H3C SecPath Series Installation manual

H3C SecPath Series High-End Firewalls
Attack Protection Command Reference
Hangzhou H3C Technologies Co., Ltd.
http://www.h3c.com
Software version: SECPATH1000FE&SECBLADEII-CMW520-R3166
SECPATH5000FA-CMW520-R3206
Document version: 6PW107-20120703

Copyright © 2008-2012, Hangzhou H3C Technologies Co., Ltd. and its licensors
All rights reserved
No part of this manual may be reproduced or transmitted in any form or by any means without prior
written consent of Hangzhou H3C Technologies Co., Ltd.
Trademarks
H3C, , Aolynk, , H3Care, , TOP G, , IRF, NetPilot, Neocean, NeoVTL,
SecPro, SecPoint, SecEngine, SecPath, Comware, Secware, Storware, NQA, VVG, V2G, VnG, PSPT,
XGbus, N-Bus, TiGem, InnoVision and HUASAN are trademarks of Hangzhou H3C Technologies Co.,
Ltd.
All other trademarks that may be mentioned in this manual are the property of their respective owners
Notice
The information in this document is subject to change without notice. Every effort has been made in the
preparation of this document to ensure accuracy of the contents, but all statements, information, and
recommendations in this document do not constitute the warranty of any kind, express or implied.

Preface
The H3C SecPath Series High-End Firewalls command references describe the commands and command
syntax options available for the H3C SecPath Series High-End Firewalls.
The Attack Protection Command Reference describes the ARP and web filtering commands.
This preface includes:
•Audience
•Conventions
•About the H3C SecPath series high-end firewalls documentation set
•Obtaining documentation
•Technical support
•Documentation feedback
Audience
This documentation is intended for:
•Network planners
•Field technical support and servicing engineers
•Network administrators working with the H3C high-end firewall products
Conventions
This section describes the conventions used in this documentation set.
Command conventions
Convention Descri
p
tion
Boldface Bold text represents commands and keywords that you enter literally as shown.
Italic Italic text represents arguments that you replace with actual values.
[ ] Square brackets enclose syntax choices (keywords or arguments) that are optional.
{ x | y | ... }
Braces enclose a set of required syntax choices separated by vertical bars, from which
you select one.
[ x | y | ... ]
Square brackets enclose a set of optional syntax choices separated by vertical bars, from
which you select one or none.
{ x | y | ... } *
Asterisk marked braces enclose a set of required syntax choices separated by vertical
bars, from which you select at least one.
[ x | y | ... ] *
Asterisk marked square brackets enclose optional syntax choices separated by vertical
bars, from which you select one choice, multiple choices, or none.
&<1-n> The argument or keyword and argument combination before the ampersand (&) sign can
be entered 1 to n times.

Convention Descri
p
tion
# A line that starts with a pound (#) sign is comments.
GUI conventions
Convention Descri
p
tion
Boldface Window names, button names, field names, and menu items are in Boldface. For
example, the New User window appears; click OK.
> Multi-level menus are separated by angle brackets. For example, File > Create > Folder.
Convention Descri
p
tion
< > Button names are inside angle brackets. For example, click <OK>.
[ ] Window names, menu items, data table and field names are inside square brackets. For
example, pop up the [New User] window.
/ Multi-level menus are separated by forward slashes. For example, [File/Create/Folder].
Symbols
Convention Descri
p
tion
WARNING An alert that calls attention to important information that if not understood or followed can
result in personal injury.
CAUTION An alert that calls attention to important information that if not understood or followed can
result in data loss, data corruption, or damage to hardware or software.
IMPORTANT An alert that calls attention to essential information.
NOTE An alert that contains additional or supplementary information.
TIP An alert that provides helpful information.
Network topology icons
Represents a generic network device, such as a router, switch, or firewall.
Represents a routing-capable device, such as a router or Layer 3 switch.
Represents a generic switch, such as a Layer 2 or Layer 3 switch, or a router that supports
Layer 2 forwarding and other Layer 2 features.
Represents a SecPath firewall chassis or a SecBlade firewall module.
Port numbering in examples
The port numbers in this document are for illustration only and might be unavailable on your device.

About the H3C SecPath series high-end firewalls
documentation set
The H3C SecPath series high-end firewalls documentation set includes:
Cate
g
or
y
Documents Pur
p
oses
Product description and
specifications
Marketing
brochures
F1000-E
Describe product specifications and benefits.
F5000-A5
Firewall
modules
Hardware specifications
and installation
Compliance
and safety
manuals
F1000-E Provide regulatory information and the safety
instructions that must be followed during
installation.
F5000-A5
Installation
guides
F1000-E Provide a complete guide to hardware
installation and hardware specifications.
F5000-A5
Card
manuals
F5000-A5 Provide the hardware specifications of the
firewall chassis and modules.
Firewall
modules
Software configuration
Configuration guides Describe software features and configuration
procedures, and all available commands.
Configuration examples Describe typical network scenarios and provide
configuration examples and instructions.
Operations and
maintenance
Software upgrade guide Describes the software upgrade procedures.
Release
notes
F1000-E Provide information about the product release,
including the version history, hardware and
software compatibility matrix, version upgrade
information, technical support information, and
software upgrading.
F5000-A5
Firewall
modules
Obtaining documentation
You can access the most up-to-date H3C product documentation on the World Wide Web
at http://www.h3c.com.
Click the links on the top navigation bar to obtain different categories of product documentation:
[Technical Support & Documents > Technical Documents] – Provides hardware installation, software
upgrading, and software feature configuration and maintenance documentation.
[Products & Solutions] – Provides information about products and technologies, as well as solutions.
[Technical Support & Documents > Software Download] – Provides the documentation released with the
software version.

Technical support
servi[email protected]
http://www.h3c.com
Documentation feedback
You can e-mail your comments about product documentation to inf[email protected].
We appreciate your comments.

i
Contents
ARP attack defense configuration commands············································································································ 1
ARP automatic scanning and fixed ARP configuration commands··············································································1
arp fixup····································································································································································1
arp scan ····································································································································································2
Web filtering configuration commands······················································································································ 3
display firewall http activex-blocking ·····················································································································3
display firewall http java-blocking··························································································································4
display firewall http url-filter host ····························································································································5
display firewall http url-filter parameter ·················································································································6
firewall http activex-blocking acl ····························································································································8
firewall http activex-blocking enable······················································································································8
firewall http activex-blocking suffix·························································································································9
firewall http java-blocking acl·································································································································9
firewall http java-blocking enable ······················································································································· 10
firewall http java-blocking suffix ·························································································································· 11
firewall http url-filter host acl ································································································································ 11
firewall http url-filter host default·························································································································· 12
firewall http url-filter host enable·························································································································· 13
firewall http url-filter host ip-address···················································································································· 13
firewall http url-filter host load······························································································································ 14
firewall http url-filter host save······························································································································ 14
firewall http url-filter host url-address ··················································································································· 15
firewall http url-filter parameter···························································································································· 16
firewall http url-filter parameter enable··············································································································· 17
firewall http url-filter parameter load··················································································································· 18
firewall http url-filter parameter save··················································································································· 18
reset firewall http ··················································································································································· 19
Index ···········································································································································································20

1
ARP attack defense configuration commands
ARP automatic scanning and fixed ARP
configuration commands
arp fixup
Syntax
arp fixup
View
System view
Default Level
2: System level
Parameters
None
Description
Use the arp fixup command to change dynamic ARP entries into static ARP entries.
Note the following:
•The static ARP entries changed from dynamic ARP entries have the same attributes as the static ARP
entries manually configured. Use the arp fixup command to change the recently created dynamic
ARP entries into static.
•The number of static ARP entries changed from dynamic ARP entries is restricted by the number of
static ARP entries that the firewall supports. As a result, the firewall may fail to change all dynamic
ARP entries into static.
•Suppose that the number of dynamic ARP entries is Dand that of the existing static ARP entries is S.
When the dynamic ARP entries are changed into static, new dynamic ARP entries may be created
(suppose the number is M) and some of the dynamic ARP entries may be aged out (suppose the
number is N). After the process is complete, the number of static ARP entries is D+ S+ M– N.
•To delete a specific static ARP entry changed from a dynamic one, use the undo arp ip-address
[ vpn-instance-name ] command. To delete all such static ARP entries, use the reset arp all or reset
arp static command.
Examples
# Enable Fixed ARP.
<Sysname> system-view
[Sysname] arp fixup

2
arp scan
Syntax
arp scan [ start-ip-address to end-ip-address ]
View
Layer 3 Ethernet interface view, Layer 3 Ethernet subinterface view, VLAN interface view
Default Level
2: System level
Parameters
start-ip-address: Start IP address of the scanning range.
end-ip-address: End IP address of the scanning range. The end IP address must be higher than or equal
to the start IP address.
Description
Use the arp scan command to enable ARP automatic scanning.
Note the following:
•If start IP and end IP addresses are specified, the firewall scans the specific address range for
neighbors and learns their ARP entries. If not, the firewall only scans the network where the primary
IP address of the interface resides for neighbors.
•The start IP address and end IP address must be on the same network as the primary IP address or
manually configured secondary IP addresses of the interface.
•IP addresses already exist in ARP entries are not scanned.
•ARP automatic scanning may take some time. To stop an ongoing scan, press Ctrl + C. Dynamic
ARP entries are created based on ARP replies received before the scan is terminated.
Examples
# Configure the firewall to scan the network where the primary IP address of GigabitEthernet 0/0 resides
for neighbors.
<Sysname> system-view
[Sysname] interface gigabitethernet 0/0
[Sysname-GigabitEthernet0/0] arp scan
# Configure the firewall to scan the specific address range for neighbors.
<Sysname> system-view
[Sysname] interface gigabitethernet 0/0
[Sysname-GigabitEthernet0/0] arp scan 1.1.1.1 to 1.1.1.20

3
Web filtering configuration commands
NOTE:
The file name conventions in this document are as follows:
•Full file name: File path plus file name, a case-insensitive strin
g
of 1 to 135 characters excludin
g
the end
character.
•File name: File name without file path, a case-insensitive string of 1 to 91 characters excludin
g
the end
character.
display firewall http activex-blocking
Syntax
display firewall http activex-blocking [ all |item keywords | verbose ]
View
Any view
Default level
1: Monitor level
Parameters
all: Specifies all active blocking suffix keywords.
item keywords: Specifies a blocking suffix keyword. It is a string of 1 to 9 characters. It must start with a
dot “.” and consist of characters 0 to 9, a to z, and A to Z.
verbose: Specifies detailed information.
Description
Use the display firewall http activex-blocking command to display information about ActiveX blocking.
If no parameters are specified, the command displays brief information about ActiveX blocking.
Examples
# Display brief information about ActiveX blocking.
<Sysname> display firewall http activex-blocking
ActiveX blocking is enabled.
# Display ActiveX blocking information about a specified suffix keyword.
<Sysname> display firewall http activex-blocking item .ocx
The HTTP request packet including ".ocx" had been matched for 5 times.
# Display ActiveX blocking information about all suffix keywords.
<Sysname> display firewall http activex-blocking all
SN Match-Times Keywords
----------------------------------------------
1 5 .OCX

4
2 0 .vbs
Table 1 Output description
Field Descri
p
tion
SN Serial number
Match-Times Number of times that a suffix keyword is matched
Keywords ActiveX blocking suffix keyword
# Display detailed ActiveX blocking information.
<Sysname> display firewall http activex-blocking verbose
ActiveX blocking is enabled.
No ACL group has been configured.
There are 5 packet(s) being filtered.
There are 0 packet(s) being passed.
display firewall http java-blocking
Syntax
display firewall http java-blocking [ all |item keywords | verbose ]
View
Any view
Default level
1: Monitor level
Parameters
all: Specifies all Java blocking suffix keywords.
item keywords: Specifies a blocking suffix keyword. It is a string of 1 to 9 characters. It must start with a
dot “.” and consist of characters 0 to 9, a to z, and A to Z.
verbose: Specifies detailed information.
Description
Use the display firewall http java-blocking command to display information about Java blocking.
If no parameters are specified, the command displays brief information about Java blocking.
Examples
# Display brief information about Java blocking.
<Sysname> display firewall http java-blocking
Java blocking is enabled.
# Display Java blocking information about a specified suffix keyword.
<Sysname> display firewall http java-blocking item .class
The HTTP request packet including ".class" had been matched for 10 times.
# Display Java blocking information about all suffix keywords.
<Sysname> display firewall http java-blocking all

5
SN Match-Times Keywords
----------------------------------------------
1 10 .CLASS
2 0 .JAR
3 0 .java
Table 2 Output description
Field Descri
p
tion
SN Serial number
Match-Times Number of times that the suffix keyword has been matched
Keywords Java blocking suffix keyword
# Display detailed information about Java blocking.
<Sysname> display firewall http java-blocking verbose
Java blocking is enabled.
No ACL group has been configured.
There are 10 packet(s) being filtered.
There are 0 packet(s) being passed.
display firewall http url-filter host
Syntax
display firewall http url-filter host [ all |item keywords | verbose ]
View
Any view
Default level
1: Monitor level
Parameters
all: Specifies all URL filtering keywords.
item keywords: Specifies a filtering keyword, The keywords argument is a case-insensitive string of 1 to
80 characters. Valid characters include 0 to 9, a to z, A to Z, dot “.”, hyphen “-“, underline “_”, and
wildcards “^”, “$”, “&”, and “*”. For meanings and usage guidelines of the wildcards, refer to the
relevant description for command firewall http url-filter host url-address.
verbose: Specifies detailed information.
Description
Use the display firewall http url-filter host command to display information about URL address filtering.
If no parameters are specified, the command displays brief information about URL address filtering.
Examples
# Display brief information about URL address filtering.
<Sysname> display firewall http url-filter host
URL-filter host is enabled.
Default method: permit.
# Display URL address filtering information about a specified filtering entry.

6
<Sysname> display firewall http url-filter host item ^webfilter$
The HTTP request packet including "^webfilter$" had been matched for 10 times.
# Display URL address filtering information about all filtering entries.
<Sysname> display firewall http url-filter host all
SN Match-Times Keywords
----------------------------------------------
1 10 ^webfilter$
Table 3 Output description
Field Descri
p
tion
SN Serial number
Match-Times Number of times that the keyword has been matched
Keywords URL address filtering keyword
# Display detailed information about URL address filtering.
<Sysname> display firewall http url-filter host verbose
URL-filter host is enabled.
Default method: permit.
The support for IP address: deny.
No ACL group has been configured.
URL-filter host has loaded file “cfa0:/urlfilter”.
There are 10 packet(s) being filtered.
There are 0 packet(s) being passed.
Table 4 Output description
Field Descri
p
tion
Default method Default URL address filtering action, which can be permit or deny.
The support for IP address Support for website IP addresses, permit or deny.
display firewall http url-filter parameter
Syntax
display firewall http url-filter parameter [ all |item keywords | verbose ]
View
Any view
Default level
1: Monitor level
Parameters
all: Specifies all filtering keywords.
item keywords: Specifies a filtering keyword. The keywords argument is a case-insensitive string of 1 to
80 characters. Valid characters include numerals, English letters, wildcards (‘^’, ‘$’, ‘&’ and ‘*’), and
other ASCII characters with values in the range 31 to 127.
verbose: Specifies detailed information.

7
Description
Use the display firewall http url-filter parameter command to display information about URL parameter
filtering.
If no parameters are specified, the command displays brief information about URL parameter filtering.
Examples
# Display brief information about URL parameter filtering.
<Sysname> display firewall http url-filter parameter
URL-filter parameter is enabled.
# Display URL parameter filtering information about a specified keyword.
<Sysname> display firewall http url-filter parameter item ^select$
The HTTP request packet including "^select$" had been matched for 10 times.
# Display URL parameter filtering information about all keywords.
<Sysname> display firewall http url-filter parameter all
SN Match-Times Keywords
----------------------------------------------
1 0 ^select$
2 0 ^insert$
3 0 ^update$
4 0 ^delete$
5 0 ^drop$
6 0 --
7 0 ‘
8 0 ^exec$
9 10 %27
10 0 qqqqq
Table 5 Output description
Field Description
SN Serial number
Match-Times Number of times that the keyword has been matched
Keywords URL parameter filtering keyword
# Display detailed information about URL parameter filtering.
<Sysname> display firewall http url-filter parameter verbose
URL-filter parameter is enabled.
URL-filter parameter has loaded file “cfa0:/parameterfilter”.
There are 10 packet(s) being filtered.
There are 0 packet(s) being passed.

8
firewall http activex-blocking acl
Syntax
firewall http activex-blocking acl acl-number
undo firewall http activex-blocking acl
View
System view
Default level
2: System level
Parameters
acl-number: ACL number, in the range 2000 to 3999.
Description
Use the firewall http activex-blocking acl command to specify an ACL for ActiveX blocking.
Use the undo firewall http activex-blocking acl command to cancel the configuration.
By default, no ACL is specified for ActiveX blocking.
After the command takes effect, all Web requests containing any suffix keywords in the ActiveX blocking
suffix list will be processed according to the ACL.
You can specify multiple ACLs for ActiveX blocking, but only the last one takes effect.
You can specify a non-existing ACL, but ActiveX blocking based on the ACL takes effect only after you
create and configure the ACL correctly.
Related commands: display firewall http activex-blocking.
Examples
# Specify the ACL for ActiveX blocking as ACL 2003.
<Sysname> system-view
[Sysname] firewall http activex-blocking acl 2003
firewall http activex-blocking enable
Syntax
firewall http activex-blocking enable
undo firewall http activex-blocking enable
View
System view
Default level
2: System level
Parameters
None

9
Description
Use the firewall http activex-blocking enable command to enable the ActiveX blocking function and add
the default blocking keyword ‘.ocx’ to the ActiveX blocking suffix list.
Use the undo firewall http activex-blocking enable command to disable the ActiveX blocking function.
By default, the ActiveX blocking function is disabled.
Related commands: display firewall http activex-blocking.
Examples
# Enable the ActiveX blocking function.
<Sysname> system-view
[Sysname] firewall http activex-blocking enable
firewall http activex-blocking suffix
Syntax
firewall http activex-blocking suffix keywords
undo firewall http activex-blocking suffix keywords
View
System view
Default level
2: System level
Parameters
keywords: Blocking suffix keyword, a case-insensitive string of 1 to 9 characters. It must start with a dot
“.” and consist of characters 0 to 9, a to z, and A to Z.
Description
Use the firewall http activex-blocking suffix command to add an ActiveX blocking suffix keyword to the
ActiveX blocking suffix list.
Use the undo firewall http activex-blocking suffix command to remove an ActiveX blocking suffix
keyword from the ActiveX blocking suffix list.
You can add a maximum of 5 ActiveX blocking suffix keywords.
You cannot add or remove the default suffix keyword “.ocx” by these commands.
Related commands: display firewall http activex-blocking.
Examples
# Add .vbs to the ActiveX blocking suffix list.
<Sysname> system-view
[Sysname] firewall http activex-blocking suffix .vbs
firewall http java-blocking acl
Syntax
firewall http java-blocking acl acl-number
undo firewall http java-blocking acl

10
View
System view
Default level
2: System level
Parameters
acl-number: ACL number, in the range 2000 to 3999.
Description
Use the firewall http java-blocking acl command to specify an ACL for Java blocking.
Use the undo firewall http java-blocking acl command to cancel the configuration.
By default, no ACL is specified for Java blocking.
After the command takes effect, all Web requests containing any suffix keywords in the Java blocking
suffix list will be processed according to the specified ACL.
You can specify multiple ACLs for Java blocking, but only the last one takes effect.
You can specify a non-existing ACL, but Java blocking based on the ACL takes effect only after you create
and configure the ACL correctly.
Related commands: display firewall http java-blocking.
Examples
# Specify the ACL for Java blocking as ACL 2002.
<Sysname> system-view
[Sysname] firewall http java-blocking acl 2002
firewall http java-blocking enable
Syntax
firewall http java-blocking enable
undo firewall http java-blocking enable
View
System view
Default level
2: System level
Parameters
None
Description
Use the firewall http java-blocking enable command to enable the Java blocking function and add the
default blocking keywords .class and .jar to the Java blocking suffix list.
Use the undo firewall http java-blocking enable command to disable the Java blocking function.
By default, the Java blocking function is disabled.
Related commands: display firewall http java-blocking.

11
Examples
# Enable the Java blocking function.
<Sysname> system-view
[Sysname] firewall http java-blocking enable
firewall http java-blocking suffix
Syntax
firewall http java-blocking suffix keywords
undo firewall http java-blocking suffix keywords
View
System view
Default level
2: System level
Parameters
keywords: Blocking suffix keyword, a case-insensitive string of 1 to 9 characters. It must start with a dot
“.” and consists of characters 0 to 9, a to z, and A to Z.
Description
Use the firewall http java-blocking suffix command to add a Java blocking suffix keyword to the Java
blocking suffix list.
Use the undo firewall http java-blocking suffix command to remove a Java blocking suffix keyword from
the Java blocking suffix list.
You can add a maximum of five Java blocking suffix keywords.
You cannot remove the default block suffix keywords .class and .jar.
Related commands: display firewall http java-blocking.
Examples
# Add .js to the Java blocking suffix list.
<Sysname> system-view
[Sysname] firewall http java-blocking suffix .js
firewall http url-filter host acl
Syntax
firewall http url-filter host acl acl-number
undo firewall http url-filter host acl
View
System view
Default level
2: System level

12
Parameters
acl-number: ACL number, in the range 2000 to 3999.
Description
Use the firewall http url-filter host acl command to specify an ACL for URL address filtering.
Use the undo firewall http url-filter host acl command to cancel the configuration.
By default, no ACL is specified for URL address filtering.
With the command configured, all Web requests using IP addresses will be processed according to the
specified ACL.
If you specify multiple ACLs for URL address filtering, only the last one takes effect.
You can specify a non-existing ACL, but filtering based on the ACL takes effect only after you create and
configure the ACL correctly.
Related commands: display firewall http url-filter host.
Examples
# Specify URL address filtering to permit Web requests with website IP addresses permitted by ACL
2000.
<Sysname> system-view
[Sysname] acl number 2000
[Sysname-acl-basic-2000] rule 0 permit source 3.3.3.3 0.0.0.0
[Sysname-acl-basic-2000] quit
[Sysname] firewall http url-filter host acl 2000
firewall http url-filter host default
Syntax
firewall http url-filter host default {deny |permit }
View
System view
Default level
2: System level
Parameters
deny: Denies Web requests.
permit: Permits Web requests.
Description
Use the firewall http url-filter host default command to specify the default action for URL address filtering,
that is, action to be taken for Web requests whose URL addresses do not match the configured filtering
entries.
By default, the default filtering action is deny.
Related commands: display firewall http url-filter host.
Examples
# Specify the default filtering action as permit.

13
<Sysname> system-view
[Sysname] firewall http url-filter host default permit
firewall http url-filter host enable
Syntax
firewall http url-filter host enable
undo firewall http url-filter host enable
View
System view
Default level
2: System level
Parameters
None
Description
Use the firewall http url-filter host enable command to enable the URL address filtering function.
Use the undo firewall http url-filter host enable command to disable the URL address filtering function.
By default, the URL address filtering function is disabled.
Related commands: display firewall http url-filter host.
Examples
# Enable the URL address filtering function.
<Sysname> system-view
[Sysname] firewall http url-filter host enable
firewall http url-filter host ip-address
Syntax
firewall http url-filter host ip-address {deny |permit }
View
System view
Default level
2: System level
Parameters
permit: Specifies to permit a Web request whose destination URL is present in IP address.
deny: Specifies to deny a Web request whose destination URL is present in IP address.
Description
Use the firewall http url-filter host ip-address command to enable/disable support for IP address in URL
address filtering, that is, to permit or deny Web requests using IP addresses for access to websites.
By default, the URL address filtering function denies Web requests using IP addresses for access to
websites.