Use the access control list to build a "copper wall"

I configured the ACL Access Control List on routers and switches to prevent viruses and hacker attacks. After the configuration, network devices effectively prevent the shock wave attacks when many hosts do not have the corresponding patches.

Because viruses, especially system vulnerability viruses, are transmitted and attacked using the corresponding ports, we can consider setting the corresponding ACL on the vro or vswitch for prevention.

Take Cisco as an example. The specific ACL Configuration is as follows:

Access-list 101 permit tcp any established

This command is used to create an ACL. It only allows the established connections to transmit data from the external server, and data transmission is denied for connections that are not established in advance. Finally, bind the ACL to the corresponding port to prevent viruses.

Now let's take a look at how to use this technology to combat the shock wave. Many Computers in the company do not have patches, so that hosts infected with external shock will spread viruses to internal hosts through ports 445, 5554, and 9996. Because we have configured an ACL, when external viruses actively transmit data to internal ports 445, 5554, and 9996, the data is filtered out by the router to implement real prevention. This setting has no impact on the use of the network by users in the intranet.

Prompt
1. because the established statement only supports the TCP protocol, if the company wants to transmit DNS and other information, it also needs to set the corresponding ACL statement to enable UDP transmission in the format of access-list 101 permit udp any.

2. after this setting, the user will complain that FTP cannot be used, because FTP password verification and data transmission are not using the same port. For password verification, port 21 is used, and data transmission uses Port 20, therefore, we also need to add the corresponding ACL in the format of access-list 101 permit tcp any eq ftp-data or access-list 101 permit tcp any eq 20.(