IP blacklist configuration example

As shown in Figure 189, configure the IP blacklist feature on the router to block packets from the attacker Host D permanently and from Host C for 50 minutes.

# Configure IP addresses for the interfaces on the router. (Details not shown.)

# Enable the global blacklist feature.

<Router> system-view
[Router] blacklist global enable

# Add an IPv4 blacklist entry for Host D.

[Router] blacklist ip 5.5.5.5

# Add an IPv4 blacklist entry for Host C and set the blacklist entry aging time to 50 minutes.

[Router] blacklist ip 192.168.1.4 timeout 50

# Verify that the IPv4 blacklist entries are successfully added.

<Router> display blacklist ip
IP address      VPN instance   DS-Lite tunnel peer  Type    TTL(sec) Dropped
5.5.5.5         --             --                   Manual  Never    0
192.168.1.4     --             --                   Manual  2989     0

# Verify that the router drops packets from Host D. (Details not shown.)

# Execute the undo blacklist ip 5.5.5.5 command and verify that the router forwards packets from Host D. (Details not shown.)

# Verify that the router drops packets from Host C for 50 minutes and forwards packets from Host C after 50 minutes. (Details not shown.)