#-------------------------------------------------------------------
# DES-3200-28 Configuration
#
# Firmware: Build 1.31.B005
# Copyright(C) 2010 D-Link Corporation. All rights reserved.
#-------------------------------------------------------------------
# PASSWORD ENCRYPTION
enable password encryption
config terminal_line default
disable clipaging
disable command logging
# STORM
config traffic control_trap both
config traffic control all broadcast enable multicast enable unicast disable action shutdown threshold 64 time_interval 5 countdown 5
config traffic control 25 broadcast disable multicast disable unicast disable action shutdown threshold 64 time_interval 5 countdown 5
# STP
disable stp
# LOOP_DETECT
enable loopdetect
config loopdetect recover_timer 600
config loopdetect interval 1
config loopdetect mode port-based
config loopdetect trap both
config loopdetect ports all state enabled
# QOS
config scheduling_mechanism weight_fair
config scheduling 0 weight 1
config scheduling 1 weight 2
config scheduling 2 weight 4
config scheduling 3 weight 8
config 802.1p user_priority 0 0
config 802.1p user_priority 1 1
config 802.1p user_priority 2 1
config 802.1p user_priority 3 2
config 802.1p user_priority 4 2
config 802.1p user_priority 5 3
config 802.1p user_priority 6 3
config 802.1p user_priority 7 3
config cos tos value 0 class 0
config cos tos value 1 class 1
config cos tos value 2 class 1
config cos tos value 3 class 2
config cos tos value 4 class 2
config cos tos value 5 class 3
config cos tos value 6 class 3
config cos tos value 7 class 3
config dscp_mapping dscp_value 0 class 0
config dscp_mapping dscp_value 1 class 0
config dscp_mapping dscp_value 2 class 0
config dscp_mapping dscp_value 3 class 0
config dscp_mapping dscp_value 4 class 0
config dscp_mapping dscp_value 5 class 0
config dscp_mapping dscp_value 6 class 0
config dscp_mapping dscp_value 7 class 0
config dscp_mapping dscp_value 8 class 1
config dscp_mapping dscp_value 9 class 1
config dscp_mapping dscp_value 10 class 1
config dscp_mapping dscp_value 11 class 1
config dscp_mapping dscp_value 12 class 1
config dscp_mapping dscp_value 13 class 1
config dscp_mapping dscp_value 14 class 1
config dscp_mapping dscp_value 15 class 1
config dscp_mapping dscp_value 16 class 1
config dscp_mapping dscp_value 17 class 1
config dscp_mapping dscp_value 18 class 1
config dscp_mapping dscp_value 19 class 1
config dscp_mapping dscp_value 20 class 1
config dscp_mapping dscp_value 21 class 1
config dscp_mapping dscp_value 22 class 1
config dscp_mapping dscp_value 23 class 1
config dscp_mapping dscp_value 24 class 2
config dscp_mapping dscp_value 25 class 2
config dscp_mapping dscp_value 26 class 2
config dscp_mapping dscp_value 27 class 2
config dscp_mapping dscp_value 28 class 2
config dscp_mapping dscp_value 29 class 2
config dscp_mapping dscp_value 30 class 2
config dscp_mapping dscp_value 31 class 2
config dscp_mapping dscp_value 32 class 2
config dscp_mapping dscp_value 33 class 2
config dscp_mapping dscp_value 34 class 2
config dscp_mapping dscp_value 35 class 2
config dscp_mapping dscp_value 36 class 2
config dscp_mapping dscp_value 37 class 2
config dscp_mapping dscp_value 38 class 2
config dscp_mapping dscp_value 39 class 2
config dscp_mapping dscp_value 40 class 3
config dscp_mapping dscp_value 41 class 3
config dscp_mapping dscp_value 42 class 3
config dscp_mapping dscp_value 43 class 3
config dscp_mapping dscp_value 44 class 3
config dscp_mapping dscp_value 45 class 3
config dscp_mapping dscp_value 46 class 3
config dscp_mapping dscp_value 47 class 3
config dscp_mapping dscp_value 48 class 3
config dscp_mapping dscp_value 49 class 3
config dscp_mapping dscp_value 50 class 3
config dscp_mapping dscp_value 51 class 3
config dscp_mapping dscp_value 52 class 3
config dscp_mapping dscp_value 53 class 3
config dscp_mapping dscp_value 54 class 3
config dscp_mapping dscp_value 55 class 3
config dscp_mapping dscp_value 56 class 3
config dscp_mapping dscp_value 57 class 3
config dscp_mapping dscp_value 58 class 3
config dscp_mapping dscp_value 59 class 3
config dscp_mapping dscp_value 60 class 3
config dscp_mapping dscp_value 61 class 3
config dscp_mapping dscp_value 62 class 3
config dscp_mapping dscp_value 63 class 3
config 802.1p default_priority 1-28 0
config cos mapping ports all ethernet 802.1p ip dscp
# BANDWIDTH
config bandwidth_control 1-28 rx_rate no_limit tx_rate no_limit
config per_queue bandwidth_control ports 1-28 0 max_rate no_limit
config per_queue bandwidth_control ports 1-28 1 max_rate no_limit
config per_queue bandwidth_control ports 1-28 2 max_rate no_limit
config per_queue bandwidth_control ports 1-28 3 max_rate no_limit
# SYSLOG
enable syslog
create syslog host 1 severity all facility local0 ipaddress 172.17.0.187 udp_port 514 state enable
config log_save_timing on_demand
# TRAF-SEGMENTATION
config traffic_segmentation 1-28 forward_list 1-28
# SSL
disable ssl
# PORT
disable jumbo_frame
# MANAGEMENT
create trusted_host network 172.17.0.0/24
create trusted_host network 172.31.0.0/24
create trusted_host network 10.240.0.0/16
enable snmp traps
enable snmp authenticate_traps
enable snmp linkchange_traps
config snmp linkchange_traps ports all enable
config snmp system_name vl-3200-
config snmp system_contact
noc@vladlink.netdisable rmon
# SNMPv3
create snmp host 172.17.0.4 v2c private
create snmp host 172.17.0.4 v2c public
# SAFEGUARD_ENGINE
config safeguard_engine state disable utilization rising 70 falling 30 trap_log enable mode fuzzy
# SSH
disable ssh
# MULTICAST
config limited_multicast_addr ports 1-28 delete profile_id 1
config limited_multicast_addr ports 1-28 delete profile_id 2
config limited_multicast_addr ports 1-28 delete profile_id 3
delete mcast_filter_profile profile_id all
# Служебный диапазон, требуется для подключения к IGMP группе
create mcast_filter_profile profile_id 1 profile_name 1
config mcast_filter_profile profile_id 1 add 224.0.1.0-224.2.255.255
# Разрешаем сети на клиентских портах
config limited_multicast_addr ports 1-28 add profile_id 1
config limited_multicast_addr ports 1-28 add profile_id 2
config limited_multicast_addr ports 25 delete profile_id 1
config limited_multicast_addr ports 25 delete profile_id 2
# === Вот на этом месте клиенты еще могут что-то вещать на диапазонах указанных выше
# === Вот на этом месте уже не могут, вернее к их группам никто не сможет подписаться.
# Конфигурим снупинг:
config multicast port_filtering_mode 1-28 filter_unregistered_groups
config multicast port_filtering_mode 25 forward_unregistered_groups
# Включаем снупинг, чтобы мультикаст не валил во все порты подрят
enable igmp_snooping
config igmp_snooping all state enable fast_leave enable
config igmp_snooping querier all query_interval 125 max_response_time 10 robustness_variable 2
config igmp_snooping querier all last_member_query_interval 1 state disable
config igmp_snooping data_driven_learning max_learned_entry 256
config igmp_snooping data_driven_learning all aged_out enable
# Говорим что мультикаст может валить только с 25 порта
config router_ports default delete 1-28
config router_ports default add 25
# А следовательно запрещаем принудительную отправку мультикаста на клиентские порты если по какой то причине с них пришел пакет которые похож на пакет от мультикаст роутера
config router_ports_forbidden default add 1-28
config router_ports_forbidden default delete 25
#DHCP Filter
config filter dhcp_server ports 1-28 state enable
config filter dhcp_server ports 25 state disable
config filter dhcp_server illegal_server_log_suppress_duration 1min
config filter dhcp_server log enable
config filter dhcp_server trap enable
# delete all ACL
delete access_profile all
# --------------- BEGIN ACL------------------
#
# broadcast
create access_profile ethernet destination_mac ff-ff-ff-ff-ff-ff ethernet_type profile_id 6
# permit arp broadcast
config access_profile profile_id 6 add access_id auto_assign ethernet destination_mac ff-ff-ff-ff-ff-ff ethernet_type 0x806 port all permit
# deny ip broadcast
config access_profile profile_id 6 add access_id auto_assign ethernet destination_mac ff-ff-ff-ff-ff-ff ethernet_type 0x800 port all deny
# netbios
create access_profile ip tcp dst_port_mask 0xFFFF profile_id 7
config access_profile profile_id 7 add access_id auto_assign ip tcp dst_port 135 port all deny
config access_profile profile_id 7 add access_id auto_assign ip tcp dst_port 137 port all deny
config access_profile profile_id 7 add access_id auto_assign ip tcp dst_port 138 port all deny
config access_profile profile_id 7 add access_id auto_assign ip tcp dst_port 139 port all deny
config access_profile profile_id 7 add access_id auto_assign ip tcp dst_port 445 port all deny
create access_profile ip udp dst_port_mask 0xFFFF profile_id 8
config access_profile profile_id 8 add access_id auto_assign ip udp dst_port 135 port all deny
config access_profile profile_id 8 add access_id auto_assign ip udp dst_port 137 port all deny
config access_profile profile_id 8 add access_id auto_assign ip udp dst_port 138 port all deny
config access_profile profile_id 8 add access_id auto_assign ip udp dst_port 139 port all deny
config access_profile profile_id 8 add access_id auto_assign ip udp dst_port 445 port all deny
# CPU INTERFACE FILTERING
delete cpu access_profile profile_id 1
delete cpu access_profile profile_id 2
delete cpu access_profile profile_id 3
enable cpu_interface_filtering
# --------------- END ACL------------------
create cpu access_profile profile_id 1 ip destination_ip_mask 255.255.255.255
config cpu access_profile profile_id 1 add access_id 1 ip destination_ip 224.0.0.1 port 25 permit
config cpu access_profile profile_id 1 add access_id 2 ip destination_ip 224.0.0.1 port 1-28 deny
# SMTP
disable smtp
# SNTP
enable sntp
config time_zone operator + hour 11 min 0
config sntp primary 172.17.0.4 secondary 0.0.0.0 poll-interval 720
config dst disable
# DOS_PREVENTION
enable dos_prevention trap_log
config dos_prevention dos_type all state disable
# IP
enable telnet 23
enable web 80
disable autoconfig
config autoconfig timeout 50
#-------------------------------------------------------------------
# End of configuration file for DES-3200-28
#------------------------------------------------------------------
clear log
save
Вход
Регистрация
FAQ
Поиск
