JuniperFWtrainingNXPowerLite.pptx

Juniper 防火墙产品技术培训防火墙产品技术培训Juniper防火墙概述防火墙概述01 Juniper 防火墙基本概念防火墙基本概念4Copyright 2009 Juniper Networks,I 目标目标 防火墙部署的必要性 构成防火墙安全特性和功能的组建包括以下的内容：Virtual Systems(VSYS)ZonesPoliciesVirtual RoutersInterfaces 了解和分析数据包是如何通过防火墙的 如何正确部署防火墙设备，为企业的网络保驾护航。5Copyright 2009 Juniper Networks,I 安全设备的必备条件安全设备的必备条件 数据包的转发：Bridging(Layer 2)Routing(Layer 3)防火墙基于 IP,TCP/UDP,的内容过滤，以及针对应用层的内容过滤。NAT 网络地址翻译私网到公网的地址翻译 Virtual Private Networks（虚拟专用网络）封装、认证、加密主要通过IPSec来实现6Copyright 2009 Juniper Networks,I Layer 2 Frame Forwarding(Bridging/Switching)透明模式的功能Learning(based on Source MAC address)Forward/Flood/Filter(based on Destination MAC address)Loop prevention(Spanning Tree protocol)MAC Address Table00c0.01cd.5120 E1E8 00e0.01ab.cd10Destination AddressPort00c0.01cd.5120E100e0.01ab.cd10E87Copyright 2009 Juniper Networks,I Layer 3 Packet Forwarding(Routing)根据目的地址转发数据包 主要的路由协议Static routesDynamic routes(RIP,OSPF,BGP)Default routes10.1.1.110.3.3.10E8 10.2.2.1/24NetworkInt.Gateway10.1.1.0/24E10.0.0.010.2.2.0/24E80.0.0.010.3.3.0/24E810.2.2.2208 Route TableE1 10.1.1.1/2410.2.2.2/2410.3.3.1/248Copyright 2009 Juniper Networks,I Firewall 根据包头进行过滤 IP(SA,DA,Protocol)TCP/UDP(Port#)实现安全策略的方法：10.1.10.5SRC-IP1.1.70.250DST-IP36033SRC-Port80DST-Port6Protocol9Copyright 2009 Juniper Networks,I 网络网络/端口端口 地址翻译地址翻译 把私网地址转换为公网的地址NAT/PAT10.1.1.5Trust 10.1.1.1Untrust201.1.8.110.1.1.5SRC-IP221.1.8.5DST-IP36033SRC-Port80DST-Port6Protocol201.1.8.1SRC-IP221.1.8.5DST-IP1025SRC-Port80DST-Port6Protocol10Copyright 2009 Juniper Networks,I 虚拟专用网络（虚拟专用网络（VPN）在Internet 中传输的数据提供加密的隧道封装加密认证Trust 10.0.0.25410.1.20.310.1.20.4Untrust1.1.1.1Untrust 2.2.2.1Trust20.1.20.1IP PacketIP PacketEncrypted PacketEncrypted PacketIP PacketIP Packet10.0.0.5 10.0.0.611Copyright 2009 Juniper Networks,I 传统防火墙的特点传统防火墙的特点 外网Internet or another public networkNo control 内网Our private networkWe have controlUntrustZoneTrustZone10.0.0.5 10.0.0.612Copyright 2009 Juniper Networks,I Web ServerFTP ServerMail Server停火区（停火区（DMZ）能够为Internet 提供访问服务。DMZ区可能遭受到黑客的入侵提供WEB，邮件，FTP 等服务10.0.0.5 10.0.0.6UntrustZoneTrustZoneDMZZone13Copyright 2009 Juniper Networks,I UntrustZoneNext Step:No Trusted Networks 内部网络中的安全需求 企业网络面临的新的挑战部署 更加灵活可以对企业网络进行预测Web ServerFTP ServerMail ServerDMZZoneAdministrationZoneMarketing ZoneEngineering Zone14Copyright 2009 Juniper Networks,I Juniper 防火墙的安全特点防火墙的安全特点 Juniper的解决方案是针对新的安全挑战 提供更加灵活部署、可以预测的性能、更加安全的保证。构成:InterfacesZonesVirtual RoutersPolicyVirtual Systems15Copyright 2009 Juniper Networks,I NetScreen DeviceVSYSVirtual System安全体系的组成安全体系的组成Virtual Router 1Virtual Router 2Virtual RouterR.T.R.T.R.T.R.T.Forwarding TableZone AZone BZone CZone DZonesE1E2E3E4E5E6E7E8InterfacesFlow1.2.3.4SRC-IP5.6.7.8DST-IP1234SRC-Port80DST-Port6ProtocolSession5.6.7.8SRC-IP1.2.3.4DST-IP80SRC-Port1234DST-Port6ProtocolPolicy CheckPolicy CheckA-CA-CPolicy16Copyright 2009 Juniper Networks,I 安全的概念安全的概念功能功能 防火墙的主要作用是阻止企业不希望通过防火墙的流量从防火墙通过。防火墙有以下的分类：包过滤应用代理状态检测应用网关攻击防御17Copyright 2009 Juniper Networks,I 包过滤包过滤 对数据包头进行安全过滤Source/Destination IPProtocol NumberSource/Destination PortTCP Ack Flag 大多数的路由器可以实现这个功能 不能了解数据包通过防火墙时候的状态 容易造成地址欺骗的发生18Copyright 2009 Juniper Networks,I 应用代理应用代理 对特定的应用程序做代理服务器。防火墙充当代理服务器的作用实现对流量的访问控制HTTP and FTP are two commonly used proxies 防火墙可以直接检查应用层的数据，同时根据管理员的需要决定是否允许数据包通过。实现第七层（OSI模型）的内容过滤 性能比包过滤防火墙要差19Copyright 2009 Juniper Networks,I 状态检测状态检测 根据数据包的状态以及我们的访问控制规则决定是否允许数据包通过。通过多项指标保持IP数据包的连接状态（3-7）层新的连接被检查后添加到状态表中只有已经建立session 的数据包和被防火墙允许通过的数据包才能够通过防火墙系统。提供比包过滤防火墙更高级别的防火墙安全体系 比代理网关型防火墙速度更快，但是可能无法提供像代理网关那样细度的访问控制。20Copyright 2009 Juniper Networks,I 应用层网关应用层网关(ALGs)特殊协议的特点特殊的命令动态打开的端口例如：FTPH.323 ALGs 的开发使得防火墙能够满足更加复杂的应用环境，支持协议中的多端口，端口重定向支持每个会话中动态打开/关闭的端口21Copyright 2009 Juniper Networks,I 攻击防御攻击防御 拒绝服务攻击SCREEN functions 病毒Anti-Virus scanning 恶意数据攻击通过DI中的攻击签名进行防御22Copyright 2009 Juniper Networks,I Juniper FW Decision Process/Packet Flow24Copyright 2009 Juniper Networks,I ExternalZonePrivateZone1.1.70.2501.1.70.0/2410.1.10.510.1.20.0/24B10.1.10.0/24PublicZone10.1.20.5.254200.5.5.5ABCD10.1.1.0/2410.1.2.0/24.1.254.1.2541.1.7.0/241.1.8.0/24.254.1Packet Flow Example25Copyright 2009 Juniper Networks,I Packet Flow Example10.1.20.5SRC-IP200.5.5.5DST-IP1042SRC-Port80DST-Port6Protocol1.Existing Session?NoAddress PairProtocol Port Pair(no match)Session Table2.Destination Reachable?YesNetInt NHR10.1.1.0/24E1(connected)10.1.2.0/24E2(connected)10.1.10.0/24 E110.1.1.510.1.20.0/24 E210.1.2.50.0.0.0/0E81.1.8.254Routing Table3.Inter-Zone Traffic?YesIntZoneE1Inside-PrivateE2Inside-PrivateE7Inside-PublicE8OutsideZone Table26Copyright 2009 Juniper Networks,I Packet Flow Example(cont.)4.Permitted by Policy?YesFrom Private to ExternalSADAServiceAction10.1.0.0/16anyFTPpermit 10.1.0.0/16anyHTTPpermit10.1.0.0/16anypingpermitanyanyanydenyAction:Forward Packet10.1.20.5SRC-IP200.5.5.5DST-IP1042SRC-Port80DST-Port6ProtocolAction:Add to Session TableAddress PairProtocol Port Pair10.1.20.5 200.5.5.5 61042 80Session Table27Copyright 2009 Juniper Networks,I 部署部署Juniper防火墙设备防火墙设备 专业设计的安全网关设备单一防火墙系统应用:Small office/Home Office,small enterprise系统支持多个虚拟防火墙应用:large enterprise,service provider28Copyright 2009 Juniper Networks,I 设备的部署设备的部署 Engineering ZoneBBBAdmin ZoneMarketingZoneRemote Client29Copyright 2009 Juniper Networks,I 系统部署系统部署Service ProviderVSYS AVSYS BPhysicalNetworkLogicalNetwork30Copyright 2009 Juniper Networks,I 总结总结 在本章我们应该掌握:Juniper 安全网关的功能Juniper 安全设备的优势和特点Juniper防火墙设备对数据包进行处理的步骤Juniper防火墙产品的部署02对防火墙的管理对防火墙的管理32Copyright 2009 Juniper Networks,I 目标目标 介绍防火墙的管理 通过控制线和网络实现对防火墙的管理 配置管理员设置和选项 配置防火墙与第三方设备之间的管理通信 License 的管理 对防火墙的配置文件和软件升级的管理 灾难恢复的管理33Copyright 2009 Juniper Networks,I 系统组成系统组成 所有关键的系统功能都在内存中运行。可以通过控制线和webu对防火墙的配置进行修改。TablesBuffersRunningConfigScreenOS(active)ScreenOSImageSaved ConfigCerts,etc.RAMFlashInterf.Interf.Interf.TFTPPwrUp/ResetAux.StorageWebUIJuniperAux.Mgt.ServersDNS/SyslogConsole“Get”“Set”34Copyright 2009 Juniper Networks,I 建立控制台的连接建立控制台的连接 可以通过物理的控制线来连接防火墙设备。用控制线连接的好处直接连接到防火墙安全性好完成配置不需要网络连接不需要IP地址可以看到启动的信息可以看到时事的 debug or snoop 信息Juniper FWDeviceConsolePort35Copyright 2009 Juniper Networks,I 命令行界面命令行界面 使用终端登录防火墙，用默认的口令登录防火墙login:netscreen password:netscreen Command line interface(CLI)是默认的模式Use Up and Down Arrow keys to recall previous commands Use CTL-A to move to the beginning of a command lineUse CTL-E to move to the end of a command lineUse Left and Right Arrow keys to position cursor editing commandsUse TAB for command completionHelp facility availableUse?to display optionsUse at the prompt for commandsUse within a command for parameters36Copyright 2009 Juniper Networks,I 提供命令使用的帮助提供命令使用的帮助 CLIns208-?clear clear dynamic system infoexec exec system commandsexit exit command consoleget get system informationping ping other hostreset reset systemsave save commandset configure system parameterstrace-route trace routeunset unconfigure system parameters 输入问号可以提供时事的帮助信息:左列显示该命令的使用右列显示该命令的帮助信息。37Copyright 2009 Juniper Networks,I ns208-get systemProduct Name:NS208Serial Number:0043042002000034,Control Number:00000000Hardware Version:0110(0)-(11),FPGA checksum:00000000,VLAN1 IP(0.0.0.0)Software Version:5.0.0.0,Type:Firewall+VPNBase Mac:0010.db1d.1c30File Name:n200-LAS0z0ad,Checksum:00000000Date 04/15/2003 22:06:53,Daylight Saving Time enabledThe Network Time Protocol is DisabledUp 2 hours 31 minutes 14 seconds Since 15 Apr 2003 19:35:39Total Device Resets:0System in NAT/route mode.Use interface IP,Config Port:80User Name:netscreenInterface ethernet1:number 0,if_info 0,if_index 0,mode nat link up,phy-link up/full-duplex vsys Root,zone Trust,vr trust-vr dhcp disabled *ip 1.1.1.1/24 mac 0010.db1d.1c30 *manage ip 1.1.1.1,mac 0010.db1d.1c30-more-显示状态信息显示状态信息-CLI In the CLI,get commands provide valuable status about operational conditions:System serial numberSoftware versionOperating modeInterface statusInterface addressManagement addresses38Copyright 2009 Juniper Networks,I 图形化界面图形化界面-WebUI Juniper 防火墙可以通过图形化的界面进行管理。需要的条件(ie.one IP address)一台PC机与防火墙在同一个网段口令保护39Copyright 2009 Juniper Networks,I 初始化配置向导初始化配置向导 一台新设备可以通过初始化向导进行防火墙的配置，也可以跳过向导手工进行配置12340Copyright 2009 Juniper Networks,I 初始化配置向导初始化配置向导 初始化完毕系统会通过向用户提供配置信息41Copyright 2009 Juniper Networks,I WebUI 的主界面的主界面 Displays information similar to get system output42Copyright 2009 Juniper Networks,I WebUI 启动启动java 菜单菜单 Navigation in the category selection panel can be accomplished using Java link format43Copyright 2009 Juniper Networks,I 配置管理员访问配置管理员访问概述概述 配置IP地址以便进行通信Assign addressManagement servicesManage-IP addresses(optional)修改 root administrator 口令 建立系统管理员 system administrators 管理员选项TimeoutsManager-IP addresses44Copyright 2009 Juniper Networks,I 网卡配置步骤网卡配置步骤1.分配网卡到安全域2.定义L3 ip 地址45Copyright 2009 Juniper Networks,I Zone 和和 Interface 的分配的分配 A strict hierarchical linkage exists between zones and interfaces in a NetScreen deviceZones are assigned to a virtual routerInterfaces are assigned to a security zoneAn interface can only belong to one security zoneIndividual configuration parameters are assigned to interfacesIP addressesManagement servicesOthersInt.ZoneZoneVirtual RouterVRZoneInt.IP46Copyright 2009 Juniper Networks,I Zone 的类型的类型 安全zonePre-defined:Trust,Untrust,DMZ;V1-Trust,V1-Untrust,V1-DMZUser-defined Tunnel Zone 功能 ZonesNullMGTHASelfVLANns5gt-get zoneTotal 10 zones created in vsys Root-5 are policy configurable.Total policy configurable zones for Root is 5.-ID Name Type Attr VR Default-IF VSYS 0 Null Null Shared untrust-vr hidden Root 1 Untrust Sec(L3)Shared trust-vr untrust Root 2 Trust Sec(L3)trust-vr trust Root 4 Self Func trust-vr self Root 5 MGT Func trust-vr null Root 10 Global Sec(L3)trust-vr null Root 11 V1-Untrust Sec(L2)trust-vr v1-untrust Root 12 V1-Trust Sec(L2)trust-vr v1-trust Root 14 VLAN Func trust-vr vlan1 Root 16 Untrust-Tun Tun trust-vr hidden.1 Root-47Copyright 2009 Juniper Networks,I Configuring Zones/Interfaces-WebUINetwork Interfaces(edit)48Copyright 2009 Juniper Networks,I Configuring Zones/Interfaces-CLI 一个网卡必须属于一个 “security zone”然后才能分配IP地址。set interface zone set interface ip/ns208-set interface e1 zone trustns208-set interface e1 ip 1.1.1.1/2449Copyright 2009 Juniper Networks,I 管理服务管理服务 WebUI 在默认情况下与域的分配有关。Trust zone:all services enabledAny other zone:all services disabledNetworkInterfacesEdit50Copyright 2009 Juniper Networks,I Management Services CLIset interface manage ns208-set interface e1 manage pingns208-set interface e1 manage webEnable all services:ns208-set interface e1 manage 如果没有通过命令指定管理服务，那么所有的管理服务都被允许。51Copyright 2009 Juniper Networks,I Manage-IP Address Separate IP address specifically for managementset interface manage-ip set interface e1 manage-ip 1.1.1.250NetworkInterfacesEdit52Copyright 2009 Juniper Networks,I 验证网卡的配置验证网卡的配置-WebUINetworkInterfacesEdit53Copyright 2009 Juniper Networks,I 验证网卡的配置验证网卡的配置-CLIns208-get interface e1Interface ethernet1:number 0,if_info 0,if_index 0,mode nat link up,phy-link up/full-duplex vsys Root,zone Trust,vr trust-vr dhcp disabled ip 1.1.1.1/24 mac 0010.db1d.1c30 manage ip 1.1.1.3,mac 0010.db1d.1c30 ping enabled,telnet enabled,SSH enabled,SNMP enabled web enabled,ident-reset disabled,SSL enabled webauth disabled,webauth-ip 0.0.0.0 OSPF disabled BGP disabled RIP disabled DHCP-Relay disabled bandwidth:physical 100000kbps,configured 0kbps,current 0kbps total configured gbw 0kbps,total allocated gbw 0kbps54Copyright 2009 Juniper Networks,I 设备管理员设备管理员 Juniper 防火墙可以被不同级别的管理员进行管理Root admin defined by the ScreenOSLocal admin created by the Root accountClick to create new Local AdministratorClick to view settings for Root accountConfigurationAdminAdministrators55Copyright 2009 Juniper Networks,I 修改根管理员的用户名和口令修改根管理员的用户名和口令ConfigurationAdminAdministratorsset admin name set admin password 56Copyright 2009 Juniper Networks,I 建立系统管理员建立系统管理员ConfigurationAdminAdministratorsset admin user name password privilege all|read-only57Copyright 2009 Juniper Networks,I 验证管理员信息验证管理员信息 WebUIConfigurationAdminAdministrators58Copyright 2009 Juniper Networks,I 验证管理员验证管理员-CLIns208-get admin userName Privilege-netscreen RootIT-Admin-10 Read-WriteIT-Admin-20 Read-WriteAdmin-Mktg Read-Onlyns208-get admin ssh allAdmin Name SSH PWA enabled SSH PKA keys-netscreen yes 0IT-Admin-10 yes 0IT-Admin-20 yes 0Admin-Mktg no 059Copyright 2009 Juniper Networks,I Timeout-Console Management via the console port is protected by an idle timeoutDefault value is 10 minutesDisable by setting timeout to 0set console timeout ns208 set console timeout 560Copyright 2009 Juniper Networks,I Timeout-WebUIset admin auth timeout ConfigurationAdminManagement61Copyright 2009 Juniper Networks,I Manager-IP Addresses 出于安全的考虑，Juniper 防火墙可以指定一些 IP地址，这些IP 地址被认为是可以信任的管理IP 地址。通过 Permitted IP addresses 来定义可以信任的管理IP地址。允许管理的IP 地址可以包括掩码进行网段的定义。可以是主机，子网、网络组等。每个设备可以定义6个条目以前的版本 称 Restricted Management IP62Copyright 2009 Juniper Networks,I Configuring Manager-IPset admin manager-ip ns208-set admin manager-ip 1.1.7.250 255.255.255.255ns208-set admin manager-ip 1.1.1.0 255.255.255.0ConfigurationAdminPermitted IPs63Copyright 2009 Juniper Networks,I Verifying Manager-IP-CLIns208-get systemSerial Number:0043042002000034,Control Number:00000000Hardware Version:0110(0)-(11),FPGA checksum:00000000,VLAN1 IP(0.0.0.0)Software Version:5.0.0ad.0,Type:Firewall+VPNBase Mac:0010.db1d.1c30File Name:n200-LAS0z0ad,Checksum:00000000Date 04/15/2003 22:39:46,Daylight Saving Time enabledThe Network Time Protocol is DisabledUp 3 hours 4 minutes 7 seconds Since 15 Apr 2003 19:35:39Total Device Resets:0System in NAT/route mode.Use interface IP,Config Port:80Mng Host IP:1.1.7.250/255.255.255.255Mng Host IP:1.1.1.0/255.255.255.0User Name:netscreenInterface ethernet1:number 0,if_info 0,if_index 0,mode nat link up,phy-link up/full-duplex vsys Root,zone Trust,vr trust-vr-more-64Copyright 2009 Juniper Networks,I 管理的运作步骤：管理的运作步骤：Management requests terminate on the unit As a security device,the NetScreen must qualify all management requestsMatch the management address of the arriving interfaceMatch the IP address of a trusted sourceMatch an allowed service typeMatch username/password Src Dst Mgt.RequestAddr Addr (ie.Ping)ManagementServiceFilterInterfacemanage-ipMgt.AddressAllowed servicesAuthenticationUsername/passwordmanager-ipTrusted Source65Copyright 2009 Juniper Networks,I 外部管理设备外部管理设备 Juniper 防火墙也可以通过一些标准的网络设备进行管理。例如：DNSSyslogSNMP66Copyright 2009 Juniper Networks,I DNS ConfigurationNetworkDNSset dns host dns1 set dns host dns2 set dns host schedule 67Copyright 2009 Juniper Networks,I Syslog ConfigurationConfigurationReport SettingsSyslogset syslog config facility set syslog config log all|traffic|eventset syslog src-interface set syslog enable68Copyright 2009 Juniper Networks,I SNMP Configuration-WebUIConfigurationReport SettingsSNMP69Copyright 2009 Juniper Networks,I SNMP Configuration WebUI(cont.)ConfigurationReport SettingsSNMPCommunity70Copyright 2009 Juniper Networks,I SNMP Configuration-CLIset snmp contact set snmp location set snmp port listen|trap set snmp community trap-on|trap-offset snmp community version v1|v2cset snmp host src-interface set snmp host trap 71Copyright 2009 Juniper N