（经典）Juniper防火墙培训.ppt

1、防火墙培训ccb,议程,系统管理透明模式路由模式安全策略地址翻译应用层和网络层防攻击NSRPDebug,系统管理,系统组成,所有关键的系统功能都在内存中运行。可以通过控制线和webu对防火墙的配置进行修改。,TablesBuffersRunningConfigScreenOS(active),ScreenOSImageSavedConfigCerts,etc.,RAM,Flash,Interf.,Interf.,Interf.,TFTP,PwrUp/Reset,Aux.Storage,WebUI,NetScreen,Aux.Mgt.Servers,DNS/Syslog,Console,“Get

2、”,“Set”,ns208-getsystemProductName:NS208SerialNumber:0043042002000034,ControlNumber:00000000HardwareVersion:0110(0)-(11),FPGAchecksum:00000000,VLAN1IP()SoftwareVersion:,Type:Firewall+VPNBaseMac:0010.db1d.1c30FileName:n200-LAS0z0ad,Checksum:00000000Date04/15/200322:06:53,DaylightSavingT

3、imeenabledTheNetworkTimeProtocolisDisabledUp2hours31minutes14secondsSince15Apr200319:35:39TotalDeviceResets:0SysteminNAT/routemode.UseinterfaceIP,ConfigPort:80UserName:netscreenInterfaceethernet1:number0,if_info0,if_index0,modenatlinkup,phy-linkup/full-duplexvsysRoot,zoneTrust,vrtrust-vrdhcpdisabled

4、*ip/24mac0010.db1d.1c30*manageip,mac0010.db1d.1c30-more-,显示状态信息-CLI,IntheCLI,getcommandsprovidevaluablestatusaboutoperationalconditions:SystemserialnumberSoftwareversionOperatingmodeInterfacestatusInterfaceaddressManagementaddresses,图形化界面-WebUI,NetScreen防火墙可以通过图形化的界面进行管理。需要的条件(ie.oneIP

5、address)一台PC机与防火墙在同一个网段口令保护,Zone和Interface的分配,AstricthierarchicallinkageexistsbetweenzonesandinterfacesinaNetScreendeviceZonesareassignedtoavirtualrouterInterfacesareassignedtoasecurityzoneAninterfacecanonlybelongtoonesecurityzoneIndividualconfigurationparametersareassignedtointerfacesIPaddressesMan

6、agementservicesOthers,Int.,Zone,Zone,VirtualRouter,IP,Zone的类型,安全zonePre-defined:Trust,Untrust,DMZ;V1-Trust,V1-Untrust,V1-DMZUser-definedTunnelZone,功能ZonesNullMGTHASelfVLAN,ns5gt-getzoneTotal10zonescreatedinvsysRoot-5arepolicyconfigurable.TotalpolicyconfigurablezonesforRootis5.-IDNameTypeAttrVRDefaul

7、t-IFVSYS0NullNullShareduntrust-vrhiddenRoot1UntrustSec(L3)Sharedtrust-vruntrustRoot2TrustSec(L3)trust-vrtrustRoot4SelfFunctrust-vrselfRoot5MGTFunctrust-vrnullRoot10GlobalSec(L3)trust-vrnullRoot11V1-UntrustSec(L2)trust-vrv1-untrustRoot12V1-TrustSec(L2)trust-vrv1-trustRoot14VLANFunctrust-vrvlan1Root16

8、Untrust-TunTuntrust-vrhidden.1Root-,ConfiguringZones/Interfaces-WebUI,NetworkInterfaces(edit),LicenseKeys的管理,以下的特征需要增加licensekey:Capacityexpansion(extended/advancedreleases)Anti-virusURLfilteringDeepInspection两种安装key的方法ManualgetkeyfromJuniper/resellerAutomaticregisterdeviceatJuniperWebsite,thendownl

9、oadlicenses,execlicense-keycapacity,execlicense-keyupdate,文件管理,备份/恢复netscreen防火墙所需要的重要的配置文件信息。ScreenOSimageConfigurationfiles备份/恢复配置文件的存放On-boardFlashTFTPserverExternalstorage(SANdisk)Managementstation(WebUIonly),保存配置,WebUISavesautomaticallywhenyouclick“Apply”or“OK”ConsoledisplayssavemessagesCLIManu

10、alcommandWritestoon-boardflashconfigurationfile,ns208save,配置文件管理-CLI,只有根管理员才能进行这些操作配置文件备份配置文件恢复Option1:copiesfileintoflashavailableatnextrebootOption2:mergesfileintoRAMBECAREFUL!,saveconfigfromflashtotftp|pcmcia|slot1ns208-saveconfigfromflashtotftp5015Jun03.cfg,saveconfigfromtftp|pcmcia|slot1

11、toflashns208-saveconfigfromtftp5015June03.cfgtoflash,saveconfigfromtftp|pcmcia|slot1mergens208-saveconfigfromtftp5015June03.cfgmerge,配置文件管理WebUI,ConfigurationUpdateConfigFile,配置的回退（Rollback）,Provides“safetynet”forfailed/corruptedconfigIfdefaultconfiginflashcantbeloaded,systemwilltrytol

12、oad“lastknowngood”fileCanbeforcedmanuallytocorrectconfigmistakesCreaterollbackfileForcerollback,saveconfigtolast-known-good,execconfigrollback,软件包的管理,ImagebackupImageimporting(Upgrade)Downgradefrom5.0orhighertopriorreleases,savesoftwarefromflashtotftp|pcmcia|slot1ns208-savesoftwarefromflashtotftp1.1

13、.7.250ns208image.bin,savesoftwarefromtftp|pcmcia|slot1toflashns208-savesoftwarefromtftp50newimagetoflash,execdowngrade,UpgradeExampleCLI,5XT-savesoftwarefromtftp50newimage.bintoflash!tftpreceivedoctets=3304662tftpsuccess!TFTPSucceededSavetoflash.Itmaytakeafewminutes.updatenewflashimage

14、(02c86db0,3304662)platform=17,cpu=10,version=16offset=20,address=900000,size=3304584date=0,time=0,cksum=28e9f31cProgramflash(0,3304662).+doneDone5XT-reset,ConfigurationUpdateScreenOS/Keys,UpgradeExample-WebUI,灾难恢复“Disaster”Recovery,NetScreendevicessupportfeaturestodealwithelectronic“disasters”Corrup

15、tedScreenOSimageinFlashLostrootpasswordRequirementtoresettofactorydefaults,RecoveringtheScreenOSImage-BootMode,NetScreenNS-200BootLoaderVersion3.0.0(Checksum:35E1A866)Copyright(c)1997-2003NetScreenTechnologies,Inc.Totalphysicalmemory:128MBTest-PassInitialization-DoneModelNumber:NS-208Hitanykeytorunl

16、oaderHitanykeytorunloaderHitanykeytoruSerialNumber0043042002000034:READONLYHWVersionNumber0110:READONLYSelfMACAddress0010-db1d-1c30:READONLYBootFileNamen200-LAS0z0ad:n200-LAS0z0adSelfIPAddress:TFTPIPAddress31:Saveloaderconfig(112bytes).Done,TFTPservermustbeinsames

17、ubnetasNetScreensSelfIPaddress.Servermustbeconnectedto:TrustinterfaceondeviceswithTrustinterfaceE1interfaceondeviceswithE1interfaceE1/1orMGTinterfaceonsystems,BootMode(cont.),Loadingfilen200-LAS0z0ad.r!r.tatatatatatatatatatatatatatatatatLoadedSuccessfully!(size=3,444,522bytes)Ignoreimageauthenticati

18、on!Savetoon-boardflashdisk?(y/n/m)Yes!Savingasdefaultsystemimageinflashdisk.Done!(size=3,444,522bytes)Rundownloadedsystemimage?(y/n)Yes!Startloading.Done.NetScreenTechnologies,IncNS200SystemSoftwareCopyright,1997-2003Version5.0.0ad.0InitHeap(1546000/50b9c00,32,00000000/00000000)GT64120revisionid:0 x

19、11LoadNVRAMInformation.(5.0)Done,根管理员口令丢失,口令不能被恢复系统需要回到出厂设置Alsocalled“AssetRecovery”Allconfigurationparameters,certificates,andkeysaredeleted两种方法LogintoconsolewithdeviceserialnumberasusernameandpasswordWarningmessagesregardingdestructiveresultswillappearUsepinholeonexteriorofsystemPressuntilflashing

20、lightchangestoredWaituntilflashingredturnstoflashinggreenPressagain,透明模式,什么是透明模式?,Netscreen防火墙的接口在第二层的网桥模式或者是第二层的交换模式下进行工作。Learning,Flooding,Forwarding,Filtering通过安全策略让风火墙对第二层的安全区之间的数据包进行流量的访问控制。,/16,E1,E3,zoneV1-Trust,zoneV1-DMZ,zoneV1-Untrust,E2,Layer2FrameForwarding(Bridging/Switching),透明

21、模式的功能Learning(basedonSourceMACaddress)Forward/Flood/Filter(basedonDestinationMACaddress)Loopprevention(SpanningTreeprotocol),MACAddressTable,00c0.01cd.5120E1E800e0.01ab.cd10,V1-Untrust,透明模式的工作,由于没有使用到网络的第三层，因此，透明模式能够让防火墙更加快速的部署。不需要定义拓扑结构增加安全性在netscreen的二层工作模式下可以使用VPNZone概念的提出，可以提供比基于路由的ACL更加安全的访问控制,

22、/16,B,B,D,A,B,/16,/16,Layer-2安全区,预先定义的“V1”zonesV1-TrustV1-UntrustV1-DMZ用户定义的安全区Layer-2(L2)区用户在定义安全区的时候必须以“L2-”开头。,透明模式中的接口,在ScreenOS5.0没有定义任何接口是属于透明模式把一个接口放到第二层的安全区中因此二层的接口的域必须是以“V1-”or“L2-”开头的。所有接口在v1或者是L2安全区，是具有相同广播域的第二层防火墙的成员。,Inte1,ZoneL2-private,Inte2,ZoneL2-public,1

23、/16,VLAN1接口,在VLAN区中是第三层逻辑接口该接口可以配置一个IP地址，用来管理netscreen防火墙。支持管理IP地址所有物理接口都可以接受arp请求。,V1-Trust,0,1,2,V1-DMZ,V1-Untrust,VLAN1isalogicalinterfacewhichisaccessiblefromanytransparentzone,VLAN1interface:10/24,E1,E3,E2,A,B,C,V1-Trust,0,1,2,V1-DMZ,V1-Un

24、trust,VLAN1interface:10/24,E1,E3,E2,A,B,C,管理行为,VLAN1willinheritmanagementoptionsfromzonemembershipofphysicalinterfaces,X,VLAN1interface:10/24,透明模式的配置,建立2层的安全区(在没有使用缺省安全区的情况下)分配接口给2层安全区为VLAN1配置管理地址3a.配置IP地址3b.选择广播的方法3c.配置管理服务(可选项)配置每个安全区的管理服务在不同的安全区之间配置策略,Step1:配置2层安全区,NetworkZonesNew,s

25、etzonenameL2Example:ns208-setzonenameL2-DemoL21,Step2:分配接口到安全区,NetworkInterfaces(Edit),setinterfacezonens208-setinterfacee3zoneL2-Demo,Step3a:配置VLAN1的IP地址,NetworkInterfacesEdit(VLAN1),UseforInterfaceIPwhenterminatingVPNs,UseManage-IPasdestinationaddressofPING,telnet,WebUI,etc.,setinterfacevlan1ip/ns

26、208-setintvlan1ip/24,setinterfacevlan1manage-ipns208-setintvlan1manage-ip00/24,Step3b:选择广播的方法,Flooding(default)如果MAC表中没有，原数据包将向所有的接口进行广播除了流入数据包的接口。ARP/Trace-Route如果MAC表中没有,ARP或traceroute将向所有的接口进行广播除了流入数据包的接口。,NetworkInterfacesEdit(VLAN1),setvlan1broadcastarp,setvlan1broadcastflood,Step

27、3c:配置VLAN1的服务,允许所有的管理服务WebUI,Telnet,SSH,SNMP,SSL,NS-GlobalPro(nsmgmt)选择指定的管理服务,NetworkInterfacesEdit(VLAN1),setinterfacevlan1managens208-setintvlan1manage,setinterfacevlan1managens208-setintvlan1managewebns208-setintvlan1managesslns208-setintvlan1managensmgmt,Step4:在每个安全区中配置不同的管理服务,NetworkZonesEdit(

28、V1-Trust),setzonemanagens208-setzonev1-dmzmanageweb,透明模式的检查工具,GetinterfaceGetARPGetmac-learnGetsession,Getinterface,ns208-getinterfaceethernet1Interfaceethernet1:number0,if_info0,if_index0,modexparent,portvlan1,sesstoken9linkup,phy-linkup/half-duplexvsysRoot,zoneV1-Trust,vrtrust-vr*ip/0mac001

29、0.db22.23f0pingenabled,telnetenabled,SSHenabled,SNMPenabledwebenabled,ident-resetdisabled,SSLenabled,nsmgmtenabledwebauthdisabledDHCP-Relaydisabledbandwidth:physical100000kbps,configured0kbps,current0kbpstotalconfiguredgbw0kbps,totalallocatedgbw0kbpsns208-,Getarp,ns208-getarpIPMacVR/InterfaceStateAg

30、eRetryPakQueabc3241244dctrust-vr/v1-trustSTS005000065bd2ff42trust-vr/v1-trustVLD115100ARPEntryNumber2/1024,NoFreeEntryCount:0Arpalways-on-dest:disabledns208-,Note:Althoughitsays“interface”,intransparentmodethezonenameisdisplayed,Getmac-learn,学习AssociatesaMACaddresswithanoutgoinginterfa

31、ceDetermineshowreceivedframesareforwardedinLayer-2AlsoknownasBridgeTableorL2ForwardingTable静态ARP影射MACaddresstooutgoingportassociationcanbemanuallyconfiguredviatheCLI,setmac,ns208-getmac-learnlinkdownclearmaclearntable:enableTotal3,Create9,Ageout6Flood1,BCast150,ReLearn1,NoFree0,Error0,Drop0ethernet2

32、:0004.7648.aa3c56ethernet1:0010.db13.e44144ethernet3:0010.db15.6bc459,Getsession,ns208-getsessionalloc2/max128000,allocfailed0id43/s*,vsys0,flag00000090/00/00,policy1,time117(01):/27129-0/768,1,00b0d06c3f39,vlan0,tun0,vsd019(00):/271290/768,1,00b0d06c3f39,

33、vlan0,tun0,vsd019(00):/27385setzonenamePrivate,NetworkZones,Step2:分配接口给Zones,NetworkInterfaces(Edit),setinterfacezonens208-setinterfacee8zoneuntrust,Step3:分配地址给接口,setinterfaceip/ns208-setinterfacee8ip/24,NetworkInterfaces(Edit),Step4:配置静态路由,setroute/interfacegatewayExample:ns208-se

34、troute/24interfacee1gateway54,NetworkRoutingDestinationEdit,验证接口的配置,NetworkInterfaces,ns208-getinterfaceA-Active,I-Inactive,U-Up,D-Down,R-ReadyInterfacesinvsysRoot:NameIPAddressZoneMACVLANStateVSDeth/24Private0010.db1d.1be0-U-eth/0V1-DMZ0010.db1d.1be4-D-eth/

35、0V1-Untrust0010.db1d.1be5-D-eth/0Private0010.db1d.1be6-D-eth/0Untrust0010.db1d.1be7-D-eth/0Null0010.db1d.1be8-D-eth/24Public0010.db1d.1be9-U-eth/24External0010.db1d.1bea-U-vlan/0VLAN0010.db1d.1bef1D-,验证静态路由WebUI,NetworkRoutingDestination,验证静态路由-CLI,ns2

36、08-getrouteuntrust-vr(0entries)-C-Connected,S-Static,A-Auto-Exported,I-Imported,R-RIPiB-IBGP,eB-EBGP,O-OSPF,E1-OSPFexternaltype1E2-OSPFexternaltype2trust-vr(9entries)-IDIP-PrefixInterfaceGatewayPPrefMtrVsys-*/0eth54S201Root*8/24eth0S201Root9/24eth0S201

37、Root*/24ethC00Root1/24eth0S201Root*/24ethC00Root/24ethC00Root/24ethC00Root*/24ethC00Root,验证路由,getrouteipns208-getrouteipDestinationRoutesfor-trust-vr:=/24(id=6)via54(vr

38、:trust-vr)Interfaceethernet1,metric1,验证路由,ns208-pingTypeescapesequencetoabortSending5,100-byteICMPEchosto,timeoutis2seconds!SuccessRateis100percent(5/5),round-triptimemin/avg/max=2/3/9msns208-pingTargetIPaddress:Repeatcount5:Datagramsize100:Timeoutinseconds2:Sourceinterfac

39、e:TypeescapesequencetoabortSending5,100-byteICMPEchosto,timeoutis2seconds!SuccessRateis100percent(5/5),round-triptimemin/avg/max=2/3/4ms,Pingandextendedping,验证路由,ns208-traceTypeescapesequencetoescapeSendICMPechosto,timeoutis2seconds,maximumhopsare3211ms2ms2ms5423ms

40、2ms3msTracecomplete,traceroute,路由的相互依赖性,ExternalZone,PrivateZone,50,/24,,/24,B,/24,PublicZone,,.254,,A,B,C,D,/24,/24,.1.254,.1.254,/24,/24,.254.1,NetworkInterfaceNextHop/24E1-/0E

41、54,HowwilltrafficfromHostDgettoHostA?,VirtualRoutersOneVR,OnetabledisplaysallroutesexternalandinternalDifficulttosecure,RoutingTable,IDIP-PrefixInterfaceGatewayPPrefMtrVsys-*/24ethC00Root*/24ethS201Root*/24ethS201Root*/24ethC00Root*

42、4/24ethS201Root*5/24ethS201Root,E8,E1,,,,,,,,,Loopback接口,没有物理连接只要路有可以达到，可以通过任何接口连接到防火墙的loopback地址Usedfor管理VPN终结动态路由(RouterID),LoopbackInterface配置,setinterfaceloopback.zonesetinterfaceloopback.

43、ip/setinterfaceloopback.manage,NetworkAddressTranslation(NAT),ExternalZone,PrivateZone,,/24,.254,,A,D,/24,.1.254,/24,内部的私有地址被翻译为外部的合法的注册的有效的公网IP地址。这个过程被称作网络地址端口转化：NetworkAddressPortTranslation(NAPT),基于接口的NAT,防火墙的接口运行在NAT或路由模式下在路由模式下没有地址翻译发生在NAT模式下，地址翻译可以出现在特

44、定的条件中OneVRFromTrustzonetoUntrustzoneONLYTwoVRFromanyVRtoUntrustVRONLY如果NAT需要在其他的zones/VRs中使用,请使用基于策略的NAT。我们在以后的课程中再讨论这个问题。,RouteMode,没有地址翻译发生需要设定内部地址的路由,ExternalZone,PrivateZone,,/24,.254,,A,D,/24,.1.254,/24,NATMode,内部的地址被翻译成防火墙向外访问的公网的IP地址返回的流量被重新翻译成内部的地址。,

45、UntrustZone,TrustZone,,/24,.254,,A,D,/24,.1.254,/24,配置接口的模式,setinterfaceroute|natns208-setinterfacee1nat,NetworkInterfaces(Edit),验证接口的工作模式,WebUIsamescreenforconfigurationandverification,getinterfacens208-getinte1Interfaceethernet1:number0,if_info0,if_index0,

46、modenatlinkup,phy-linkup/half-duplexvsysRoot,zoneTrust,vrtrust-vrdhcpdisabled*ip/24mac0010.db1d.1be0*manageip,mac0010.db1d.1be0pingenabled,telnetenabled,SSHenabled,SNMPenabledwebenabled,ident-resetdisabled,SSLenabledwebauthdisabled,webauth-ipOSPFdisabledBGPdisabledRIPdisabledD

47、HCP-Relaydisabledbandwidth:physical10000kbps,configured0kbps,current0kbpstotalconfiguredgbw0kbps,totalallocatedgbw0kbps,验证NAT行为,没有翻译在不同的方向具有相同的IP地址经过了翻译在不同的方向，IP地址不相同,ns208-getsessionalloc5/max128000,allocfailed0id99/s*,vsys0,flag00000000/00/00,policy1,time60(01):/34560-/512,1,0010

48、db12cea1,vlan0,tun0,vsd010(20):/1028getsessionalloc5/max128000,allocfailed0id78/s*,vsys0,flag00000040/80/20,policy-1,time890(21):/4647-/80,6,0010db12cea1,vlan0,tun0,vsd03(00):/4647Advanced,AdvancedPolicyOptions(cont.),PolicyAdvanced,TrafficLogs,记录了会话结束时间,会话持续时间,地址和地

49、址翻译以及所使用的服务。,ReportsPoliciesTrafficLog,ConfiguringTrafficLogs,setpolicy(fromzonetozonesadaserviceaction)logORsetpolicylogns5gt-setpolicyid1ns5gt(policy:1)-setpolicylog,Policy,Verifying/AccessingLogging,getlogtraffic,Policies,ReportsPolicies,流量统计,图形化的方式察看匹配策略的流量情况。WebUIonly,ReportsPoliciesTrafficCoun

50、tingGraph,ConfiguringTrafficCounters,setpolicy(fromzonetozonesadaserviceaction)count-OR-setpolicycountsetpolicycountalarmns5gt-setpolicyid1ns5gt(policy:1)-setpolicycount,PolicyAdvanced,Verifying/AccessingTrafficCounters,Policies,ReportsPolicies,getcounterspolicy,PolicyScheduling,定义策略基于时间的允许和禁止两个选项重复

51、时间TwowindowsperdayWeeklyscheduleOnceonly为了时间的准确性，请配置时间服务器。,ConfiguringPolicyScheduling,CreatescheduleApplyscheduletopolicy,CreateSchedule-WebUI,ObjectsSchedulesNew,CreateScheduleCLI,setschedulerrecurrentstartstopstartstopns208-setschedulerNoICQrecurrentmonstart7:00stop12:00start13:00stop18:00ns208-s

52、etschedulerNoICQrecurrenttuesstart7:00stop12:0013:00stop18:00(etc.)setscheduleroncestartstopns208-setschedulerY2Koncestart01/01/2000stop01/02/2000,ApplyScheduletoPolicy,setpolicy(fromzonetozonesadaserviceaction)schedule,PolicyAdvanced,VerifyingScheduling,如果策略是灰色的背景，那么该策略已经启动了scheduling请确认何时禁止何时允许。,用

53、户认证,当数据流量通过防火墙的时候，需要输入用户名和口令。可以与NSRemoteClient结合使用当防火墙需要附加的对用户身份验证的时候可以使用这条规则。两种工作方式当数据包通过防火墙的时候，防火墙自动提示用户输入用户名和口令。策略中的应用必须是Telnet,FTP,orHTTP可以使用WebAuth在防火墙上首先进行认证，认证通过，流量可以通过防火墙一旦认证通过，所有匹配策略的应用将被运行通过防火墙。,防火墙认证,WebServer9,DA:9,serviceHTTP,AuthPolicy,Username?Password?,DA:172.16.1

54、.99,serviceHTTP,UsernamePassword,Authenticated!,Alltrafficpermittedbypolicy,WebAuth认证,DA:2,serviceHTTP,WebAuth,Username?Password?,UsernamePassword,Authenticated!,Alltrafficpermittedbypolicy,WebServer9,WebAuthaddress2,WebAuthexample防火墙认证的方式取决于用户所使用的认证服务的形式。HTTPdisplayssimila

55、rdialogueFTP/Telnetdisplaytext-basedprompts,认证的界面,认证配置的步骤,建立用户配置认证策略(WebAuthonly)配置WebAuth地址,Step1:建立用户,ObjectsUsersLocalEdit,setuserpassword,Step2:配置认证策略,setpolicy(fromzonetozonesadaserviceaction)authsetpolicy(fromzonetozonesadaserviceaction)webauth,PolicyAdvanced,Step3:配置WebAuth地址,NetworkInterfaceEdit,setinterfacewebauthsetinterfacewebauth-ip,验证认证,ns5gt-getuserallTotalusers:1IdUsernameEnableTypeID-typeIdentityBelongstogroups-1JoeUserYesauthns5gt-getauthtableTotalusersintable:1Successful:1,Failed:0Pending:0,Others:0ColT:Used:D=Def