How to configure a blacklist on a CE series switch.


To defend against malicious packet attacks, a switch uses ACLs to add users with specific characteristic into a blacklist and discards packets sent by users in the blacklist.
A maximum of eight blacklists can be configured in an attack defense policy on a switch.
The ACL to be used must have been created.
The following example applies ACL 2001 to blacklist 2.
[~HUAWEI] cpu-defend policy test
[*HUAWEI-cpu-defend-policy-test] blacklist 2 acl 2001
[*HUAWEI-cpu-defend-policy-test] commit

Other related questions:
Configure a blacklist of an AR router
A blacklist can be manually configured. After the address scan and port scan functions of the attack defense module are enabled on an AR router, an IP address (or an interface) for which the packet rate exceeds a set value can be automatically added into a blacklist to shield packets sent from this IP address (or through this interface) as the router considers the rate excess as a scan attack. To configure a blacklist, do as follows: Run the system-view command to access the system view. [Huawei] firewall blacklist enable //Enable the blacklist function. By default, the blacklist function is not enabled. Blacklist entries can be added one by one or in batches. [Huawei] firewall blacklist ip-address [ vpn-instance vpn-instance-name ] [ expire-time minutes ] //Add blacklist entries one by one. Note: Blacklist entries without specified aging time will be written into a configuration file, while those with specified aging time will not. Run the display firewall blacklist command to check the blacklist entries without specified aging time. [Huawei] firewall black-white-list load configuration-file configuration-file-name //Load the configuration file of the blacklist/whitelist. Note: By loading the configuration file of the blacklist/whitelist, blacklist entries can be configured in batches. This configuration file must be configured in advance, and it supports only the text format. For details about how to configure the blacklist function of AR series routers using command lines and through the web NMS, see the URL: AR router configuration blacklist.

How to configure a port group on a CE series switch
The procedure for configuring a port group on a CE series switch is described on the right.

If you have more questions, you can seek help from following ways:
To iKnow To Live Chat
Scroll to top