service-security global-binding

Function

The service-security global-binding command applies an MPAC policy globally on a device.

The undo service-security global-binding command cancels the configuration.

By default, an MPAC policy is not applied globally on a device.

Format

service-security global-binding { ipv4 | ipv6 } security-policy-name

undo service-security global-binding { ipv4 | ipv6 }

Parameters

Parameter	Description	Value
ipv4	Specifies IPv4 MPAC policies.	-
ipv6	Specifies IPv6 MPAC policies.	-
security-policy-name	Specifies the name of an MPAC policy.	The value is a string of 1 to 31 case-sensitive characters without spaces and must start with a letter.

Parameter

Description

Value

ipv4

Specifies IPv4 MPAC policies.

ipv6

Specifies IPv6 MPAC policies.

security-policy-name

Specifies the name of an MPAC policy.

The value is a string of 1 to 31 case-sensitive characters without spaces and must start with a letter.

Views

System view

Default Level

2: Configuration level

Task Name and Operations

Task Name	Operations
hostdefend	write

Usage Guidelines

Usage Scenario

To prevent unauthorized users from attacking or controlling network devices, configure the management-plane access control function so that a policy can be used to send specified protocol packets to or prevent specified protocol packets from being sent to the CPU, improving device security and reliability and ensuring normal network running.

You can run the service-security global-binding command to apply an MPAC policy globally on a device.

Prerequisites

An MPAC policy has been created using the service-security policy command.

Example

# Create an IPv6 MPAC policy and apply the policy globally to a device.

<HUAWEI> system-view
[~HUAWEI] service-security policy ipv6 huawei1
[*HUAWEI-service6-sec-huawei1] rule 10 deny protocol tcp
[*HUAWEI-service6-sec-huawei1] quit
[*HUAWEI] service-security global-binding ipv6 huawei1

# Create an IPv4 MPAC policy and apply the policy globally to a device.

<HUAWEI> system-view
[~HUAWEI] service-security policy ipv4 huawei
[*HUAWEI-service-sec-huawei] rule 5 permit protocol tcp source-port 1000 source-ip 127.1.1.1 0
[*HUAWEI-service-sec-huawei] quit
[*HUAWEI] service-security global-binding ipv4 huawei