Introducing-the-Cisco-IOS-FirewallPPT课件

CiscoIOSThreatDefenseFeatures,IntroducingtheCiscoIOSFirewall,LayeredDefenseStrategy,DMZ,ADMZisestablishedbetweensecurityzonesDMZsarebuffernetworkswhichareneitherinsidenoroutside.DMZ建立于安全区域之间-DMZ是一个缓冲的网络其不属于内部网络也不属于外部网络.,LayeredDefenseFeatures,Accesscontrolisenforcedontrafficenteringandexitingthebuffernetworktoallsecurityzonesby:访问控制强制的应用在流量进入和离开缓冲网络到达所有安全区域:Classicrouters第一线路由器(即边界路由器)Dedicatedfirewalls专用的防火墙DMZsareusedtohostservices:DMZs用于主机服务:Exposedpublicservicesareservedondedicatedhostsinsidethebuffernetwork.将提供公共服务的专用主机放置于缓冲区域.TheDMZmayhostanapplicationgatewayforoutboundconnectivity.DMZ的主机可以提供应用程序网关用于外出的连接.,LayeredDefenseFeatures(Cont.),ADMZcontainsanattackerinthecaseofabreak-in.DMZ可以容忍攻击者的攻击.ADMZisthemostusefulandcommonmodernarchitecture.DMZ是一个非常有用和通用的流行架构.,MultipleDMZs,MultipleDMZsprovidebetterseparationandaccesscontrol:多重DMZ提供了最佳的独立的和访问控制:EachservicecanbehostedinitsownDMZ.每一个提供服务的主机拥有自己的DMZDamageislimitedandattackerscontainedifaserviceiscompromised.如果某一个服务受到攻击其仅仅会限制在受到攻击的服务,而不影响其它.,ModernDMZDesign,Varioussystems(statefulpacketfilter,proxyserver)canfiltertraffic.Properconfigurationofthefilteringdeviceiscritical.,FirewallTechnologies,FirewallTechnologies,Firewallsusethreetechnologies:Packetfiltering包过滤Applicationlayergateway应用层网关Statefulpacketfiltering状态包过滤,PacketFiltering,Packetfilteringlimitstrafficintoanetworkbasedonthedestinationandsourceaddresses,ports,andotherflagscompiledinanACL.在ACL中使用基于目标和源地址及端口号和其它标记包过滤受限制的流量进入网络.,PacketFilteringExample,Router(config)#access-list100permittcpany55establishedRouter(config)#access-list100denyipanyanylogRouter(config)#interfaceSerial0/0Router(config-if)#ipaccess-group100inRouter(config-if)#end,ApplicationLayerGateway,TheALGinterceptsandestablishesconnectionstotheInternethostsonbehalfoftheclient.ALG通过截取客户端数据包以客户端的身份与Internet主机建立连接,ALGFirewallDevice,StatefulPacketFiltering,StatelessACLsfiltertrafficbasedonsourceanddestinationIPaddresses,TCPandUDPportnumbers,TCPflags,ICMPtypesandcodes.无状态ACL过滤流量基于源与目标地址,TCP和UDP的端口号,TCP的标记,ICMP类型和代码.Statefulinspectionthenrememberscertaindetails,orthestateofthatrequest.状态过滤是通过检察数据包记住某些信息或其请求状态特征.,StatefulFirewallOperation,StatefulFirewalls,Alsocalled“Statefulpacketfilters”and“Application-awarepacketfilters.”也被称为“状态包过滤”和“应用感知包过滤”Statefulfirewallshavetwomainimprovementsoverpacketfilters:状态防火墙有两种改进的包过滤机制:Theymaintainasessiontable(statetable),wheretheytrackallconnections.通过维护会话表（状态表）跟踪所有连接.Theyrecognizedynamicapplicationsandknowwhichadditionalconnectionswillbeinitiatedbetweentheendpoints.能够支持端与端之间的初始化附加的连接应用这样的动态的应用.,StatefulFirewalls(Cont.),Statefulfirewallsinspecteverypacket,compareitagainstthestatetable,andmayexaminethepacketforanyspecialprotocolnegotiations.状态防火墙检查每一个数据包，与状态表相比较，同时还可以检查一些特殊协议的协商.Statefulfirewallsoperatemainlyattheconnection(TCPandUDP)layer.状态防火墙主要是在连接层上进行工作（TCP和UDP）.,StatefulFirewallHandlingofDifferentProtocols,IntroducingtheCiscoIOSFirewallFeatureSet,TheCiscoIOSFirewallFeatureSet,TheCiscoIOSFirewallFeatureSetcontainsthreemainfeatures:CiscoIOS防火墙特性包含三个主要特征:CiscoIOSFirewallAuthenticationproxyIPS,CiscoIOSFirewall,PacketsareinspectedenteringtheCiscoIOSfirewalliftheyarenotspecificallydeniedbyanACL.如果进入CiscoIOS防火墙的数据包没有被特定的ACL禁止掉则会被审查.CiscoIOSFirewallpermitsordeniesspecifiedTCPandUDPtrafficthroughafirewall.CiscoIOS防火墙允许或拒绝指定的TCP和UDP的流量通过防火墙.Astatetableismaintainedwithsessioninformation.使用状态表维护会话信息.ACLsaredynamicallycreatedordeleted.ACL被动态的创建或删除.CiscoIOSFirewallprotectsagainstDoSattacks.CiscoIOS防火墙能够保护不受DoS攻击.,CiscoIOSAuthenticationProxy,HTTP,HTTPS,FTP,andTelnetauthenticationProvidesdynamic,per-userauthenticationandauthorizationviaTACACS+andRADIUSprotocols,CiscoIOSIPS,Actsasaninlineintrusionpreventionsensortrafficgoesthroughthesensor还可以担当内连的入侵防护设备Whenanattackisdetected,thesensorcanperformanyoftheseactions:当检测到攻击时,哪么会执行如下动作:Alarm:SendanalarmtoSDMorsyslogserver.警告:向SDM或syslog服务器发送警告.Drop:Dropthepacket.丢弃:丢弃数据包.Reset:SendTCPresetstoterminatethesession.重置:向终端设备发送TCP的会话重置信息.Block:BlockanattackerIPaddressorsessionforaspecifiedtime.阻塞:在指定的时间内阻塞攻击者的IP地址或会话Identifies700+commonattacks能够识别700多种常见的攻击,CiscoIOSFirewallFunctions,CiscoIOSACLsRevisited,ACLsprovidetrafficfilteringbythesecriteria:根据如下标准ACL提供包过滤:SourceanddestinationIPaddresses源和目标的IP地址Sourceanddestinationports源和目标的端口ACLscanbeusedtoimplementafilteringfirewallleadingtothesesecurityshortcomings:ACL能够用于实现防火墙过滤时也导致了如下的一些安全缺点:Portsopenedpermanentlytoallowtraffic,creatingasecurityvulnerability端口持续开放允许数据流,创建了安全漏洞Donotworkwithapplicationsthatnegotiateportsdynamically不能够工作于动态协商的端口的应用CiscoIOSFirewalladdressestheseshortcomingsofACLs.CiscoIOS防火墙的ACL使用的包过滤的静态地址是缺点主要的原因.,CiscoIOSFirewallTCPHandling,CiscoIOSFirewallUDPHandling,CiscoIOSFirewallProcess,HowCiscoIOSFirewallWorks,SupportedProtocols,TCP(singlechannel)UDP(singlechannel)RPCFTP/FTPSTFTPTelnet/SSHUNIXR-commands(suchasrlogin,rexec,andrsh)SMTPHTTP/HTTPSICMPSNMPKazaa,SQL*NetRTSP(suchasRealNetworks)Tacacs+/RadiusSignallingH.323SkinnySIPOthermultimedia:MicrosoftNetShowStreamWorksVDOLiveBGPAndmanyothers,AlertsandAuditTrails,CiscoIOSFirewallgeneratesreal-timealertsandaudittrails.CiscoIOS防火墙能够产生实时的警告和审核信息索引.Audittrailfeaturesusesyslogtotrackallnetworktransactions.审核索引特性使用syslog去记录所有网络处理WithCiscoIOSFirewallinspectionrules,youcanconfigurealertsandaudittrailinformationonaper-applicationprotocolbasis.利用CiscoIOS防火墙检查规则,你可以基于每一个应用协议配置警告和审核索引信息,Summary,Layereddefensestrategyenhancessecuritybyprovidingbuffernetworkswithfilteringcapabilities.Therearethreemainfirewalltechnologies:packetfiltering,applicationproxy,andstatefulpacketfiltering.TheCiscoIOSFeatureSetcontainsthreemainfeatures:CiscoIOSFirewall,authentica