使用NBAR来基于应用层过滤流量

2007-03-28 03:12:51

使用NBAR 对进站的HTTP 流量下载进行限速, 其中凡是下载的图象格式包括gif的，速率限制为50kbps。并防止红色代码(Code Red)和尼姆达(Nimda)蠕虫病毒

R1
conf t
int s2/0
ip ad 10.1.1.1 255.255.255.0
no shut
exit
class-map PHOTO
match protocol http url "*.gif"
exit
class-map VIRUS
match protocol http url "cmd.exe"
match protocol http url "*.ida"
match protocol http url "root.exe"
match protocol http url "readme.eml*"
exit
policy-map NBAR
class PHOTO
police 50000 conform-action transmit exceed-action drop
class VIRUS
drop
exit
int s 2/0
service-policy input NBAR
end

校验
R1#sh policy-map int s2/0
Serial2/0

Service-policy input: NBAR

    Class-map: PHOTO (match-all)
      0 packets, 0 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match: protocol http url "*.gif"
      police:
          cir 50000 bps, bc 1562 bytes
        conformed 0 packets, 0 bytes; actions:
          transmit
        exceeded 0 packets, 0 bytes; actions:
          drop
        conformed 0 bps, exceed 0 bps

    Class-map: VIRUS (match-all)
      0 packets, 0 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match: protocol http url "cmd.exe"
      Match: protocol http url "*.ida"
      Match: protocol http url "root.exe"
      Match: protocol http url "readme.eml*"
      drop

    Class-map: class-default (match-any)
      0 packets, 0 bytes
      5 minute offered rate 0 bps, drop rate 0 bps
      Match: any

本文出自 “穿过地狱去看海” 博客，谢绝转载！

上一篇使用MQC对数据包无条件丢弃　　下一篇拥塞管理之－－－CBWFQ

类别：CCIE ┆ 技术圈() ┆ 阅读() ┆ 评论() ┆推送到技术圈 ┆返回首页

相关文章

文章评论

昵称：
验证码：		点击图片可刷新验证码　　博客过2级，无需填写验证码
内容：