Juniper策略配置的方法

防火墻平安戰(zhàn)略1目的掌握防火墻的戰(zhàn)略配置方法、步驟，包括：記錄日志流量統(tǒng)計戰(zhàn)略生效的時間用戶認證掌握戰(zhàn)略的驗證方法2PolicyOptions–MainScreenAttackPreventionVPNsOptions3AdvancedPolicyOptionsPolicy>Advanced4AdvancedPolicyOptions(cont.)Policy>Advanced5TrafficLogs記錄了會話終了時間,會話繼續(xù)時間,地址和地址翻譯以及所運用的效力。Reports>Policies>TrafficLog6ConfiguringTrafficLogssetpolicy(fromzonetozonesadaserviceaction)logOR–setpolicylogns5gt->setpolicyid1ns5gt(policy:1)->setpolicylogPolicy7Verifying/AccessingLogginggetlogtrafficPoliciesReports>Policies8流量統(tǒng)計圖形化的方式察看匹配戰(zhàn)略的流量情況。WebUIonlyReports>Policies>TrafficCountingGraph9ConfiguringTrafficCounterssetpolicy(fromzonetozonesadaserviceaction)count-OR-setpolicycountsetpolicycountalarm<bytes/sec><kbytes/min>ns5gt->setpolicyid1ns5gt(policy:1)->setpolicycountPolicy>Advanced10Verifying/AccessingTrafficCountersPoliciesReports>Policiesgetcounterspolicy<id><timeparameters>11PolicyScheduling定義戰(zhàn)略基于時間的允許和制止兩個選項反復時間TwowindowsperdayWeeklyscheduleOnceonly為了時間的準確性，請配置時間效力器。12ConfiguringPolicySchedulingCreatescheduleApplyscheduletopolicy13CreateSchedule-WebUIObjects>Schedules>New14CreateSchedule–CLIsetscheduler<name>recurrent<day>start<time>stop<time>[start<time>stop<time>]ns208->setschedulerNoICQrecurrentmonstart7:00stop12:00start13:00stop18:00ns208->setschedulerNoICQrecurrenttuesstart7:00stop12:0013:00stop18:00(etc.)setscheduler<name>oncestart<mm/dd/yyyy>stop<mm/dd/yyyy>ns208->setschedulerY2Koncestart01/01/2000stop01/02/200015ApplyScheduletoPolicysetpolicy(fromzonetozonesadaserviceaction)schedule<name>Policy>Advanced16VerifyingScheduling假設戰(zhàn)略是灰色的背景，那么該戰(zhàn)略曾經(jīng)啟動了scheduling請確認何時制止何時允許。17用戶認證當數(shù)據(jù)流量經(jīng)過防火墻的時候，需求輸入用戶名和口令?？梢耘cNSRemoteClient結(jié)合運用當防火墻需求附加的對用戶身份驗證的時候可以運用這條規(guī)那么。兩種任務方式當數(shù)據(jù)包經(jīng)過防火墻的時候，防火墻自動提示用戶輸入用戶名和口令。戰(zhàn)略中的運用必需是Telnet,FTP,or可以運用WebAuth在防火墻上首先進展認證，認證經(jīng)過，流量可以經(jīng)過防火墻一旦認證經(jīng)過，一切匹配戰(zhàn)略的運用將被運轉(zhuǎn)經(jīng)過防火墻。18防火墻認證WebServer9DA:9,serviceAuthPolicyUsername?Password?DA:9,serviceUsernamePasswordAuthenticated!Alltrafficpermittedbypolicy19WebAuth認證DA:2,serviceWebAuthUsername?Password?UsernamePasswordAuthenticated!AlltrafficpermittedbypolicyWebServer9WebAuthaddress220WebAuthexample防火墻認證的方式取決于用戶所運用的認證效力的方式。displayssimilardialogueFTP/Telnetdisplaytext-basedprompts認證的界面21認證配置的步驟建立用戶配置認證戰(zhàn)略(WebAuthonly)配置WebAuth地址22Step1:建立用戶Objects>Users>Local>Editsetuser<name>password<password>23Step2:配置認證戰(zhàn)略setpolicy(fromzonetozonesadaserviceaction)authsetpolicy(fromzonetozonesadaserviceaction)webauthPolicy>Advanced24Step3:配置WebAuth地址Network>Interface>Editsetinterface<name>webauthsetinterface<name>webauth-ip<ip>25驗證認證ns5gt->getuserallTotalusers:1IdUsernameEnableTypeID-typeIdentityBelongstogroups-------------------------------------------------------------------1JoeUserYesauthns5gt->getauthtableTotalusersintable:1Successful:1,Failed:0Pending:0,Others:0ColT:Used:D=Defaultsettings,W=WebAuth,A=AuthserverinpolicyidsrcusergroupagestatusserverTsrczonedstzone13JoeUser5SuccessLocalWN/A