苏州电信SSG5培训资料-07-攻击防护复习进程

苏州电信SSG5培训资料---07-攻击防护网页内容过滤使用内置SurfControl网页内容过滤引擎转发给外置的内容过滤服务器SurfControl服务器WebSense服务器2网页内容过滤配置启用内置引擎Screening>URLFiltering>ProtocolSelectionseturlprotocolsc-cpa3网页内容过滤配置配置参数Screening>URLFiltering>ProtocolSelection4网页内容过滤定义类别

123Screening>URLFiltering>Profile>CustomList5网页内容过滤配置定义档案1Screening>URLFiltering>Profile>CustomProfile26网页内容过滤配置在策略中应用Policiessetpolicyfrom<zone>to<zone><sourceadd><destadd><service><permit>url-filterseturlprotocolsc-cpaprofile<name>7防病毒引擎使用KasperskyAV引擎8防病毒引擎的配置扫描管理器Screening>Anti-Virus>ScanManager9防病毒引擎的配置全局参数的设定Screening>Anti-Virus>GlobalSettings10防病毒引擎的配置在安全策略的应用Policies>Editsetpolicyfrom<zone>to<zone><SA><DA><service>permitavscan-mgr-OR-setavscan-mgr(inpolicyeditmode)11深层检测攻击特征库深层检测策略12攻击特征库Objects>Attacks>PredefinedGroups13攻击程度的分类AttackSeverityLogLevelMeaningCriticalCriticalHighErrorMediumWarningLowNotificationInfoInformationalContainsattackobjectsmatchingexploitsthatattempttoevadedetection,causeanetworkdevicetocrash,orgainsystem-levelprivileges.Containsattackobjectsmatchingexploitsthatattempttodisruptaservice,gainuser-levelaccesstoanetworkdevice,oractivateaTrojanhorsepreviouslyloadedonadevice.Containsattackobjectsmatchingexploitsthatdetectreconnaissanceeffortsattemptingtoaccessvitalinformationthroughdirectorytraversalorinformationleaks.Containsattackobjectsmatchingexploitsthatattempttoobtainnon-criticalinformationorscananetworkwithascanningtool.Containsattackobjectsmatchingnormal,harmlesstrafficcontainingURLs,DNSlookupfailures,SNMPpubliccommunitystrings,andPeer-to-Peer(P2P)parameters.Youcanuseinformationalattackobjectstoobtaininformationaboutyournetwork.14加载攻击特征库WebUI模式Configuration>Update>AttackSignature15加载攻击特征库CLI模式SetURLSetUpdateModeSetScheduleManualLoadingsetattackdbserver/restricted/sigupdates

setattackdbmode[update|check]setattackdbschedule[weekly<dayofweek>|daily]<hh:mm>saveattackdbfromtftp<ip_address><signature_file>toflash16深层检测策略的响应种类SendsendsRSTtoserverCloseServerSendRSTtoclientCloseClientSendRSTtobothclientandserverCloseDroptheconnectionwithoutsendingRSTtothesenderDropConnectionDroppacketbeforeitcanreachthedestinationDropPacketIgnoretherestoftheconnectionafterana