华为防火墙性能超限问题

1

查看业务板CPU使用率：

1. 执行命令display health，检查各业务板SPU-CPUX的CPU使用率，如果CPU使用率超过80%，需要确认是否有异常流量。

    HRP_M<sysname> display health
     Slot                CPU Usage  Memory Usage(Used/Total)
    ------------------------------------------------------------
     5 MPU(Master)          6%         52%    894MB/1712MB 
     1 SPU-CPU0             100%       35%   5517MB/15703MB
     1 SPU-CPU1             98%        34%   5471MB/15703MB
     1 SPU-CPU2             99%        27%   4277MB/15703MB
     1 SPU-CPU3             100%       27%   4282MB/15703MB
     1 SPU-CPU6             100%       16%     56MB/338MB  
     2 LPU                  20%        22%    468MB/2098MB 
    ------------------------------------------------------------
    SPU CPU Average Utilization: 1 %

2. 执行命令display firewall topn source-ip 或display firewall topn destination-ip，排查异常流量源头，并和客户确认是否属于正常业务流。

   举例：

   # 假设当前某个服务器1.1.1.1受到攻击，可以通过查看目的地址为1.1.1.1的源IP地址的排序结果确定攻击源。

   HRP_M[sysname] display firewall topn source
   -ip traffic all-systems destination ip
   -address 1.1.1.1
    Statistic result is being generated. Please wait patiently! 
    ------------------------------------------------------------------------------ 
    Top N traffic rate (last 10 seconds) 
    Ranking    IP address          Traffic rate(kb/s)    VSYS
    1          192.168.1.1         88000                 public 
    2          192.168.1.2         10380                 public 
    3          192.168.1.3         7750                  public
    4          192.168.1.4         6610                  public
    5          192.168.1.5         6010                  public
    6          192.168.1.6         4660                  public
    7          192.168.1.7         4310                  public 
    8          192.168.1.8         3790                  public
    9          192.168.1.9         3470                  public
    10         192.168.1.10        2600                  public
    ----------------------------------------------------------

   # 查看TopN会话源IP地址的排序结果，找到会话数最多的源IP并采取相应的防范措施。

   HRP_M[sysname] display firewall topn source-ip session-number
    Statistic result is being generated. Please wait patiently! 
   ------------------------------------------------------------------------------ 
    Top N Session number (source IP)
    Ranking    IP address          Session number    VSYS  
    1          192.168.1.1         8800             public 
    2          192.168.1.2         1038             public  
    3          192.168.1.3         775              public  
    4          192.168.1.4         661              public    
    5          192.168.1.5         601              public 
    6          192.168.1.6         466              public    
    7          192.168.1.7         431              public 
    8          192.168.1.8         379              public 
    9          192.168.1.9         347              public
    10         192.168.1.10        260              public 
    ------------------------------------------------------------------------------

   # 查看TopN会话目的IP地址的排序结果，找到会话数最多的目的IP并采取相应的防范措施。

   HRP_M[sysname] display firewall topn destination-ip session-number
    Statistic result is being generated. Please wait patiently! 
   ------------------------------------------------------------------------------ 
    Top N Session number (destination IP)    
    Ranking    IP address          Session number    VSYS  
    1          192.168.1.1         8800             public
    2          192.168.1.2         1038             public
    3          192.168.1.3         775              public
    4          192.168.1.4         661              public
    5          192.168.1.5         601              public
    6          192.168.1.6         466              public
    7          192.168.1.7         431              public
    8          192.168.1.8         379              public
    9          192.168.1.9         347              public
    10         192.168.1.10        260              public
    -----------------------------------------------------------

1. 排查到异常流量后，在防火墙通过安全策略、黑名单封堵，或者前端交换机封堵。

   举例：

   # 通过安全策略限制10.1.1.2的终端对服务器（10.2.0.10）8888端口发起的TCP连接

   HRP_M[sysname] ip address-set server_deny type object //配置终端IP
   HRP_M[sysname-object-address-set-server_deny] address 10.1.1.2 mask 32
   HRP_M[sysname-object-address-set-server_deny] quit
   HRP_M[sysname] ip service-set server1_port type object 
   HRP_M[sysname-object-service-set-server1_port] service protocol TCP source-port 0 to 65535 destination-port 8888 
   //配置服务器对应服务的端口
   HRP_M[sysname-object-service-set-server1_port] quit
   HRP_M[sysname] security-policy 
   HRP_M[sysname-policy-security] rule name policy_sec_deny1 
   HRP_M[sysname-policy-security-rule-policy_sec_deny1] source-zone trust //源安全域根据需要调整
   HRP_M[sysname-policy-security-rule-policy_sec_deny1] destination-zone dmz //目的安全域根据需要调整
   HRP_M[sysname-policy-security-rule-policy_sec_deny1] source-address address-set server_deny 
   HRP_M[sysname-policy-security-rule-policy_sec_deny1] destination-address 10.2.0.10 32 
   HRP_M[sysname-policy-security-rule-policy_sec_deny1] service server1_port 
   HRP_M[sysname-policy-security-rule-policy_sec_deny1] action deny 
   HRP_M[sysname-policy-security-rule-policy_sec_deny1] quit

   # 开启黑名单功能，把源IP地址1.1.1.1加入黑名单表项，该黑名单表项的超时时间指定为20分钟。

   <sysname> system-view 
   [sysname] firewall blacklist enable
   [sysname] firewall blacklist item source-ip 1.1.1.1 timeout 20

2. 如果确认为正常业务流量，需要进行紧急扩容，如果短时间无法完成扩容，需要割接部分流量到其他链路上运行。