H3C SecPath Series Installation manual

H3C SecPath Series High-End Firewalls
Attack Protection Command Reference
Hangzhou H3C Technologies Co., Ltd.
http://www.h3c.com
Software version: SECPATH1000FE&SECBLADEII-CMW520-R3166
SECPATH5000FA-CMW520-R3206
Document version: 6PW107-20120703

Copyright © 2008-2012, Hangzhou H3C Technologies Co., Ltd. and its licensors
All rights reserved
No part of this manual may be reproduced or transmitted in any form or by any means without prior
written consent of Hangzhou H3C Technologies Co., Ltd.
Trademarks
H3C, , Aolynk, , H3Care, , TOP G, , IRF, NetPilot, Neocean, NeoVTL,
SecPro, SecPoint, SecEngine, SecPath, Comware, Secware, Storware, NQA, VVG, V2G, VnG, PSPT,
XGbus, N-Bus, TiGem, InnoVision and HUASAN are trademarks of Hangzhou H3C Technologies Co.,
Ltd.
All other trademarks that may be mentioned in this manual are the property of their respective owners
Notice
The information in this document is subject to change without notice. Every effort has been made in the
preparation of this document to ensure accuracy of the contents, but all statements, information, and
recommendations in this document do not constitute the warranty of any kind, express or implied.

Preface
The H3C SecPath Series High-End Firewalls command references describe the commands and command
syntax options available for the H3C SecPath Series High-End Firewalls.
The Attack Protection Command Reference describes the ARP and web filtering commands.
This preface includes:
•Audience
•Conventions
•About the H3C SecPath series high-end firewalls documentation set
•Obtaining documentation
•Technical support
•Documentation feedback
Audience
This documentation is intended for:
•Network planners
•Field technical support and servicing engineers
•Network administrators working with the H3C high-end firewall products
Conventions
This section describes the conventions used in this documentation set.
Command conventions
Convention Descri
p
tion
Boldface Bold text represents commands and keywords that you enter literally as shown.
Italic Italic text represents arguments that you replace with actual values.
[ ] Square brackets enclose syntax choices (keywords or arguments) that are optional.
{ x | y | ... }
Braces enclose a set of required syntax choices separated by vertical bars, from which
you select one.
[ x | y | ... ]
Square brackets enclose a set of optional syntax choices separated by vertical bars, from
which you select one or none.
{ x | y | ... } *
Asterisk marked braces enclose a set of required syntax choices separated by vertical
bars, from which you select at least one.
[ x | y | ... ] *
Asterisk marked square brackets enclose optional syntax choices separated by vertical
bars, from which you select one choice, multiple choices, or none.
&<1-n> The argument or keyword and argument combination before the ampersand (&) sign can
be entered 1 to n times.

Convention Descri
p
tion
# A line that starts with a pound (#) sign is comments.
GUI conventions
Convention Descri
p
tion
Boldface Window names, button names, field names, and menu items are in Boldface. For
example, the New User window appears; click OK.
> Multi-level menus are separated by angle brackets. For example, File > Create > Folder.
Convention Descri
p
tion
< > Button names are inside angle brackets. For example, click <OK>.
[ ] Window names, menu items, data table and field names are inside square brackets. For
example, pop up the [New User] window.
/ Multi-level menus are separated by forward slashes. For example, [File/Create/Folder].
Symbols
Convention Descri
p
tion
WARNING An alert that calls attention to important information that if not understood or followed can
result in personal injury.
CAUTION An alert that calls attention to important information that if not understood or followed can
result in data loss, data corruption, or damage to hardware or software.
IMPORTANT An alert that calls attention to essential information.
NOTE An alert that contains additional or supplementary information.
TIP An alert that provides helpful information.
Network topology icons
Represents a generic network device, such as a router, switch, or firewall.
Represents a routing-capable device, such as a router or Layer 3 switch.
Represents a generic switch, such as a Layer 2 or Layer 3 switch, or a router that supports
Layer 2 forwarding and other Layer 2 features.
Represents a SecPath firewall chassis or a SecBlade firewall module.
Port numbering in examples
The port numbers in this document are for illustration only and might be unavailable on your device.

About the H3C SecPath series high-end firewalls
documentation set
The H3C SecPath series high-end firewalls documentation set includes:
Cate
g
or
y
Documents Pur
p
oses
Product description and
specifications
Marketing
brochures
F1000-E
Describe product specifications and benefits.
F5000-A5
Firewall
modules
Hardware specifications
and installation
Compliance
and safety
manuals
F1000-E Provide regulatory information and the safety
instructions that must be followed during
installation.
F5000-A5
Installation
guides
F1000-E Provide a complete guide to hardware
installation and hardware specifications.
F5000-A5
Card
manuals
F5000-A5 Provide the hardware specifications of the
firewall chassis and modules.
Firewall
modules
Software configuration
Configuration guides Describe software features and configuration
procedures, and all available commands.
Configuration examples Describe typical network scenarios and provide
configuration examples and instructions.
Operations and
maintenance
Software upgrade guide Describes the software upgrade procedures.
Release
notes
F1000-E Provide information about the product release,
including the version history, hardware and
software compatibility matrix, version upgrade
information, technical support information, and
software upgrading.
F5000-A5
Firewall
modules
Obtaining documentation
You can access the most up-to-date H3C product documentation on the World Wide Web
at http://www.h3c.com.
Click the links on the top navigation bar to obtain different categories of product documentation:
[Technical Support & Documents > Technical Documents] – Provides hardware installation, software
upgrading, and software feature configuration and maintenance documentation.
[Products & Solutions] – Provides information about products and technologies, as well as solutions.
[Technical Support & Documents > Software Download] – Provides the documentation released with the
software version.

Technical support
servi[email protected]
http://www.h3c.com
Documentation feedback
You can e-mail your comments about product documentation to inf[email protected].
We appreciate your comments.

i
Contents
ARP attack defense configuration commands············································································································ 1
ARP automatic scanning and fixed ARP configuration commands··············································································1
arp fixup····································································································································································1
arp scan ····································································································································································2
Web filtering configuration commands······················································································································ 3
display firewall http activex-blocking ·····················································································································3
display firewall http java-blocking··························································································································4
display firewall http url-filter host ····························································································································5
display firewall http url-filter parameter ·················································································································6
firewall http activex-blocking acl ····························································································································8
firewall http activex-blocking enable······················································································································8
firewall http activex-blocking suffix·························································································································9
firewall http java-blocking acl·································································································································9
firewall http java-blocking enable ······················································································································· 10
firewall http java-blocking suffix ·························································································································· 11
firewall http url-filter host acl ································································································································ 11
firewall http url-filter host default·························································································································· 12
firewall http url-filter host enable·························································································································· 13
firewall http url-filter host ip-address···················································································································· 13
firewall http url-filter host load······························································································································ 14
firewall http url-filter host save······························································································································ 14
firewall http url-filter host url-address ··················································································································· 15
firewall http url-filter parameter···························································································································· 16
firewall http url-filter parameter enable··············································································································· 17
firewall http url-filter parameter load··················································································································· 18
firewall http url-filter parameter save··················································································································· 18
reset firewall http ··················································································································································· 19
Index ···········································································································································································20

1
ARP attack defense configuration commands
ARP automatic scanning and fixed ARP
configuration commands
arp fixup
Syntax
arp fixup
View
System view
Default Level
2: System level
Parameters
None
Description
Use the arp fixup command to change dynamic ARP entries into static ARP entries.
Note the following:
•The static ARP entries changed from dynamic ARP entries have the same attributes as the static ARP
entries manually configured. Use the arp fixup command to change the recently created dynamic
ARP entries into static.
•The number of static ARP entries changed from dynamic ARP entries is restricted by the number of
static ARP entries that the firewall supports. As a result, the firewall may fail to change all dynamic
ARP entries into static.
•Suppose that the number of dynamic ARP entries is Dand that of the existing static ARP entries is S.
When the dynamic ARP entries are changed into static, new dynamic ARP entries may be created
(suppose the number is M) and some of the dynamic ARP entries may be aged out (suppose the
number is N). After the process is complete, the number of static ARP entries is D+ S+ M– N.
•To delete a specific static ARP entry changed from a dynamic one, use the undo arp ip-address
[ vpn-instance-name ] command. To delete all such static ARP entries, use the reset arp all or reset
arp static command.
Examples
# Enable Fixed ARP.
<Sysname> system-view
[Sysname] arp fixup

2
arp scan
Syntax
arp scan [ start-ip-address to end-ip-address ]
View
Layer 3 Ethernet interface view, Layer 3 Ethernet subinterface view, VLAN interface view
Default Level
2: System level
Parameters
start-ip-address: Start IP address of the scanning range.
end-ip-address: End IP address of the scanning range. The end IP address must be higher than or equal
to the start IP address.
Description
Use the arp scan command to enable ARP automatic scanning.
Note the following:
•If start IP and end IP addresses are specified, the firewall scans the specific address range for
neighbors and learns their ARP entries. If not, the firewall only scans the network where the primary
IP address of the interface resides for neighbors.
•The start IP address and end IP address must be on the same network as the primary IP address or
manually configured secondary IP addresses of the interface.
•IP addresses already exist in ARP entries are not scanned.
•ARP automatic scanning may take some time. To stop an ongoing scan, press Ctrl + C. Dynamic
ARP entries are created based on ARP replies received before the scan is terminated.
Examples
# Configure the firewall to scan the network where the primary IP address of GigabitEthernet 0/0 resides
for neighbors.
<Sysname> system-view
[Sysname] interface gigabitethernet 0/0
[Sysname-GigabitEthernet0/0] arp scan
# Configure the firewall to scan the specific address range for neighbors.
<Sysname> system-view
[Sysname] interface gigabitethernet 0/0
[Sysname-GigabitEthernet0/0] arp scan 1.1.1.1 to 1.1.1.20

3
Web filtering configuration commands
NOTE:
The file name conventions in this document are as follows:
•Full file name: File path plus file name, a case-insensitive strin
g
of 1 to 135 characters excludin
g
the end
character.
•File name: File name without file path, a case-insensitive string of 1 to 91 characters excludin
g
the end
character.
display firewall http activex-blocking
Syntax
display firewall http activex-blocking [ all |item keywords | verbose ]
View
Any view
Default level
1: Monitor level
Parameters
all: Specifies all active blocking suffix keywords.
item keywords: Specifies a blocking suffix keyword. It is a string of 1 to 9 characters. It must start with a
dot “.” and consist of characters 0 to 9, a to z, and A to Z.
verbose: Specifies detailed information.
Description
Use the display firewall http activex-blocking command to display information about ActiveX blocking.
If no parameters are specified, the command displays brief information about ActiveX blocking.
Examples
# Display brief information about ActiveX blocking.
<Sysname> display firewall http activex-blocking
ActiveX blocking is enabled.
# Display ActiveX blocking information about a specified suffix keyword.
<Sysname> display firewall http activex-blocking item .ocx
The HTTP request packet including ".ocx" had been matched for 5 times.
# Display ActiveX blocking information about all suffix keywords.
<Sysname> display firewall http activex-blocking all
SN Match-Times Keywords
----------------------------------------------
1 5 .OCX