# мультикаст - в сад!
config igmp_snooping all state enable
config igmp_snooping querier all state enable
enable igmp_snooping

config router_ports_forbidden VLAN_NAME add 1-25

config multicast port_filtering_mode 1-25 filter_unregistered_groups

create multicast_range mult_deny from 224.0.0.1 to 239.255.255.254
config limited_multicast_addr ports 1-25 add multicast_range mult_deny
config limited_multicast_addr ports 1-25 state enable


# РРРоЕ
create access_profile                               ethernet ethernet_type        profile_id 1
config access_profile profile_id 1 add access_id  1 ethernet ethernet_type 0x8863 port 1-25 permit priority 3 replace_priority replace_dscp_with 25
config access_profile profile_id 1 add access_id 26 ethernet ethernet_type 0x8864 port 1-25 permit priority 3 replace_priority replace_dscp_with 25


# ARP (см. profile_id 7)
create access_profile                               ethernet ethernet_type        profile_id 2
#config access_profile profile_id 2 add access_id  1 ethernet ethernet_type 0x806  port  1 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 2 add access_id  2 ethernet ethernet_type 0x806  port  2 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 2 add access_id  3 ethernet ethernet_type 0x806  port  3 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 2 add access_id  4 ethernet ethernet_type 0x806  port  4 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 2 add access_id  5 ethernet ethernet_type 0x806  port  5 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 2 add access_id  6 ethernet ethernet_type 0x806  port  6 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 2 add access_id  7 ethernet ethernet_type 0x806  port  7 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 2 add access_id  8 ethernet ethernet_type 0x806  port  8 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 2 add access_id  9 ethernet ethernet_type 0x806  port  9 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 2 add access_id 10 ethernet ethernet_type 0x806  port 10 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 2 add access_id 11 ethernet ethernet_type 0x806  port 11 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 2 add access_id 12 ethernet ethernet_type 0x806  port 12 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 2 add access_id 13 ethernet ethernet_type 0x806  port 13 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 2 add access_id 14 ethernet ethernet_type 0x806  port 14 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 2 add access_id 15 ethernet ethernet_type 0x806  port 15 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 2 add access_id 16 ethernet ethernet_type 0x806  port 16 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 2 add access_id 17 ethernet ethernet_type 0x806  port 17 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 2 add access_id 18 ethernet ethernet_type 0x806  port 18 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 2 add access_id 19 ethernet ethernet_type 0x806  port 19 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 2 add access_id 20 ethernet ethernet_type 0x806  port 20 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 2 add access_id 21 ethernet ethernet_type 0x806  port 21 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 2 add access_id 22 ethernet ethernet_type 0x806  port 22 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 2 add access_id 23 ethernet ethernet_type 0x806  port 23 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 2 add access_id 24 ethernet ethernet_type 0x806  port 24 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 2 add access_id 25 ethernet ethernet_type 0x806  port 25 permit priority 1 replace_priority replace_dscp_with 8


# бродкасты идут следом за мультикастом
create access_profile                              packet_content_mask offset_0-15 0xffffffff 0xffff0000 0x0 0x0 profile_id 3
config access_profile profile_id 3 add access_id 1 packet_content_mask offset_0-15 0xffffffff 0xffff0000 0x0 0x0 port 1-25 deny


# ТСР шняга - туда же
create access_profile                                ip tcp dst_port_mask 0xffff profile_id 4
config access_profile profile_id 4 add access_id   1 ip tcp dst_port          42 port 1-25 deny
config access_profile profile_id 4 add access_id  26 ip tcp dst_port         135 port 1-25 deny
config access_profile profile_id 4 add access_id  51 ip tcp dst_port         139 port 1-25 deny
config access_profile profile_id 4 add access_id  76 ip tcp dst_port         445 port 1-25 deny
config access_profile profile_id 4 add access_id 101 ip tcp dst_port         593 port 1-25 deny
config access_profile profile_id 4 add access_id 126 ip tcp dst_port        2869 port 1-25 deny
config access_profile profile_id 4 add access_id 151 ip tcp dst_port        5000 port 1-25 deny


# UDP - за компанию с предыдущими
create access_profile                                ip udp dst_port_mask 0xffff profile_id 5
config access_profile profile_id 5 add access_id   1 ip udp dst_port          42 port 1-25 deny
config access_profile profile_id 5 add access_id  26 ip udp dst_port         137 port 1-25 deny
config access_profile profile_id 5 add access_id  51 ip udp dst_port         138 port 1-25 deny
config access_profile profile_id 5 add access_id  76 ip udp dst_port         445 port 1-25 deny
config access_profile profile_id 5 add access_id 101 ip udp dst_port        1025 port 1-25 deny
config access_profile profile_id 5 add access_id 126 ip udp dst_port        1026 port 1-25 deny
config access_profile profile_id 5 add access_id 151 ip udp dst_port        1027 port 1-25 deny
config access_profile profile_id 5 add access_id 176 ip udp dst_port        1900 port 1-25 deny


# в сеть ходить можно только разрешенным IP
create access_profile                               ip source_ip_mask 255.255.255.255 profile_id 7
#config access_profile profile_id 7 add access_id  1 ip source_ip      xxx.yyy.zzz.    port  1 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 7 add access_id  2 ip source_ip      xxx.yyy.zzz.    port  2 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 7 add access_id  3 ip source_ip      xxx.yyy.zzz.    port  3 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 7 add access_id  4 ip source_ip      xxx.yyy.zzz.    port  4 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 7 add access_id  5 ip source_ip      xxx.yyy.zzz.    port  5 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 7 add access_id  6 ip source_ip      xxx.yyy.zzz.    port  6 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 7 add access_id  7 ip source_ip      xxx.yyy.zzz.    port  7 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 7 add access_id  8 ip source_ip      xxx.yyy.zzz.    port  8 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 7 add access_id  9 ip source_ip      xxx.yyy.zzz.    port  9 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 7 add access_id 10 ip source_ip      xxx.yyy.zzz.    port 10 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 7 add access_id 11 ip source_ip      xxx.yyy.zzz.    port 11 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 7 add access_id 12 ip source_ip      xxx.yyy.zzz.    port 12 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 7 add access_id 13 ip source_ip      xxx.yyy.zzz.    port 13 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 7 add access_id 14 ip source_ip      xxx.yyy.zzz.    port 14 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 7 add access_id 15 ip source_ip      xxx.yyy.zzz.    port 15 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 7 add access_id 16 ip source_ip      xxx.yyy.zzz.    port 16 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 7 add access_id 17 ip source_ip      xxx.yyy.zzz.    port 17 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 7 add access_id 18 ip source_ip      xxx.yyy.zzz.    port 18 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 7 add access_id 19 ip source_ip      xxx.yyy.zzz.    port 19 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 7 add access_id 20 ip source_ip      xxx.yyy.zzz.    port 20 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 7 add access_id 21 ip source_ip      xxx.yyy.zzz.    port 21 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 7 add access_id 22 ip source_ip      xxx.yyy.zzz.    port 22 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 7 add access_id 23 ip source_ip      xxx.yyy.zzz.    port 23 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 7 add access_id 24 ip source_ip      xxx.yyy.zzz.    port 24 permit priority 1 replace_priority replace_dscp_with 8
#config access_profile profile_id 7 add access_id 25 ip source_ip      xxx.yyy.zzz.    port 25 permit priority 1 replace_priority replace_dscp_with 8


# все иные IP - в сад!
create access_profile                              ip source_ip_mask 0.0.0.0 destination_ip_mask 0.0.0.0 profile_id 8
config access_profile profile_id 8 add access_id 1 ip source_ip      0.0.0.0 destination_ip      0.0.0.0 port 1-25 deny


# все что не IP - так же в сад!
create access_profile                              ethernet source_mac 00-00-00-00-00-00 profile_id 9
config access_profile profile_id 9 add access_id 1 ethernet source_mac 00-00-00-00-00-00 port 1-25 deny

# ТСР
create access_profile                                ip tcp dst_port_mask 0xffff profile_id 1
config access_profile profile_id 1 add access_id   1 ip tcp dst_port          42 port 1-50 deny
config access_profile profile_id 1 add access_id  51 ip tcp dst_port         135 port 1-50 deny
config access_profile profile_id 1 add access_id  101 ip tcp dst_port         139 port 1-50 deny
config access_profile profile_id 1 add access_id  151 ip tcp dst_port         445 port 1-50 deny
config access_profile profile_id 1 add access_id  201 ip tcp dst_port         593 port 1-50 deny
create access_profile                                ip tcp dst_port_mask 0xffff profile_id 2
config access_profile profile_id 2 add access_id 1 ip tcp dst_port        2869 port 1-50 deny
config access_profile profile_id 2 add access_id 51 ip tcp dst_port        5000 port 1-50 deny


# UDP
create access_profile                                ip udp dst_port_mask 0xffff profile_id 3
config access_profile profile_id 3 add access_id 1 ip udp dst_port          42 port 1-50 deny
config access_profile profile_id 3 add access_id 51 ip udp dst_port         137 port 1-50 deny
config access_profile profile_id 3 add access_id 101 ip udp dst_port         138 port 1-50 deny
config access_profile profile_id 3 add access_id 151 ip udp dst_port         445 port 1-50 deny
config access_profile profile_id 3 add access_id 201 ip udp dst_port        1025 port 1-50 deny
create access_profile                                ip udp dst_port_mask 0xffff profile_id 4
config access_profile profile_id 4 add access_id 1 ip udp dst_port        1026 port 1-50 deny
config access_profile profile_id 4 add access_id 51 ip udp dst_port        1027 port 1-50 deny
config access_profile profile_id 4 add access_id 101 ip udp dst_port        1900 port 1-50 deny

#DHCP, исключить порты с DHCP сервером.

create access_profile ip udp src_port_mask 0xFFFF dst_port_mask 0xFFFF profile_id 5
config access_profile profile_id 5 add access_id 1 ip udp src_port 68 dst_port 67 port 2-50 permit
config access_profile profile_id 5 add access_id 50 ip udp src_port 67 dst_port 68 port 2-50 deny

#IP броадкасты, исключить порты с DHCP сервером.

create access_profile packet_content_mask offset_16-31  0x0  0x0  0xFF  0x0 offset_32-47  0x0  0xFFFF  0x0  0x0 profile_id 6
config access_profile profile_id 6 add access_id 1 packet_content_mask offset_16-31  0x0  0x0  0x11  0x0 offset_32-47  0x0  0x44  0x0  0x0 port 2-50 permit
config access_profile profile_id 6 add access_id 50 packet_content_mask offset_16-31  0x0  0x0  0x11  0x0 offset_32-47  0x0  0x43  0x0  0x0 port 2-50 deny

# IP протокол + пакет не фрагментирован + порт (135, 137, 138, 139, 445 и не важно TCP или UDP)
create access_profile                                packet_content_mask offset_16-31 0xffff0000 0x0 0x00ff0000 0x0 offset_32-47 0x0 0x0 0xffff0000 0x0 profile_id 1
config access_profile profile_id 1 add access_id   1 packet_content_mask offset_16-31 0x08000000 0x0 0x00000000 0x0 offset_32-47 0x0 0x0 0x00870000 0x0 port 1-50 deny
config access_profile profile_id 1 add access_id  51 packet_content_mask offset_16-31 0x08000000 0x0 0x00000000 0x0 offset_32-47 0x0 0x0 0x00890000 0x0 port 1-50 deny
config access_profile profile_id 1 add access_id 101 packet_content_mask offset_16-31 0x08000000 0x0 0x00000000 0x0 offset_32-47 0x0 0x0 0x008a0000 0x0 port 1-50 deny
config access_profile profile_id 1 add access_id 151 packet_content_mask offset_16-31 0x08000000 0x0 0x00000000 0x0 offset_32-47 0x0 0x0 0x008b0000 0x0 port 1-50 deny
config access_profile profile_id 1 add access_id 201 packet_content_mask offset_16-31 0x08000000 0x0 0x00000000 0x0 offset_32-47 0x0 0x0 0x01bd0000 0x0 port 1-50 deny

# IP протокол + пакет не фрагментирован + протокол TCP/UDP + порт (67 (UDP), 68 (UDP), 1900 (UDP) и 2869 (TCP))
create access_profile                                packet_content_mask offset_16-31 0xffff0000 0x0 0x00ff00ff 0x0 offset_32-47 0x0 0x0 0xffff0000 0x0 profile_id 2
config access_profile profile_id 2 add access_id   1 packet_content_mask offset_16-31 0x08000000 0x0 0x00000011 0x0 offset_32-47 0x0 0x0 0x00430000 0x0 port 1-50 deny
config access_profile profile_id 2 add access_id  51 packet_content_mask offset_16-31 0x08000000 0x0 0x00000011 0x0 offset_32-47 0x0 0x0 0x00440000 0x0 port 1-50 deny
config access_profile profile_id 2 add access_id 101 packet_content_mask offset_16-31 0x08000000 0x0 0x00000011 0x0 offset_32-47 0x0 0x0 0x076c0000 0x0 port 1-50 deny
config access_profile profile_id 2 add access_id 151 packet_content_mask offset_16-31 0x08000000 0x0 0x00000006 0x0 offset_32-47 0x0 0x0 0x0b350000 0x0 port 1-50 deny

# IP бродкасты
create access_profile                                packet_content_mask offset_0-15 0xffffffff 0xffff0000 0x0 0x0 offset_16-31 0xffff0000 0x0 0x0 0x0 profile_id 3
config access_profile profile_id 3 add access_id   1 packet_content_mask offset_0-15 0xffffffff 0xffff0000 0x0 0x0 offset_16-31 0x08000000 0x0 0x0 0x0 port 1-50 deny