培训资料Juniper网络安全防火墙设备售前培训v

合集下载

Juniper防火墙产品培训+#

市场领导地位-Gartnet 2004年报告
Juniper #1 out of 18 vendors
Gartner Magic Quadran报告是针对IT特定细分市场上的厂商实力所进行的极具声望的评价，它从各个方面来全方位评价厂商，包括产品线的完整度和功能、技术实力、创新性、成功实施情况、满足客户现有和未来需求的能力，以及包括服务和支持在内的执行能力、市场份额、财务健康状况和其它关键指标
• 广电总局国家骨干网
•
全国骨干网，50%以上设备
市场机会，约超过70 亿美元
• 安全市场上估计存在超过 70 亿美元的机会 • 包括 IPS、SSL VPN、路由功能和防火墙 VPN • 防火墙 VPN 仍然是安全市场最大的组成部分 • 我们的强项是防火墙/VPN产品 • 继续推动安全类产品的发展
先进的硬件设计通用结构的处理?数据在几个非优化的接口传送?每个api引入安全风险?处理的延迟导致无法预测的行为?数据通道无法优化pcappliancespseudoappliancesosvpncoprocessorcpurambusioinoutapplications专用的安全处理?基于流的线性的数据包处理?每个处理模块被优化?优化的应用和硬件用于安全处理和性能gigascreenasiccpuhighspeedbackplaneinoutramionetscreenadvancedarchitecturesecurityspecificrealtimeosintegratedsecurityapplicationsasicjuniper防火墙产品培训149152020screenos特点?安全性专用的实时操作系统?完全设计用于执行计算密集型安全功能而不会影响吞吐量?与硬件设备安全操作系统及安全应用紧密集成?状态协议级智能?集成深层检测防病毒和web过滤等?专用操作系统减少补丁和测试?所有防火墙ipsecvpn系列产品上部署相同的安全性专用操作系统juniper防火墙产品培训159152020screenosipv6?为状态防火墙和ipsecvpn提供生产级的商用ipv6支持?支持双堆栈架构使客户能够在一个设备上同时支持并保护ipv4与ipv6网络?支持所有主要的ipv6迁移机制包括ipv4ipv6和ipv6ipv4迁移ipv6隧道中的ipv4和ipv4隧道中的ipv6?以及面向ipv6的natpt?支持ripng动态路由协议允许客户提高生产网络中的ipv6部署的可扩展性?防止ipv6网络遭受synflood攻击和其他攻击使客户能够抵御从ipv4或ipv6网络中发起的拒绝服务攻击juniper防火墙产品培训169152020juniper防火墙产品线ns5gtns2550nshscns5400isg2000isg1000ssg520mssg550mnsseriesisgseriesssgseriesns5200ns500ns208ns204ssg20ssg5ssg140ssg350ssg320juniper防火墙产品培训179152020议程?juniper简介?juniper防火墙vpn产品线?juniperisg集成安全网关系列?juniperssg安全业务网关系列?产品对比?案例分析juniper防火墙

juniper技术培训

Configuration>Admin>Administrators
PPT文档演模板
juniper技术培训
更改根管理员用户名/密码
PPT文档演模板
Configuration>Admin>Administrators
set admin name <name> set admin password <password>
Network>Interfaces>Edit
set interface <name> manage-ip <address) ns208> set interface e1 manage-ip 1.1.1.250
PPT文档演模板
juniper技术培训
校验接口配置 - WebUI
Network>Interfaces>Edit
• 透明模式允许在2层安全域之间通过策略控制流量
PPT文档演模板
juniper技术培训
透明模式的作用
10.1.0.0/16
A
V1-Trust
10.100.1.0/16
C
B
B B
D V1-DMZ
E
V1-Untrust
10.200.1.0/16
• 可以简单快速的部署防火墙到现有网络中
– 不需要改变现有网络拓扑结构
get
get system information
ping
ping other host
reset
reset system
save
save command
ห้องสมุดไป่ตู้
set
configure system parameters

juniper防火墙培训PPT--JNSA-SSC对比sec2

Copyright ©2004 Juniper网络公司，Inc.
Proprietary and Confidential

3
安全市场格局 – 主要产品系列定位
2003年下半年企业防火墙 Gartner Magic Quadrant Research Note：M-22-5175，R. Stiennon，2004年4月21日
• SonicWALL
• Fortinet
Copyright ©2004 Juniper网络公司，Inc.
Proprietary and Confidential

6
如何针对Cisco进行全面定位
卖点
• 使购买决策成为安全决策
• 向安全人员销售－让他们帮助说服管理层

Cisco Systems
Cisco PIX 防火墙
他们怎么说/做：
PIX • FWSM • IOS路由器防火墙
• PIX是带集成 VPN的专用防火墙，
• 通过PCI总线卡实现3DES加速 PIX 535
成本
PIX 525 PIX 515E
PIX 506E PIX 501
• 可通过―Fix Up” (ALG)很好地支持复杂的协议 • 通过H.323 “可随时支持VoIP‖ ，体积小，支持SIP • PIX 525是低价位的GigE基本产品 (330mbps 防火墙)
• PIX • FWSM • IOS路由器防火墙
PIX 防火墙 – 从低端到高端的独立设备 • 优点 – 很吸引人的产品规范，‖足够好的‖防火
•
墙，防火墙/VPN 缺点 – 在负载情况下性能会降低，较弱的VPN，管理，不能提供应用层攻击防护功能

JUNIPER培训资料-产品篇

• 冗余路由引擎 • 冗余交换矩阵
• 无源背板 • 分布式包转发的系统架构 • 冗余电源以及风扇系统
物理参数
• 高度: 8RU (大约1/6机架), 深度: <800mm深
系统容量
• 整机最大双工达到1.44T bps的转发性能
与MX960的通用硬件组件
• 相同的RE/SCB板卡 • 相同的DPC/MPC板卡
Copyright © 2012 Juniper Networks, Inc.
Proprietary and Confidential

‹#›
MX960系统组件如何连接?
A-PEM3 A-PEM2 A-PEM1 A-PEM0 A-FAN0 A-FAN1 A-FPB0
A-RE0 A-SCB0
业务槽位上线/下线按钮
Copyright © 2012 Juniper Networks, Inc.
Proprietary and Confidential

‹#›
MX960 电源参数
系统设计2+2 电源冗余电源配置
• MX960的机框分为2个供电区域,每个区域需要1个电源模块 -> 2个电源模块是非冗余的配置 • 如果要冗余, 则每个供电区域需要增加第2个电源模块 • 供电区域1: 电源模块 0 & 2 供电给 DPC 6到11, SCB 1和 2以及下部风扇托盘 • 供电区域2:电源模块 1 & 3供电给DPC 0到5, SCB 0, 以及上部风扇托盘
A-RE1 A-SCB1 A-SCB21
A-DPC0
A-DPC11
A-DPC1
A-DPC10
A-DPC2
A-DPC9
A-DPC3

juniper防火墙培训(SRX系列)

Config），在执行commit后配置模式下可通过
run show config命令查看当前有效配置（Active config）。此外可通过执行show | compare比对候选配置和有效配置的差异。
1
4
SRX可对模块化配置进行功能关闭与激活，如执行deactivate 命令可使相关配置不生效，并可通
用节点id）
指定Control Port 指定Fabric Link Port 配置Redundancy Group 每个机箱的个性化配置地址等）配置Redundant Ethernet Interface （类似NSRP的Redundant冗余接口）配置Interface Monitoring 依据）
同类产品相比，SRX3000系列还可实现最大的I/O端口密度。每一个SRX3000业务网关均可
以安装一个或多个输入/输出卡(IOC)，每一个IOC可以支持16个千兆位接口（16个铜线或光纤千兆以太网），或者20个千兆位接口（2个万兆XFP以太网）。凭借能够添加更多IOC的出色灵活性，SRX3000业务网关系列可支持在接口和处理能力之间实现最佳平衡。（注：要想实现正常的系统功能，至少需要1个NPC和1个SPC）
JUNOS作为电信级产品的精髓是Juniper真正成功的基石，它让企业级产品同样具有电
信级的不间断运营特性，更好的安全性和管理特性，JUNOS软件创新的分布式架构为高性能、高可用、高可扩展的网络奠定了基础。基于NP架构的SRX系列产品产品同时提供性能优异的防火墙、NAT、IPSEC、IPS、UTM等全系列安全功能，其安全功能主要来源于已被广
root@srx5800b> request chassis cluster failover reset redundancy-group 1 c) 查看cluster interface

Juniper产品培训

交换控制板（ Switching Control Board ）
不同路由器的型号使用不同的控制板的命名方式:

M20—系统交换板 (System Switching Board) M160—交换和转发模块 (Switching and Forwarding Module) M10/M7i/M10i/M120—转发引擎板 (Forwarding Engine

M5/M7i/M10/M10i/M20的PIC插槽号从右至左进行编号 M120/M160/T640/T1600的PIC插槽号是从上至下 PIC端口号是以0为起始号.PIC上对端口进行了标识,端口号的编

PIC port Numbers

号方式根据PIC的不同而不同
北京千禧维讯科技有限公司
Page 12
标签 MASTE R OK
颜色蓝色绿色
状态持续持续
描述 SCG处于主用状态 SCG在线，并且工作正常
FAIL
琥珀色
持续
SCG发生故障
北京千禧维讯科技有限公司
Page 18
Craft interface
可以通过Craft interface 查看运行状态以及故障诊断的信息，并且执行许多系统控制功能。 Craft interface 是可以热插拔的部件 Craft interface包括如下：告警LED和告警取消/灯光测试按钮 LCD和导航按钮主机子系统 SIB LED FPC LED FPC oneline/offline 按钮
北京千禧维讯科技有限公司
Page 25
议程
硬件体系介绍
产品系列介绍
板卡插拔/硬件更换ห้องสมุดไป่ตู้

Juniper_防火墙应用培训资料

3
1、安全防护功能的实现
• Juniper防火墙可以防止31类攻击行为。 • 在防火墙中提供一个独立的位置对安全防护的设置进行细化设置。 • 具体的安全设置会体现在对应的安全域中。 • 防火墙作为网络安全设备，可以防止一部分的网络攻击，主要是防护基于TCP/IP协议的二层、三层、四层的攻击行为的防止。 • 注意：目前所有的防火墙设备对DDOS的攻击行为的防护效果欠佳。 • 设置的位置为：SCREENING>SCREEN
22
2、动态VPN的拓扑图
23
2、动态VPN的设置
24
2、动态VPN的设置
25
2、C/S方式的VPN应用
• 基于客户端软件和中心端防火墙方式的 VPN应用。 • 一般建议在临时性外出的移动用户中使用，VPN连接后，数据的流量一般不大。 • 需要注意的地方：NAT穿越的选择。
26
2、C/S方式的拓扑图
10
2、静态VPN连接的设置
• 环境：位于两地的两个网络通过防火墙实现VPN应用。 • 位于两地的两台防火墙的外连端口具有固定的公共IP地址。
11
2、静态VPN的拓扑图
12
2、VPN设置阶段一（1）基本
13
2、VPN设置阶段一（2）高级
14
2、VPN设置阶段一说明
• • • • • • • • • 阶段一的名称定义. 阶段一的VPN网关指向（指向IP，指向用户）. 阶段一的公共密钥. *(C/S方式)本地ID. 高级部分：加密算法、认证算法、加密长度。 VPN的模式：主模式、主动模式。 NAT穿越的选择。 UDP的保持时间
15
2、VPN设置阶段二（1）基本
16
2、VPN设置阶段二（2）高级

Juniper路由器内部培训资料-JUNOS_Lab_Guide_Module1_Sec7

V1.0, 02/15/08 -----------------------------------------------------------Lab 7-1 TroubleshootingObjectivesThe objective of this lab it to provide you with a series of outputs you can use to troubleshoot and diagnose issues that may arise from the configuration of policies, protocols, firewalls, and enhanced services. This module is not intended to be an all inclusive document but rather a reference to help you ensure that your configurations meet the assignments in the previous labs. It is understood that time may not permit you to use all of these commands. As mentioned in module one, however, it is imperative that you verify correct operation of your configuration therefore we are including some of the more common outputs used. Assignment:Use the command line interface to issue commands that verify the correct operation of your configurations from all labs done in this course. Specifically, verify correct operation of the following:-Interfaces-Protocols-OSPF-RIP-Policy-Firewall-Stateful firewall-Screen OptionsV1.0, 02/15/08 -----------------------------------------------------------Lab 7-2 InterfacesUse the show interfaces terse command to display a terse listing of all interfaces installed in the router along with their administrative and link-layer status.Above we can see the status of all the interfaces on our router. It helps to have an understanding of what the different Admin and Link status may indicate.When an interface is administratively disabled, the physical interface has an Admin status of down and a Link status of up, and the logical interface has an admin status of up and a link status of down. The physical interface has a link status of up because the physical link is healthy (no alarms). The logical interface has a link status of down because the data link layer cannot be established end to end.V1.0, 02/15/08 -----------------------------------------------------------When an interface is not administratively disabled and the data-link layer between the local router and the remote router is not functioning, the physical interface has an Admin status of up and a Link status of up while the logical interface has an admin status of up and a link status of down. The physical interface has a link status of up because the physical link is healthy (no alarms). The logical interface has a link status of down because the data-link layer cannot be established end to end.If we see that our interface is not listed as UP/UP, but rather Admin Up but Link down, we can troubleshoot inconsistencies in the configuration or settings on both sides of the link. The show interfaces (interface name) <extensive, brief, detail, statistics> output will show us specific information about settings on the interface as well as drops, errors, alarms, flags, and hardware specific media alarms. The following are some examples of these outputs.V1.0, 02/15/08 -----------------------------------------------------------The output of a show interfaces command displays the device-level configuration and provides additional information about the device’s operation through various flags. These flags include the following:-Down: Device was administratively disabled.-Hear-Own-Xmit: Device will hear its own transmissions.-Link-Layer-Down: The link-layer protocol failed to successfully connect with the remote endpoint.-Loopback: Device is in physical loopback.-Loop-Detected: The link layer received frames that it sent and suspects a physical loopback.-No-Carrier: Where the media supports carrier recognition, this indicates that no carrier is currently seen.-No-Multicast: Device does not support multicast traffic.-Present: Device is physically present and recognized.-Promiscuous: Device is in promiscuous mode and sees frames addressed to all physical addresses on the medium.V1.0, 02/15/08 ------------------------------------------------------------Quench: Device is quenched because it overran its output buffer.-Recv-All-Multicasts: No multicast filtering (multicast promiscuous).-Running: Device is active and enabled.The status of the interface is communicated with one or more flags. These flags include the following:-Admin-Test: Interface is in test mode, which means that some sanity checking, such as loop detection, is disabled.-Disabled: Interface is administratively disabled.-Hardware-Down: Interface is nonfunctional or incorrectly connected.-Link-Layer-Down: Interface keepalives indicate that the link is incomplete.-No-Multicast: Interface does not support multicast traffic.-Point-To-Point: Interface is point to point.-Promiscuous: Interface is in promiscuous mode and sees frames addressed to all physical addresses.-Recv-All-Multicasts: No multicast filtering (multicast promiscuous).-SNMP-Traps: SNMP traps are enabled.-Up: Interface is enabled and operational.The operational status of the device’s link layer protocol is also indicated with flags. These flags include the following:-Give-Up: Link protocol does not continue to retry to connect after repeated failures.-Keepalives: Link protocol keepalives are enabled.-Loose-LCP: PPP does not use LCP to indicate whether the link protocol is up.-Loose-LMI: Frame Relay will not use LMI to indicate whether the link protocol is up.-Loose-NCP: PPP does not use NCP to indicate whether the device is up.-No-Keepalives: Link protocol keepalives are disabled.The output also summarizes the device-level traffic load, which is displayed in both bits and packets per second, as well as any alarms that might be active. The final portion of the command output displays the configuration and status of each logical unit defined on that deviceV1.0, 02/15/08 -----------------------------------------------------------V1.0, 02/15/08 -----------------------------------------------------------V1.0, 02/15/08 -----------------------------------------------------------Now we look at the show interfaces extensive command. In the output above we have narrowed our output to show the section for traffic statistics, and input and output errors. The following is a list of some of the fields displayed here and a brief explanation of what some of the non-obvious ones mean.Input-Errors: Displays the sum of the incoming frame aborts and frame check sequence (FCS) errors.-Policed discards: Displays the frames that the incoming packet match code discarded because they were not recognized or of interest. Usually, this field reports protocolsthat JUNOS software does not handle, such as Cisco Discovery Protocol(CDP)/Spanning Tree Protocol (STP), or any protocol type JUNOS software does notunderstand. (On an Ethernet network, numerous possibilities exist.) -L3 incompletes: This counter increments when the incoming packet fails Layer 3 (usually IPv4) checks of the header. For example, a frame with less than 20 bytes ofavailable IP header would be discarded, and this counter would increment.-L2 channel errors: This counter increments when the software cannot find a valid logical interface (such as e3-1/2/3.0) for an incoming frame.-L2 mismatch timeouts: Displays the count of malformed or short packets that cause the incoming packet handler to discard the frame as unreadable.-SRAM errors: This counter increments when a hardware error occurs in the SRAM on the PIC. The value in this field should always be 0. If it increments, the PIC ismalfunctioning.Output-HS link CRC errors: Displays the count of errors on the high-speed links between the ASICs responsible for handling the router interfaces.-Carrier transitions: Displays the number of times the interface has gone from down to up. This number should not increment quickly, increasing only when the cable isunplugged, the far-end system is powered down and up, or a similar problem occurs.If it does increment quickly (perhaps every 10 seconds), then either the transmission line, the far-end system, or the PIC is broken.-Errors: Displays the sum of the outgoing frame aborts and FCS errors.-Drops: Displays the number of packets dropped by the output queue of the I/O Manager ASIC. If the interface is saturated, this number increments once for everypacket that is dropped by the ASIC’s RED mechanism.-Aged packets: Displays the number of packets that remained in shared packet SDRAM for so long that the system automatically purged them. The value in this field shouldnever increment. If it does, it is most likely a software bug or possibly malfunctioning hardware.V1.0, 02/15/08 -----------------------------------------------------------Lab 7-3 ProtocolsThe first protocol that we configured in our labs was OSPF. Lets take a look at some outputs that will help us determine the overall health of OSPF. In doing this we will look to see if the interfaces are configured for OSPF, if we are seeing adjacencies, and if we are learning our routes.V1.0, 02/15/08 -----------------------------------------------------------The show ospf route command display those routes in the unicast routing table, inet.0, that were installed by OSPF. The use of additional keywords allows you to display only OSPF routes learned by specific LSA types. The output fields of the show ospf route command are the following:-Prefix: Displays the destination of the route.-Route/Path Type: Displays how the route was learned:-ABR: Route to area border router;-ASBR: Route to AS border router;-Ext: External router;-Inter: Interarea route;-Intra: Intra-area route; or-Network: Network router.-Metric: Displays the route's metric value.-Next hop i/f: Displays the interface through which the route's next hop is reachable.-Next hop addr: Displays the address of the next hop.-area: (detail output only) Displays the area ID of the route.-options: (detail output only) Displays the option bits from the LSA.-origin: (detail output only) Displays the router from which the route was learned.V1.0, 02/15/08 -----------------------------------------------------------The show ospf interface command displays information relating to the interfaces on which the respective protocol is configured to run. In the case of OSPF, the output fields are the following:-Interface: Displays the name of the interface running OSPF.-State: Displays the state of the interface. It can be BDR, Down, DR, DRother, Loop, PtToPt, or Waiting.-Area: Displays the number of the area in which the interface is located.-DR ID: Displays the address of the area's DR.-BDR ID: Displays the BDR for a particular subnet.-Nbrs: Displays the number of neighbors on this interface.V1.0, 02/15/08 ------------------------------------------------------------Type (detail and extensive output only): Displays the type of interface. It can be LAN, NBMA, P2MP, P2P, or Virtual.-Address (detail and extensive output only): Displays the IP address of the neighbor.-Mask (detail and extensive output only): Displays the mask of the interface.-MTU (detail and extensive output only): Displays the interface's MTU.-Cost (detail and extensive output only): Displays the interface's cost (metric).-DR addr (detail and extensive output only): Displays the address of the DR.-BDR addr: Displays the address of the BDR.-Adj count (detail and extensive output only): Displays the number of adjacent neighbors.-Flood list (extensive output only): Displays the list of LSAs pending flood on this interface.-Ack list (extensive output only): Displays the list of pending acknowledgments on this interface.-Descriptor list (extensive output only): Displays the list of packet descriptors.-Dead (detail and extensive output only): Displays the configured value for the dead timer.-Hello (detail and extensive output only): Displays the configured value for the hello timer.-ReXmit (detail and extensive output only): Displays the configured value for the retransmit timer.-OSPF area type (detail and extensive output only): Displays the type of OSPF area, which can be Stub, Not Stub, or NSSA.V1.0, 02/15/08 -----------------------------------------------------------Next we can check to see if the interfaces we have configured for OSPF are forming adjacencies. The show ospf neighbor command displays adjacency status for their respective protocols. In the case of OSPF, the output fields include the following: -Address: Displays the address of the neighbor.-Intf: Displays the interface through which the neighbor is reachable.-State: Displays the state of the neighbor, which can be Attempt, Down, Exchange, ExStart, Full, Init, Loading, or 2Way.-ID: Displays the RID of the neighbor.-Pri: Displays the priority of the neighbor to become the DR.-Dead: Displays the number of seconds until the neighbor becomes unreachable.-area (detail and extensive output only): Displays the area in which the neighbor is located.-opt (detail and extensive output only): Displays the option bits from the neighbor.-DR (detail and extensive output only): Displays the address of the DR.-BDR (detail and extensive output only): Displays the address of the BDR.-Up (detail and extensive output only): Displays the length of time since the neighbor came up.-adjacent (detail and extensive output only): Displays the length of time since the adjacency with the neighbor was established.V1.0, 02/15/08 -----------------------------------------------------------Now that we have taken a look at OSPF, let’s take a brief look at some of the commands we can use to verify operation of the RIP protocol.This output displays information about RIP neighbors. This is a list of the fields and what they mean.-Neighbor: Name of RIP neighbor.-State: State of the connection: Up or Dn (Down).-Source Address: Source Address.-Destination Address: Destination Address.-Send Mode: Send options: broadcast, multicast, none, or version 1.-Receive Mode: Type of packets to accept: both, none, version1 or version2.-In Met: Metric added to incoming routes when advertising into RIP routes that were learned from other protocols.V1.0, 02/15/08 -----------------------------------------------------------This output above displays the route entries in the routing table that were learned from protocols RIP. A description of some of the fields follows.-active: Number of routes that are active.-holddown: Number of routes that are in the hold-down state prior to being declared inactive.-hidden: Number of routes not used because of routing policy.-+: A plus sign before [protocol/preference] indicates the active route, which is the route installed from the routing table into the forwarding table.--: A hyphen before [protocol/preference] indicates the last active route.-*: An asterisk before [protocol/preference] indicates that the route is both the active and the last active route. An asterisk before a ‘to’ line indicates the best subpath to the route.V1.0, 02/15/08 -----------------------------------------------------------To see what RIP routes are being sent or received on the router issue the show route advertising-protocol rip<egress interface address> and show route receive-protocol rip<remote advertising interface address> commands. The field definitions follow:-active: Number of routes that are active.-holddown: Number of routes that are in the hold-down state prior to being declared inactive.-hidden: Number of routes not used because of routing policy.-+: A plus sign before [protocol/preference] indicates the active route, which is the route installed from the routing table into the forwarding table.--: A hyphen before [protocol/preference] indicates the last active route.-*: An asterisk before [protocol/preference] indicates that the route is both the active and the last active route. An asterisk before a ‘to’ line indicates the best subpath to theroute.V1.0, 02/15/08 -----------------------------------------------------------Lab 7-4 PolicyWhen troubleshooting policy two of the most common commands are show route receive-protocol and show route advertising-protocol. When issuing these commands it’s important to understand where we are getting the outputs from. The commands on the slide show routing updates received before import policy processing and the routing updates sent after export policy processing.Use the show route receive-protocol protocol neighbor command to show the specified protocol-type route advertisements that a particular neighbor is advertising to your router before import policy is applied. Use the show route advertising-protocol protocolneighbor command to show the protocol-type route advertisements that you are advertising to a particular neighbor after export policy is applied.The use of route filters marks an exception to the behavior documented previously. JUNOS software evaluates route filters before the output of a show route receive-protocol command is generated. Thus, you must specify the hidden switch to the show routereceive-protocol command to display received routes filtered by your import policy.If you want to monitor the effects of an import policy, use the show route protocol protocol command to monitor the effects of your import policy. This command shows all routes from the protocol type specified that are installed in the routing table.Another way we can troubleshoot policy is to use the function test policy <policy name><prefix>. By using this command you can test policies that are created (and committed) on the router for a specific prefix to see if the policy will have the desired effect on the prefix being tested.V1.0, 02/15/08 -----------------------------------------------------------V1.0, 02/15/08 -----------------------------------------------------------It is important to keep in mind that the default action of ‘test’ is to accept. Note the difference in behavior once we add a second term catch-all to reject any remaining routes.V1.0, 02/15/08 -----------------------------------------------------------Lab 7-5 Stateless Firewall Filters (Packet Filters)One of the more common ways to test firewall filters is to set up counters to capture discarded and accepted packets. If we see packets increment in the discard counter then we can at least be assured that our filter is applied and that packets are matching. Please recall that in a previous lab we used a firewall filter to match on ICMP and a counter to show that it was working correctly. The following command, show firewall, shows the counter we created and the amount of traffic that has been matched it.-----------------------------------------------------------V1.0, 02/15/08 -----------------------------------------------------------Another method for troubleshooting is to look at the firewall log created specially for dropped packets due to firewall match criteria. The log modifier writes packet header information to a memory resident buffer in the PFEV1.0, 02/15/08 -----------------------------------------------------------The following chart shows the output field definitions:Time of Log Time that the event occurred. to be providedFilter Name of a filter that has been configured with the filterstatement at the [edit firewall] hierarchy level.• A hyphen (-) indicates that the packet was handled bythe Packet Forwarding Engine.• A space (no hyphen) indicates the packet was handledby the Routing Engine.•The notation pfe indicates packets logged by thePacket Forwarding Engine hardware filters.to beprovidedFilter Action Filter action:•A—Accept•D—Discard•R—Rejectto beprovidedName of Interface Ingress interface for the packet.to beprovidedName of protocol Packet's protocol name: egp, gre, ipip, ospf, pim, rsvp, tcp, orudp.to beprovidedPacket length Length of the packet. to be providedSource address Packet's source address. to be providedDestination address Packet's destination address and port.to beprovidedV1.0, 02/15/08 -----------------------------------------------------------Finally one more way to look at the results of our firewall filters is to create a system log file that matches on the packets that have been dropped as a result of the firewall applied to the router. First of all, take a look at the system syslog settings that allow us to analyze the log filesThen as part of the firewall filter, we include the action of syslog:V1.0, 02/15/08 -----------------------------------------------------------Finally, we can now take a look at the log files created as a result of our work:In this section we will see a couple outputs that give us useful information on stateful firewalls, zones, and interfaces that participate. One thing to keep in mind is that the output for flows shows up only if traffic has passed within a certain amount of time. This means that even though your configuration may be correct, the output may not show incrementing valueswithout traffic.V1.0, 02/15/08 -----------------------------------------------------------This output is shown to let you see that with JES configured on your router, a showinterfaces output references the zones assigned to the logical portion of your interface. This can be helpful when determining if your zones have been applied correctly and give you some basic information as to the amount and type of traffic being allowed to traverse your interface.V1.0, 02/15/08 -----------------------------------------------------------Conversely, if you would rather take a look at the zones configured on your router, the show security zones output will show you the zones configured as well as the interfaces associated with these zones. Additional information can be found here that let’s us know any settings we have for the return traffic. For instance, if we have decided to send a reset for non-SYN session TCP packets, this information would be shown under the security zone section of this output.V1.0, 02/15/08 -----------------------------------------------------------The output above summarizes all of the active sessions that have been created.V1.0, 02/15/08 -----------------------------------------------------------From time to time it may become necessary to clear flows on your router, the output above shows this. You also have the ability to clear specific sessions with the session identifier.V1.0, 02/15/08 -----------------------------------------------------------Lab 7-7 Screen OptionsFor the lab and objective assignments, sending ping packets that are obviously too large and then monitoring the command show security screen statistics zone <zone name> should give us an indication of whether or not our configuration will account for the specific type of attack we are mitigating. Because this output has all ready been seen in module 6, the output above may look a bit familiar. ☺。

1、下载文档前请自行甄别文档内容的完整性，平台不提供额外的编辑、内容补充、找答案等附加服务。
2、"仅部分预览"的文档,不可在线预览部分如存在完整性等问题,可反馈申请退款(可完整预览的文档不适用该条件!)。
3、如文档侵犯您的权益，请联系客服反馈,我们会尽快为您处理(人工客服工作时间：9:00-18:30)。

– 是 IDP 防“phone-home” 攻击（向外发布私人信息）的补充(保护已受感染设备)
– 完全和ScreenOS 5.3 整合
• 客户可以选择采用Kaspersky还是Trend – 推荐用卡巴斯基
25
内嵌防垃圾邮件
– 阻断垃圾邮件和网页仿冒攻击
• 将赛门铁克的防垃圾邮件功能集成到SSG 520/550中 • 使用基于IP的、强韧的、始终更新的垃圾邮件发送人和网页仿
• Source/Destination ip Session number limit
20
SSG：多种领先的安全技术的集成
• 入侵防御功能：
• 防病毒：卡巴斯基
• 防垃圾邮件：赛门铁克
• 网页过滤：美讯智
其他厂家主要依靠自己开发，特征库不完善，不专业；或者只能支持部分的UTM功能
21
更多应用层协议的DI（IPS）支持
3
Juniper将电信级的技术精髓带入金融企业
2006
M-Series
1996
Incorporated
1998
1999
Revenue Employees
2000
2001
2002
$500M 1000
T-Series
1500
5
2004
$1B 2500
2005
#789
Acorn
UAC
SSG
$2B $2.3B
– 2个选项：集成 (SurfControl) 或重新定向 (SurfControl 或Websense)
URL 请求
许可接入
XOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXO
Malformed Packet Protection • SYN and FIN bit set • No flags in TCP • FIN with no ACK • ICMP fragment • Large ICMP • IP strict source route • IP record route • IP security options • IP timestamp • IP stream • IP bad options • Unknown protocols
control)
探测保护 • Port scan • IP address sweep
PROTECTION
DoS 和 DDoS 防护
• SYN flood • 包括syn proxy和syn
cookie 方式
• ICMP flood • UDP flood • IP spoofing • Per-session limiting • SYN fragments •恶D意e数fau据lt包pa防c护ket deny •• SPiYnNg-AofCdKe-aAtChK attack • Land attack • Tear drop attack • WinNuke attack • IP source route • Loose source route
性能
小型/中型办事处/远程站点 /远程工作人员
大中型站点/分支办事处 /远程办事处
18
内部网络、服务供应商、高速网关
网络分区有助加强安全性和管理
Untrust
Internet
Custom Zone (DMZ #2)
Custom Zone (DMZ #1)
Trust
• 接口与安全域是对应的 • 多个接口可与同一安全域对应 • 安全域间的流量必须通过安全策略控制
• Juniper 是全球IDP领域市场分额第二 2004-2006 Frost & Suቤተ መጻሕፍቲ ባይዱlivan
• Juniper在2006年国内网络安全市场分额第一 (Frost & Sullivan)
6
客户影响力不断提升－中国
• Juniper在大中国
– 已经为大中国各顶尖运营商提供战略性网络系统。
• 对入站和出站流量进行病毒扫描
XOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOX OXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXO XOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOX
19
HA Link
Custom Zone (Wireless LAN)
基于安全区的Denial-of-Service 防护
Firewall
Protected Network
防火墙保护 • 状态检测 (i.e., TCP and
UDP) • TCP顺序检测 • MAC 地址检测 • CRC 检测
内容保护 • Java/ActiveX/Zip/Exe 阻断 • 用户定义的恶意 URLs • URL 阻断 (Websense、surf
入侵防护解决方案
Intrusion prevention appliances that help protect networks and critical resources from attacks
整合接入控制解决方案
Juniper Unified Access Control (UAC) combines user identity, device security state and location information for session-specific access policy by user
致：John Subject：请打开这个文件
丢弃受感染的电子邮件，并向用户发送消息
24
Juniper的防病毒引擎
• 和业界领先的防病毒厂家(卡巴斯基Kaspersky)合作
– 一直以来该都被评为最佳的检测和响应引擎
• 新的防病毒解决方案包括的向内方向的Spyware / Adware / Keyloggers的阻断
Screen OS 5.1 and 5.2
Screen OS 5.3
FTP, Gnutella, HTTP, IMAP, NetBIOS, POP3, DNS, MSRPC, SMB, SMTP and Instant Messaging (AOL, MSN, Yahoo).
CHARGEN, DHCP, DISCARD, ECHO, FINGER, Gopher, ICMP, IDENT, IKE, IRC, LDAP, LPR, MS-SQL, NFS, NNTP, NTP, PortMapper, RADIUS, Rexec, rlogin, SunRPC, Rsh, RTSPRusers, SNMP/Trap, SQL Mon, SSH, SSL, Syslog, TELNET, TFTP, VNC, WHOIS
冒人的全球名单来阻断（及/或标记出）垃圾邮件 • 使用特定的域、电子邮件发送方或IP地址来创建定制的“黑名
单”和“白名单”
• 过滤垃圾邮件，由赛门铁克提供
XOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOX OXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXO XOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOX
– 已经为尖端教育科研系统、银行系统、能源系统、以及广泛的商用市场/中小企业等提供尖端网络系统服务。
9
Juniper 安全系列产品防火墙
防火墙议程
1. Juniper简介 2. Juniper 防火墙整合的安全功能 3. Juniper 防火墙硬件结构及性能方面与其
它产品的区别 4. Juniper 防火墙产品型号
SSL VPN Solutions
Product lines for secure LAN, extranet and intranet access to mobile employees, customers and partners with no client software deployment
Juniper Networks
防火墙产品
防火墙议程
1. Juniper简介 2. Juniper 防火墙整合的安全功能 3. Juniper 防火墙硬件结构及性能方面与其
它产品的区别 4. Juniper 防火墙产品型号
2
Gartner历年的评价 (2007年报告)
Juniper #1 out of 11 vendors
不希望的 / 主动发送的电子邮件
全球垃圾邮件数据库
减少没有价值的电子邮件流量
26
内嵌Web过滤
• 控制Web的使用以提高员工生产率和网络资源利用率并避免诉讼
– 防止用户访问已知的间谍软件和网页仿冒站点 – 通过预定义的或定制的URL列表来控制对网站的访问
• 可基于站点、内容类型或用户群来制订策略
11
SSG使用了业界最好的引擎与技术
保护的企业
入侵防护
防病毒
反垃圾邮件
网页过滤
基本防火墙
IPSec VPN
“ ” Layered protection model
12
安全产品分类
UAC Agent
企业安全路由解决方案
Service provider quality routers for the enterprise designed for remote, branch or regional offices