专线与虚拨封堵808080端口操作方法.docxVIP

专线与虚拨封堵808080端口操作方法总则：封堵80与8080端口，专线尽量在靠近用户端的三层设备上部署。虚拨需要查出账号后提供个平台进行账号屏蔽后在到用户接入BRAS上将用户踢下线，此时用户可能报故障无法拨号上网。JUNIPER封锁808080端口举例：E320ERX专线用户封堵808080端口：配置（具体IP根据需求更改）：! ip classifier-list limit-8080 tcp any host eq 80封堵一个IPip classifier-list limit-8080 tcp any host eq 8080封堵一个IPip classifier-list limit-8080 tcp any 55 eq 80封堵一段IPip classifier-list limit-8080 tcp any 55 eq 8080 封堵一段IP!! ip policy-list limit-8080classifier-group limit-8080 precedence 90filterclassifier-group *forward!应用（在IP接口的output方向应用）：int g 16/1/7.11ip policy output limit-8080查看：DP-test-E320#sh ipint g 16/1/7.11GigabitEthernet16/1/7.11 line protocol VlanSub is up, ip is up Network Protocols: IP, ISIS Internet address is 0/52 Broadcast address is 55 Operational MTU = 1500 Administrative MTU = 0 Operational speed = 1000000000 Administrative speed = 0 Discontinuity Time = Router advertisement = disabled Proxy Arp = enabled ARP spoof checking = enabled Network Address Translation is disabled TCP MSS Adjustment = disabled Administrative debounce-time = disabled Operational debounce-time = disabled Access routing = disabled Multipath mode = hashed Auto Configure = disabled Auto Detect = disabled Re-Authenticate Auto Detect = disabled Inactivity Timer = disabled Use Framed Routes = disabled Warm-restart initial-sequence-preference: Operational = 1 Administrative = 0 In Received Packets Bytes 39267617109 Unicast Packets Bytes 39267617109 Multicast Packets 0, Bytes 0 In Policed Packets 1334519, Bytes In Error Packets 0 In Invalid Source Address Packets 0 In Discarded Packets 0 Out Forwarded Packets Bytes 44283693379 Unicast Packets Bytes 44283693379 Multicast Routed Packets 0, Bytes 0 Out Scheduler Dropped Packets 0, Bytes 0 Out Policed Packets 0, Bytes 0 Out Discarded Packets 0IP policy output limit-8080封堵成功 Statistics are disabled IP policy secondary-input LimitLocal Statistics are d