H3C SecPath Series Manuel d'installation

H3C SecPath Series High-End Firewalls

Attack Protection Command Reference

Hangzhou H3C Technologies Co., Ltd.

http://www.h3c.com

Software version: SECPATH1000FE&SECBLADEII-CMW520-R3166

SECPATH5000FA-CMW520-R3206

Document version: 6PW107-20120703

No part of this manual may be reproduced or transmitted in any form or by any means without prior

written consent of Hangzhou H3C Technologies Co., Ltd.

Trademarks

H3C, , Aolynk, , H3Care, , TOP G, , IRF, NetPilot, Neocean, NeoVTL,

SecPro, SecPoint, SecEngine, SecPath, Comware, Secware, Storware, NQA, VVG, V2G, VnG, PSPT,

XGbus, N-Bus, TiGem, InnoVision and HUASAN are trademarks of Hangzhou H3C Technologies Co.,

Ltd.

All other trademarks that may be mentioned in this manual are the property of their respective owners

Notice

The information in this document is subject to change without notice. Every effort has been made in the

preparation of this document to ensure accuracy of the contents, but all statements, information, and

recommendations in this document do not constitute the warranty of any kind, express or implied.

Preface

The H3C SecPath Series High-End Firewalls command references describe the commands and command

syntax options available for the H3C SecPath Series High-End Firewalls.

The Attack Protection Command Reference describes the ARP and web filtering commands.

This preface includes:

•Audience

•Conventions

•About the H3C SecPath series high-end firewalls documentation set

•Obtaining documentation

•Technical support

•Documentation feedback

Audience

This documentation is intended for:

•Network planners

•Field technical support and servicing engineers

•Network administrators working with the H3C high-end firewall products

Conventions

This section describes the conventions used in this documentation set.

Command conventions

Convention Descri

tion

Boldface Bold text represents commands and keywords that you enter literally as shown.

Italic Italic text represents arguments that you replace with actual values.

[ ] Square brackets enclose syntax choices (keywords or arguments) that are optional.

{ x | y | ... }

Braces enclose a set of required syntax choices separated by vertical bars, from which

you select one.

[ x | y | ... ]

Square brackets enclose a set of optional syntax choices separated by vertical bars, from

which you select one or none.

{ x | y | ... } *

Asterisk marked braces enclose a set of required syntax choices separated by vertical

bars, from which you select at least one.

[ x | y | ... ] *

Asterisk marked square brackets enclose optional syntax choices separated by vertical

bars, from which you select one choice, multiple choices, or none.

&<1-n> The argument or keyword and argument combination before the ampersand (&) sign can

be entered 1 to n times.

Convention Descri

tion

# A line that starts with a pound (#) sign is comments.

GUI conventions

Convention Descri

tion

Boldface Window names, button names, field names, and menu items are in Boldface. For

example, the New User window appears; click OK.

> Multi-level menus are separated by angle brackets. For example, File > Create > Folder.

Convention Descri

tion

< > Button names are inside angle brackets. For example, click <OK>.

[ ] Window names, menu items, data table and field names are inside square brackets. For

example, pop up the [New User] window.

/ Multi-level menus are separated by forward slashes. For example, [File/Create/Folder].

Symbols

Convention Descri

tion

WARNING An alert that calls attention to important information that if not understood or followed can

result in personal injury.

CAUTION An alert that calls attention to important information that if not understood or followed can

result in data loss, data corruption, or damage to hardware or software.

IMPORTANT An alert that calls attention to essential information.

NOTE An alert that contains additional or supplementary information.

TIP An alert that provides helpful information.

Network topology icons

Represents a generic network device, such as a router, switch, or firewall.

Represents a routing-capable device, such as a router or Layer 3 switch.

Represents a generic switch, such as a Layer 2 or Layer 3 switch, or a router that supports

Layer 2 forwarding and other Layer 2 features.

Represents a SecPath firewall chassis or a SecBlade firewall module.

Port numbering in examples

The port numbers in this document are for illustration only and might be unavailable on your device.

About the H3C SecPath series high-end firewalls

documentation set

The H3C SecPath series high-end firewalls documentation set includes:

Cate

Documents

Pur

oses

Product description and

specifications

Marketing

brochures

F1000-E

Describe product specifications and benefits.

F5000-A5

Firewall

modules

Hardware specifications

and installation

Compliance

and safety

manuals

F1000-E Provide regulatory information and the safety

instructions that must be followed during

installation.

F5000-A5

Installation

guides

F1000-E Provide a complete guide to hardware

installation and hardware specifications.

F5000-A5

Card

manuals

F5000-A5 Provide the hardware specifications of the

firewall chassis and modules.

Firewall

modules

Software configuration

Configuration guides Describe software features and configuration

procedures, and all available commands.

Configuration examples Describe typical network scenarios and provide

configuration examples and instructions.

Operations and

maintenance

Software upgrade guide Describes the software upgrade procedures.

Release

notes

F1000-E Provide information about the product release,

including the version history, hardware and

software compatibility matrix, version upgrade

information, technical support information, and

software upgrading.

F5000-A5

Firewall

modules

Obtaining documentation

You can access the most up-to-date H3C product documentation on the World Wide Web

at http://www.h3c.com.

Click the links on the top navigation bar to obtain different categories of product documentation:

[Technical Support & Documents > Technical Documents] – Provides hardware installation, software

upgrading, and software feature configuration and maintenance documentation.

[Products & Solutions] – Provides information about products and technologies, as well as solutions.

[Technical Support & Documents > Software Download] – Provides the documentation released with the

software version.

Technical support

servi[email protected]

http://www.h3c.com

Documentation feedback

You can e-mail your comments about product documentation to inf[email protected].

We appreciate your comments.

Contents

ARP attack defense configuration commands············································································································ 1

ARP automatic scanning and fixed ARP configuration commands··············································································1

arp fixup····································································································································································1

arp scan ····································································································································································2

Web filtering configuration commands······················································································································ 3

display firewall http activex-blocking ·····················································································································3

display firewall http java-blocking··························································································································4

display firewall http url-filter host ····························································································································5

display firewall http url-filter parameter ·················································································································6

firewall http activex-blocking acl ····························································································································8

firewall http activex-blocking enable······················································································································8

firewall http activex-blocking suffix·························································································································9

firewall http java-blocking acl·································································································································9

firewall http java-blocking enable ······················································································································· 10

firewall http java-blocking suffix ·························································································································· 11

firewall http url-filter host acl ································································································································ 11

firewall http url-filter host default·························································································································· 12

firewall http url-filter host enable·························································································································· 13

firewall http url-filter host ip-address···················································································································· 13

firewall http url-filter host load······························································································································ 14

firewall http url-filter host save······························································································································ 14

firewall http url-filter host url-address ··················································································································· 15

firewall http url-filter parameter···························································································································· 16

firewall http url-filter parameter enable··············································································································· 17

firewall http url-filter parameter load··················································································································· 18

firewall http url-filter parameter save··················································································································· 18

reset firewall http ··················································································································································· 19

Index ···········································································································································································20

ARP attack defense configuration commands

ARP automatic scanning and fixed ARP

configuration commands

arp fixup

Syntax

arp fixup

View

System view

Default Level

2: System level

Parameters

None

Description

Use the arp fixup command to change dynamic ARP entries into static ARP entries.

Note the following:

•The static ARP entries changed from dynamic ARP entries have the same attributes as the static ARP

entries manually configured. Use the arp fixup command to change the recently created dynamic

ARP entries into static.

•The number of static ARP entries changed from dynamic ARP entries is restricted by the number of

static ARP entries that the firewall supports. As a result, the firewall may fail to change all dynamic

ARP entries into static.

•Suppose that the number of dynamic ARP entries is Dand that of the existing static ARP entries is S.

When the dynamic ARP entries are changed into static, new dynamic ARP entries may be created

(suppose the number is M) and some of the dynamic ARP entries may be aged out (suppose the

number is N). After the process is complete, the number of static ARP entries is D+ S+ M– N.

•To delete a specific static ARP entry changed from a dynamic one, use the undo arp ip-address

[ vpn-instance-name ] command. To delete all such static ARP entries, use the reset arp all or reset

arp static command.

Examples

# Enable Fixed ARP.

<Sysname> system-view

[Sysname] arp fixup

arp scan

Syntax

arp scan [ start-ip-address to end-ip-address ]

View

Layer 3 Ethernet interface view, Layer 3 Ethernet subinterface view, VLAN interface view

Default Level

2: System level

Parameters

start-ip-address: Start IP address of the scanning range.

end-ip-address: End IP address of the scanning range. The end IP address must be higher than or equal

to the start IP address.

Description

Use the arp scan command to enable ARP automatic scanning.

Note the following:

•If start IP and end IP addresses are specified, the firewall scans the specific address range for

neighbors and learns their ARP entries. If not, the firewall only scans the network where the primary

IP address of the interface resides for neighbors.

•The start IP address and end IP address must be on the same network as the primary IP address or

manually configured secondary IP addresses of the interface.

•IP addresses already exist in ARP entries are not scanned.

•ARP automatic scanning may take some time. To stop an ongoing scan, press Ctrl + C. Dynamic

ARP entries are created based on ARP replies received before the scan is terminated.

Examples

# Configure the firewall to scan the network where the primary IP address of GigabitEthernet 0/0 resides

for neighbors.

<Sysname> system-view

[Sysname] interface gigabitethernet 0/0

[Sysname-GigabitEthernet0/0] arp scan

# Configure the firewall to scan the specific address range for neighbors.

<Sysname> system-view

[Sysname] interface gigabitethernet 0/0

[Sysname-GigabitEthernet0/0] arp scan 1.1.1.1 to 1.1.1.20

Web filtering configuration commands

NOTE:

The file name conventions in this document are as follows:

•Full file name: File path plus file name, a case-insensitive strin

of 1 to 135 characters excludin

the end

character.

•File name: File name without file path, a case-insensitive string of 1 to 91 characters excludin

the end

character.

display firewall http activex-blocking

Syntax

display firewall http activex-blocking [ all |item keywords | verbose ]

View

Any view

Default level

1: Monitor level

Parameters

all: Specifies all active blocking suffix keywords.

item keywords: Specifies a blocking suffix keyword. It is a string of 1 to 9 characters. It must start with a

dot “.” and consist of characters 0 to 9, a to z, and A to Z.

verbose: Specifies detailed information.

Description

Use the display firewall http activex-blocking command to display information about ActiveX blocking.

If no parameters are specified, the command displays brief information about ActiveX blocking.

Examples

# Display brief information about ActiveX blocking.

<Sysname> display firewall http activex-blocking

ActiveX blocking is enabled.

# Display ActiveX blocking information about a specified suffix keyword.

<Sysname> display firewall http activex-blocking item .ocx

The HTTP request packet including ".ocx" had been matched for 5 times.

# Display ActiveX blocking information about all suffix keywords.

<Sysname> display firewall http activex-blocking all

SN Match-Times Keywords

----------------------------------------------

1 5 .OCX

Autres manuels pour SecPath Series

Table des matières

Autres manuels H3C Pare-feu

H3C

H3C SecPath F5000-A5 Manuel utilisateur

H3C

H3C SecPath Series Instructions d'installation

H3C

H3C SecPath F1000-AI-X0 Manuel utilisateur

H3C

H3C SecPath T9000 IPS Series Manuel d'utilisation et d'entretien

H3C

H3C SecPath F5020 Manuel utilisateur

H3C

H3C H3C SecPath F1800-A Manuel utilisateur

H3C

H3C SecPath NSQM1F1KGM0 Manuel utilisateur

H3C

H3C SecPath M9000-S NSQM2FWDFG0 Manuel utilisateur

H3C

H3C SecPath F50X0-D Series Manuel d'installation

H3C

H3C H3C SecPath F1800-A Manuel utilisateur

H3C

H3C SecPath F100-C-EI Manuel utilisateur

H3C

H3C SecPath F10X0 Manuel utilisateur

H3C

H3C SecPath F100-X-G3 Manuel utilisateur

H3C

H3C F1000-AI-20 Manuel utilisateur

H3C

H3C SecPath F5030 Manuel utilisateur

H3C

H3C SecPath F5000-AI-15 Manuel utilisateur

H3C

H3C SecPath F1000-AI-5 Series Manuel utilisateur

H3C

H3C SecPath F5020 Manuel utilisateur

H3C

H3C SecPath F5000 Series Mode d’emploi

H3C

H3C SecPath F10 0 Series Manuel utilisateur

H3C

H3C H3C SECPATH F100-A Manuel utilisateur

H3C

H3C SecPath F5030 Manuel utilisateur

H3C

H3C H3C SECPATH F1000-S Manuel utilisateur

H3C

H3C H3C SECPATH F1000-A Manuel utilisateur

Manuels Pare-feu populaires d'autres marques

Cisco

Cisco S190 Manuel utilisateur

Fortinet

Fortinet FortiGate Voice Series Manuel utilisateur

ADTRAN

ADTRAN NetVanta 2300 Manuel utilisateur

SecureLogix

SecureLogix ETM System Manuel utilisateur

NETGEAR

NETGEAR ProSafe FVX538 Manuel utilisateur

Lanner

Lanner FW-8877 Manuel utilisateur

Huawei

Huawei USG6000 Series Manuel d'installation et d'exploitation

Nexcom

Nexcom DNA 1150 Manuel utilisateur

Fortinet

Fortinet FortiGate-60 series Manuel utilisateur

Cisco

Cisco 3110 Manuel

Draytek

Draytek Vigor2860 Series Manuel utilisateur

Lanner electronics

Lanner electronics FW-7650 Series Manuel utilisateur

Swisscom

Swisscom Internet Backup Manuel utilisateur

SonicWALL

SonicWALL NSa 5700 Manuel utilisateur

DPtech

DPtech FW1000 SERIES Manuel utilisateur

FEITIAN

FEITIAN MultiPass FIDO Manuel utilisateur

EBLOCKER

EBLOCKER PRO Manuel utilisateur

GTA

GTA GB-200 Manuel utilisateur