深信服SD-WAN产品使用说明书

合集下载

Fortinet Secure SD-WAN 产品简介说明书

Simplifying SD-WAN Operations with Single-Pane ManagementExecutive SummarySoftware-defined wide area networking (SD-WAN) is rapidly replacingtraditional WAN for remote office and branch deployments. While SD-WANoffers performance benefits that support new digital innovations, many SD-WANsolutions lack consolidated networking and security features. In response, manynetwork leaders have had to add a complex assortment of tools and solutions tomanage and protect their SD-WAN deployments. Instead, they need a simplifiedapproach to contain costs, improve efficiency, and reduce risks. Fortinet SecureSD-WAN addresses each of these requirements, combining next-generationfirewalls (NGFWs) with integrated solutions for management and analytics tocentralize and simplify SD-WAN operations.Supporting Innovation While Securing Growing BusinessesDistributed enterprises are adopting digital innovations—such as Software-as-a-Service (SaaS) applications and real-time applications such as voice and video—toincrease productivity, improve communications, and foster rapid business growth.However, traditional WAN architectures at many branch and remote office locationsstruggle to support the traffic demands of these new technologies. This has ledto increasing adoption of SD-WAN architectures that utilize more affordable directinternet connections. The SD-WAN market is expected to grow to over $30 billion in2030, from $3.5 billion in 2022, with a CAGR of 31.2% from 2022 to 2030.1But while SD-WAN improves networking bandwidth, it can also increase theorganization’s risk exposure. According to Gartner survey analysis, “Customerscontinue to strive for better WAN performance and visibility, but security now topstheir priorities when it comes to the challenges with their WAN.2In many organizations, the need for SD-WAN security has led network engineeringand operations leaders to incorporate many different tools and point products toaddress individual functions, threat exposures, or compliance requirements. But thisapproach leads to infrastructure complexity, which increases manageability burdenswhile creating new defensive gaps at the network edge.Fortinet Simplifies and Secures SD-WAN DeploymentsConsolidating networking and security tools requires a secure SD-WAN solution thateliminates the complexity of disaggregated branch infrastructures. This not onlyreduces the organization’s attack surface while enabling digital innovation initiatives,but it also simplifies operations for networking teams. SOLUTION BRIEFFortinet enables the convergence of networking and security to simplify network operations, ensuring a secure and optimized user experience across all network edges with the hybrid mesh firewall (HMF). Hybrid mesh firewall is a new concept bringing all firewall deployments together in an integrated mesh to manage, monitor, and secure all firewall deployments. It unifies network management and security policies for all firewall deployments, whether on-premises for branch, campus, and data centerdeployments or virtual firewalls for cloud and cloud-native environments. It also uses artificial intelligence and machine learning to provide advanced threat protection. FortiManager is the foundation of HMF, offering unified, centralized management of all FortiGate deployments.Fortinet Secure SD-WAN can leverage a single-pane-of-glass console with an SD-WAN orchestrator offered as part ofFortiManager and provide enhanced analytics and improved reporting with FortiAnalyzer. This allows organizations tosignificantly simplify centralized deployment, enable automation to save time, and offer business-centric policies.Figure 1: SD-WAN use case featuring network operations center solutions Zero-touch deploymentOrganizations implementing Fortinet Secure SD-WAN can leverage FortiManager to accelerate deployment, reducing the time from days to minutes. FortiManager zero-touch deployment capabilities enable FortiGate devices to be plugged in at a branch location and then automatically configured by FortiManager at the main office via a broadband connection, thereby avoiding the time and cost of truck rolls. Fortinet’s approach can also leverage an existing SD-WAN configuration as a template to accelerate the deployment of new branches and remote sites at scale.Centralized management for distributed organizationsCentralized management through the FortiManager of all distributed networks across the organization helps network leaders drastically reduce the opportunities for configuration errors that lead to cyber-risk exposures and network outages.Secure SD-WAN orchestrator is part of the FortiManager. This allows customers to significantly simplify centralized deployment, enable automation to save time, and offer business-centric policies. Fortinet management tools can support much larger deployments than competing solutions—up to 100,000 FortiGate devices. Features such as SD-WAN and NGFW templating, enterprise-grade configuration management, and role-based access controls help network engineering and operations leaders quickly mitigate human errors.SD-WAN reporting and analyticsEnhanced analytics for WAN link availability, performance service-level agreements (SLAs) and application traffic in runtime, and historical stats allow the infrastructure team to troubleshoot and quickly resolve network issues. FortiManager, integrated with FortiAnalyzer, offers advanced telemetry for application visibility and network performance to achieve faster resolution and reduce the number of IT support tickets. On-demand SD-WAN reports provide further insight into the threat landscape, trust level, and asset access, which are mandated for compliance.Network Operations Center Solutions FortiManager with SD-WAN Orchestrator and FortiAnalyzerBranch Branch Branch Third-Party ToolsSD-WAN Orchestrator FortiManager FortiAnalyzerFortiGate FortiGate FortiGateCompliance reportingOrganizations need reports and tools for customization to help prove compliance to their auditors. However, compliance management has traditionally been a costly, labor-intensive process for networking teams—often requiring multiple full-time staff and months of work to aggregate and normalize data from multiple point security products.Fortinet accelerates compliance reporting by simplifying security infrastructure and eliminating the need for many manual processes. FortiManager and FortiAnalyzer include customizable regulatory templates as well as canned reports for standards such as Payment Card Industry Data Security Standard (PCI DSS), Security Activity Report (SAR), Center for Internet Security (CIS), and National Institute of Standards and Technology (NIST). They also provide audit logging and role-based access control (RBAC) to ensure that employees can only access the information they need to perform their jobs.As an extension of FortiManager and FortiAnalyzer capabilities, the FortiGuard Security Rating Service runs audit checks to help security and networking teams identify critical vulnerabilities and configuration weaknesses in their Security Fabric setup and implement best-practice recommendations. As part of the service, network leaders can compare their organization’s security posture score against those of other industry peers.5Integration and automationTo be effective, security must integrate seamlessly across every part of the distributed organization—every branch and remote office location. Network engineering and operations leaders need full visibility across the entire attack surface from a single location. They then need automated responses to reduce the time window from detection to remediation and alleviate the burdens of manual tasks from their staff.FortiManager and FortiAnalyzer help decrease threat remediation time from months to minutes by coordinating policy-based automated response actions across the Fortinet Security Fabric, an integrated security architecture that unlocks security workflows and threat intelligence automation. A detected incident alert sent with contextual awareness data from one branch location allows a network administrator to quickly determine a course of action to protect the entire enterprise against a potential coordinated attack. Certain events can also trigger automatic changes to device configurations to instantly close the loop on attack mitigation.FortiAnalyzer and FortiManager also automate many required SD-WAN tasks to help network leaders reduce the burden on their staff resources. Both products integrate with third-party tools, such as security information and event management (SIEM), IT service management (ITSM), and DevOps (for example, Ansible, Terraform), to preserve existing workflows and previous investments in other security and networking tools.Delivering Value, Simplicity, and SecurityFortiManager and FortiAnalyzer deliver enterprise-class security and branch networking capabilities with industry-leading benefits: Increases ROI: Fortinet’s integrated approach to secure SD-WAN improves return on investment (ROI) by consolidating the number of networking and security tools required via capital expenditure (CapEx) while also reducing operating expenses (OpEx) through simplified management and workflow automation. The move to public broadband means expensive multiprotocol label switching (MPLS) connections can be replaced with more cost-effective options. Here, Fortinet Secure SD-WAN delivers 300% ROI over three years, eight months payback, a 65% reduction in the number of network disruptions, and a 50% increase in the productivity of security and network teams.6Improves efficiency: Simultaneously, Fortinet institutes a simplified infrastructure for SD-WAN that reduces operational complexity both at the branch and across the entire distributed organization. Fortinet Secure SD-WAN can be administered through a single, intuitive management console. With FortiManager, FortiGate devices are true plug-and-play. Centralized policies and device information can be configured with FortiManager, and the FortiGate devices are automatically updatedto the latest policy configuration. The flexibility of single-pane-of-glass management includes scalable remote security and network control via the cloud for all branches and locations.Contains risks: Fortinet’s tracking and reporting features help organizations ensure compliance with privacy laws, security standards, and industry regulations while reducing risks associated with fines and legal costs in the event of a breach. FortiAnalyzer tracks real-time threat activity, facilitates risk assessment, detects potential issues, and helps mitigate problems. Its close integration with Fortinet Secure SD-WAN allows it to monitor firewall policies and help automate compliance audits across distributed business infrastructures.The average total cost of a data breach ($4.35 million) in 2022, a 2.6% increase from last year.7Fortinet Realizes Secure SD-WANThere are many use cases for secure SD-WAN, and Fortinet’s unique approach enables them in the most effective way for all types of SD-WAN projects. Simplifying SD-WAN operations is core to successful implementation and expansion in supportof digital innovation initiatives. Fortinet Secure SD-WAN with FortiManager and FortiAnalyzer offers best-of-breed SD-WAN management and analytics capabilities that help network leaders reduce operational costs and risks at the network edge.1“SD-WAN Market,” Prescient & Strategic Intelligence, Dec. 2022.2“Fortinet Named a 2023 Gartner® Peer Insights™ Customers’ Choice for SD-WAN for the Fourth Year in a Row,” Fortinet, March 23, 2023.3“2022 Gartner® Magic Quadrant™ for SD-WAN,” Gartner, September 2022.4 Meiran Galis, “Security Compliance: Hurdle or Critical Growth Strategy,” Forbes, June 13, 2023.5“FortiGuard Security Rating Service,” Fortinet, accessed July 20, 2023.6“The Total Economic Impact™ Of Fortinet Secure SD-WAN,” Forrester, Dec. 2022.7“Cost of a Data Breach Report 2022,” Ponemon Institute and IBM, July 2022. Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved.Copyright © 2023 Fortinet, Inc. All rights reserved. Fortinet, FortiGate, FortiCare and FortiGuard, and certain other marks are registered trademarks of Fortinet, Inc., and other Fortinet names herein may also be registered and/or common law trademarks of Fortinet. All other product or company names may be trademarks of their respective owners. Performance and other metrics contained herein were attained in internal lab tests under ideal conditions, and actual performance and other results may vary. Network variables, different network environments and other conditions may affect performance results. Nothing herein represents any binding commitment by Fortinet, and Fortinet disclaims all warranties, whether express or implied, except to the extent Fortinet enters a binding written contract, signed by Fortinet’s General Counsel, with a purchaser that expressly warrants that the identified product will perform according to certain expressly-identified performance metrics and, in such event, only the specific performance metrics expressly identified in such binding written contract shall be binding on Fortinet. For absolute clarity, any such warranty will be limited to performance in the same ideal conditions as in Fortinet’s internal lab tests. Fortinet disclaims in full any covenants, representations, and guarantees pursuant hereto, whether express or implied. Fortinet reserves the right to change, modify, transfer, or otherwise revise this publication without notice, and the most current version of the publication shall be applicable.。

华为防火墙 SD-WAN 配置管理手册说明书

防火墙/SD-WAN配置管理手册手册版本V5.0产品版本V5.0资料状态发行内容介绍本手册详细介绍防火墙/SD-WAN的功能特性，配置方法；用于指导用户对于产品的配置，使用。

本书共分为六部分：第一部分管理方式介绍内容涵盖第1章；主要介绍防火墙的WEB管理方法。

第二部分系统信息内容涵盖第2-14章；主要介绍防火墙的系统状态，历史数据统计，流量监控等功能的使用方法。

第三部分网络配置内容涵盖第16-41章，主要介绍防火墙网络相关功能配置方式。

包括VLAN，链路聚合，IP地址，静态路由，策略路由，动态路由，静态ARP，NAT，协议管理，网络调试的介绍。

第四部分安全特性内容涵盖第42-68章；主要介绍的安全相关策略的配置，包括安全策略，ARP 和DoS防护策略，流控策略，应用策略，会话控制策略等第五部分模板与对象内容涵盖第69-79章；防火墙为使配置更加灵活简便，引入了对象及模板的概念。

对象建立好后，可以在多种业务功能中使用。

该部分包括对地址对象，时间对象，服务对象，ISP地址对象，健康检查模板的介绍。

第六部分系统管理内容涵盖80-90章，主要介绍防火墙安全特性的系统特性的配置方式。

包括设备基本配置，时间配置，配置文件管理，操作系统升级管理，管理员，许可授权，高可靠性，VRRP ，日志管理和SNMP。

防火墙/sd-wan配置管理手册 (1)内容介绍 (1)第1章Web管理介绍 (1)1.1 Web管理概述 (1)1.2 工具条 (1)1.2.1 保存配置 (1)1.2.2 修改密码 (1)1.2.3 注销 (2)1.3 Web管理 (2)1.3.1 菜单 (3)1.3.2 列表 (3)1.3.3 图标 (4)1.4 设备默认配置 (4)1.4.1 管理接口的默认配置 (4)1.4.2 默认管理员用户 (4)第2章首页 (5)2.1 首页 (5)2.1.1 用户流量排行Top10 (5)2.1.2 应用流量排行Top10 (6)2.1.3 威胁统计 (6)2.1.4 URL访问排行Top10 (7)2.1.5 设备流量 (7)2.1.6 连接数 (8)2.1.7 高级别日志 (8)2.1.8 物理接口信息 (9)2.1.9 系统信息 (10)2.1.10 常用配置概览 (11)第3章vCenter (12)3.1 vCenter概述 (12)3.2 流量 (12)3.3 威胁 (14)第4章系统监控 (16)4.1 系统监控概述 (16)4.2 系统监控 (16)第5章接口监控 (17)5.1 接口监控概述 (17)5.2 接口概览 (17)5.3 接口详情 (18)第6章威胁监控 (21)6.1 威胁监控概述 (21)6.2 威胁概览 (21)6.3 威胁详情 (25)第7章用户监控 (28)7.1 用户监控概述 (28)7.2 用户概览 (28)7.3 用户详情 (29)7.4 指定用户 (30)第8章应用监控 (32)8.1 应用监控概述 (32)8.2 应用监控概览 (32)8.3 应用统计详情 (33)第9章流量监控 (37)9.1 流量监控概述 (37)9.2 流量监控详情 (37)第10章URL监控 (38)10.1 URL监控概述 (38)10.2 URL监控概览 (38)10.3 URL统计详情 (38)第11章SDWAN监控 (42)11.1 SDWAN监控概述 (42)11.2 链路质量 (42)11.3 SDWAN统计 (42)11.4 WOC加速统计 (43)第12章会话监控 (45)12.1 会话监控概述 (45)12.2 会话统计 (45)12.3 标准会话 (46)12.4 配置案例 (47)第13章流量统计 (50)13.1 基于IP/端口流量统计查询 (50)13.2 配置案例 (51)13.3 基于策略流量统计 (51)13.4 配置案例 (52)第14章主机监控 (54)14.1 主机监控概述 (54)14.2 威胁主机 (54)14.3 风险主机 (55)14.4 关注网段 (56)第15章资产防护 (58)15.1 资产防护概述 (58)15.2 配置资产防护 (58)15.2.1 防护配置 (58)15.3 配置资产黑名单 (59)15.3.1 配置资产黑名单 (59)15.3.2 放行删除资产黑名单 (61)15.3.3 手动删除资产黑名单 (61)15.3.4 重置资产黑名单命中数 (62)15.3.5 查询资产黑名单配置 (62)15.3.6 设置资产黑名单阻断方向 (62)15.4 配置IP-MAC绑定 (63)15.4.1 配置IP-MAC绑定 (63)15.5 配置交换机联动 (63)15.5.1 配置的基本要素 (63)15.5.2 启用交换机联动 (64)15.5.3 删除SNMP服务器 (65)15.6 配置预定义指纹库 (65)15.6.1 预定义指纹库版本 (65)15.6.2 预定义指纹库总数 (65)15.6.3 预定义指纹库升级 (65)15.7 配置自定义指纹 (66)15.7.1 配置的基本要素 (66)15.7.2 编辑自定义指纹 (67)15.7.3 删除自定义指纹 (67)15.7.4 导入自定义指纹 (68)15.7.5 导出自定义指纹 (68)15.8 配置资产列表 (69)15.8.1 资产列表配置 (69)15.9 行为学习 (71)15.9.1 连接和资产统计 (71)15.9.2 连接关系详情 (72)15.9.3 当前连接数详情 (74)15.9.4 隔离资产详情 (75)15.10 配置案例 (75)15.10.1 配置案例1：对某个网段开启资产防护功能 (75)15.10.2 配置案例：创建资产黑名单 (77)15.10.3 配置案例：交换机联动 (78)第16章接口 (79)16.1 接口概述 (79)16.2 物理接口配置 (79)16.3 VLAN配置 (82)16.3.1 添加VLAN (83)16.3.2 修改VLAN (85)16.3.3 删除VLAN (86)16.4 VXLAN配置 (86)16.4.1 添加VXLAN (87)16.4.2 修改VXLAN (87)16.4.3 删除VXLAN (88)16.5 透明桥配置 (88)16.5.1 添加透明桥 (88)16.5.2 修改桥接口 (90)16.5.3 删除桥接口 (91)16.6 链路聚合配置 (92)16.6.1 添加链路聚合 (92)16.6.2 修改链路聚合 (94)16.6.3 删除链路聚合 (95)16.7 GRE配置 (95)16.7.1 添加GRE接口 (95)16.7.2 修改GRE (97)16.7.3 删除GRE接口 (97)16.8 LOOPLACK接口配置 (98)16.8.1 添加LOOPBACK接口 (98)16.8.2 修改LOOPBACK接口 (99)16.8.3 删除LOOPBACK接口 (99)16.9 旁路部署 (100)16.10 接口联动 (100)16.10.1 接口联动概述 (100)16.10.2 配置接口联动组 (100)16.10.3 编辑接口联动组 (101)16.10.4 删除接口联动组 (102)16.11 配置案例 (102)16.11.1 配置案例1：增加一个VLAN (102)16.11.2 配置案例2：增加一个VXLAN隧道配置 (103)16.11.3 配置案例3：增加一个链路聚合 (104)16.11.4 配置案例4：配置桥模式 (105)16.11.5 配置案例5：增加一个GRE接口 (105)16.12 常见故障分析 (106)16.12.1 故障现象：链路聚合接口无效 (106)16.12.2 故障现象：VLAN下tagged接口无效 (106)16.12.3 故障现象：桥接环境，部分流量不通 (107)16.12.4 故障现象：GRE隧道环境，流量不通 (107)第17章安全域 (108)17.1 安全域概述 (108)17.2 配置安全域 (108)17.2.1 配置安全域 (108)17.2.2 编辑安全域 (109)17.2.3 删除安全域 (110)17.3 配置案例 (110)17.3.1 配置案例1：增加一个安全域并在防火墙策略中进行引用 (110)17.4 常见故障分析 (112)17.4.1 故障现象：安全域无法选择某接口 (112)第18章静态ARP (113)18.1 静态ARP概述 (113)18.2 静态ARP配置 (113)18.2.1 添加静态ARP (113)18.2.2 修改静态ARP (114)18.2.3 删除静态ARP (114)18.3 常见故障分析 (115)18.3.1 故障现象：添加静态ARP后网络不通 (115)第19章DHCP服务器 (116)19.1 DHCP服务概述 (116)19.1.1 DHCP服务器概述 (116)19.1.2 DHCP Relay概述 (117)19.2 配置说明 (117)19.2.1 在接口上指定DHCP服务 (117)19.2.2 配置DHCP服务器地址池 (119)19.2.3 配置DHCP服务器地址排除 (120)19.2.4 配置DHCP服务器地址绑定 (121)19.3 配置案例 (122)19.3.1 案例1：接口ge0/2配置DHCP Server (122)19.3.2 案例2：接口ge0/1配置DHCP Relay (124)19.4 监控与维护 (125)19.4.1 查看DHCP服务器的地址分配 (125)19.5 常见故障分析 (126)19.5.1 故障现象：启用DHCP Server的接口对应的DHCP Client不能获得地址 (126)19.5.2 故障现象：启用DHCP Relay的接口对应的DHCP Client不能获得地址 (126)第20章静态路由 (128)20.1 静态路由概述 (128)20.2 配置静态路由 (128)20.2.1 配置IPv4静态路由 (128)20.2.2 查看IPv4路由表 (129)20.2.3 配置IPv6静态路由 (129)20.2.4 查看IPv6路由表 (130)20.2.5 IPv6前缀公告 (130)20.3 配置案例 (131)20.3.1 配置案例1：对多条路由配置路由监控 (131)20.4 常见故障分析 (134)20.4.1 路由状态为失效状态 (134)第21章静态路由BFD (135)21.1 BFD概述 (135)21.2 配置说明 (135)21.2.1 配置静态路由BFD (135)21.3 配置案例 (136)21.3.1 配置BFD与静态路由联动 (136)21.4 故障分析 (137)21.4.1 BFD邻居建立失败 (137)第22章RIP路由 (138)22.1 RIP协议概述 (138)22.2 配置RIP协议 (138)22.2.1 缺省配置信息 (138)22.2.2 配置RIP版本 (138)22.2.3 配置RIP高级选项 (139)22.2.4 配置RIP发布的网络 (140)22.2.5 配置RIP接口 (141)22.3 配置案例 (142)22.3.1 配置案例：配置两台防火墙设备互连 (142)22.4 查看RIP配置信息 (144)22.4.1 查看RIP配置信息 (144)22.5 常见故障分析 (144)22.5.1 故障现象1：两台设备不能正常通信 (144)第23章OSPF路由 (145)23.1 OSPF协议概述 (145)23.2 配置OSPF协议 (145)23.2.1 缺省配置信息 (145)23.2.2 配置OSPF (146)23.2.3 配置OSPF的网络 (147)23.2.4 编辑区域属性 (147)23.2.5 配置OSPF接口 (148)23.3 配置案例 (149)23.3.1 配置案例：配置两台防火墙设备互连 (149)23.4 OSPF监控与维护 (151)23.4.1 查看邻居路由器状态信息 (151)23.5 常见故障分析 (151)23.5.1 故障现象：两台设备不能建立邻接关系 (151)第24章BGP路由 (153)24.1 BGP协议概述 (153)24.2 配置BGP协议 (154)24.2.1 缺省配置信息 (154)24.2.2 配置BGP Router-ID (155)24.2.3 配置运行BGP (156)24.2.4 配置指定BGP的对等体 (156)24.2.5 配置宣告网络 (157)24.3 配置案例 (157)24.3.1 配置案例1：配置两台FW设备互连 (157)24.4 BGP监控与维护 (159)查看BGP路由信息 (159)24.5 常见故障分析 (159)24.5.1 故障现象1：两台设备不能建立邻接关系 (159)第25章策略路由 (160)25.1 策略路由概述 (160)25.2 配置策略路由 (160)25.2.1 创建策略路由 (160)25.2.2 编辑策略路由 (161)25.2.3 删除策略路由 (162)25.2.4 策略路由顺序调整 (163)25.2.5 策略路由启用禁用 (163)25.2.6 查看策略路由列表 (164)25.3 配置案例 (165)25.3.1 策略路由案例1 (165)25.3.2 策略路由案例2 (168)25.3.3 策略路由案例3 (169)25.4 常见故障分析 (171)25.4.1 策略路由不生效 (171)25.4.2 策略路由部分下一跳没有命中计数 (172)第26章会话保持 (173)26.1 会话保持概述 (173)26.2 配置会话保持 (173)26.2.1 配置会话保持 (173)26.2.2 会话保持配置说明 (173)26.3 常见故障分析 (174)26.3.1 策略路由会话保持不生效 (174)26.3.2 会话保持不生效 (174)第27章配置NAT (175)27.1 NAT概述 (175)27.2 配置NAT (175)27.2.1 配置地址池(NAT Pool) (176)27.2.2 编辑地址池 (177)27.2.4 配置源地址转换 (178)27.2.5 配置目的地址转换 (180)27.2.6 配置双向地址转换 (181)27.2.7 配置静态地址转换 (183)27.2.8 启用NAT规则 (184)27.2.9 编辑NAT规则 (184)27.2.10 删除NAT规则 (185)27.2.11 移动NAT规则 (186)27.3 NAT监控与维护 (186)27.3.1 查看地址池 (186)27.3.2 查看源、目的NAT规则 (187)27.3.3 查看静态NAT规则 (188)27.3.4 查看NAT规则并发连接数和命中数 (188)27.4 配置案例 (189)27.4.1 配置源地址转换 (189)27.4.2 配置目的地址转换 (191)27.4.3 配置双向地址转换 (194)27.4.4 配置静态地址转换 (197)27.5 常见故障分析 (199)27.5.1 连接时通时断 (199)第28章NAT地址池检查 (200)28.1 配置地址池检查功能 (200)28.2 修改地址池检查配置 (201)28.3 开启地址池检查功能 (202)28.4 关闭地址池检查功能 (202)28.5 查看地址池检查状态 (203)第29章跨协议转换 (205)29.1 跨协议转换概述 (205)29.2 配置跨协议转换规则 (205)29.2.1 配置IVI转换方式 (205)29.2.2 配置嵌入地址转换方式 (207)29.2.3 配置地址池转换方式 (209)29.2.4 编辑跨协议转换规则 (211)29.2.5 删除跨协议转换规则 (212)29.2.6 移动跨协议转换规则 (213)29.3 配置案例 (213)29.3.1 配置NAT46转换 (213)29.3.2 配置NAT64转换 (215)29.4 常见故障分析 (217)29.4.1 用户发现网络中一直有地址冲突的情形 (217)29.4.2 用户发送的请求报文无法到达设备 (218)第30章端口管理 (219)30.1 端口管理概述 (219)30.2 端口配置 (219)30.2.1 设置端口号 (219)30.2.2 删除端口号 (219)30.2.3 查看端口号 (220)30.3 配置案例 (220)第31章IPSec VPN (224)31.1 概述 (224)31.2 IPSec VPN配置过程 (224)31.2.1 配置IKE协商策略 (225)31.2.2 配置IPSEC协商策略 (225)31.2.3 配置IPsec策略 (226)31.3 IPSec VPN配置参数 (227)31.3.1 IKE协商参数 (227)31.3.2 IPSEC协商参数 (229)31.3.3 IPsec策略 (230)31.4 配置案例 (231)31.4.1 配置案例1：配置IPSEC基本组网 (231)31.4.2 配置案例2：配置IPSEC HUB_SPOKE (233)31.5 IPSEC VPN监控与维护 (239)31.5.1 查看SA是否建立 (239)31.5.2 删除建立的SA (240)31.6 常见故障分析 (240)31.6.1 故障现象：不能建立隧道 (240)第32章SSL远程接入 (241)32.1 技术简介 (241)32.2 配置SSL VPN (241)32.2.1 配置SSL VPN基本功能 (242)32.2.2 配置SSL VPN用户和用户组 (244)32.2.3 配置SSL VPN Web访问配置 (245)32.2.4 配置SSL VPN资源和资源组 (246)32.2.5 配置SSL VPN接口选项 (248)32.3 SSL VPN登录 (249)32.3.1 WEB模式 (249)32.3.2 Tunnel模式 (252)32.4 SSL VPN监控与维护 (258)32.4.1 SSL VPN监视器 (258)32.5 WINDOWS7 下的使用注意事项 (258)32.6 SSLVPN插件、客户端与操作系统兼容性问题的FAQ (263)32.6.1 共性问题 (263)32.6.2 针对Windows 2003和Windows XP-SP3操作系统 (264)32.6.3 针对Windows Vista、Windows 7和Windows 2008操作系统 (267)第33章L2TP (273)33.1 L2TP概述 (273)33.2 配置L2TP (274)33.2.1 配置认证用户 (275)33.2.2 配置用户组 (275)33.2.3 配置接口接入控制 (276)33.2.4 配置L2TP (277)33.3 配置案例 (278)33.3.1 案例1：在接口ge0/0上启用L2TP (278)33.4 L2TP监控与维护 (280)33.4.1 察看L2TP会话信息 (280)33.5 故障分析 (280)33.5.1 L2TP客户端拨号，无法建立连接 (280)33.5.2 L2TP建立连接后，出现异常断开 (281)第34章DNS代理 (282)34.1 DNS代理概述 (282)34.2 配置DNS代理 (282)34.2.1 配置服务器 (282)34.2.2 配置代理策略 (283)34.2.3 配置全局配置 (284)34.3 配置案例 (285)34.3.1 DNS代理配置案例1 (285)34.3.2 DNS代理配置案例2 (287)第35章DNS服务 (289)35.1 DNS服务概述 (289)35.2 配置DNS服务 (289)35.2.1 基础配置 (289)35.2.2 配置DNS记录 (290)35.2.3 配置案例 (296)第36章系统参数 (299)36.1 系统参数概述 (299)36.2 协议管理 (299)36.3 TCP状态管理 (300)36.4 参数管理 (300)第37章WEB调试 (302)37.1 WEB调试概述 (302)37.2 配置WEB调试 (302)37.2.1 配置WEB调试的基本要素 (302)37.2.2 配置协议为TCP(UDP)的WEB调试 (303)37.2.3 配置协议为ICMP的WEB调试 (304)37.2.4 配置协议为OTHER的WEB调试 (304)37.3 配置案例 (305)37.3.1 案例1：使用IPv4的Web调试功能 (305)第38章路由跟踪 (308)38.1 路由跟踪概述 (308)38.2 配置路由跟踪 (308)38.2.1 配置路由跟踪的基本要素 (308)38.2.2 配置TCP(或UDP)协议类型的路由跟踪 (309)38.2.3 配置ICMP协议类型的路由跟踪 (309)38.2.4 配置IP协议类型的路由跟踪 (310)38.3 配置案例 (310)38.3.1 案例1：配置IPv4路由跟踪 (310)38.3.2 案例2：配置IPv6路由跟踪 (311)第39章诊断 (313)39.1 诊断功能概述 (313)39.2 配置 (313)39.2.1 配置traceroute诊断 (313)39.2.2 配置ping诊断 (314)39.2.3 配置TCP诊断 (314)39.2.4 配置ping6诊断 (315)39.3 配置案例 (315)39.3.1 配置案例1：对网络进行traceroute诊断 (315)第40章PMTU (317)40.1 PMTU概述 (317)40.2 PMTU配置 (317)40.3 配置案例 (317)第41章自定义抓包 (319)41.1 自定义抓包概述 (319)41.2 自定义抓包配置 (319)41.3 配置案例 (320)第42章SDWAN策略 (322)42.1 SDWAN策略概述 (322)42.2 配置SDWAN策略 (322)42.2.1 创建SDWAN策略 (322)42.2.2 编辑SDWAN策略 (324)42.2.3 删除SDWAN策略 (324)42.2.4 SDWAN策略顺序调整 (325)42.2.5 SDWAN策略启用禁用 (325)42.2.6 查看SDWAN策略列表 (327)42.3 配置链路质量检查 (327)42.4 配置案例 (329)42.4.1 SDWAN策略案例 (329)42.4.2 链路质量检查案例 (332)42.5 常见故障分析 (334)42.5.1 SDWAN策略不生效 (334)42.5.2 SDWAN策略部分下一跳没有命中计数 (335)第43章WOC加速模板 (336)43.1 WOC加速模板概述 (336)43.2 配置WOC加速模板 (336)43.2.1 新建WOC加速模板 (336)43.2.2 编辑WOC加速模板 (336)43.2.3 删除WOC加速模板 (337)43.2.4 防护策略引用WOC加速模板 (337)43.3 WOC加速监控 (338)43.4 配置案例 (339)第44章防火墙策略 (340)44.1 防火墙策略概述 (340)44.2 配置策略组 (340)44.2.1 配置策略组 (340)44.2.2 启用策略组 (341)44.2.3 删除策略组 (341)44.2.4 移动策略组 (342)44.2.5 插入策略组 (343)44.2.6 重命名策略组 (343)44.2.7 策略组内策略迁移 (344)44.3 配置防火墙策略 (345)44.3.1 配置策略的基本要素 (345)44.3.2 配置DENY策略 (346)44.3.3 配置PERMIT策略 (347)44.3.4 启用防火墙策略 (348)44.3.5 编辑防火墙策略 (349)44.3.6 删除防火墙策略 (353)44.3.7 移动防火墙策略 (353)44.3.8 插入防火墙策略 (354)44.3.9 策略配置模块 (355)44.3.10 策略预编译模块 (356)44.4 防火墙策略监控与维护 (357)44.4.1 按协议类型查看防火墙策略 (357)44.4.2 按分类方式（策略组）查看防火墙策略 (357)44.4.3 按分类方式（接口对）查看防火墙策略 (358)44.4.4 导出csv文件查看防火墙策略 (359)44.4.5 按过滤条件查询防火墙策略 (360)44.4.6 防火墙策略冗余检测 (361)44.4.7 查看防火墙策略流量统计 (362)44.4.8 查看防火墙策略会话监控信息 (362)44.4.9 查看防火墙策略当前连接数 (363)44.5 配置案例 (364)44.5.1 配置案例1：创建IPV4防火墙策略 (364)44.5.2 配置案例2 ：二层转发控制 (366)44.5.3 配置案例3：web认证用户防火墙策略控制 (367)44.6 常见故障分析 (370)44.6.1 故障现象1：匹配上某条策略的数据流没有执行相应的动作 (370)44.6.2 故障现象2：配置基于应用的防火墙策略不能匹配 (371)44.6.3 故障现象3：防火墙策略部分接口不能选择 (371)第45章本地安全策略 (372)45.1 本地安全策略概述 (372)45.2 配置本地安全策略 (372)45.2.1 创建本地安全策略 (372)45.2.2 编辑本地安全策略 (373)45.2.3 删除本地安全策略 (373)45.2.4 移动本地安全策略 (373)45.2.5 插入本地安全策略 (374)45.2.6 启用本地安全策略 (374)45.2.7 查看本地安全策略列表 (375)45.2.8 策略配置模块 (375)45.3 配置案例 (376)45.3.1 配置案例：阻断不安全用户访问设备 (376)第46章防护策略 (378)46.1 安全防护策略概述 (378)46.2 配置安全防护策略 (378)46.2.1 配置策略的基本要素 (378)46.2.2 启用安全防护策略 (380)46.2.3 编辑安全防护策略 (380)46.2.4 删除安全防护策略 (381)46.2.5 调整安全防护策略的顺序 (382)46.2.6 插入一条攻击防护策略 (383)46.2.7 重置安全防护策略的命中计数 (384)46.2.8 查询攻击防护策略 (384)46.3 配置案例 (385)46.3.1 案例1：创建安全防护策略 (385)46.3.2 案例2：创建安全防护防扫描策略 (386)46.4 常见故障分析 (388)46.4.1 故障现象：某些应该匹配上某条策略的数据流没有匹配上该策略 (388)第47章攻击防护 (389)47.1 攻击防护概述 (389)47.2 配置攻击防护 (389)47.2.2 编辑攻击防护 (392)47.2.3 删除攻击防护 (393)47.2.4 在安全防护策略中引用攻击防护 (394)47.3 配置案例 (395)47.3.1 案例1：创建安全防护防Flood策略 (395)47.3.2 案例2：创建安全防护防扫描策略 (396)47.4 攻击防护监控与维护 (398)47.4.1 查看攻击防护日志 (398)47.5 常见故障分析 (399)47.5.1 故障现象：防flood功能不能正常工作 (399)第48章病毒防护 (400)48.1 病毒防护概述 (400)48.2 配置病毒防护 (400)48.2.1 新建病毒防护模板 (400)48.2.2 编辑病毒防护模板 (400)48.2.3 删除病毒防护模板 (401)48.2.4 防护策略引用病毒防护模板 (401)48.3 配置文件类型 (402)48.3.1 文件扫描配置 (402)48.3.2 新增文件类型 (403)48.3.3 删除文件类型 (404)48.3.4 文件类型的启用和不启用 (404)48.4 配置案例 (405)48.5 病毒防护监控 (407)48.5.1 查看病毒防护日志 (407)第49章入侵防护 (409)49.1 入侵防护概述 (409)49.2 配置事件集 (409)49.2.1 新建事件集 (409)49.2.2 编辑事件集 (410)49.2.3 删除事件集 (411)49.2.4 复制事件集 (412)49.2.5 防护策略引用事件集 (413)49.3 事件集中事件配置 (414)49.3.1 查看事件 (414)49.3.2 在线说明 (415)49.3.3 添加事件 (416)49.3.4 删除事件 (417)49.3.5 编辑事件 (418)49.3.6 搜索事件 (419)49.4 自定义事件配置 (419)49.4.2 编辑自定义事件 (421)49.4.3 删除自定义事件 (422)49.4.4 引用自定义事件 (423)49.4.5 自定义事件在线说明 (423)49.5 全局配置 (424)49.6 自定义事件配置备份恢复 (425)49.7 IPS抓包 (425)49.7.1 IPS抓包概述 (425)49.7.2 IPS抓包配置 (425)49.7.3 IPS抓包配置案例 (426)49.8 配置案例 (428)49.9 入侵防护监控 (430)49.9.1 查看入侵防护日志 (430)第50章Web防护 (431)50.1 Web防护概述 (431)50.2 配置Web防护 (431)50.2.1 配置策略的基本要素 (431)50.2.2 编辑Web防护 (432)50.2.3 删除Web防护策略 (432)第51章威胁情报 (434)51.1 威胁情报概述 (434)51.2 配置威胁情报 (434)51.2.1 配置威胁情报 (434)51.2.2 编辑威胁情报 (435)51.2.3 删除威胁情报 (435)51.2.4 配置防护等级 (435)51.2.5 配置云端查询 (436)51.2.6 情报库升级 (436)51.3 配置案例 (437)51.4 威胁情报监控 (438)51.4.1 查看IP地址威胁监控 (438)51.4.2 查看域名威胁监控 (439)第52章Dos防护 (440)52.1 防攻击概述 (440)52.2 配置防攻击 (440)52.3 配置案例 (441)52.3.1 案例1：配置防DOS攻击 (441)52.4 防攻击监控与维护 (443)52.4.1 查看防攻击日志 (443)52.5 常见故障分析 (443)52.5.1 故障现象：SYN Flood攻击防御失效 (443)52.5.2 故障现象：配置防扫描后没有报警，没有拒包 (444)第53章ARP攻击防护 (445)53.1 ARP攻击防护概述 (445)53.2 配置ARP攻击防护 (445)53.2.1 缺省配置信息 (445)53.2.2 ARP攻击防护基本配置 (445)53.2.3 主动保护列表配置 (447)53.2.4 IP-MAC绑定配置 (448)53.2.5 ARP表 (448)53.3 配置案例 (450)53.3.1 配置案例：配置防ARP欺骗和防ARP Flood (450)53.4 常见故障分析 (452)53.4.1 故障现象：PC无法上网 (452)第54章IP黑名单防护 (453)54.1 IP黑名单概述 (453)54.2 配置IP黑名单阻断方向 (453)54.3 配置IP黑名单组 (454)54.3.1 创建IP黑名单组 (454)54.3.2 删除IP黑名单组 (455)54.3.3 修改IP黑名单组 (455)54.3.4 修改IP黑名单组名称 (456)54.3.5 启停IP黑名单组 (456)54.3.6 查询IP黑名单组 (457)54.4 配置IP黑名单 (457)54.4.1 创建IP黑名单 (457)54.4.2 编辑创建IP黑名单 (459)54.4.3 修改IP黑名单 (460)54.4.4 删除IP黑名单 (460)54.4.5 删除失效IP黑名单 (461)54.4.6 超时自动删除IP黑名单 (461)54.4.7 重置IP黑名单命中数 (462)54.4.8 查询IP黑名单 (462)54.4.9 组过滤显示IP黑名单 (462)54.4.10 全局开关IP黑名单 (463)54.5 IP黑名单配置导入导出 (463)54.5.1 IP黑名单导入 (463)54.5.2 IP黑名单导出 (465)54.6 配置案例 (466)54.6.1 案例1：创建IP黑名单 (466)54.6.2 案例2：创建实时阻断IP黑名单 (466)54.6.3 案例3：创建入侵防护阻断IP黑名单 (467)54.6.4 案例4：创建WEB应用防护阻断IP黑名单 (468)54.6.5 案例5：创建口令防护IP黑名单 (468)第55章域名黑名单防护 (470)55.1 域名黑名单概述 (470)55.2 配置域名黑名单 (470)55.2.1 配置域名黑名单 (470)55.2.2 编辑创建域名黑名单 (471)55.2.3 修改域名黑名单 (472)55.2.4 删除黑名单 (472)55.2.5 重置域名黑名单命中数 (472)55.2.6 刷新域名黑名单 (473)55.3 查询域名黑名单配置 (473)55.4 域名黑名单配置导入导出 (473)55.4.1 域名黑名单导入 (474)55.4.2 域名黑名单导出 (474)55.5 配置案例 (474)55.5.1 案例1：禁止员工访问博彩站点 (474)55.5.2 案例2：禁止员工在上班期间访问游戏站点 (475)55.6 域名黑名单防护监控与维护 (476)55.6.1 查看域名黑名单防护日志 (476)第56章白名单防护 (477)56.1 白名单概述 (477)56.2 配置白名单匹配方向 (477)56.3 配置白名单 (477)56.3.1 配置白名单 (477)56.3.2 编辑创建白名单 (479)56.3.3 修改白名单 (479)56.3.4 删除白名单 (480)56.3.5 重置白名单命中数 (480)56.3.6 全局开关白名单 (481)56.3.7 查询白名单 (481)56.4 白名单配置导入导出 (481)56.4.1 白名单导入 (482)56.4.2 白名单导出 (483)56.5 配置案例 (483)56.5.1 案例1：创建白名单 (483)第57章口令防护 (484)57.1 口令防护概述 (484)57.2 配置口令防护 (484)57.2.1 新建口令防护模板 (484)57.2.2 编辑口令防护模板 (486)57.2.3 删除口令防护 (486)57.2.1 在安全防护策略中引用口令防护 (487)57.3 配置案例 (488)57.3.1 案例1：创建安全防护弱口令检查策略 (488)57.3.2 案例2：创建安全防护防口令暴力破解策略 (489)57.4 口令防护监控与维护 (490)57.4.1 查看口令防护日志 (490)第58章Web应用防护 (492)58.1 概述 (492)58.2 配置策略 (492)58.2.1 策略的基本要素 (492)58.2.2 新建策略 (492)58.2.3 编辑策略 (493)58.2.4 删除策略 (494)58.2.5 移动策略 (494)58.2.6 插入策略 (495)58.3 配置事件集 (495)58.3.1 新建事件集 (495)58.3.2 编辑事件集 (496)58.3.3 删除事件集 (497)58.3.4 复制事件集 (497)58.4 配置事件集中事件 (497)58.4.1 查看事件 (497)58.4.2 添加事件 (498)58.4.3 编辑事件 (499)58.4.4 删除事件 (500)58.5 配置自定义事件 (500)58.5.1 添加自定义事件 (500)58.5.2 编辑自定义事件 (501)58.5.3 删除自定义事件 (502)58.5.4 引用自定义事件 (502)58.6 配置合规检查模板 (503)58.6.1 添加合规检查模板 (503)58.6.2 编辑合规检查模板 (504)58.6.3 删除合规检查模板 (505)58.7 配置参数 (505)58.8 配置案例 (506)58.8.1 阻断POST方法 (506)58.9 常见故障分析 (507)58.9.1 自定义事件不能匹配 (507)第59章应用控制策略 (508)59.1 应用控制策略概述 (508)59.2 配置应用控制策略 (508)59.2.1 配置策略的基本要素 (508)59.2.2 关键字配置 (510)59.2.3 启用应用控制策略 (510)59.2.4 编辑应用控制策略 (511)59.2.5 删除应用控制策略 (512)59.2.6 调整应用控制策略的顺序 (512)59.2.7 查询应用控制策略 (513)59.3 配置案例 (513)59.3.1 案例1：阻断QQ号中包含“12456”的用户登陆 (513)59.3.2 案例2：拒绝接收所有电子邮件 (515)59.4 常见故障分析 (516)59.4.1 常见故障：策略没有命中 (516)第60章Web控制策略 (517)60.1 Web控制策略概述 (517)60.2 配置Web控制策略 (517)60.2.1 配置策略的基本要素 (517)60.2.2 关键字配置 (518)60.2.3 启用Web控制策略 (519)60.2.4 编辑Web控制策略 (520)60.2.5 删除Web控制策略 (520)60.2.6 调整Web控制策略的顺序 (521)60.2.7 阻断提示页面 (521)60.3 配置案例 (522)60.3.1 案例1：阻断所有新闻网页并提示该网络禁止访问新闻 (522)60.4 常见故障分析 (523)60.4.1 常见故障：策略没有命中 (523)第61章流量控制策略 (524)61.1 流量控制概述 (524)61.2 配置线路策略 (524)61.2.1 配置线路策略 (524)61.2.2 编辑线路策略 (525)61.2.3 删除线路策略 (525)61.3 配置管道策略 (526)61.3.1 配置管道策略 (526)61.3.2 编辑管道策略 (528)61.3.3 删除管道策略 (528)61.3.4 移动管道策略 (529)61.4 流量监控 (529)61.5 配置案例 (530)第62章会话控制策略 (532)62.1 会话控制策略概述 (532)62.2 配置会话控制策略 (532)62.2.1 配置策略的基本要素 (532)62.2.2 启用会话控制策略 (534)62.2.3 编辑会话控制策略 (534)62.2.4 删除会话控制策略 (535)62.2.5 调整会话控制策略的顺序 (535)62.2.6 查询会话控制策略 (536)62.3 会话控制策略监控与维护 (537)62.3.1 查看会话控制策略 (537)62.4 配置案例 (537)62.4.1 案例1：创建IPv4会话控制策略限制总连接速率 (537)62.5 常见故障分析 (538)62.5.1 故障现象：匹配上某条策略的某些数据流没有受到相应的限制 (538)第63章Web认证策略 (539)63.1 Web认证策略概述 (539)63.2 配置Web认证策略 (539)63.2.1 配置用户 (539)63.2.2 配置用户组 (541)63.2.3 配置Web认证策略 (541)63.2.4 编辑Web认证策略 (543)63.2.5 删除Web认证策略 (543)63.2.6 移动Web认证策略 (544)63.2.7 Web认证策略命中次数清零 (544)63.2.8 修改Web认证配置 (545)63.2.9 清除所有在线用户 (545)63.3 配置案例 (546)63.3.1 配置案例：配置员工上网需要ladp认证 (546)63.4 常见故障分析 (548)63.4.1 故障现象：认证用户进行认证时失败 (548)第64章地址对象 (550)64.1 地址对象概述 (550)64.2 配置地址节点 (550)64.3 批量删除地址节点 (551)64.4 配置地址组 (551)64.5 批量删除地址组 (552)64.6 配置域名地址 (552)64.7 批量删除域名地址 (553)64.8 清除域名地址解析成员 (553)64.9 配置案例 (554)64.9.1 配置案例1：增加IPv4地址节点 (554)64.9.2 配置案例2：编辑增加IPv4地址节点 (554)64.9.3 配置案例3：增加IPv6地址节点 (555)64.9.4 配置案例4：增加地址对象组 (556)64.9.5 配置案例5：增加域名地址并在防火墙策略中引用 (557)64.10 地址对象监控与维护 (558)64.10.1 查看地址节点 (558)64.10.2 查看地址组 (559)64.10.3 查看域名地址 (560)64.10.4 地址对象的备份和恢复 (561)64.11 常见故障分析 (563)64.11.1 故障现象：提交不成功 (563)64.11.2 故障现象：域名地址没有成员 (563)第65章ISP地址库 (564)65.1 ISP地址库概述 (564)65.1 配置ISP地址库 (564)65.1.1 配置ISP地址库 (564)65.1.2 ISP地址库导入 (565)65.1.3 ISP地址库导出 (565)65.1.4 ISP地址库删除 (566)65.2 常见故障分析 (567)65.2.1 ISP地址加载不完整 (567)第66章服务对象 (568)66.1 概述 (568)66.2 配置服务对象 (568)66.2.1 预定义服务 (568)66.2.2 配置自定义服务 (568)66.2.3 批量删除自定义服务 (569)66.2.4 配置服务组 (569)66.2.5 批量删除服务组 (570)66.3 配置案例 (570)66.3.1 配置案例1：添加自定义服务 (570)66.3.2 配置案例2：添加服务组 (571)66.4 服务对象监控与维护 (571)66.4.1 查看预定义服务 (571)66.4.2 查看自定义服务 (573)66.4.3 查看服务组 (574)66.5 常见故障分析 (575)66.5.1 故障现象：提交不成功 (575)第67章应用对象 (576)67.1 概述 (576)67.2 配置应用对象 (576)67.2.1 配置自定义应用 (576)67.2.2 配置应用组 (577)67.3 配置案例 (578)67.3.1 配置案例1：增加自定义应用 (578)67.3.2 配置案例2：增加应用组 (579)67.4 监控与维护 (579)67.4.1 查看预定义应用 (579)67.4.2 查看自定义应用 (580)67.4.3 查看应用组 (580)第68章用户对象 (582)68.1 用户对象概述 (582)68.2 配置用户对象 (582)68.2.1 配置本地认证用户对象 (582)68.2.2 配置radius用户对象 (582)68.2.3 配置ldap用户对象 (583)68.2.4 配置静态用户对象 (583)68.3 配置用户组对象 (584)68.4 用户对象查看 (585)68.5 用户组对象查看 (586)第69章认证服务器对象 (588)69.1 认证服务器对象概述 (588)69.2 配置认证服务器对象 (588)69.2.1 配置RADIUS服务器对象 (588)69.2.2 配置LDAP服务器 (589)69.3 配置AD域同步策略 (590)69.3.1 新建同步策略 (590)69.3.2 配置案例 (590)第70章URL分类 (592)70.1 概述 (592)70.2 配置URL分类 (592)70.2.1 配置自定义URL分类 (592)70.2.2 配置URL组 (593)70.3 自定义URL分类配置备份恢复 (594)70.4 配置案例 (595)70.4.1 配置案例1：增加自定义URL分类 (595)70.4.2 配置案例2：增加URL组 (595)70.5 监控与维护 (596)70.5.1 查看预定义URL分类 (596)70.5.2 查看自定义URL分类 (597)70.5.3 查看URL组 (597)70.5.4 URL分类查询 (598)第71章域名对象 (599)71.1 概述 (599)71.2 配置域名对象 (599)71.2.1 配置自定义域名 (599)71.2.2 配置域名组 (600)71.3 配置案例 (600)71.3.1 配置案例1：增加自定义域名 (600)71.3.2 配置案例2：增加域名组 (601)71.4 监控与维护 (601)71.4.1 查看自定义域名 (601)71.4.2 查看域名组 (602)第72章时间对象 (603)72.1 概述 (603)72.2 配置时间对象 (603)72.2.1 配置绝对时间 (603)72.2.2 配置周期时间 (603)72.3 配置案例 (604)72.3.1 配置案例1：增加绝对时间 (604)72.3.2 配置案例2：增加周期时间 (605)72.4 绝对时间与周期时间监控与维护 (605)72.4.1 查看绝对时间 (605)72.5 常见故障分析 (606)72.5.1 故障现象：提交不成功 (606)第73章健康检查 (607)73.1 健康检查概述 (607)73.2 配置健康检查 (607)73.3 配置案例 (626)第74章CA证书 (628)74.1 证书概述 (628)74.2 配置证书管理 (628)74.2.1 配置通用证书 (628)74.2.2 配置国密证书 (631)74.2.3 配置CA证书 (634)74.2.4 配置CRL证书 (636)74.2.5 配置管理根CA配置 (639)74.2.6 配置管理用户证书 (645)74.3 配置案例 (649)74.4 常见故障 (650)74.4.1 导入证书链失败 (650)第75章日志管理 (651)75.1 日志概述 (651)75.2 配置说明 (651)75.2.1 缺省配置说明 (651)75.2.2 配置SYSLOG服务器 (651)75.3 配置日志过滤 (652)75.4 部分模块日志配置的注意事项 (652)75.5 监控与维护 (654)75.5.1 日志查看 (654)75.5.2 日志查询条件设置 (655)75.6 配置案例 (656)75.6.1 配置案例：配置健康检查模块SYSLOG日志 (656)75.7 常见故障分析 (658)75.7.1 故障现象1：SYSLOG日志失效 (658)75.7.2 故障现象2：E-mail日志失效 (658)第76章日志合并 (659)76.1 日志合并概述 (659)76.2 配置日志合并 (659)76.3 配置案例 (660)76.3.1 配置案例：配置防火墙策略日志合并 (660)第77章流日志 (662)77.1 流日志概述 (662)77.2 流日志配置 (662)77.2.1 全局开关 (662)77.2.2 流日志过滤开关 (662)77.3 流日志展示 (662)77.3.1 本地日志展示 (662)第78章系统配置 (665)78.1 系统配置概述 (665)78.2 配置说明 (665)78.2.1 配置设备 (665)78.2.2 系统监控 (667)78.2.3 时间配置 (668)78.2.4 DNS配置 (670)78.2.5 备份恢复 (671)78.2.6 告警邮件配置 (671)78.2.7 问题反馈 (673)78.2.8 设备重启 (674)78.2.9 集中管理 (674)78.2.10 设备运行记录 (675)78.2.11 配置自动备份 (676)78.3 配置案例 (676)78.3.1 配置案例1：对设备运行记录进行配置并导出 (676)78.3.2 配置案例2：设置每个月10号进行配置自动备份 (677)第79章管理员 (679)79.1 管理员概述 (679)79.2 配置管理员 (679)79.2.1 配置管理员 (679)79.3 配置RADIUS服务器 (681)79.4 配置LDAP服务器 (681)79.4.1 配置LDAP服务器 (681)79.5 认证用户监控与维护 (682)79.5.1 查看管理员信息 (682)79.5.2 查看RADIUS服务器信息 (683)79.5.3 查看LDAP服务器信息 (683)79.5.4 查看在线管理员信息 (683)79.6 常见故障分析 (684)79.6.1 故障现象：系统用户使用radius认证失败 (684)第80章版本管理 (685)80.1 版本管理 (685)80.1.1 版本管理 (685)80.1.2 特征库升级 (685)1.1.3 系统快照 (686)第81章许可管理 (689)81.1 许可管理概述 (689)81.2 许可导入 (689)81.3 许可试用 (690)第82章高可用性 (691)82.1 HA概述 (691)82.2 HA基本配置 (691)82.3 配置同步 (692)82.4 差异配置导出 (693)82.5 配置数据同步 (694)82.6 配置HA监控 (694)82.6.1 配置接口监控 (694)82.6.2 配置链路聚合监控 (695)82.6.3 配置网关监控 (696)82.6.4 配置切换条件 (696)82.7 HA状态控制 (697)82.8 配置案例 (698)82.8.1 案例1：配置主备模式基本配置 (698)82.8.2 案例2：配置主主模式基本配置 (700)第83章VRRP (703)83.1 VRRP概述 (703)83.2 配置VRRP (705)83.2.1 配置VRRP (705)83.2.2 编辑VRRP备份组 (707)83.2.3 删除VRRP备份组 (707)83.2.4 查看VRRP备份组 (707)83.3 配置案例 (708)。

Fortinet安全SD-WAN体系组件说明书

Fortinet Secure SD-WAN Architecture ComponentsFortiGate Next Generation Firewall CapabilitiesApplication AwarenessFortiGuard LabsFortiSandbox Security Rating ServiceMPLSSwitched EthernetBroadbandFortiExtenderFortiDeployFortiManagerFortiGateFortiAuthenticatorFortiSSOFortiGateFortiManagerFortiAnalyzerFortiSIEMCIO•Enable Digital Transformation•Application Resilience & Recovery •Integrated Security Infrastructure •Edge Device Consolidation •CapEx & OpEx ReductionCISO•Attack Surface Visibility •Reduced Complexity•Increased Response Time •Compliance Posture Visibility •D&R Automation•Security Framework AlignmentSecurity ProcessorIPS Content FilterAnti-BotnetApp ControlReputation AntivirusSSL InspectionVLANRouter IPSNGFW SD-WAND a t a C e n t e rP r i v a t e C l o u dM u l t i -C l o u dI n t e r n a l S e r v e r sVMsE x t e r n a l S e r v i c e s•WAN Path Controller •Application Awareness •Zero Touch Deployment •Device Consolidation•Improved WAN Link Performance •Dynamic Application Distribution•Next Generation Firewall (NGFW)•Multi-Transport Support •Centralized Management•Single-Pane-of-Glass Monitoring •Identity-Based Policy•Service Level Agreements (WAN Metrics)•Traffic Shaping & Policing3 M b p s25 Mbps100 Mbps500 M b p sBranch OfficeNGFWSD-WAN MembersBroadbandIPSec Tunnel MPLSLANDigital Transformation for Enterprise BranchMPLSInternetSIEM &Analytics Provisioning Server Threat Intelligence Monitoring & ManagementD a t a C e n t e r•WAN Path Controller •Application Awareness •Zero Touch Deployment •Device Consolidation •Improved WAN Link Performance•Dynamic Application Distribution•Identity-Based Policy •Traffic Shaping & Policing•Next Generation Firewall (NGFW)•Multi-Transport Support •Centralized Management•Single-Pane-of-Glass Monitoring •Service Level Agreements (WAN Metrics)I n t e r n a l S e r v e r sVMsE x t e r n a l S e r v i c e s1 G b p s10 Mbps10 Mbps50 M b p s50 MbpsSD-WAN MembersSD-WAN MembersReduce WAN OpEx with Direct Internet AccessBroadbandIPSec Tunnel MPLSLANP r i v a t e C l o u dM u l t i -C l o u d10 Mbps100 MbpsBranch OfficeSD-WAN MembersInternetNGFWNGFWMPLSSIEM &Analytics Provisioning Server Threat Intelligence Monitoring & ManagementNGFW•WAN Path Controller •Application Awareness •Zero Touch Deployment •Device Consolidation•Improved WAN Link Performance •Dynamic Application Distribution •Next Generation Firewall (NGFW)•Multi-Transport Support •Centralized Management•Single-Pane-of-Glass Monitoring •Identity-Based Policy•Service Level Agreements (WAN Metrics)•Traffic Shaping & PolicingBroadbandIPSec Tunnel LANRedundant Broadband Enterprise BranchTwo Internet Service Providers Direct Internet AccessD a t a C e n t e rI n t e r n a l S e r v e r s E x t e r n a l S e r v i c e sISP1ISP22x 200 Mbps2x 50 MbpsSD-WAN MembersISP1 –InternetVMsBranch OfficeNGFWP r i v a t e C l o u dM u l t i -C l o u dSIEM &AnalyticsProvisioning Server Threat IntelligenceMonitoring & ManagementISP2 –InternetI n t e r n a l S e r v e r sE x t e r n a l S e r v i c e sD a t a C e n t e r•WAN Path Controller •Application Awareness •Zero Touch Deployment •Device Consolidation •Centralized Management•Single-Pane-of-Glass Monitoring •Identity-Based Policy•Service Level Agreements (WAN Metrics)•Traffic Shaping & PolicingFortiGateSimplify with Secure SD-Branch5 Mbps25 Mbps10 M b p s50 Mbps100 Mbps1 G b p sSD-BranchSD-BranchFortiGate Secure SD-WANFortiAPFortiAPFortiSwitchFortiSwitchFortiGate Secure SD-WANBroadbandIPSec Tunnel MPLSLANInternetMPLS•Next Generation Firewall (NGFW)•Improved WAN Link Performance •Dynamic Application Distribution •Multi-Transport SupportP r i v a t e C l o u dM u l t i -C l o u d SIEM &Analytics Provisioning Server Threat Intelligence Monitoring & Management•WAN Path Controller •Application Awareness •Zero Touch Deployment •Device Consolidation •Improved WAN Link Performance•Dynamic Application Distribution•Next Generation Firewall •Multi-Transport Support •Centralized Management •Single-Pane-of-Glass Monitoring•Identity-Based Policy •Service LevelAgreements (WAN Metrics)•Traffic Shaping & PolicingISP1 (20 Mbps)Branch Office100 Mbps ISP1 (Broadband)ISP2 (LTE)ISP2 (LTE)SD-WAN MembersRedundant Connectivity Enterprise BranchBroadband with LTE Direct Internet AccessInternetNGFWD a t a C e n t e rI n t e r n a l S e r v e r sVMsE x t e r n a l S e r v i c e sP r i v a t e C l o u dM u l t i -C l o u dSIEM &Analytics Provisioning Server Threat Intelligence Monitoring & ManagementBroadbandIPSec Tunnel LANIPsec。

(完整版)H3CSD-WAN解决方案技术建议书v0607

文档密级（内部公开）
H3C SD-WAN 解决方案技术建议书
（A DWA N 控制器）
2020 年 5 月 6 日
新华三技术有限公司
2017 年 6 月
新华三集团机密，未经许可不得扩散
广域网解决方案王明
第 1页共 1 页Fra bibliotek文档密级（内部公开）
目录
第 1 章综述 ............................................................................................................................ 1 第 2 章 H3C ADWAN 系统架构说明 ................................................................................... 1
3.1.1 控制器部署模式设计 ...................................................................................... 5 3.1.2 控制器配置 ..................................................................................................... 6 3.2 本期某行核心骨干网 SDN 解决方案 ...................................................................... 6 3.2.1 整体方案思路 .................................................................................................. 6 3.2.2 应用定义策略 .................................................................................................. 7 3.2.3 方案部署步骤 .................................................................................................. 8 3.3 某行核心骨干网演进规划 ...................................................................................... 10 第 4 章方案优势以及特点 .................................................................................................. 11 4.1 适用于大型广域网络 .............................................................................................. 11 4.2 高效的流量转发机制（ Segment Routing） .......................................................... 11 4.2.1 Segment Routing控制平面 ........................................................................... 12 4.2.2 Segment Routing控制平面 ........................................................................... 12 4.2.3 Segment Routing技术优势 ........................................................................... 14 4.3 南向控制机制 .......................................................................................................... 15 4.4 应用流量可视化 ...................................................................................................... 15 4.5 精细化应用定义模式 .............................................................................................. 16 4.6 系统管理 .................................................................................................................. 16 第 5 章运维效益 .................................................................................................................. 18 5.1 运维效率优化 .......................................................................................................... 18 5.2 运维服务增值 .......................................................................................................... 19 第 6 章产品介绍 .................................................................................................................. 19 6.1 控制器产品介绍 ...................................................................................................... 19

SD-WAN启用多云自由路：白皮书说明书

WHITE PAPERSD-WAN Enables a Multi-cloud FreewayExecutive SummaryThe COVID-19 pandemic only accelerated the already rapid pace of digital innovation at organizations in every industry.1 This velocity of change is enabled by cloud-based services and solutions, which facilitate quick rollouts, scalable infrastructure, and minimal capital expenditure. The result is that the vast majority of enterprises—and an increasing number of small and midsize businesses—now operate hybrid clouds and even across multiple clouds.A multi-cloud architecture enables organizations to deploy a reliableand technically appropriate infrastructure for each service, but it brings complications as well. It expands the attack surface and makes security management more challenging. It also complicates the task of connecting users to all the services they need to access, and of integrating applications and workflows that need to interact with each other.In the words of one observer, “Clouds were born to be complex because applications were able to break away from the confines of the racked physical servers, storage, and networking devices. Once unleashed, new ways to manage, ensure, and secure applications would be required.”2 And yet the complexity of multi-cloud architectures makes finding these new ways difficult. Complexity Brings Inefficiency “Multi-cloud computing lowers the risk of cloud provider lock-in, and can provide service resiliency and migration opportunities, in addition to the core cloud benefits of agility, scalability, and elasticity.”3For example, each of the three largest public clouds in North America—Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP)—has its own networking constructs, management consoles, and security and networking tools. They are essentially incompatible with each other, and this complicates the task of administering a multi-cloud architecture.For network architects, connecting each public cloud with headquarters, branch offices, and the corporate data center is challenging. Configuring the correct routes and setting up and maintaining virtual private networks (VPNs) can be a waste of time if one works within each provider’s console. This is because it’s a largely manual process—and even automation across the various clouds is different. These increase operational complexity and security risks.SD-WAN Addresses ComplexitySoftware-defined wide-area networking (SD-WAN) technology was originally developed to provide highly available WAN connections to branch locations, delivering superior performance and cost effectiveness compared with traditional WAN. But it can also play a key role with cloud connectivity. SD-WAN gateways can steer applications over policy-definedlinks and automatically set up Internet Protocol security (IPsec) tunnels to and across cloud service providers—all from a centralized console.The big three cloud providers have taken steps to make it easier to support SD-WAN gateways. AWS has introduced Transit Gateway Connect designed to connect AWS VPCs in each region to a transit VPC with an SD-WAN gateway that aggregates connections from on-premises locations. GCP has launched its Network Connectivity Center with more robust options for connecting Google Cloud VPC virtual private clouds with branches and data center networks. And Microsoft has built features into its virtual WAN to integrate with SD-WAN gateways and extend connectivity to Azure virtual networks from branch offices and remote sites.This means that SD-WAN technology can be used as a cloud overlay network to connect branch offices to cloud services, virtual networks within a single public cloud, and even across multiple clouds with one another. Its ability to prioritize traffic by application enables the most critical traffic to receive priority, and its ability to steer traffic over multiple routes for the best performance makes it ideal as a multi-cloud overlay. Access and security policies are centralized, and administrators have full visibility into application traffic, performance, and security.2Copyright © 2021 Fortinet, Inc. All rights reserved. Fortinet ®, FortiGate ®, FortiCare ® and FortiGuard ®, and certain other marks are registered trademarks of Fortinet, Inc., and other Fortinet names herein may also be registered and/or common law trademarks of Fortinet. All other product or company names may be trademarks of their respective owners. Performance and other metrics contained herein were attained in internal lab tests under ideal conditions, and actual performance and other results may vary. Network variables, different network environments and other conditions may affect performance results. Nothing herein represents any binding commitment by Fortinet, and Fortinet disclaims all warranties, whether express or implied, except to the extent Fortinet enters a binding written contract, signed by Fortinet’s General Counsel, with a purchaser that expressly warrants that the identified product will perform according to certain expressly-identified performance metrics and, in such event, only the specific performance metrics expressly identified in such binding written contract shall be binding on Fortinet. For absolute clarity, any such warranty will be limited to performance in the same ideal conditions as in Fortinet’s internal lab tests. Fortinet disclaims in full any covenants, representations, and guarantees pursuant hereto, whether express or implied. Fortinet reserves the right to change, modify, transfer, or otherwise revise this publication without notice, and the most current version of the publication shall be applicable.August 28, 2021 12:57 PM1238653-0-0-EN Public Cloud as TransitwayWhile most public cloud use cases focus on applications and workloads, cloudproviders have built out high-speed network backbones, and customers cantake advantage of this infrastructure to simplify cloud connectivity, boostperformance, ensure security, and improve agility. SD-WAN technology makesthe cloud provider network backbone more efficient for organizations to deliverthe best application experience.For instance, if a company had a business requirement for a high-performance,low-latency connection between two branches in different parts of the country,the network team could leverage a cloud provider’s backbone as the transport. Inthis use case, secure SD-WAN in each branch and in the public cloud can be usedto set up IPsec tunnels that will traverse the cloud provider’s backbone.SD-WAN as Information Freeway The idea of deploying SD-WAN in branch locations to enable public cloud access is well understood. As organizations embrace a fuller multi-cloud strategy—deliberately or by default—they can extend their SD-WAN investment to supporthybrid cloud and multi-cloud deployments, enabling highly secure and efficientnetwork traffic across an enterprise.These flexible and rapid “freeways” route traffic efficiently and securely between users and different clouds, between different services in a single cloud, and between multiple public and private clouds. Ideally this would all be centrallymanaged and monitored. Unlike physical freeways, constructing and maintaining them does not cause major disruption. Once the IPsec tunnels are set up, secure SD-WAN technology automatically prioritizes traffic and ensures that each packet is sent over the most efficient route.SD-WAN as Part of a Security FabricAll of these connections of course must be monitored and secured. SD-WAN can integrate into a security fabric, whichdelivers security capabilities across a variety of domains, including wired and wireless networks, endpoints, web applications, the cloud, and more. A security fabric can analyze logs and events from all these security products to correlate alarms and alerts and provide greater context into incidents. A fabric can also orchestrate a response to threats across domains.Networking for the FutureSD-WAN technology provides an extensive menu of options to network architects for connecting an organization’s people with all its digital resources. In a multi-cloud world, it can provide the necessary links across the infrastructure to enable secure network traffic with high performance for users.“Multi-cloud is not the same as hybrid cloud, in which public and private clouds are integrated. Multi-cloud simplymeans that organizations havethe flexibility to select the bestcloud provider for each of theirvarious infrastructure andapplication needs.”41 “How COVID-19 has pushed companies over the technology tipping point—and transformed business forever ,” McKinsey, October 5, 2020.2 Emil Sayegh, “Is Further Abstraction The Answer To Cloud Complexities?” Forbes, May 3, 2021.3 Rani Osnat, “Mitigating the Risks of Multi-Cloud Environments ,” Network Computing, July 27, 2021.4“What to Look for in a Secure SD-WAN Solution for Multi-Cloud Environments ,” Fortinet, July 10, 2020.。

深信服上网行为管理系统用户手册

深信服上网行为管理系统用户手册深信服上网行为管理系统用户手册AC 12.0.18用户手册目录前言 (2)手册内容 (2)本书约定 (2)图形界面格式约定 (2)各类标志 (3)技术支持 (3)致谢 (3)第1 章安装指南 (4)1.1.环境要求 (4)1.2.电源 (4)1.3.产品外观 (4)1.4.配置与管理 (5)1.5.单设备接线方式 (5)1.6.双机备份接线方式 (7)第2 章控制台的使用 (8)2.1.登录WebUI配置界面 (8)2.1.1.AC的web 登录方式 (8)2.1.2.统一认证中心的登录方式 (11)2.2.配置和使用 (12)第3 章功能说明 (15)3.1.增值服务导航 (15)3.1.1.激活设备 (15)3.1.2.进入技术社区 (17) 3.1.3.“信服君”机器人 (18) 3.2.行为感知系统 (19)3.2.1.办公网上网态势 (22) 3.2.2.带宽分析 (31)3.2.3.泄密追溯分析 (33) 3.2.4.离职倾向分析 (36) 3.2.5.工作效率分析 (40) 3.2.6.未关机检测分析 (42) 3.3.实时状态 (43)3.3.1.实时状态 (43)3.4.对象定义 (89)3.4.1.应用特征识别库 (91) 3.4.2.应用智能识别库 (97) 3.4.3.自定义应用 (100)3.4.4.URL分类库 (104) 3.4.5.URL库列表 (104) 3.4.6.准入规则库 (109)3.4.7.网络服务 (129)3.4.8.IP 地址库 (131)3.4.9.时间计划组 (139)3.4.10.关键字组 (141)3.4.11.文件类型组 (143) 3.4.12.位置对象组 (144) 3.5.用户认证与管理 (147) 3.5.1.原理 (147)3.5.2.用户认证 (151)3.5.3.用户管理 (220)3.5.4.认证高级选项 (259) 3.6.策略管理 (277)3.6.1.上网策略 (278)3.6.2.策略高级选项 (368)3.7.流量管理 (375)3.7.1.概述 (375)3.7.3.通道配置 (377)3.7.4.线路带宽配置 (414)3.7.5.虚拟线路配置 (415)3.7.6.流量可视化 (425)3.8.终端接入管理 (425)3.8.1.共享接入管理 (426)3.8.2.移动终端管理 (430)3.8.3.代理工具管理 (433)3.9.上网安全 (438)3.9.1.安全状态 (438)3.9.2.安全配置 (441)3.10.VPN配置 (457)3.10.1.DLAN运行状态 (457) 3.10.2.多线路设置 (458)3.10.3.SDWAN智能选路 (460) 3.10.4.基本设置 (472)3.10.5.用户管理 (474)3.10.6.连接管理 (488)3.10.7.虚拟IP 池 (491)3.10.8.本地子网列表 (492) 3.10.9.隧道间路由设置 (494) 3.10.10.第三方对接 (497)3.10.11.通用设置 (509)3.10.12.证书管理 (511)3.10.13.高级设置 (515)3.11.系统管理 (527)3.11.1.防火墙 (527)3.11.2.网络配置 (544)3.11.3.系统配置 (633)3.12.网络安全法 (693)第4 章案例集 (696)4.1.单点登录配置案例 (696)4.1.1AD域单点登录功能配置案例 (696)4.1.2PROXY单点登录配置案例 (723)4.1.3POP3单点登录配置案例 (732)4.1.4Web单点登录配置案例 (737)4.1.5与第三方设备结合单点登录配置案例 (741)4.1.6深信服设备结合认证 (756)4.1.7数据库系统结合认证 (759)4.2.不需要认证用户配置案例 (762)4.3.密码认证用户配置案例 (769)4.3.1短信认证 (769)4.3.2微信及二维码认证 (787)4.3.3密码认证 (801)4.4.其他认证配置案例 (810)4.5.与cas第三方认证配置案例 (825)4.6.策略配置案例 (828)4.6.1针对某用户组设置封堵P2P 和P2P流媒体的策略 (828) 4.6.2针对某用户组设置IM 监控的策略 (832)4.6.3针对某用户组设置开启审计功能 (836)4.7.终端管理配置案例 (838)4.7.1防共享功能配置案例 (838)4.7.2移动终端管理配置案例 (840)4.7.3代理工具理配置案例 (841)4.8.SNMPTRAP配置案例 (842)4.9.综合案例 (846)4.9.1客户网络环境与需求 (846)4.9.2配置思路 (847)附录：SANGFOR设备升级系统的使用 (865)产品升级步骤 (868)前言手册内容第1 部分SANGFOR AC 产品概述。

FortiGate 30E-3G安全SD-WAN数据表说明书

Firewall IPS NGFW Threat Protection Interfaces 950 Mbps 300 Mbps 200 Mbps 150 MbpsMultiple GE RJ45Refer to specification table for detailsfanless desktop form factor for enterprise branch offices and mid-sized businesses. Protect against cyber threats with industry-leading secure SD-WAN in a simple, affordable and easy to deploy solution.Security§Identifies thousands of applications inside network traffic for deep inspection and granular policy enforcement§Protects against malware, exploits, and malicious websites in both encrypted and non-encrypted traffic§Prevent and detect against known and unknown attacks using continuous threat intelligence from AI powered FortiGuard Labs security services Performance§Delivers industry’s best threat protection performance and ultra-low latency using purpose-built security processor (SPU) technology§Provides industry-leading performance and protection for SSL encrypted traffic Certification§Independently tested and validated best security effectiveness and performance§Received unparalleled third-party certifications from NSS Labs, ICSA, Virus Bulletin and AV ComparativesNetworking§Best of Breed SD-WAN capabilities to enable application steering using WAN path control for high quality of experience §Delivers extensive routing, switching, wireless controller, high-performance, and scalable IPsec VPN capabilities Management§Includes Management Console that’s effective, simple to use, and provides comprehensive network automation & visibility. §Provides Zero Touch Integration with Security Fabric’s Single Pane of Glass Management§Predefined compliance checklist analyzes the deployment and highlights best practices to improve overall security posture Security Fabric§Enables Fortinet and Fabric-ready partners’ products to provide broader visibility, integrated end-to-end detection, threatintelligence sharing and automated remediation§Automatically builds Network Topology visualizations which discover IoT devices and provide complete visibility into Fortinet and Fabric-ready partner productsDATA SHEET | FortiGate® 30E-3G4GDeploymentU nified Threat Management(UTM)§Integrated wired and wireless networking to simplify IT§Purpose-built hardware for industry best performance with easyadministration through cloud management§Provides consolidated security and networking for smallbusinesses and consistently provides top-rated threat protection§Proactively blocks newly discovered sophisticated attacks inreal-time with advanced threat protectionS ecureSD-WAN§Secure direct Internet access for Cloud Applications forimproved latency and reduce WAN cost spending§High-performance and cost-effective threat protectioncapabilities§WAN Path Controller and Link Health Monitoring for betterapplication performance and quality of experience§Security Processer powered industry’s best IPsec VPN and SSLInspection performance§Simplified Management and Zero Touch deploymentFortiGate 30E-3G4G deployment in Small Office(UTM)FortiGate 30E-3G4G deployment in Enterprise Branch(Secure SD-WAN)Secure AccessSwitchDATA SHEET | FortiGate ® 30E-3G4G3HardwareInterfaces1. USB Port2. Console Port3. 1x GE RJ45 WAN PortFortiGate 30E-3G4GInstall in Minutes with FortiExplorerThe FortiExplorer wizard enables easy setup and configuration coupled with easy-to-follow instructions. FortiExplorer runs on popular iOS devices. Using FortiExplorer is as simple as starting the application and connecting to the appropriate USB port on the FortiGate. By using FortiExplorer, you can be up and running and protected in minutes.3G/4G WAN ExtensionsThe FortiGate 30E-3G4G includes built-in 3G/4G modem that allows additional WAN connectivity or a redundant link for maximum reliability.Compact and Reliable Form FactorDesigned for small environments, you can simply place the FortiGate 30E-3G4G on a desktop. It is small, lightweight yet highly reliable with superior MTBF (Mean Time Between Failure), minimizing the chance of a network disruption.4. 4x GE RJ45 Switch Ports5. Internal 3G4G ModemFortiOSControl all security and networking capabilities across the entireFortiGate platform with one intuitive operating system. Reducecomplexity, costs, and response time with a truly consolidatednext-generation security platform.§ A truly consolidated platform with a single OS and pane-of-glassfor all security and networking services across all FortiGateplatforms.§Industry-leading protection: NSS Labs Recommended, VB100,AV Comparatives, and ICSA validated security and performance.Ability to leverage latest technologies such as deception-basedsecurity.§Control thousands of applications, block the latest exploits, andfilter web traffic based on millions of real-time URL ratings inaddition to true TLS 1.3 support.§Prevent, detect, and mitigate advanced attacks automaticallyin minutes with integrated AI-driven breach prevention andadvanced threat protection.§Fulfil your networking needs with extensive routing, switching,and SD-WAN capabilities along with intent-based segmentation.§Utilize SPU hardware acceleration to boost security capabilityperformance.dynamically expand and adapt as more and more workloads and dataare added. Security seamlessly follows and protects data, users, andapplications as they move between IoT, devices, and cloud environmentsthroughout the network. All this is ties together under a single pane ofglass management for significantly thereby delivering leading securitycapabilities across your entire environment while also significantly reducingcomplexity.FortiGates are the foundation of Security Fabric, expanding securityvia visibility and control by tightly integrating with other Fortinet securityproducts and Fabric-Ready Partner solutions.ServicesFortiGuard™Security ServicesFortiGuard Labs offers real-time intelligence on the threatlandscape, delivering comprehensive security updates acrossFortiCare™Support ServicesOur FortiCare customer support team provides global technicalsupport for all Fortinet products. With support staff in the Americas,DATA SHEET | FortiGate ® 30E-3G4G5SpecificationsNote: All performance values are “up to” and vary depending on system configuration. 1. IPsec VPN performance test uses AES256-SHA256.2. IPS (Enterprise Mix), Application Control, NGFW and Threat Protection are measured with Logging enabled.3. SSL Inspection performance test uses TLS v1.2 with AES128-SHA256.4. NGFW performance is measured with Firewall, IPS and Application Control enabled.5. Threat Protection performance is measured with Firewall, IPS, Application Control and MalwareProtection enabled.Firewall Latency (64 byte UDP packets)130 μs Firewall Throughput (Packets Per Second)180 Kpps Concurrent Sessions (TCP)900,000New Sessions/Second (TCP)15,000Firewall Policies5,000IPsec VPN Throughput (512 byte) 175 Mbps Gateway-to-Gateway IPsec VPN Tunnels 200Client-to-Gateway IPsec VPN Tunnels 250SSL-VPN Throughput35 Mbps Concurrent SSL-VPN Users(Recommended Maximum, Tunnel Mode)100SSL Inspection Throughput (IPS, HTTP) 3160 Mbps Application Control Throughput (HTTP 64K) 2400 Mbps CAPWAP Throughput (HTTP 64K)850 Mbps Virtual Domains (Default / Maximum) 5 / 5Maximum Number of FortiSwitches Supported 8Maximum Number of FortiAPs (Total / Tunnel Mode)2 / 1Maximum Number of FortiTokens500Maximum Number of Registered FortiClients 200High Availability ConfigurationsActive/Active, Active/Passive, ClusteringFG-30E-3G4G-GBLRegional CompatibilityAll RegionsModem Model Sierra Wireless EM7565LTE B1, B2, B3, B4, B5, B7, B8, B9, B12, B13, B18, B19, B20, B26, B28, B29, B30, B32, B41, B42, B43, B46, B48, B66UMTS/HSPA+B1, B2, B3, B4, B5, B6, B8, B9, B19WCDMA–CDMA 1xRTT/EV-DO Rev A –GSM/GPRS/EDGE –Module Certifications CE, FCC, GCF, IC, JRF/JPA, NCC, PTCRBDiversity Yes MIMO Yes GNSS BiasYesDATA SHEET | FortiGate ® 30E-3G4GCopyright © 2019 Fortinet, Inc. All rights reserved. Fortinet®, FortiGate®, FortiCare® and FortiGuard®, and certain other marks are registered trademarks of Fortinet, Inc., and other Fortinet names herein may also be registered and/or common lawtrademarks of Fortinet. All other product or company names may be trademarks of their respective owners. Performance and other metrics contained herein were attained in internal lab tests under ideal conditions, and actual performance and other results may vary. Network variables, different network environments and other conditions may affect performance results. Nothing herein represents any binding commitment by Fortinet, and Fortinet disclaims all warranties, whether express or implied, except to the extent Fortinet enters a binding written contract, signed by Fortinet’s General Counsel, with a purchaser that expressly warrants that the identified product will perform according to certain expressly-identified performance metrics and, in such event, only the specific performance metrics expressly identified in such binding written contract shall be binding on Fortinet. For absolute clarity, any such warranty will be limited to performance in the same ideal conditions as in Fortinet’s internal lab tests. Fortinet disclaims in full any covenants, representations, and guarantees pursuant hereto, whether express or implied. Fortinet reserves the right to change, modify, transfer, or otherwise revise this publication without notice, and the most current version of the publication shall be applicable. Fortinet disclaims in full any covenants, representations, and guarantees pursuant hereto, whether express or implied. Fortinet reserves the right to change, modify, transfer, or otherwise revise this publication without notice, and the most current version of the publication shall be applicable.FST -PROD-DS-GT30E2FGFWF-30E-3G4G-DAT -R13-201904Order InformationBundlesFortiGuard BundleFortiGuard Labs delivers a number of security intelligence services to augment the FortiGate firewall platform. You can easily optimize the protection capabilities of your FortiGate with one of these FortiGuard Bundles.Bundles 360 Protection Enterprise Protection UTM Threat Protection FortiCareASE 124x724x724x7FortiGuard App Control Service ••••FortiGuard IPS Service••••FortiGuard Advanced Malware Protection (AMP) — Antivirus, Mobile Malware, Botnet, CDR, Virus Outbreak Protection and FortiSandbox Cloud Service ••••FortiGuard Web Filtering Service •••FortiGuard Antispam Service •••FortiGuard Security Rating Service ••FortiGuard Industrial Service ••FortiCASB SaaS-only Service ••FortiConverter Service•SD-WAN Cloud Assisted Monitoring 2•SD-WAN Overlay Controller VPN Service 2• FortiAnalyzer Cloud2•FortiManager Cloud2•1. 24x7 plus Advanced Services Ticket Handling2. Available when running FortiOS 6.2ProductSKUDescriptionFortiGate 30E-3G4G-GBLFG-30E-3G4G-GBL5x GE RJ45 ports (including 1x WAN port, 4x Switch ports) with Embedded 3G/4G/LTE wireless WAN module (Global LTE – EM7565), 2 external SMA WWAN antennas included.。

深信服SD-WAN产品使用说明书

深信服SD-WAN 产品使用手册目录前言 (11)手册内容 (11)本书约定 (12)技术支持 (13)致谢 (13)第1 章SDWAN 的安装 (15)1.1. 环境要求 (15)1.2. 电源 (15)1.3.产品形态 (15)1.3.1.SD-WAN-MIG 一体化网关 (16)1.3.2.SD-WAN-WOC (16)1.3.3.SDWAN 虚拟网元 (16)1.3.4.管控平台X-Central (17)1.3.5.硬件性能参数 (18)1.4.配置与管理 (19)1.5.设备接线方式 (19)1.6.设备开机方式 (20)第2 章SDWAN 组网方式 (21)2.1.hub-spoken 组网 (21)2.2.full mesh 组网 (21)2.3.partial mesh 组网 (22)第3 章SDWAN 的部署 (24)3.1.网关模式部署 (24)3.2.网桥模式部署 (24)3.3.网桥VPN 模式部署 (25)3.4.网桥多线路模式部署 (26)3.5.双网桥模式部署 (27)3.6.单臂模式的部署 (28)3.7.双单臂模式部署 (30)第4 章SD-WAN 易部署和应用选路 (32)4.1.分支邮件易部署 (32)4.2.AutoVPN (33)4.3.SD-WAN 应用选路 (34)4.3.1.指定线路 (34)4.3.2.高质量选路选路 (34)4.3.3.按剩余带宽负载 (35)4.3.4.带宽叠加 (35)4.3.5.线路质量探测原理与淘汰机制 (36)第5 章SDWAN 终端设备 (38)5.1.ssh 登录 (38)5.2.登录WebUI 配置界面 (38)5.3. 状态 (39)5.3.1.广域网优化状态 (39)5.3.2.流量监控 (42)5.3.3.DHCP 状态 (48)5.3.4.设备运行状态 (48)5.3.5.EoIP 状态 (48)5.4.路由设置 (49)5.4.1.系统设置 (50)5.4.2.部署设置 (54)5.4.3.路由设置 (85)5.4.4.用户管理 (93)5.4.5.网络对象 (97)5.4.6.DHCPv4 设置 (105)5.4.7.DHCPv6 设置 (108)5.4.8.Syslog & SNMP (109)5.4.9.SC 设置 (113)5.5.SD-WAN VPN (114)5.5.1.SDWAN 选路 (114)5.5.2. 服务端 (115)5.5.3. 客户端 (134)5.5.4. 多线路 (137)5.5.5.第三方认证 (140)5.5.6.高级设置 (144)5.6.SD-WAN VPN (153)5.6.1.第一阶段 (153)5.6.2.第二阶段 (156)5.6.3.安全选项 (159)5.6.4.EoIP 设置 (160)5.7.流量管理 (164)5.7.1.对象设置 (164)5.7.2.策略设置 (177)5.7.3.流控设置 (186)5.7.4.策略故障排除 (206)5.7.5.高级设置 (207)5.8.应用识别 (210)5.8.1.识别是管理的基础 (210)5.8.2.应用库说明 (211)5.9.NAT 设置 (212)5.9.1.代理上网网段 (212)5.9.2.端口映射 (214)5.10.安全防护能力 (216)5.10.1.端对端传输加密 (216)5.10.2.过滤规则 (217)5.10.3.防DoS 攻击 (219)5.10.4.ARP 欺骗防护 (221)5.10.5.涉及产品 (222)5.10.6.僵木蠕一次清理，保障终端安全 (223)5.10.7.已知威胁 (223)5.10.8.未知威胁 (224)5.11.高可用冗余保护 (225)5.11.1.双机部署方式 (226)5.11.2.双机维护 (227)5.13. 维护 (229)5.13.1. 日志 (230)5.13.2. 序列号 (231)5.13.3. 自动升级 (232)5.13.4. 备份/恢复 (233)5.13.5. 关机 (236)5.13.6.页面控制台 (236)5.13.7.远程技术支持 (238)第6 章方案整体设计 (240)6.1. 总部端 (240) (241) (241) (241)6.2. 数据中心互联 (241)6.3. 分支端 (242)6.4.大中型分支 (243)6.5.跨国分支 (244)6.6.智能应用选路 (245)第7 章广域网优化（SD-WAN 接入网元） (251)7.1.分钟级上线 (251)7.2.AUTO VPN (252)7.3.广域网数据传输优化 (253)7.4.广域网传输安全加固 (262)7.5.广域网立体安全防护 (263)7.6.应用及流量可视化，打造一张可管理的广域网 (267)7.7.应用识别功能 (267)对象设置 (270)策略设置 (283)流控设置 (292)7.7.1.HTP 高速传输协议解决高延迟高丢包 (312)7.7.2.改进型TCP 实现快速TCP 传输 (314)7.8.冗余数据削减技术，提高带宽吞吐 (314)7.8.1.基于码流特征的数据优化 (314)7.8.2.高效的数据流压缩算法 (316)7.8.3.全局IP 流量压缩，降低TCP 和UDP 流量占用 (316)7.9.应用加速，提升核心业务系统访问速度，提升工作效率 (317)7.9.1.传输协议优化 (317)7.9.2.应用协议优化 (318)7.9.3.CIFS 协议优化技术 (318)7.9.4.HTTP 和FTP 协议优化技术 (319)7.9.5.Exchange MAPI 协议优化技术 (320)7.9.6.RDP 与Citrix ICA 协议优化技术 (320)7.9.7.OracleTNS 协议优化技术 (320)7.9.8.常见应用系统加速效果 (321)7.10.广域网流量管理，实现流量整形和基于应用的带宽保障 (322)7.10.1.基于应用和内容的流量管理技术 (322)7.10.2.带宽通道实现智能带宽保证 (322)7.10.3.虚拟线路技术有效保障视频会议带宽，提升访问体验 (323)7.11.视频会议优化，零距离协同办公 (323)7.11.1.智能带宽保障 (323)7.11.2.丢包补偿（UDP 代理+FEC 前向校验） (324)7.11.3.业务数据压缩 (325)7.12.SD-WAN 广域网优化其他亮点技术 (326)7.12.1.移动客户端的广域网优化 (326)7.12.2.多线路复用 (327)7.12.3.HTTP 和FTP 文件预取功能 (327)7.12.4.数据中心智能报表，帮助用户智慧决策 (328)7.12.5.策略路由 (329)7.13.SD-WAN 广域网优化能为您解决的问题 (329)7.14.服务配置说明 (331)7.14.1.应用设置 (332)7.14.2.流缓存设置 (339)7.14.3.视频优化设置 (339)7.14.4. 服务端 (340)7.14.5. 客户端 (346)7.14.6.数字证书 (352)7.14.7.高级设置 (359)7.14.8.LDAP 服务器 (362)7.14.9.高级设置 (364)第8 章灰白盒化交付 (369)8.1.产品介绍 (369)8.2.集中可视可控运营管理 (371)第9 章虚拟化SD-WAN (377)9.1.性能部署要求 (377)9.1.1.场景描述 (377)9.1.2.性能相关要求 (377)9.1.3.检测性能参数 (377)9.1.4.场景拓扑 (378)9.2.前期准备 (378)9.3.部署操作 (378)9.3.1. 云部署 (378)9.3.2.WOC 基础配置 (398)9.3.3.VPN 配置 (402)9.3.4.配置引流策略 (405)9.3.5.验证VPN 业务 (405)9.4.业务配置 (406)9.4.1.加速配置 (406)9.4.2.流量管理 (406)9.4.3.SDWAN 智能选路 (406)9.5. FAQ (407)第10 章SDWAN 管控平台使用说明 (408)10.1.平台性能参数 (408)10.2.首页地图 (408)10.3.智能监控 (410)10.3.1.智能告警 (410)10.3.2.设备配置管理 (411)10.4.Restful API (412)10.4.1.协议规范说明 (412)10.4.2.用户管理接口格式 (413)10.4.3.设备管理接口格式 (414)10.4.4.虚拟网元管理网络编排接口格式 (414)10.4.5.设备功能调用接口格式 (415)10.4.6.平台管理接口格式 (415)10.4.7.数据分析输出接口格式 (415)第11 章数据中心的使用 (417)11.1. 首页 (417)11.2.流量分析 (418)11.2.1.流量排名 (418)11.2.2.带宽分布 (421)11.3.带宽优化 (423)11.4. 报表 (425)11.5. 日志 (430)11.5.1.管理日志 (430)11.5.2.防火墙日志 (431)11.6.系统设置 (433)11.6.1.数据库清理 (433)11.6.3. 子网 (435)第12 章案例集 (438)12.1.双单臂模式部署配置案例 (438)12.2.VLAN 环境下的单网桥部署配置案例 (439)12.3.网桥VPN 部署配置案例 (442)12.4.网桥多线路部署配置案例 (443)12.5.WCCP 的应用场景及配置案例 (445)12.6.MAC 跟踪的应用场景及配置案例 (447)12.7.加速本地子网和静态路由的配置案例 (450)12.8.网关VPN 模式EoIP 部署案例 (452)12.9.添加加速用户的案例 (460)12.10.Sangfor VPN 的配置案例 (462)12.10.1.隧道内NAT 案例 (462)12.10.2.移动PDLAN 用户接入WOC 设备的案例 (466)12.10.3.VPN 内网权限的设置案例 (472)12.10.4.VPN 多线路配置案例 (476)12.10.5.移动用户使用LDAP 认证接入案例 (481)12.10.6.VPN 多子网配置案例 (484)12.10.7.通过隧道间路由实现分支间互访的案例 (487)12.10.8.通过目的路由用户上网的配置案例 (489)12.11.和CISCO PIX 标准IPSEC VPN 互连的案例 (492)12.12.WOC 加速互连的案例 (500)12.12.1.为分支WOC 设备创建用户并关联策略的案例 (500)12.12.2.加速HTTP 或HTTPS 访问的Oracle EBS 案例 (501)12.12.3.加速访问Citrix 服务器的案例 (504)12.12.4.加速访问RDP 服务器的案例 (507)12.12.5.跟总部建立加速连接的配置案例 (510)12.12.6.加速Outlook Anywhere 访问Exchange 服务器的案例 (511)12.12.7.使用透明传输模式的案例 (516)12.12.8.使用反向加速建立双向加速连接的案例 (517)12.12.9.对FTP 服务器的预取案例 (524)12.12.10.通过排除规则对指定网段进行加速的案例 (525)12.13.UDP 优化配置案例 (527)12.14.委派的配置案例 (532)12.15.策略路由配置案例 (540)12.16.综合案例 (546)12.16.1.客户环境与需求 (546)12.16.2.配置思路 (546)12.16.3.总部WOC 设备配置步骤 (547)12.16.4.分支WOC 设备配置步骤 (553)附录A：SANGFOR 设备升级系统的使用 (556)附录B：通过USB 口恢复默认配置 (559)功能1：使用U 盘查看网口配置 (559)功能2：使用U 盘恢复控制台密码 (559)注意事项 (560)前言手册内容第1 部分SANGFOR SDWAN 产品介绍和安装。

1、下载文档前请自行甄别文档内容的完整性，平台不提供额外的编辑、内容补充、找答案等附加服务。
2、"仅部分预览"的文档,不可在线预览部分如存在完整性等问题,可反馈申请退款(可完整预览的文档不适用该条件!)。
3、如文档侵犯您的权益，请联系客服反馈,我们会尽快为您处理(人工客服工作时间：9:00-18:30)。