ISCW10S06L01IOS防火墙基础.ppt

CiscoIOSThreatDefenseFeatures,IntroducingtheCiscoIOSFirewall,LayeredDefenseStrategy,DMZ,ADMZisestablishedbetweensecurityzonesDMZsarebuffernetworkswhichareneitherinsidenoroutside.,LayeredDefenseFeatures,Accesscontrolisenforcedontrafficenteringandexitingthebuffernetworktoallsecurityzonesby:ClassicroutersDedicatedfirewallsDMZsareusedtohostservices:Exposedpublicservicesareservedondedicatedhostsinsidethebuffernetwork.TheDMZmayhostanapplicationgatewayforoutboundconnectivity.ADMZcontainsanattackerinthecaseofabreak-in.ADMZisthemostusefulandcommonmodernarchitecture.,MultipleDMZs,MultipleDMZsprovidebetterseparationandaccesscontrol:EachservicecanbehostedinitsownDMZ.Damageislimitedandattackerscontainedifaserviceiscompromised.,ModernDMZDesign,Varioussystems(statefulpacketfilter,proxyserver)canfiltertraffic.Properconfigurationofthefilteringdeviceiscritical.,FirewallTechnologies,FirewallTechnologies,Firewallsusethreetechnologies:PacketfilteringApplicationlayergatewayStatefulpacketfiltering,PacketFiltering,Packetfilteringlimitstrafficintoanetworkbasedonthedestinationandsourceaddresses,ports,andotherflagscompiledinanACL.,PacketFilteringExample,Router(config)#access-list100permittcpany55establishedRouter(config)#access-list100denyipanyanylogRouter(config)#interfaceSerial0/0Router(config-if)#ipaccess-group100inRouter(config-if)#end,ApplicationLayerGateway,TheALGinterceptsandestablishesconnectionstotheInternethostsonbehalfoftheclient.,ALGFirewallDevice,StatefulPacketFiltering,StatelessACLsfiltertrafficbasedonsourceanddestinationIPaddresses,TCPandUDPportnumbers,TCPflags,ICMPtypesandcodes.Statefulinspectionthenrememberscertaindetails,orthestateofthatrequest.,StatefulFirewallOperation,StatefulFirewalls,Alsocalled“Statefulpacketfilters”and“Application-awarepacketfilters.”Statefulfirewallshavetwomainimprovementsoverpacketfilters:Theymaintainasessiontable(statetable),wheretheytrackallconnections.Theyrecognizedynamicapplicationsandknowwhichadditionalconnectionswillbeinitiatedbetweentheendpoints.Statefulfirewallsinspecteverypacket,compareitagainstthestatetable,andmayexaminethepacketforanyspecialprotocolnegotiations.Statefulfirewallsoperatemainlyattheconnection(TCPandUDP)layer.,StatefulFirewallHandlingofDifferentProtocols,IntroducingtheCiscoIOSFirewallFeatureSet,TheCiscoIOSFirewallFeatureSet,TheCiscoIOSFirewallFeatureSetcontainsthreemainfeatures:CiscoIOSFirewallAuthenticationproxyIPS,CiscoIOSFirewall,PacketsareinspectedenteringtheCiscoIOSfirewalliftheyarenotspecificallydeniedbyanACL.CiscoIOSFirewallpermitsordeniesspecifiedTCPandUDPtrafficthroughafirewall.Astatetableismaintainedwithsessioninformation.ACLsaredynamicallycreatedordeleted.CiscoIOSFirewallprotectsagainstDoSattacks.,CiscoIOSAuthenticationProxy,HTTP,HTTPS,FTP,andTelnetauthenticationProvidesdynamic,per-userauthenticationandauthorizationviaTACACS+andRADIUSprotocols,CiscoIOSIPS,ActsasaninlineintrusionpreventionsensortrafficgoesthroughthesensorWhenanattackisdetected,thesensorcanperformanyoftheseactions:Alarm:SendanalarmtoSDMorsyslogserver.Drop:Dropthepacket.Reset:SendTCPresetstoterminatethesession.Block:BlockanattackerIPaddressorsessionforaspecifiedtime.Identifies700+commonattacks,CiscoIOSFirewallFunctions,CiscoIOSACLsRevisited,ACLsprovidetrafficfilteringbythesecriteria:SourceanddestinationIPaddressesSourceanddestinationportsACLscanbeusedtoimplementafilteringfirewallleadingtothesesecurityshortcomings:Portsopenedpermanentlytoallowtraffic,creatingasecurityvulnerabilityDonotworkwithapplicationsthatnegotiateportsdynamicallyCiscoIOSFirewalladdressestheseshortcomingsofACLs.,CiscoIOSFirewallTCPHandling,CiscoIOSFirewallUDPHandling,CiscoIOSFirewallProcess,HowCiscoIOSFirewallWorks,SupportedProtocols,TCP(singlechannel)UDP(singlechannel)RPCFTP/FTPSTFTPTelnet/SSHUNIXR-commands(suchasrlogin,rexec,andrsh)SMTPHTTP/HTTPSICMPSNMPKazaa,SQL*NetRTSP(suchasRealNetworks)Tacacs+/RadiusSignallingH.323SkinnySIPOthermultimedia:MicrosoftNetShowStreamWorksVDOLiveBGPAndmanyothers,AlertsandAuditTrails,CiscoIOSFirewallgeneratesreal-timealertsandaudittrails.Audittrailfeaturesusesyslogtotrackallnetworktransactions.WithCiscoIOSFirewallinspectionrules,youcanconfigurealertsandaudittrailinformationonaper-applicationprotocolbasis.,Summary,Layereddefensestrategyenhancessecuritybyprovidingbuffernetworkswithfilteringcapabilities.Therearethreemainfirewalltechnologies:packetfiltering,applicationproxy,andstatefulpacketfiltering.TheCiscoIOSFeatureSetcontainsthreemainfeatures:CiscoIOSFirewall,authenticationproxy,andIPS.CiscoIOSFirewallintelligentlyfiltersTCP