Alcatel-Lucent OmniAccess 700, Руководство по настройке CLI

Страница: 733 / 1193

Zone Configuration
Except on the first page, right running head:
Heading1 or Heading1NewPage text (automatic)
707
Alcatel-Lucent
Beta Beta
CLI Configuration Guide
14. Configuring the Firewall Policy to Protect Against the DoS Attack.
ALU(config)#firewall
ALU(config-firewall)# policy prevent
ALU(config-firewall-prevent)# match any DoS attack atk1
drop
Applying this firewall policy to the trust and DMZ as an IN policy to protect the
network against the Dos attacks.
ALU(config-if Serial0:0)#firewall policy in prevent
E
XAMPLE
2: S
IMPLE
Z
ONE
C
ONFIGURATION IN
OA-700
In OA-700, you can define classification for trusted/untrusted/dmz traffic in
ACL, NAT, or DoS policies, and further apply these policies to the interfaces:
Match-list trusted
Ip 10.1.1.0/24 any
Match-list dmz
Ip 148.64.4.0/24 any
Match-list any-ip
Ip any any
Ip nat nat-policy
Match trusted source-nat
Ip filter permit-dmz-policy
Match dmz permit
Ip filter deny-untrusted-policy
Match any-ip deny
Suppose Gigabit Ethernet 7/1 is facing external networks, you will need to
apply these NAT and Filter policies to this interface:
Interface GigabitEthernet7/1
//Physical i/f to untrusted networks
Ip nat out nat-policy
//This will NAT internal traffic
Ip filter out permit-dmz-policy
//This will permit DMZ traffic without
translation
Ip filter in deny-untrusted-policy
//This will deny all untrusted
traffic originated from outside.
Exit
//Done