锐捷路由设置实例

锐捷路由设置实例

设置console口密码

lh#conf t

Enter configuration commands, one per line. End with CNTL/Z.

lh(config)#line con 0

lh(config-line)#password mima

lh(config-line)#

修改enable口令

lh#conf t

Enter configuration commands, one per line. End with CNTL/Z.

lh(config)#enable password mima

lh(config)#enable secret mima

lh(config)#

修改telnet口令

lh#conf t

Enter configuration commands, one per line. End with CNTL/Z.lh(config)lh(config)#line vty 0 4

lh(config-line)#login

lh(config-line)#password mima

lh(config-line)#exit

lh(config)#exit

lh#exit

出现攻击时掉线时请用console链接路由,保存好如下命令的相关内容,用以分析:

1、show ver (版本信息)

2、show run (配置信息)

3、show arp (arp信息)

4、show interface (端口信息)

5、show ip nat trans (nat信息)

6、show ip nat stat

7、show ip nat statistics per-user (只要第1屏的信息)

8、show ip cache (只要第1屏的信息)

9、show ip nat statistics suspicious-pc

发送免费arp:

lh#conf t

Enter configuration commands, one per line. End with CNTL/Z.

lh(config)#int f 0/0(内网)

lh(config)#arp gr int 1

lh(config)#int f 1/0(外网)

lh(config)#arp gr int 1

lh(config)#end

lh#wr

端口映射:

lh#conf t

Enter configuration commands, one per line. End with CNTL/Z.

lh(config)#ip nat source static tcp 192.168.3.99ip 80 219.128.102.110 80 permit-inside

lh(config)#end

lh#wr

限制内网某机器不限速(192.168.2.80):

lh#conf t

Enter configuration commands, one per line. End with CNTL/Z.

lh(config)#ip nat translation rate-limit iprange 192.168.2.2 192.168.2.79 inbound 500 outbound 1000

lh(config)#ip nat translation rate-limit iprange 192.168.2.81 192.168.3.253 inbound 500 outbound 1000

lh(config)#end

lh#wr

限制内网PC的链接线程数同限速:

lh#conf t

Enter configuration commands, one per line. End with CNTL/Z.

lh(config)#ip nat translation per-user 0.0.0.0 250

lh(config)#ip nat translation rate-limit default inbound 500 outbound 1000

lh(config)#end

lh#wr

禁止公网访问IP

lh#conf t

Enter configuration commands, one per line. End with CNTL/Z.

lh(config)#access-list 3199 deny icmp any any echo

lh(config)#access-list 3199 deny tcp any any eq 135

lh(config)#access-list 3199 deny tcp any any eq 139

lh(config)#access-list 3199 deny udp any any eq netbios-ss

lh(config)#access-list 3199 deny tcp any any eq 445

lh(config)#access-list 3199 deny tcp any host 219.128.102.110 eq www

lh(config)#access-list 3199 permit ip any any

lh(config)#end

lh#wr

禁止内网部分IP访问网关的

lh#conf t

Enter configuration commands, one per line. End with CNTL/Z.

lh(config)#webaccess-list 3198 deny tcp 192.168.2.1 192.168.2.100 host 192.168.3.254 eq www

lh(config)#access-list 3198 permit ip any any

lh(config)#end

lh#wr

禁止IP访问网络

lh#conf t