SNR S2989G-48TX-POE — настройка функций безопасности для сетевых устройств [294/553]

Превью страниц Страница 294 / 553

S2989G-24TX Operation Manual

Chapter 6 Security Function Configuration

6-21

network connected to the interface 10 of the switch is 00-12-11-23-xx-xx, and IP network

is 10.0.0.0/24. FTP should be disabled and ping requests from outside network should be

disabled.

Configuration description:

1. Create the corresponding access list.

2. Configure datagram filtering.

3. Bind the ACL to the related interface.

The configuration steps are listed as below.

Switch(config)#access-list 3110 deny 00-12-11-23-00-00 00-00-00-00-ff-ff

any-destination-mac tcp 10.0.0.0 0.0.0.255 any-destination d-port 21

Switch(config)#access-list 3110 deny any-source-mac 00-12-11-23-00-00

00-00-00-00-ff-ff icmp any-source 10.0.0.0 0.0.0.255

Switch(config)#firewall enable

Switch(config)#interface ethernet 1/0/10

Switch(Config-If-Ethernet1/0/10)#mac-ip access-group 3110 in

Switch(Config-Ethernet1/0/10)#exit

Switch(config)#exit

Configuration result:

Switch#show firewall

Firewall Status: Enable.

Switch#show access-lists

access-list 3110(used 1 time(s))

access-list 3110 deny 00-12-11-23-00-00 00-00-00-00-ff-ff

any-destination-mac

tcp 10.0.0.0 0.0.0.255 any-destination d-port 21

access-list 3110 deny any-source-mac 00-12-11-23-00-00 00-00-00-00-ff-ff icmp

any-source 10.0.0.0 0.0.0.255

Switch #show access-group interface ethernet 1/0/10

interface name:Ethernet1/0/10

MAC-IP Ingress access-list used is 3110, traffic-statistics Disable.

Scenario 4:

The configuration requirement is stated as below: IPv6 protocol runs on the interface

600 of the switch. And the IPv6 network address is 2003:1:1:1::0/64. Users in the