防火墻安全策略概述課件

防火墻安全策略防火墻安全策略1目標(biāo)掌握防火墻的策略配置方法、步驟，包括：記錄日志流量統(tǒng)計(jì)策略生效的時(shí)間用戶認(rèn)證掌握策略的驗(yàn)證方法2目標(biāo)掌握防火墻的策略配置方法、步驟，包括：2PolicyOptions–MainScreenAttackPreventionVPNsOptions3PolicyOptions–MainScreenAtAdvancedPolicyOptionsPolicy>Advanced4AdvancedPolicyOptionsPolicy>AdvancedPolicyOptions(cont.)Policy>Advanced5AdvancedPolicyOptions(cont.TrafficLogs記錄了會(huì)話結(jié)束時(shí)間,會(huì)話持續(xù)時(shí)間,地址和地址翻譯以及所使用的服務(wù)。Reports>Policies>TrafficLog6TrafficLogs記錄了會(huì)話結(jié)束時(shí)間,會(huì)話持續(xù)時(shí)間,ConfiguringTrafficLogssetpolicy(fromzonetozonesadaserviceaction)logOR–setpolicylogns5gt->setpolicyid1ns5gt(policy:1)->setpolicylogPolicy7ConfiguringTrafficLogssetpoVerifying/AccessingLogginggetlogtrafficPoliciesReports>Policies8Verifying/AccessingLoggingget流量統(tǒng)計(jì)圖形化的方式察看匹配策略的流量情況。WebUIonlyReports>Policies>TrafficCountingGraph9流量統(tǒng)計(jì)圖形化的方式察看匹配策略的流量情況。ReportsConfiguringTrafficCounterssetpolicy(fromzonetozonesadaserviceaction)count-OR-setpolicycountsetpolicycountalarm<bytes/sec><kbytes/min>ns5gt->setpolicyid1ns5gt(policy:1)->setpolicycountPolicy>Advanced10ConfiguringTrafficCountersseVerifying/AccessingTrafficCountersPoliciesReports>Policiesgetcounterspolicy<id><timeparameters>11Verifying/AccessingTrafficCoPolicyScheduling定義策略基于時(shí)間的允許和禁止兩個(gè)選項(xiàng)重復(fù)時(shí)間TwowindowsperdayWeeklyscheduleOnceonly為了時(shí)間的準(zhǔn)確性，請(qǐng)配置時(shí)間服務(wù)器。12PolicyScheduling定義策略基于時(shí)間的允許和禁ConfiguringPolicySchedulingCreatescheduleApplyscheduletopolicy13ConfiguringPolicySchedulingCCreateSchedule-WebUIObjects>Schedules>New

14CreateSchedule-WebUIObjectCreateSchedule–CLIsetscheduler<name>recurrent<day>start<time>stop<time>[start<time>stop<time>]ns208->setschedulerNoICQrecurrentmonstart7:00stop12:00start13:00stop18:00ns208->setschedulerNoICQrecurrenttuesstart7:00stop12:0013:00stop18:00(etc.)setscheduler<name>oncestart<mm/dd/yyyy>stop<mm/dd/yyyy>ns208->setschedulerY2Koncestart01/01/2000stop01/02/200015CreateSchedule–CLIsetschedApplyScheduletoPolicysetpolicy(fromzonetozonesadaserviceaction)schedule<name>Policy>Advanced16ApplyScheduletoPolicysetpoVerifyingScheduling如果策略是灰色的背景，那么該策略已經(jīng)啟動(dòng)了scheduling請(qǐng)確認(rèn)何時(shí)禁止何時(shí)允許。17VerifyingScheduling如果策略是灰色的背景用戶認(rèn)證當(dāng)數(shù)據(jù)流量通過(guò)防火墻的時(shí)候，需要輸入用戶名和口令?？梢耘cNSRemoteClient結(jié)合使用當(dāng)防火墻需要附加的對(duì)用戶身份驗(yàn)證的時(shí)候可以使用這條規(guī)則。兩種工作方式當(dāng)數(shù)據(jù)包通過(guò)防火墻的時(shí)候，防火墻自動(dòng)提示用戶輸入用戶名和口令。策略中的應(yīng)用必須是Telnet,FTP,orHTTP可以使用WebAuth在防火墻上首先進(jìn)行認(rèn)證，認(rèn)證通過(guò)，流量可以通過(guò)防火墻一旦認(rèn)證通過(guò)，所有匹配策略的應(yīng)用將被運(yùn)行通過(guò)防火墻。18用戶認(rèn)證當(dāng)數(shù)據(jù)流量通過(guò)防火墻的時(shí)候，需要輸入用戶名和口令。1防火墻認(rèn)證WebServer9DA:9,serviceHTTPAuthPolicyUsername?Password?DA:9,serviceHTTPUsernamePasswordAuthenticated!Alltrafficpermittedbypolicy19防火墻認(rèn)證WebServerDA:9WebAuth認(rèn)證DA:2,serviceHTTPWebAuthUsername?Password?UsernamePasswordAuthenticated!AlltrafficpermittedbypolicyWebServer9WebAuthaddress220WebAuth認(rèn)證DA:2,serviWebAuthexample防火墻認(rèn)證的方式取決于用戶所使用的認(rèn)證服務(wù)的形式。HTTPdisplayssimilardialogueFTP/Telnetdisplaytext-basedprompts認(rèn)證的界面21WebAuthexample認(rèn)證的界面21認(rèn)證配置的步驟建立用戶配置認(rèn)證策略(WebAuthonly)配置WebAuth地址22認(rèn)證配置的步驟建立用戶22Step1:建立用戶Objects>Users>Local>Editsetuser<name>password<password>23Step1:建立用戶Objects>Users>Step2:配置認(rèn)證策略setpolicy(fromzonetozonesadaserviceaction)authsetpolicy(fromzonetozonesadaserviceaction)webauthPolicy>Advanced24Step2:配置認(rèn)證策略setpolicy(fromStep3:配置WebAuth地址Network>Interface>Editsetinterface<name>webauthsetinterface<name>webauth-ip<ip>25Step3:配置WebAuth地址Network>驗(yàn)證認(rèn)證ns5gt->getuserallTotalusers:1IdUsernameEnableTypeID-typeIdentityBelongstogroups-------------------------------------------------------------------1JoeUserYesauthns5gt->getauthtableTotalusersintable:1Successful:1,Failed:0Pending:0,Others:0ColT:Used:D=Defaultsettings,W=WebAuth,A=AuthserverinpolicyidsrcusergroupagestatusserverTsrczonedstzone13JoeUser5SuccessLocalWN/AN/A26驗(yàn)證認(rèn)證ns5gt->getuserall26總結(jié)在本章中我們需要掌握以下的內(nèi)容:配置和驗(yàn)證策略TrafficloggingTrafficcountersSchedulingUserAuthentication27總結(jié)在本章中我們需要掌握以下的內(nèi)容:27Lab–策略的配置步驟目標(biāo)Addlogging,counting,andscheduletoyourpolicies28Lab–策略的配置步驟目標(biāo)28防火墻安全策略防火墻安全策略29目標(biāo)掌握防火墻的策略配置方法、步驟，包括：記錄日志流量統(tǒng)計(jì)策略生效的時(shí)間用戶認(rèn)證掌握策略的驗(yàn)證方法30目標(biāo)掌握防火墻的策略配置方法、步驟，包括：2PolicyOptions–MainScreenAttackPreventionVPNsOptions31PolicyOptions–MainScreenAtAdvancedPolicyOptionsPolicy>Advanced32AdvancedPolicyOptionsPolicy>AdvancedPolicyOptions(cont.)Policy>Advanced33AdvancedPolicyOptions(cont.TrafficLogs記錄了會(huì)話結(jié)束時(shí)間,會(huì)話持續(xù)時(shí)間,地址和地址翻譯以及所使用的服務(wù)。Reports>Policies>TrafficLog34TrafficLogs記錄了會(huì)話結(jié)束時(shí)間,會(huì)話持續(xù)時(shí)間,ConfiguringTrafficLogssetpolicy(fromzonetozonesadaserviceaction)logOR–setpolicylogns5gt->setpolicyid1ns5gt(policy:1)->setpolicylogPolicy35ConfiguringTrafficLogssetpoVerifying/AccessingLogginggetlogtrafficPoliciesReports>Policies36Verifying/AccessingLoggingget流量統(tǒng)計(jì)圖形化的方式察看匹配策略的流量情況。WebUIonlyReports>Policies>TrafficCountingGraph37流量統(tǒng)計(jì)圖形化的方式察看匹配策略的流量情況。ReportsConfiguringTrafficCounterssetpolicy(fromzonetozonesadaserviceaction)count-OR-setpolicycountsetpolicycountalarm<bytes/sec><kbytes/min>ns5gt->setpolicyid1ns5gt(policy:1)->setpolicycountPolicy>Advanced38ConfiguringTrafficCountersseVerifying/AccessingTrafficCountersPoliciesReports>Policiesgetcounterspolicy<id><timeparameters>39Verifying/AccessingTrafficCoPolicyScheduling定義策略基于時(shí)間的允許和禁止兩個(gè)選項(xiàng)重復(fù)時(shí)間TwowindowsperdayWeeklyscheduleOnceonly為了時(shí)間的準(zhǔn)確性，請(qǐng)配置時(shí)間服務(wù)器。40PolicyScheduling定義策略基于時(shí)間的允許和禁ConfiguringPolicySchedulingCreatescheduleApplyscheduletopolicy41ConfiguringPolicySchedulingCCreateSchedule-WebUIObjects>Schedules>New

42CreateSchedule-WebUIObjectCreateSchedule–CLIsetscheduler<name>recurrent<day>start<time>stop<time>[start<time>stop<time>]ns208->setschedulerNoICQrecurrentmonstart7:00stop12:00start13:00stop18:00ns208->setschedulerNoICQrecurrenttuesstart7:00stop12:0013:00stop18:00(etc.)setscheduler<name>oncestart<mm/dd/yyyy>stop<mm/dd/yyyy>ns208->setschedulerY2Koncestart01/01/2000stop01/02/200043CreateSchedule–CLIsetschedApplyScheduletoPolicysetpolicy(fromzonetozonesadaserviceaction)schedule<name>Policy>Advanced44ApplyScheduletoPolicysetpoVerifyingScheduling如果策略是灰色的背景，那么該策略已經(jīng)啟動(dòng)了scheduling請(qǐng)確認(rèn)何時(shí)禁止何時(shí)允許。45VerifyingScheduling如果策略是灰色的背景用戶認(rèn)證當(dāng)數(shù)據(jù)流量通過(guò)防火墻的時(shí)候，需要輸入用戶名和口令。可以與NSRemoteClient結(jié)合使用當(dāng)防火墻需要附加的對(duì)用戶身份驗(yàn)證的時(shí)候可以使用這條規(guī)則。兩種工作方式當(dāng)數(shù)據(jù)包通過(guò)防火墻的時(shí)候，防火墻自動(dòng)提示用戶輸入用戶名和口令。策略中的應(yīng)用必須是Telnet,FTP,orHTTP可以使用WebAuth在防火墻上首先進(jìn)行認(rèn)證，認(rèn)證通過(guò)，流量可以通過(guò)防火墻一旦認(rèn)證通過(guò)，所有匹配策略的應(yīng)用將被運(yùn)行通過(guò)防火墻。46用戶認(rèn)證當(dāng)數(shù)據(jù)流量通過(guò)防火墻的時(shí)候，需要輸入用戶名和口令。1防火墻認(rèn)證WebServer9DA:9,serviceHTTPAuthPolicyUsername?Password?DA:9,serviceHTTPUsernamePasswordAuthenticated!Alltrafficpermittedbypolicy47防火墻認(rèn)證WebServerDA:9WebAuth認(rèn)證DA:2,serviceHTTPWebAuthUsername?Password?UsernamePasswordAuthenticated!AlltrafficpermittedbypolicyWebServer9WebAuthaddress248WebAuth認(rèn)證DA:2,serviWebAuthexample防火墻認(rèn)證的方式取決于用戶所使用的認(rèn)證服務(wù)的形式。HTTPdisplayssimilardialogueFTP/Telnetdisplaytext-basedprompts認(rèn)證的界面49WebAuthexample認(rèn)證的界面21認(rèn)證配置的步驟建立用戶配置認(rèn)證策略(WebAuthonly)配置WebAuth地址50認(rèn)證配置的步驟建立用戶22Step1:建立用戶Objects>Users>Local>Editsetuser<name>password<password>51Step1:建立用戶Objects>Users>Step2:配置認(rèn)證策略setpolicy(fromzonetozonesadaserviceaction)authsetpolicy(fromzonetozonesadaserviceaction)webauthPolicy>Advanced52Step2:配置認(rèn)證策略setpolicy(fromStep3:配置WebAuth地址Network>Interface>Editsetinterface<name>web