华为路由器加固

1、关闭未用服务
#
undo dhcp enable
undo ip http server enable
undo ip https server enable
undo ndp 
undo ftp server port
undo tftp client-source
#
2、设置banner
#
header  login  information  % %
header  shell  information   % %
#
3、创建ssh用户，创建源限制登录acl，在用户接口和con口下应用
#
aaa
 local-user *** password cipher ***
 local-user *** privilege level 15
 local-user *** service-type terminal ssh
#
 ssh server enable 或 stelnet server enable
 ssh user *** authentication-type password
 rsa local-key-pair create
#
acl number 3500
 rule 0 permit ip source ****
 rule 5 permit ip source   **** 0
 rule 10 permit ip source  **** 0
 rule 20 deny ip
#
user-interface vty 0 15
 undo set authentication password
 authentication-mode aaa
 user privilege level 3
 idle-timeout 5 0
 protocol inbound ssh
 acl 3500 inbound
#
user-interface aux 0
 authentication-mode aaa 
 idle-timeout 5 0
#
账号创建完成，通过ssh登录后：
undo telnet server enable   #关闭telnet功能
aaa
undo local-user admin      #注销原来账号
undo ssh user admin        #注销原来的ssh
4、时钟配置 
clock timezone  beijing add 08:00:00
5、日志记录
#
display logbuffer    #查询存在日志信息即可：
#
6、网管参数
 snmp-agent trap source LoopBack0 //需要保证Trap接口的IP地址和Trap主机的IP地址之间路由可达。
 snmp-agent trap enable
7.关闭空闲端口
例如：
interface GigabitEthernet1/0/1
 shutdown
#
加固完成进行配置保存：save