! --- block TFTP
　　
　　access-list 115 deny udp any any eq 69
　　
　　! --- block W32.Blaster related protocols
　　
　　access-list 115 deny tcp any any eq 135
　　access-list 115 deny udp any any eq 135
　　
　　! --- block other vulnerable MS protocols
　　
　　access-list 115 deny udp any any eq 137
　　access-list 115 deny udp any any eq 138
　　access-list 115 deny tcp any any eq 139
　　access-list 115 deny udp any any eq 139
　　access-list 115 deny tcp any any eq 445
　　access-list 115 deny tcp any any eq 593
　　
　　! --- block remote access due to W32.Blaster
　　
　　access-list 115 deny tcp any any eq 4444
　　
　　! --- Allow all other traffic -- insert
　　! --- other existing access-list entries here
　　
　　access-list 115 permit ip any any
　　
　　interface
　　
　　ip access-group 115 in
　　ip access-group 115 out
　　
　　另外，阻止非法地址的命令是:
　　
　　Router(config)# interface
　　Router(if-config)# no ip unreachables
　　
　　如果此命令不能禁止，可参考下面这个命令:
　　
　　Elab(config)# ip icmp rate-limit unreachable
　　VACL on the CatOS
　　
　　! --- block TFTP
　　set security acl ip BLASTER deny udp any any eq 69
　　
　　! --- block vulnerable MS protocols
　　! --- Blaster related
　　set security acl ip BLASTER deny tcp any any eq 135
　　set security acl ip BLASTER deny udp any any eq 135
　　
　　! --- Non-blaster related
　　
　　set security acl ip BLASTER deny tcp any any eq 137
　　set security acl ip BLASTER deny udp any any eq 137
　　set security acl ip BLASTER deny tcp any any eq 138
　　set security acl ip BLASTER deny udp any any eq 138
　　set security acl ip BLASTER deny tcp any any eq 139
　　set security acl ip BLASTER deny udp any any eq 139
　　set security acl ip BLASTER deny tcp any any eq 593
　　
　　! --- block remote access due to W32.Blaster
　　
　　set security acl ip BLASTER deny tcp any any eq 4444
　　
　　! --- Allow all other traffic
　　! --- insert other existing access-list entries here
　　
　　set security acl ip BLASTER permit any any
　　
　　! -- applies both inbound and outbound
　　
　　commit security acl BLASTER
　　set security acl map BLASTER
　　PIX
　　
　　access-list acl_inside deny udp any any eq 69
　　access-list acl_inside deny tcp any any eq 135
　　access-list acl_inside deny udp any any eq 135
　　access-list acl_inside deny tcp any any eq 137
　　access-list acl_inside deny udp any any eq 137
　　access-list acl_inside deny tcp any any eq 138
　　access-list acl_inside deny udp any any eq 138
　　access-list acl_inside deny tcp any any eq 139
　　access-list acl_inside deny udp any any eq 139
　　access-list acl_inside deny tcp any any eq 445
　　access-list acl_inside deny tcp any any eq 593
　　access-list acl_inside deny tcp any any eq 4444
　　! --- insert previously configured acl statements here,
　　! --- or permit all other traffic out
　　
　　access-list acl_inside permit ip any any
　　
　　access-group acl_inside in interface inside

本文来源：天下网吧 作者：网吧方案