Procedure

1. Assign an IP address to each interface. For configuration details, see Configuration Files in this section.
2. Set a password for users that log in to a device using the NMS and CLI.

   <DeviceA> system-view

   [~HUAWEI] sysname RouterA

   [*HUAWEI] commit

   [~DeviceA] user-interface console 0
   [*DeviceA-ui-con0] shell
   [*DeviceA-ui-con0] authentication mode password
   [*DeviceA-ui-con0] set authentication password cipher Huawei-123
   [*DeviceA-ui-con0] idle-timeout 30 0
   [*DeviceA-ui-con0] commit
   [~DeviceA-ui-con0] quit
   [~DeviceA] user-interface maximum-vty 15
   [*DeviceA] user-interface vty 5 14
   [*DeviceA-ui-vty5-14] shell
   [*DeviceA-ui-vty5-14] authentication mode password
   [*DeviceA-ui-vty5-14] set authentication password cipher Huawei-123
   [*DeviceA-ui-vty5-14] idle-timeout 30 0
   [*DeviceA-ui-vty5-14] commit
   [~DeviceA-ui-vty5-14] quit
   

   The configurations of the other access devices are similar to the configuration of CX device A.
3. Record all information about unsuccessful logins in a log file and output log information to the console interface.

   [~DeviceA] info-center enable
   [*DeviceA] info-center source default channel 9 log level warnings
   [*DeviceA] info-center logfile channel channel9
   [*DeviceA] commit
   [~DeviceA] quit
   <DeviceA> terminal logging
4. Configure an advanced ACL on Device A and apply the advanced ACL to QoS services to defend against ICMP packet attacks.

   <DeviceA> system-view

   [~DeviceA] acl number 3001

   [*DeviceA-acl4-advance-3001] description anti-virus

   [*DeviceA-acl4-advance-3001] rule 5 deny icmp

   [*DeviceA-acl4-advance-3001] commit

   [~DeviceA-acl4-advance-3001] quit

   [~DeviceA] traffic classifier anti-virus

   [*DeviceA-classifier-anti-virus] if-match acl 3001

   [*DeviceA-classifier-anti-virus] commit

   [~DeviceA-classifier-anti-virus] quit

   [~DeviceA] traffic behavior anti-virus

   [*DeviceA-behavior-anti-virus] commit

   [~DeviceA-behavior-anti-virus] quit

   [~DeviceA] traffic policy anti-virus

   [*DeviceA-trafficpolicy-anti-virus] classifier anti-virus behavior anti-virus

   [*DeviceA-trafficpolicy-anti-virus] commit

   [~DeviceA-trafficpolicy-anti-virus] quit

   [~DeviceA] interface gigabitethernet 0/2/0

   [*DeviceA-GigabitEthernet0/2/0] traffic-policy anti-virus inbound

   [*DeviceA-GigabitEthernet0/2/0] commit

   [~DeviceA-GigabitEthernet0/2/0] traffic-policy anti-virus outbound

   [*DeviceA-GigabitEthernet0/2/0] commit
5. Verify the configuration.
   # Ping Device A from the PC. The command output shows that the ping operation fails.

   c:\>ping 172.16.1.1
   
   Pinging 172.16.1.1 with 32 bytes of data:
   Request timed out.
   Request timed out.
   Request timed out.
   Request timed out.
   
   Ping statistics for 172.16.1.1:
       Pacets: Sent = 4, Received = 0, Lost = 4 <100% loss>,

   # Delete the advanced ACL on Device A. Then the command output shows that ping operation is successful.

   c:\>ping 172.16.1.1
   
   Pinging 172.16.1.1 with 32 bytes of data:
   Reply from 172.16.1.1: bytes=32 time<1ms TTL=128
   Reply from 172.16.1.1: bytes=32 time<1ms TTL=128
   Reply from 172.16.1.1: bytes=32 time<1ms TTL=128
   Reply from 172.16.1.1: bytes=32 time<1ms TTL=128
   
   Ping statistics for 172.16.1.1:
       Packets: Sent = 4, Received = 4, Lost = 0 <0% loss>,
   Approximate round trip times in mill-seconds:
       Minimum = 0ms, Maximum = 0 ms, Average = 0ms