No relevant resource is found in the selected language.

This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Read our privacy policy>Search

Reminder

To have a better experience, please upgrade your IE browser.

upgrade

Configuration Guide - Security

S7700 and S9700 V200R011C10

This document describes the configurations of Security, including ACL, reflective ACL, local attack defense, MFF, attack defense, traffic suppression and storm control, ARP security, port security, DHCP snooping, ND snooping, PPPoE+, IPSG, SAVI, URPF, keychain, separating the management plane from the service plane, security risks.
Rate and give feedback:
Huawei uses machine translation combined with human proofreading to translate this document to different languages in order to help you better understand the content of this document. Note: Even the most advanced machine translation cannot match the quality of professional translators. Huawei shall not bear any responsibility for translation accuracy and it is recommended that you refer to the English document (a link for which has been provided).
Example for Using Basic ACLs to Restrict FTP Access Rights

Example for Using Basic ACLs to Restrict FTP Access Rights

Networking Requirements

As shown in Figure 1-12, the Switch functions as an FTP server. The requirements are as follows:

  • All the users on subnet 1 (172.16.105.0/24) are allowed to access the FTP server anytime.
  • All the users on subnet 2 (172.16.107.0/24) are allowed to access the FTP server only at the specified period of time.
  • Other users are not allowed to access the FTP server.

The routes between the Switch and subnets are reachable. You need to configure the Switch to limit user access to the FTP server.

Figure 1-12  Using basic ACLs to restrict FTP access rights

Configuration Roadmap

The following configurations are performed on the Switch. The configuration roadmap is as follows:

  1. Configure time ranges and ACLs so that the device can filter user packets to control FTP access rights of different users.
  2. Configure basic FTP functions.
  3. Apply the ACL to the FTP module to make the ACL take effect.

Procedure

  1. Configure time ranges.

    <HUAWEI> system-view
    [HUAWEI] sysname Switch
    [Switch] time-range ftp-access from 0:0 2014/1/1 to 23:59 2014/12/31
    [Switch] time-range ftp-access 14:00 to 18:00 off-day

  2. Configure a basic ACL.

    [Switch] acl number 2001
    [Switch-acl-basic-2001] rule permit source 172.16.105.0 0.0.0.255
    [Switch-acl-basic-2001] rule permit source 172.16.107.0 0.0.0.255 time-range ftp-access
    [Switch-acl-basic-2001] rule deny source any
    [Switch-acl-basic-2001] quit

  3. Configure basic FTP functions.

    [Switch] ftp server enable
    [Switch] aaa
    [Switch-aaa] local-user huawei password irreversible-cipher SetUesrPasswd@123
    [Switch-aaa] local-user huawei privilege level 15
    [Switch-aaa] local-user huawei service-type ftp
    [Switch-aaa] local-user huawei ftp-directory cfcard:
    [Switch-aaa] quit
    

  4. Configure access permissions on the FTP server.

    [Switch] ftp acl 2001
    

  5. Verify the configuration.

    Run the ftp 172.16.104.110 command on PC1 (172.16.105.111/24) in subnet 1. PC1 can connect to the FTP server.

    Run the ftp 172.16.104.110 command on PC2 (172.16.107.111/24) in subnet 2 on Monday in 2014. PC2 cannot connect to the FTP server. Run the ftp 172.16.104.110 command on PC2 (172.16.107.111/24) in subnet 2 at 15:00 on Saturday in 2014. PC2 can connect to the FTP server.

    Run the ftp 172.16.104.110 command on PC3 (10.10.10.1/24). PC3 cannot connect to the FTP server.

Configuration Files

Switch configuration file

#
sysname Switch
#
FTP server enable
FTP acl 2001
#
time-range ftp-access 14:00 to 18:00 off-day
time-range ftp-access from 00:00 2014/1/1 to 23:59 2014/12/31
#
acl number 2001
 rule 5 permit source 172.16.105.0 0.0.0.255
 rule 10 permit source 172.16.107.0 0.0.0.255 time-range ftp-access
 rule 15 deny 
#
aaa
 local-user huawei password irreversible-cipher $1a$a/sUWg/.p1*))=~SWzIRS0N",`&aS%'7X).m=o[PkQcv"!!TTQOI~Z)C'1<9$
 local-user huawei privilege level 15
 local-user huawei ftp-directory cfcard:
 local-user huawei service-type ftp
#
return
Translation
Download
Updated: 2019-04-01

Document ID: EDOC1000178319

Views: 146299

Downloads: 79

Average rating:
This Document Applies to these Products
Related Documents
Related Version
Share
Previous Next