Cisco IOS Cookbook 中文精简版第二十七章安全(完)

Router1(config)#access-list 112 deny ip any any

Router1(config)#interface FastEthernet0/0

Router1(config-if)#ip access-group 111 in

Router1(config-if)#interface FastEthernet0/1

Router1(config-if)#ip access-group 112 in

Router1(config-if)#end

Router1#

注释 从12.3(7)T开始支持这种2层防火墙或者说透明防火墙的支持，这样可以透明于网络不需要做地址的更改，采用了CBAC的方式来过滤

27.4.  防止拒绝服务攻击

提问 通过对半开放连接的限制来防范拒绝服务攻击

回答

Router1#configure terminal

Router1(config)#access-list 109 permit ip any host 192.168.99.2

Router1(config)#ip tcp intercept list 109

Router1(config)#ip tcp intercept max-incomplete high 10

Router1(config)#ip tcp intercept one-minute high 15

Router1(config)#ip tcp intercept max-incomplete low 5

Router1(config)#ip tcp intercept one-minute low 10

Router1(config)#end

Router1#

注释 除了上述的配置以外还可以对丢弃模式等进行控制

Router1(config)#ip tcp intercept drop-mode random

Router1(config)#ip tcp intercept watch-timeout 15

Router1(config)#ip tcp intercept mode watch

比较有用的一个统计命令

Router1#show tcp intercept statistics

Intercepting new connections using access-list 109

9 incomplete, 1 established connections (total 10)

8 connection requests per minute