Juniper路由器基本加固方案(共11页).doc

精选优质文档-倾情为你奉上技 术 文 件技术文件名称：Juniper路由器基本加固方案 技术文件编号： 版 本：V1.1.1 文件质量等级：共12页(包括封面) 拟 制 审 核 会 签 标准化 批 准 中兴通讯股份有限公司专心-专注-专业修改记录文件编号版本号拟制人/修改人拟制/修改日期更改理由主要更改内容（写要点即可）1.0王华刚2009/05/31无无1.1王华刚2009/06/15配置编号配置加固项编号1.1.1王华刚2009/07/03更新编号更新加固项编号注1：每次更改归档文件（指归档到事业部或公司档案室的文件）时，需填写此表。注2：文件第一次归档时，“更改理由”、“主要更改内容”栏写“无”。Juniper路由器基本加固方案目录Juniper路由器基本加固方案1 概述内部适用性说明本方案是在业务研究院网络安全规范中各项要求的基础上，提出Juniper路由器基本加固方案。外部引用说明中国移动设备通用安全功能和配置规范中国移动路由器设备安全功能规范中国移动JUNIPER路由器安全配置规范术语和定义符号和缩略语缩写英文描述中文描述本文件中的字体标识如下：蓝色斜体 在具体执行时需要替换的内容检查/加固项编码意义如下：公司名称-操作系统-条目性质 风险级别 数字编号-小项数字编号条目性质中：S意为检查；E意为加固风险级别中：H意为高风险；M意为中等风险；L意为低风险，风险级别仅存于具体条目中约定：系统配置命令需要先进入JUNOS编辑模式：rootxxx>configureroot#edit system命令执行完毕后，需要运行commitroot#commit2 Juniper路由器安全配置操作指导2.1 ZTE-JUNIPER-R-E01帐号安全加固操作2.1.1 ZTE-JUNIPER-R-EH01-01删除锁定无用帐号show configuration system login查看当前可用帐号，删除不必要的帐号root#delete system login user abc32.1.2 ZTE-JUNIPER-R-EM01-02配置只读用户root#set system login user weihuroot#set system login user weihu class read-only普通的状态查看操作必须使用weihu帐号进行2.1.3 ZTE-JUNIPER-R-EH01-03配置强密码root#set system root-authentication plain-text-passwordpassword:newpassword重复输入新密码password:newpasswordroot#set system login user weihu authentication plain-text-password 2.1.4 ZTE-JUNIPER-R-EL01-04配置radius认证（可选）root#set system authentication-order radiusroot#set system authentication-order passwordroot#set system radius-server 10.1.1.1root#set system radius-server 10.1.1.2root#set system radius-server 10.1.1.1 port 1645root#set system radius-server 10.1.1.2 port 1645root#set system radius-server 10.1.1.1 secret connpasswordroot#set system radius-server 10.1.1.2 secret connpassword2.2 ZTE-JUNIPER-R-E02网络服务/IP协议要求2.2.1 ZTE-JUNIPER-R-EM02-01关闭FTP服务root# delete system services ftp2.2.2 ZTE-JUNIPER-R-EH02-02Telnet连接白名单配置root# set firewall filter filtername1 term a from source-address 10.1.1.1/32root# set firewall filter filtername1 term a from source-address 10.1.1.2/32root# set firewall filter filtername1 term a then acceptroot# set firewall filter filtername1 term b from protocol tcp port telnetroot# set firewall filter filtername1 term b then rejectroot# set firewall filter filtername1 term c then accept2.2.3 ZTE-JUNIPER-R-EM02-03Telnet连接数限制root# set system services telnet connection-limit 10 root# set system services telnet rate-limit 52.2.4 ZTE-JUNIPER-R-EL02-04配置NTP服务器或客户端（可选）root# set system ntp authentication-key 1 type md5 value md5passwordroot# set system ntp server 10.1.1.1root# set system ntp server 10.1.1.22.2.5 ZTE-JUNIPER-R-EM02-05在网络边界，设置安全访问控制过滤与业务不相关的流量示例1：set firewall filter filtername2 term a from source-address 10.1.1.1/32set firewall filter filtername2 term a from destination-address 10.1.2.1/32set firewall filter filtername2 term a from protocol tcpset firewall filter filtername2 term a from protocol udpset firewall filter filtername2 term a from source-port 445set firewall filter filtername2 term a from destination-port 145set firewall filter filtername2 term a then acceptset firewall filter filtername2 term b then reject过滤与业务不相关的流量示例2：set firewall filter filtername2 term a from protocol udp destination-port 1434set firewall filter filtername2 term a then discardset firewall filter filtername2 term b from protocol tcp port 445set firewall filter filtername2 term b then discardset firewall filter filtername2 term c from port 5800 5900set firewall filter filtername2 term c then discardset firewall filter filtername2 term d then accept业务产品规则集彩信短信WAP网关2.2.6 ZTE-JUNIPER-RH-E02-06设置SNMP访问白名单root# set snmp community snmppasswd clients 10.1.1.1/32root# set snmp community snmppasswd clients 10.1.2.1/32root# set snmp community snmppasswd clients ready-only10.1.1.1/32和10.1.2.1/32被配置为允许SNMP访问，注意配置可能对需要SNMP的业务产生影响。2.2.7 ZTE-JUNIPER-RH-E02-07系统应配置为SNMP V2或以上版本如果使用SNMP v2：root# set snmp trap-group trapgroup version v2如果使用SNMPv3：set snmp v3 usm local-engine user username authentication-md5 authentication-keyset snmp v3 vacm access group CMNET default-context-prefix security-model usm security-level authentication read-view readonlyset snmp v3 target-address ta1 address 10.1.1.1set snmp v3 target-address ta1 target-parameters tp1set snmp v3 target-parameters tp1 parameters message-processing-model v3set snmp v3 target-parameters tp1 parameters security-model usmset snmp v3 target-parameters tp1 parameters security-level noneset snmp v3 target-parameters tp1 parameters security-name secnameset snmp v3 snmp-community index1 community-name commnameset snmp v3 snmp-community index1 security-name secnameset snmp engine-id use-mac-addressset snmp view readonly oid .1.3.6.1.2.1.2 include2.2.8 ZTE-JUNIPER-R-EH02-08配置可接收SNMP消息的主机地址root# set snmp trap-group trapgroup targets 10.1.1.1root# set snmp trap-group trapgroup targets 10.1.2.12.2.9 ZTE-JUNIPER-R-EL02-09配置动态路由协议（BGP/ MP-BGP /OSPF等）时启用带加密方式的身份验证（可选）root# set protocols bgp group abc neighbor 10.1.1.1 authentication-key passwordroot# set protocols ospf area 0.0.0.0 authentication-type md5业务产品是否配置彩信短信WAP网关2.2.10 ZTE-JUNIPER-R-EL02-10配置MP-BGP路由协议，应配置MD5加密认证，通过MD5加密认证建立peer（可选）root# set protocols bgp group groupname neighbor 10.1.1.1 authentication-key password2.2.11 ZTE-JUNIPER-R-EL02-11对于非点到点的OSPF协议配置，应配置MD5加密认证，通过MD5加密认证建立neighbor（可选）root# set protocols ospf area 0.0.0.0 authentication-type md5root# set protocols ospf area 0.0.0.0 interface fe-0/0/0.0 authentication md5 1 key password2.2.12 ZTE-JUNIPER-R-EL02-12禁止发布或接收不安全的路由信息（可选）set policy-options policy-statement polname term a from route-filter 10.0.0.0/24 exactset policy-options policy-statement polname term a then acceptset policy-options policy-statement polname term b then reject待补充：制定路由策略之后，必须将该策略应用于路由协议上才生效2.2.13 ZTE-JUNIPER-R-EL02-13启用RSVP标签分发协议时，打开RSVP协议认证功能（可选）root# set protocols rsvp interface fe-0/0/0.0 authentication-key md5password业务产品是否配置彩信短信WAP网关2.3 ZTE-JUNIPER-R-E03日志记录要求2.3.1 ZTE-JUNIPER-R-EL03-01配置登录日志root# set system syslog file author.log authorization info 2.3.2 ZTE-JUNIPER-R-EL03-02配置命令日志root# set system syslog file messages any any2.3.3 ZTE-JUNIPER-R-EL03-03配置事件日志root# set system syslog file daemon.log daemon warningroot# set system syslog file firewall.log firewall warning2.3.4 ZTE-JUNIPER-R-EL03-04配置远程日志服务器（可选）root# set system syslog host 10.1.1.1 any noticeroot# set system syslog host 10.1.1.1 log-prefix Router1root# set system syslog host 10.1.1.2 any noticeroot# set system syslog host 10.1.1.2 log-prefix Router22.3.5 ZTE-JUNIPER-R-EL03-05设置系统的配置更改信息保存到change.log文件root# set system syslog file change.log change-log info2.4 ZTE-JUNIPER-R-E04杂项2.4.1 ZTE-JUNIPER-R-EL04-01配置定期备份配置文件功能（可选）root# set system archival configuration transfer-interval 2880root# set system archival configuration archive-sites ftp:/juniper10.1.1.1 password newpasswdroot# set system archival configuration archive-sites ftp:/juniper10.1.1.2 password newpasswd