Juniper-策略配置的方法

Click to edit Master title style,Click to edit Master text styles,Second level,Third level,Fourth level,Fifth level,*,*,Tahoma 29,bold,shadowed,Tahoma 24,bold,Tahoma 20,normal,Tahoma 18,normal,Tahoma 16,Bold,Tahoma 15,italic,Testing,*,*,防火墙安全策略,目标,掌握防火墙的策略配置方法、步骤，包括：,记录日志,流量统计,策略生效的时间,用户认证,掌握策略的验证方法,2,Policy Options Main Screen,Attack,Prevention,VPNs,Options,3,Advanced Policy Options,PolicyAdvanced,4,Advanced Policy Options(cont.),PolicyAdvanced,5,Traffic Logs,记录了会话结束时间,会话持续时间,地址和地址翻译以及所使用的服务。,Reports Policies Traffic Log,6,Configuring Traffic Logs,set policy(from zone to zone sa da service action)log,OR,set policy log,ns5gt-,set policy id 1,ns5gt(policy:1)-,set policy log,Policy,7,Verifying/Accessing Logging,get log traffic,Policies,Reports Policies,8,流量统计,图形化的方式察看匹配策略的流量情况。,WebUI only,Reports Policies Traffic Counting Graph,9,Configuring Traffic Counters,set policy(from zone to zone sa da service action)count,-OR-,set policy count,set policy count alarm ,ns5gt-,set policy id 1,ns5gt(policy:1)-,set policy count,PolicyAdvanced,10,Verifying/Accessing Traffic Counters,Policies,Reports Policies,get counters policy ,11,Policy Scheduling,定义策略基于时间的允许和禁止,两个选项,重复时间,Two windows per day,Weekly schedule,Once only,为了时间的准确性，请配置时间服务器。,12,Configuring Policy Scheduling,Create schedule,Apply schedule to policy,13,Create Schedule-WebUI,Objects Schedules New,14,Create Schedule CLI,set scheduler recurrent start stop start stop,ns208-set scheduler NoICQ recurrent mon start 7:00 stop 12:00 start 13:00 stop 18:00,ns208-set scheduler NoICQ recurrent tues start 7:00 stop 12:00 13:00 stop 18:00,(etc.),set scheduler once start stop,ns208-set scheduler Y2K once start 01/01/2000 stop 01/02/2000,15,Apply Schedule to Policy,set policy(from zone to zone sa da service action)schedule,PolicyAdvanced,16,Verifying Scheduling,如果策略是灰色的背景，那么该策略已经启动了,scheduling,请确认何时禁止何时允许。,17,用户认证,当数据流量通过防火墙的时候，需要输入用户名和口令。,可以与,NS Remote Client,结合使用,当防火墙需要附加的对用户身份验证的时候可以使用这条规则。,两种工作方式,当数据包通过防火墙的时候，防火墙自动提示用户输入用户名和口令。,策略中的应用必须是,Telnet,FTP,or HTTP,可以使用,WebAuth,在防火墙上首先进行认证，认证通过，流量可以通过防火墙,一旦认证通过，所有匹配策略的应用将被运行通过防火墙。,18,防火墙认证,Web Server,172.16.1.99,DA:172.16.1.99,service HTTP,Auth Policy,Username?,Password?,DA:172.16.1.99,service HTTP,Username,Password,Authenticated!,All traffic permitted by policy,19,WebAuth,认证,DA:10.1.1.42,service HTTP,Web Auth,Username?,Password?,Username,Password,Authenticated!,All traffic permitted by policy,Web Server,172.16.1.99,WebAuth address,10.1.1.42,20,WebAuth example,防火墙认证的方式取决于用户所使用的认证服务的形式。,HTTP displays similar dialogue,FTP/Telnet display text-based prompts,认证的界面,21,认证配置的步骤,建立用户,配置认证策略,(WebAuth only),配置,WebAuth,地址,22,Step 1:,建立用户,Objects Users Local Edit,set user password,23,Step 2:,配置认证策略,set policy(from zone to zone sa da service action)auth,set policy(from zone to zone sa da service action)webauth,PolicyAdvanced,24,Step 3:,配置,WebAuth,地址,Network Interface Edit,set interface webauth,set interface webauth-ip,25,验证认证,ns5gt-,get user all,Total users:1,Id User name Enable Type ID-type Identity Belongs to groups,-,1 JoeUser Yes auth,ns5gt-,get auth table,Total users in table:1,Successful:1,Failed:0,Pending :0,Others:0,Col T:Used:D=Default settings,W=WebAuth,A=Auth server in policy,id src user group age status server T srczone dstzone,1 192.168.1.33 JoeUser 5 Success Local W N/A N/A,26,总结,在本章中我们需要掌握以下的内容,:,配置和验证策略,Traffic logging,Traffic counters,Scheduling,User Authentication,27,Lab,策略的配置步骤,目标,Add logging,counting,and schedule to your policies,28,9,、静夜四无邻，荒居旧业贫。,2024/11/28,2024/11/28,Thursday,November 28,2024,10,、雨中黄叶树，灯下白头人。,2024/11/28,2024/11/28,2024/11/28,11/28/2024 2:49:46 AM,11,、以我独沈久，愧君相见频。,2024/11/28,2024/11/28,2024/11/28,Nov-24,28-Nov-24,12,、故人江海别，几度隔山川。,2024/11/28,2024/11/28,2024/11/28,Thursday,November 28,2024,13,、乍见翻疑梦，相悲各问年。,2024/11/28,2024/11/28,2024/11/28,2024/11/28,11/28/2024,14,、他乡生白发，旧国见青山。,28 十一月 2024,2024/11/28,2024/11/28,2024/11/28,15,、比不了得就不比，得不到的就不要。,十一月 24,2024/11/28,2024/11/28,2024/11/28,11/28/2024,16,、行动出成果，工作出财富。,2024/11/28,2024/11/28,28 November 2024,17,、做前，能够环视四周；做时，你只能或者最好沿着以脚为起点的射线向前。,2024/11/28,2024/11/28,2024/11/28,2024/11/28,9,、没有失败，只有暂时停止成功！。,2024/11/28,2024/11/28,Thursday,November 28,2024,10,、很多事情努力了未必有结果，但是不努力却什么改变也没有。,2024/11/28,2024/11/28,2024/11/28,11/28/2024 2:49:46 AM,11,、成功就是日复一日那一点点小小努力的积累。,2024/11/28,2024/11/28,2024/11/28,Nov-24,28-Nov-24,12,、世间成事，不求其绝对圆满，留一份不足，可得无限完美。,2024/11/28,2024/11/28,2024/11/28,Thursday,November 28,2024,13,、不知香积寺，数里入云峰。,2024/11/28,2024/11/28,2024/11/28,2024/11/28,11/28/2024,14,、意志坚强的人能把世界放在手中像泥块一样任意揉捏。,28 十一月 2024,2024/11/28,2024/11/28,2024/11/28,15,、楚塞三湘接，荆门九派通。,十一月 24,2024/11/28,2024/11/28,2024/11/28,11/28/2024,16,、少年十五二十时，步行夺得胡马骑。,2024/11/28,2024/11/28,28 November 2024,17,、空山新雨后，天气晚来秋。,2024/11/28,2024/11/28,2024/11/28,2024/11/28,9,、杨柳散和风，青山澹吾虑。,2024/11/28,2024/11/28,Thursday,November 28,2024,10,、阅读一切好书如同和过去最杰出的人谈话。,2024/11/28,2024/11/28,2024/11/28,11/28/2024 2:49:46 AM,11,、越是没有本领的就越加自命不凡。,2024/11/28,2024/11/28,2024/11/28,Nov-24,28-Nov-24,12,、越是无能的人，越喜欢挑剔别人的错儿。,2024/11/28,