Configuring blacklist 1

Blacklist function overview·· 1

Configuring the blacklist function· 1

Displaying and maintaining the blacklist 2

Blacklist configuration example· 2

Blacklist function overview

The blacklist function is an attack protection measure that filters packets by source IP address. Compared with Access Control List (ACL) packet filtering, blacklist filtering is simpler in matching packets and therefore can filter packets at a high speed. Blacklist filtering is very effective in filtering packets from certain IP addresses.

Working in conjunction with the user login authentication function, the switch can add blacklist entries automatically and can age such blacklist entries. More specifically, when the switch detects that an FTP, Telnet, SSH, or web user has failed to provide the correct username, password, or verification code (for a web login user) after the maximum number of attempts, it considers the user an attacker, adds the IP address of the user to the blacklist, and filters subsequent login requests from the user. This mechanism can effectively prevent attackers from cracking login passwords through repeated login attempts. The maximum number of login failures is six, the blacklist entry aging time is 10 minutes, and they are not configurable.

The switch also allows you to add and delete blacklist entries manually. Blacklist entries added manually can be permanent blacklist entries or non-permanent blacklist entries. A permanent entry will always exist in the blacklist unless you delete it manually. You can configure the aging time of a non-permanent entry. After the timer expires, the switch automatically deletes the blacklist entry, allowing packets from the corresponding IP address to pass.

Configuring the blacklist function

You can configure the switch to filter packets from certain IP addresses by configuring the blacklist function.

The blacklist configuration includes enabling the blacklist function and adding blacklist entries. When adding a blacklist entry, you can also configure the entry aging time. If you do not configure the aging time, the entry will never age out and thus always exist until you delete it manually.

To configure the blacklist function:

Displaying and maintaining the blacklist

Blacklist configuration example

Network requirements

As shown in Figure 1, assume that you find an attacker (Host B) in the outside network by analyzing the traffic statistics. Configure the switch to filer packets from Host B permanently.

Figure 1 Network diagram

Configuration procedure

1.      Configure the switch:

# Configure IP addresses for interfaces. (Details not shown)

# Enable the blacklist function.

<Switch> system-view

[Switch] blacklist enable

# Add Host B’s IP address 5.5.5.5 to the blacklist without configuring an aging time for it.

[Switch] blacklist ip 5.5.5.5

2.      Verify the configuration:

After the above configuration, you can view the added blacklist entries through the display blacklist all command.

[Switch] display blacklist all

                    Blacklist information

-------------------------------------------------------------------------

Blacklist                               : enabled

Blacklist items                         : 2

------------------------------------------------------------------------------

IP              Type   Aging started       Aging finished      Dropped packets

                       YYYY/MM/DD hh:mm:ss YYYY/MM/DD hh:mm:ss

5.5.5.5         manual 2008/04/09 16:02:20 Never               0

After the configuration takes effect, the switch should always drop packets from Host B unless you delete Host B’s IP address from the blacklist by using the undo blacklist ip 5.5.5.5 command.