措施：ACL访问控制，关闭病毒端口
针对上述分析，在Flex5010上做常见病毒acl访问控制，关闭病毒端口。
启用acl
Harbour(config)#service acl enable
针对常见病毒端口，制定相应的规则，阻止其传播。
Harbour(config)#create acl acl1 tcp DIP any ip-port 113 SIP any ip-port any deny ports any
Harbour(config)#create acl acl2 udp DIP any ip-port 135 SIP any ip-port any deny ports any
Harbour(config)#create acl acl3 tcp DIP any ip-port 135 SIP any ip-port any deny ports any
Harbour(config)#create acl acl4 udp DIP any ip-port 137 SIP any ip-port any deny ports any
Harbour(config)#create acl acl5 udp DIP any ip-port 138 SIP any ip-port any deny ports any
Harbour(config)#create acl acl6 tcp DIP any ip-port 139 SIP any ip-port any deny ports any
Harbour(config)#create acl acl7 udp DIP any ip-port 139 SIP any ip-port any deny ports any
Harbour(config)#create acl acl8 udp DIP any ip-port 445 SIP any ip-port any deny ports any
Harbour(config)#create acl acl9 tcp DIP any ip-port 445 SIP any ip-port any deny ports any
Harbour(config)#create acl acl10 tcp DIP any ip-port 593 SIP any ip-port any deny ports any
Harbour(config)#create acl acl11 udp DIP any ip-port 593 SIP any ip-port any deny ports any
Harbour(config)#create acl acl12 tcp DIP any ip-port 1022 SIP any ip-port any deny ports any
Harbour(config)#create acl acl13 tcp DIP any ip-port 1023 SIP any ip-port any deny ports any
Harbour(config)#create acl acl14 tcp DIP any ip-port 1025 SIP any ip-port any deny ports any
Harbour(config)#create acl acl15 tcp DIP any ip-port 1029 SIP any ip-port any deny ports any
Harbour(config)#create acl acl16 tcp DIP any ip-port 1034 SIP any ip-port 80 deny ports any
Harbour(config)#create acl acl17 tcp DIP any ip-port 1068 SIP any ip-port any deny ports any
Harbour(config)#create acl acl18 udp DIP any ip-port 1434 SIP any ip-port any deny ports any
Harbour(config)#create acl acl19 tcp DIP any ip-port 1871 SIP any ip-port any deny ports any
Harbour(config)#create acl acl20 tcp DIP any ip-port 2745 SIP any ip-port any deny ports any
Harbour(config)#create acl acl21 tcp DIP any ip-port 3067 SIP any ip-port any deny ports any
Harbour(config)#create acl acl22 tcp DIP any ip-port 3127 SIP any ip-port any deny ports any
Harbour(config)#create acl acl23 tcp DIP any ip-port 3208 SIP any ip-port any deny ports any
Harbour(config)#create acl acl24 tcp DIP any ip-port 4331 SIP any ip-port any deny ports any
Harbour(config)#create acl acl25 tcp DIP any ip-port 4334 SIP any ip-port any deny ports any
Harbour(config)#create acl acl26 tcp DIP any ip-port 4444 SIP any ip-port any deny ports any
Harbour(config)#create acl acl27 tcp DIP any ip-port any SIP any ip-port 4444 deny ports any
Harbour(config)#create acl acl28 tcp DIP any ip-port 4510 SIP any ip-port any deny ports any
Harbour(config)#create acl acl29 tcp DIP any ip-port 4557 SIP any ip-port any deny ports any
Harbour(config)#create acl acl30 tcp DIP any ip-port 5554 SIP any ip-port any deny ports any
Harbour(config)#create acl acl31 tcp DIP any ip-port 5800 SIP any ip-port any deny ports any
Harbour(config)#create acl acl32 tcp DIP any ip-port 5900 SIP any ip-port any deny ports any
Harbour(config)#create acl acl33 tcp DIP any ip-port 6129 SIP any ip-port any deny ports any
Harbour(config)#create acl acl34 tcp DIP any ip-port 6667 SIP any ip-port any deny ports any
Harbour(config)#create acl acl35 tcp DIP any ip-port 9995 SIP any ip-port any deny ports any
Harbour(config)#create acl acl36 tcp DIP any ip-port 9996 SIP any ip-port any deny ports any
Harbour(config)#create acl acl37 tcp DIP any ip-port 10080 SIP any ip-port any deny ports any
Harbour(config)#create acl acl38 tcp DIP any ip-port 20168 SIP any ip-port any deny ports any
做上述操作之后，网络正常，flex5010再也不会时通时断了。在下班时刻（此时几乎没有什么用户在上网）查看设备端口：
Harbour(config)#sh po 9 st
---------------------------------------------------------------------------
Port:9 's Statistics Information
Tx good frames : 0 Tx total frames : 0
Tx multicast frames: 0 Tx broadcast frames: 0
Rx good frames : 328 Rx total frames : 328
Rx multicast frames: 61 Rx broadcast frames: 185
CRC error frames : 0 Oversize frames : 0
Fragments : 0 Jabber : 0
Dropped frames : 0 Undersize frames : 0
Collision : 0 Late collision : 0
Last 5 minutes ucast input rate 0 packets/sec
Last 5 minutes ucast output rate 0 packets/sec
Last 5 minutes mcast input rate 0 packets/sec
Last 5 minutes mcast output rate 0 packets/sec
Last 5 minutes bcast input rate 0 packets/sec
Last 5 minutes bcast output rate 0 packets/sec
Last 5 minutes input rate 15 bits/sec
Last 5 minutes output rate 0 bits/sec
Harbour(config)#
此时网络中仍有冲击波病毒：交换机端口9收到了328个数据包，因交换机启用了acl，对比后认为是病毒并丢弃，结果交换机全部丢弃，传输了0个数据包。第二天通知当地给电脑打好补丁并及时查杀病毒，网络恢复正常运行。
后记：网络故障诊断以网络原理、网络配置和网络运行的知识为基础。从故障现象出发，以网络诊断工具为手段获取诊断信息，确定网络故障点，查找问题的根源，排除故障，恢复网络正常运行。
解决网络病毒引起的网络突发故障，需要综合利用各种网管工具。营造一个安全顺畅的网络环境，需要用户端电脑及时打好操作系统补丁，更新杀毒软件病毒库；需要我们网管在交换机、路由器设备上及时做好针对各种病毒、木马的acl，过滤一些有害的端口，保障网络的稳定运行。
