NOTE
The firewall blacklist function only takes effect to the service packets that are sent from the user side.
–
Configure the firewall blacklist function by using advanced ACLs.
1.
Run the
acl
command to create an ACL. Only advanced ACLs can be used when
the black list function is enabled. Therefore, the range of the ACL ID is
3000-3999.
2.
Run the
rule(adv acl)
command to create an advanced ACL.
3.
Run the
quit
command to return to the global config mode.
4.
Run the
firewall blacklist enable acl-number acl-number
command to enable
the firewall blacklist function.
–
Configure the firewall blacklist function by adding the source IP addresses of untrusted
packets.
1.
Run the
firewall blacklist item
command to add the source IP addresses of
untrusted packets to the blacklist.
2.
Run the
firewall blacklist enable
command to enable the firewall blacklist
function.
l
Configure the firewall (filtering packets based on the ACL).
1.
Run the
acl
command to create an ACL. Only basic ACLs and advanced ACLs can
be used when packet filtering by firewall is configured. Therefore, the range of the
ACL ID is 2000-3999.
2.
Run different commands to create different types of ACLs.
–
Basic ACL: Run the
rule(basic acl)
command.
–
Advanced ACL: Run the
rule(adv acl)
command.
3.
Run the
quit
command to return to the global config mode.
4.
Run the
firewall enable
command to enable the firewall blacklist function. By default,
the firewall blacklist function is disabled.
To filter the packets of a port based on the basic ACL, enable the firewall blacklist
function.
5.
Run the
firewall packet-filter
command to apply firewall packet filtering rules to an
interface.
----End
Example
To add IP address 192.168.10.18 to the firewall blacklist with the aging time of 100 min, do as
follows:
huawei(config)#
firewall blacklist item 192.168.10.18 timeout 100
huawei(config)#
firewall blacklist enable
To add the IP addresses in network segment 10.10.10.0 to the firewall blacklist and bind ACL
3000 to these IP addresses, do as follows:
huawei(config)#
acl 3000
huawei(config-acl-adv-3000)#
rule deny ip source 10.10.10.0 0.0.0.255 destination
10.10.10.20 0
huawei(config-acl-adv-3000)#
quit
huawei(config)#
firewall blacklist enable acl-number 3000
SmartAX MA5616 Multi-service Access Module
Configuration Guide
3 Basic Configuration
Issue 04 (2011-10-30)
Huawei Proprietary and Confidential
Copyright © Huawei Technologies Co., Ltd.
90