command to create an ACL. Only basic ACLs and advanced ACLs can
be used when packet filtering by firewall is configured. Therefore, the range of the
ACL ID is 2000-3999.
2.
Run different commands to create different types of ACLs.
– Basic ACL: Run the rule(basic acl) command.
– Advanced ACL: Run the rule(adv acl) command.
3.
Run the quit command to return to the global config mode.
4.
Run the firewall enable command to enable the firewall blacklist function. By default,
the firewall blacklist function is disabled.
To filter the packets of a port based on the basic ACL, enable the firewall blacklist
function.
5.
Run the firewall packet-filter command to apply firewall packet filtering rules to an
interface.
Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
3 Basic Configuration
90
Hide quick links:
Advertisement
Table of Contents
