ISCW10S06L02IOS防火墙配置.ppt

CiscoIOSThreatDefenseFeatures,ImplementingCiscoIOSFirewalls,ConfiguringCiscoIOSFirewallfromtheCLI,CiscoIOSFirewallConfigurationTasksUsingtheCLI,Pickaninterface:internalorexternal.ConfigureIPACLsattheinterface.Defineinspectionrules.ApplyinspectionrulesandACLstointerfaces.Testandverify.,SetAuditTrailsandAlerts,Router(config)#loggingonRouter(config)#logginghostRouter(config)#ipinspectaudit-trailRouter(config)#noipinspectalert-off,Enablesthedeliveryofaudittrailmessagesusingsyslog,ipinspectaudit-trail,Router(config)#,Enablesreal-timealerts,noipinspectalert-off,Router(config)#,DefineInspectionRulesforApplicationProtocols,ipinspectnameinspection-nameprotocolalerton|offaudit-trailon|offtimeoutseconds,Definestheapplicationprotocolstoinspect.Willbeappliedtoaninterface:Availableprotocolsaretcp,udp,icmp,smtp,esmtp,cuseeme,ftp,ftps,http,h323,netshow,rcmd,realaudio,rpc,rtsp,sip,skinny,sqlnet,tftp,vdolive,etc.Alert,audit-trail,andtimeoutareconfigurableperprotocol,andoverrideglobalsettings.,Router(config)#,Router(config)#ipinspectnameFWRULEsmtpalertonaudit-trailontimeout300Router(config)#ipinspectnameFWRULEftpalertonaudit-trailontimeout300,ApplyanInspectionRuletoanInterface,ipinspectinspection-namein|out,Appliesthenamedinspectionruletoaninterface,Router(config-if)#,Router(config)#interfacee0/0Router(config-if)#ipinspectFWRULEin,Appliestheinspectionruletointerfacee0/0ininwarddirection,GuidelinesforApplyingInspectionRulesandACLstoInterfaces,Ontheinterfacewheretrafficinitiates:ApplyACLontheinwarddirectionthatpermitsonlywantedtraffic.Applyruleontheinwarddirectionthatinspectswantedtraffic.Onallotherinterfaces,applyACLontheinwarddirectionthatdeniesallunwantedtraffic.,Example:Two-InterfaceFirewall,ipinspectnameOUTBOUNDtcpipinspectnameOUTBOUNDudpipinspectnameOUTBOUNDicmp!interfaceFastEthernet0/0ipaccess-groupOUTSIDEACLin!interfaceFastEthernet0/1ipinspectOUTBOUNDinipaccess-groupINSIDEACLin!ipaccess-listextendedOUTSIDEACLpermiticmpanyanypacket-too-bigdenyipanyanylog!ipaccess-listextendedINSIDEACLpermittcpanyanypermitudpanyanypermiticmpanyany,Example:Three-InterfaceFirewall,interfaceFastEthernet0/0ipinspectOUTSIDEinipaccess-groupOUTSIDEACLin!interfaceFastEthernet0/1ipinspectINSIDEinipaccess-groupINSIDEACLin!interfaceFastEthernet0/2ipaccess-groupDMZACLin!ipinspectnameINSIDEtcpipinspectnameOUTSIDEtcp!ipaccess-listextendedOUTSIDEACLpermittcpanyhosteq25permittcpanyhosteq80permiticmpanyanypacket-too-bigdenyipanyanylog!ipaccess-listextendedINSIDEACLpermittcpanyanyeq80permiticmpanyanypacket-too-bigdenyipanyanylog!ipaccess-listextendedDMZACLpermiticmpanyanypacket-too-bigdenyipanyanylog,VerifyingCiscoIOSFirewall,showipinspectnameinspection-nameshowipinspectconfigshowipinspectinterfacesshowipinspectsessiondetailshowipinspectstatisticsshowipinspectall,Displaysinspections,interfaceconfigurations,sessions,andstatistics,Router#showipinspectsessionEstablishedSessionsSession6155930C(:35009)=(0:34233)tcpSIS_OPENSession6156F0CC(:35011)=(0:34234)tcpSIS_OPENSession6156AF74(:35010)=(0:5002)tcpSIS_OPEN,Router#,TroubleshootingCiscoIOSFirewall,debugipinspectfunction-tracedebugipinspectobject-creationdebugipinspectobject-deletiondebugipinspecteventsdebugipinspecttimersdebugipinspectdetail,Generaldebugcommands,debugipinspectprotocol,Protocol-specificdebug,Router#,Router#,BasicandAdvancedFirewallWizards,BasicandAdvancedFirewallWizards,SDMoffersconfigurationwizardstosimplifyCiscoIOSFirewallconfiguration.Twoconfigurationwizardsexist:BasicFirewallConfigurationwizard:Supportstwointerfacetypes(InsideandOutside)AppliespredefinedrulesAdvancedFirewallConfigurationwizard:Supportsmoreinterfaces(Inside,Outside,andDMZ)Appliespredefinedorcustomrules,ConfiguringaBasicFirewall,ConfiguringaBasicFirewall,1.,2.,3.,4.,BasicFirewallInterfaceConfiguration,BasicFirewallConfigurationSummaryandDeployment,ReviewingtheBasicFirewallfortheOriginatingTraffic,ReviewingtheBasicFirewallfortheReturningTraffic,ResultingBasicFirewallInspectionRuleConfiguration,Router#showrunning-config|includeipinspectnameipinspectnameSDM_LOWcuseemeipinspectnameSDM_LOWdnsipinspectnameSDM_LOWftpipinspectnameSDM_LOWh323ipinspectnameSDM_LOWhttpsipinspectnameSDM_LOWicmpipinspectnameSDM_LOWimapipinspectnameSDM_LOWpop3ipinspectnameSDM_LOWnetshowipinspectnameSDM_LOWrcmdipinspectnameSDM_LOWrealaudioipinspectnameSDM_LOWrtspipinspectnameSDM_LOWesmtpipinspectnameSDM_LOWsqlnetipinspectnameSDM_LOWstreamworksipinspectnameSDM_LOWtftpipinspectnameSDM_LOWtcpipinspectnameSDM_LOWudpipinspectnameSDM_LOWvdolive,ResultingBasicFirewallACLConfiguration,Router#showrunning-config|includeaccess-listaccess-list100remarkautogeneratedbySDMfirewallconfigurationaccess-list100remarkSDM_ACLCategory=1access-list100denyipanyaccess-list100denyiphost55anyaccess-list100denyip55anyaccess-list100permitipanyanyaccess-list101remarkautogeneratedbySDMfirewallconfigurationaccess-list101remarkSDM_ACLCategory=1access-list101denyip55anyaccess-list101permiticmpanyhostecho-replyaccess-list101permiticmpanyhosttime-exceededaccess-list101permiticmpanyhostunreachableaccess-list101denyip55anyaccess-list101denyip55anyaccess-list101denyip55anyaccess-list101denyip55anyaccess-list101denyiphost55anyaccess-list101denyiphostanyaccess-list101denyipanyanylog,ResultingBasicFirewallInterfaceConfiguration,Router#showrunning-config|begininterfaceinterfaceFastEthernet0/0description$FW_INSIDE$ipaddressipaccess-group100in!interfaceSerial0/0/0description$FW_OUTSIDE$ipaddress52ipaccess-group101inipverifyunicastreverse-pathipinspectSDM_LOWout!,ConfiguringInterfacesonanAdvancedFirewall,ConfiguringInterfacesonanAdvancedFirewall,2.,3.,4.,1.,AdvancedFirewallInterfaceConfiguration,ConfiguringaDMZonanAdvancedFirewall,AdvancedFirewallDMZServiceConfiguration,AdvancedFirewallDMZServiceConfiguration:TCP,AdvancedFirewallDMZServiceConfiguration:UDP,AdvancedFirewallDMZServiceConfiguration(Cont.),AdvancedFirewallSecurityConfiguration,AdvancedFirewallSecurityPolicy,AdvancedFirewallProtocolsandApplications,AdvancedFirewallProtocolsandApplications(Cont.),AdvancedFirewallProtocolsandApplications(Cont.),AdvancedFirewallInspectionParameters,AdvancedFirewallSecurityPolicySelection,CompletetheConfiguration,AdvancedFirewallConfigurationSummaryandDeployment,ResultingAdvancedFirewallInspectionRuleConfiguration,Router#showrunning-config|includeipinspectnameipinspectnameappfw_100tcpaudit-trailonipinspectnameappfw_100udpipinspectnameappfw_100ftpipinspectnamedmzinspecttcpipinspectnamedmzinspectudp,ResultingAdvancedFirewallACLConfiguration,Router#showrunning-config|includeaccess-listaccess-list100remarkautogeneratedbySDMfirewallconfigurationaccess-list100remarkSDM_ACLCategory=1access-list100denyipanyaccess-list100denyip55anyaccess-list100denyiphost55anyaccess-list100denyip55anyaccess-list100permitipanyanyaccess-list101remarkautogeneratedbySDMfirewallconfigurationaccess-list101remarkSDM_ACLCategory=1access-list101denyipanyanylogaccess-list102remarkautogeneratedbySDMfirewallconfigurationaccess-list102remarkSDM_ACLCategory=1access-list102denyip55anyaccess-list102denyip55anyaccess-list102permiticmpanyhostecho-replyaccess-list102permiticmpanyhosttime-exceededaccess-list102permiticmpanyhostunreachableaccess-list102permittcpanyhosteqwwwaccess-list102permitudpanyhosteqisakmpaccess-list102denyip55anyaccess-list102denyip55anyaccess-list102denyip55anyaccess-list102denyip55anyaccess-list102denyiphost55anyaccess-list102denyiphostanyaccess-list102denyipanyanylog,ResultingAdvancedFirewallInterfaceConfiguration,Router#showrunning-config|begininterfaceinterfaceFastEthernet0/0description$FW_INSIDE$ipaddressipaccess