Firewall filter between PPPoE access-users

Hi rganacimm,
Please wait patiently. Our engineers are looking for answers to your questions.

Hi,
Is the malicious users a normal PPPoE dialer user? For the first scenario, what you configured in the traffic-policy to drop the offending traffic? Just limit the bandwidth of the attacker?

@chenhui In the first scenario, we can drop ports like TCP25, UDP445, UDP134, and more. But internal clients continue to be vulnerable to internal attackers.

Hello @chenhui,

All the users are normal PPPoE dialer user.

In the first scenario, I configured acl+behavior+traffic-policy and applied it to the interface. It just works as expected and drop the offending traffic.

But as @LuizPuppin said, in the second scenario, we don't have an interface to apply the traffic-policy. In another vendors, like Cisco and Juniper, its possible to attach a traffic-policy to the "virtual-template", and in that point we can filter traffic like that malicious.

Does Huawei provide some way to filter this malicious traffic coming from a PPPoE User and going to another PPPoE user in the same box?

Yes, there is traffic-policy command that could be configure under the BAS interface view, but it's a value-added service. Kindly refer https://support.huawei.com/hedex/hdx.do?docid=EDOC1100136152&id=EN-US_CLIREF_0249155327&lang=en

Hi rganacim,
The LCR5DAA00 controls the DAA function. And the documentation describes that the command 'traffic-policy(bas interface view)' requires the BAS interface to be configured as a Layer 2 or Layer 3 leased line interface.
You can find at https://support.huawei.com/hedex/hdx.do?docid=EDOC1100109721&id=EN-US_CLIREF_0172386036&lang=en
I'm not sure if this will be the switch that the command available or not.

very useful

good