NBAR病毒防治

Kyon

使用NBAR来防止红色代码(Code-Red)和尼姆达(Nimda)蠕虫病毒，配置如下

ip cef

!

class-map match-all DENY-ATTACK

match protocol http url "*.ida*"

match protocol http url "*cmd.exe*"

match protocol http url "*root.exe*"

match protocol http url "*readme.eml*"

!

policy-map nimokaka

class DENY-ATTACK

drop

interface Serial0

ip address 10.0.0.1 255.255.255.252

service-policy input nimokaka