防火墙课程.ppt

《防火墙课程.ppt》由会员分享，可在线阅读，更多相关《防火墙课程.ppt（44页珍藏版）》请在淘文阁 - 分享文档赚钱的网站上搜索。

1、Firewall TranningEccom Network内容1、PIX系列硬件2、ASA系列硬件3、防火墙配置命令4、防火墙维护思科防火墙分类硬件分类 思科防火墙主要分为2类，老产品系列为PIX，新产品系列为ASA5500。软件分类 思科防火墙以配置命令格式主要分为2类软件版本：7.0以上包括7.0和7.0以下。PIX系列硬件系列硬件PIX系列PIX Firewall 515EPIX Firewall 525PIX Firewall 535PIX License TypePIX License Type501：Provided with a 10-user,50-user,or unlim

2、ited user licenses506E：Provided in a single,unlimited-user license.515E、525、535 provide 4 types of license：Unrestricted（UR）Restricted（R）Failover（FO）Failover-Active/Active（FO-A/A）PIX Firewall License ComparisonCisco PIX 500 防火墙性能参考产品产品最高性能最高性能流量端口流量端口HA50160Mbps/7500*conn.4 FE switch+1FE不支持506E100Mbp

3、s/25000*conn.2 FE不支持515E190Mbps/130000 conn.2 FE可扩充1FE(R Lic.)和4FE(UR Lic.)A/S+A/A*525E330Mbps/280000 conn.2 FE可扩充4FE或3GE(R Lic.)和8FE或3GE(UR Lic.)A/S+A/A*5351.7Gbps/500000 conn.2 FE可扩充6FE或8GE(R Lic.)和12FE或9GE(UR Lic.)A/S+A/A*ASA系列硬件系列硬件ASA系列ASA 5500 系列 5505 5520 5550 5510 5540 5580ASA 5510FeatureDes

4、criptionFirewall ThroughputUp to 300MbpsConcurrent Threat Mitigation Throughput Up to 150 Mbps with AIP-SSM-10VPN ThroughputUp to 170 MbpsConcurrent Sessions50,000/130,000*IPSec VPN Peers250SSL VPN Peer License Levels10,25,50,100,or 250Security ContextsNot supportedInterfaces3 FE+1 management port;5

5、 FE*Virtual interfaces(VLANs)10;25*High AvailabilityNot supported;Active/Standby*Upgrade available with Cisco ASA 5510 Security Plus licenseASA 5520FeatureDescriptionFirewall ThroughputUp to 450 MbpsConcurrent Threat Mitigation Throughput Up to 225 Mbps with AIP-SSM-10Up to 375 Mbps with AIP-SSM-20V

6、PN ThroughputUp to 225 MbpsConcurrent Sessions280,000IPSec VPN Peers750SSL VPN Peer License Levels*10,25,50,100,250,500,or 750Security ContextsUp to 10*Interfaces4 GE and 1 FEVirtual interfaces(VLANs)100ScalabilityVPN clustering and load balancingHigh AvailabilityActive/Active,Active/Standby*Separat

7、ely licensed feature;includes two with base systemASA 5540FeatureDescriptionFirewall ThroughputUp to 650 MbpsConcurrent Threat Mitigation Throughput Up to 450 Mbps with AIP-SSM-20VPN ThroughputUp to 325 MbpsConcurrent Sessions400,000IPSec VPN Peers5000SSL VPN Peer License Levels*10,25,50,100,250,500

8、,750,1000 and 2500Security ContextsUp to 50*Interfaces4 GE and 1 FEVirtual interfaces(VLANs)100ScalabilityVPN clustering and load balancingHigh AvailabilityActive/Active,Active/Standby*Separately licensed feature;includes two with base systemASA 5550FeatureDescriptionFirewall ThroughputUp to 1.2Gbps

9、VPN ThroughputUp to 450 MbpsConcurrent Sessions650,000IPSec VPN Peers5000SSL VPN Peer License Levels10,25,50,100,250,500,750,1000,2500 and 5000Security ContextsUp to 50*Interfaces8GE,4SFP and 1 FEVirtual interfaces(VLANs)200ScalabilityVPN clustering and load balancingHigh AvailabilityActive/Active,A

10、ctive/Standby*Separately licensed feature;includes two with base systemCharacteristics of Cisco ASA 5500 Series Adaptive Security AppliancesCharacteristics of Cisco ASA 5500 Series Adaptive Security Appliances防火墙配置命令防火墙配置命令7.0版本以下配置命令讲解interface ethernet0 auto 设定端口0 速率为自动interface ethernet1 100full

11、设定端口1 速率为100兆全双工nameif ethernet0 outside security0 设定端口0 名称为 outside 安全级别为0nameif ethernet1 inside security100 设定端口1 名称为 inside 安全级别为100nameif ethernet2 dmz security50 设定端口2 名称为 dmz 安全级别为50enable password Dv0yXUGPM3Xt7xVs encrypted 特权密码passwd 2KFQnbNIdI.2KYOU encrypted 登陆密码访问控制列表access-list 101 perm

12、it ip 192.168.99.0 255.255.255.0 192.168.170.0 255.255.255.0access-list 101 permit ip 192.168.12.0 255.255.255.0 192.168.180.0 255.255.255.0access-list 101 permit ip 192.168.23.0 255.255.255.0 192.168.180.0 255.255.255.0access-list 101 permit ip 192.168.99.0 255.255.255.0 192.168.101.0 255.255.255.0

13、建立访问列表，允许特定网段的地址访问某些网段access-group 101 in interface outsideaccess-group 101 in interface insideaccess-group 101 in interface dmz应用访问列表到接口上接口地址及MTUmtu outside 1500mtu inside 1500mtu dmz 1500ip address outside 10.1.1.4 255.255.255.224 设定外端口地址ip address inside 192.168.1.254 255.255.255.0 设定内端口地址ip addr

14、ess dmz 192.168.19.1 255.255.255.0 设定DMZ端口地址日志记录logging on logging timestamp logging buffered warningslogging trap warnings 打开设备日志记录功能并设定记录的日志等级查看日志命令：show loggingNAT配置global(outside)1 10.1.1.13-10.1.1.28global(outside)1 10.1.1.7-10.1.1.9global(outside)1 10.1.1.10 定义内部网络地址将要翻译成的全局地址或地址范围nat(inside)0

15、 access-list 101 使得符合访问列表为101地址不通过翻译，对外部网络是可见的nat(inside)1 192.168.0.0 255.255.0.0 0 0 内部网络地址翻译成外部地址nat(dmz)1 192.168.0.0 255.255.0.0 0 0 DMZ区网络地址翻译成外部地址static(inside,outside)10.1.1.5 192.168.12.100 netmask 255.255.255.255static(inside,outside)10.1.1.12 192.168.12.158 netmask 255.255.255.255static(i

16、nside,outside)10.1.1.3 192.168.2.4 netmask 255.255.255.255设定固定主机与外网固定IP之间的一对一静态转换static(dmz,outside)10.1.1.2 192.168.19.2 netmask 255.255.255.255 设定DMZ区固定主机与外网固定IP之间的一对一静态转换 静态路由设置route inside 192.168.2.0 255.255.255.0 192.168.1.1route inside 192.168.3.0 255.255.255.0 192.168.1.1route outside 192.16

17、8.4.0 255.255.255.0 192.168.10.17.0版本以上配置命令讲解防火墙7.0及以上版本的命令格式与路由器基本一样，在这里不再详述。举例如下：防火墙维护防火墙维护PIX Troubleshooting工具工具show commandShow connect和和show connect detail pix#sh conn1514 in use,66418 most usedTCP out 210.72.32.92:4826 in 10.6.99.97:1433 idle 0:00:15 Bytes 4454 flags UIOBTCP out 210.72.32.92:

18、4825 in 10.6.99.97:1433 idle 0:00:29 Bytes 4453 flags UIOBpix#sh conn det 1521 in use,66418 most usedFlags:A-awaiting inside ACK to SYN,a-awaiting outside ACK to SYN,B-initial SYN from outside,C-CTIQBE media,D-DNS,d-dump,E-outside back connection,F-outside FIN,f-inside FIN,G-group,g-MGCP,H-H.323,h-H

19、.225.0,I-inbound data,i-incomplete,k-Skinny media,M-SMTP data,m-SIP media,O-outbound data,P-inside back connection,q-SQL*Net data,R-outside acknowledged FIN,R-UDP RPC,r-inside acknowledged FIN,S-awaiting inside SYN,s-awaiting outside SYN,T-SIP,t-SIP transient,U-upTCP dmz:210.72.32.92/4826 inside:10.

20、6.99.97/1433 flags UIOBTCP dmz:210.72.32.92/4825 inside:10.6.99.97/1433 flags UIOB显示当前连接情况。显示当前连接情况。Show xlate和和show xlate detail pix#sh xlate861 in use,8295 most usedGlobal 210.72.33.20 Local 210.72.33.20Global 219.235.129.18 Local 10.6.99.158Global 210.72.32.178 Local 210.72.32.178pix#sh xlate det

21、873 in use,8295 most usedFlags:D-DNS,d-dump,I-identity,i-inside,n-no random,o-outside,r-portmap,s-staticNAT from dmz:210.72.33.20 to outside:210.72.33.20 flags sNAT from inside:10.6.99.158 to outside:219.235.129.18 flags s显示当前显示当前NAT转换情况。转换情况。Show cpu usage pix#show cpu usageCPU utilization for 5 se

22、conds=2%;1 minute:2%;5 minutes:2%显示当前显示当前CPU利用情况。利用情况。Show traffic pix#sh trafficoutside:received(in 2.890 secs):0 packets189971 bytes0 pkts/sec65733 bytes/sectransmitted(in 2.890 secs):0 packets2914252 bytes0 pkts/sec1008391 bytes/secinside:received(in 2.890 secs):0 packets2627283 bytes0 pkts/sec90

23、9094 bytes/sectransmitted(in 2.890 secs):0 packets170788 bytes0 pkts/sec59096 bytes/secdmz:received(in 2.890 secs):0 packets305187 bytes0 pkts/sec105601 bytes/sectransmitted(in 2.890 secs):0 packets23331 bytes0 pkts/sec8073 bytes/sec显示在显示在PIX各个接口各个接口的流量情况，出、入的流量情况，出、入包和字节数等。包和字节数等。Show local-host pi

24、x#sh local-hostInterface dmz:282 active,282 maximum active,0 deniedlocal host:,TCP connection count/limit=0/unlimited TCP embryonic count=0 TCP intercept watermark=unlimited UDP connection count/limit=0/unlimited AAA:Xlate(s):Global 210.72.33.20 Local 210.72.33.20 Conn(s):显示本地主机的显示本地主机的TCP、UDP连接和连接和

25、NAT情况。情况。PIX 调试中的问题应用不能正常使用调试中的问题应用不能正常使用检查：检查：Permissions:安全策略设置是否正确安全策略设置是否正确Translation:地址翻译设置是否正确。地址翻译设置是否正确。Static和和NAT语句，语句，global语句语句Routing：路由表是否正确：路由表是否正确强烈建议：在强烈建议：在PIX的安全策略、接口、路由，甚至配置改动的时候，尽的安全策略、接口、路由，甚至配置改动的时候，尽可能在条件允许的情况下使用可能在条件允许的情况下使用clear xlate、clear arp、clear local-host清除原有的清除原有的xl

26、ate、arp和连接！和连接！PIX Troubleshooting案例分析案例分析问题现象：问题现象：用户不能正常访问用户不能正常访问Internet。新连接不能正常使用。新连接不能正常使用。原有连接可正常使用。原有连接可正常使用。分析过程：分析过程：第一步：检查第一步：检查Syslog%PIX-3-211001:Memory allocation Error%PIX-3-211001:Memory allocation Error第二步：检查可用内存第二步：检查可用内存Hardware:PIX-515E,64M RAM-show memory-Free memory:714696 byte

27、sUsed memory:66394168 bytes-Total memory:67108864 bytesPIX Troubleshooting案例分析案例分析第三步：是什么用尽了内存？第三步：是什么用尽了内存？第四步：检查第四步：检查Xlatepix#sh xlate251 in use,258 most used第五步：检查连接数第五步：检查连接数pix#sh conn147456 in use,147456 most used为什么连接数这么高？为什么连接数这么高？PIX Troubleshooting案例分析案例分析第六步：检查流量情况，用第六步：检查流量情况，用show traf

28、fic命令。命令。检查结果：大多数的流量都是流入检查结果：大多数的流量都是流入Inside接口，从接口，从Outside接口接口流出。流出。-show traffic-outside:received(in 25.000 secs):1475 packets469050 bytes59 pkts/sec18762 bytes/sectransmitted(in 25.000 secs):167619 packets 9654480 bytes6704 pkts/sec386179 bytes/secinside:received(in 25.000 secs):180224 packets 1

29、0410480 bytes7208 pkts/sec416419 bytes/sectransmitted(in 25.000 secs):1050 packets118650 bytes42 pkts/sec4746 bytes/secPIX Troubleshooting案例分析案例分析第七步：分析第七步：分析为什么连接数如此高，但为什么连接数如此高，但Xlate数却不高？数却不高？结论：结论：l每一个每一个Xlate使用了大量的使用了大量的connection。l可能某个或者几个主机正在使用大量的可能某个或者几个主机正在使用大量的connection。l大多数情况下是由病毒或者攻击引起的

30、。大多数情况下是由病毒或者攻击引起的。PIX Troubleshooting案例分析案例分析第八步：查找产生大量第八步：查找产生大量connection的主机的主机pix#sh local-host|include host|count/limitlocal host:,TCP connection count/limit=146608/unlimited UDP connection count/limit=0/unlimited使用正则表达式，只查看使用正则表达式，只查看host或者或者count/limit行。行。结果表明：主机结果表明：主机10.1.1.99几乎用了所有的连接，都是基于

31、几乎用了所有的连接，都是基于TCP的应用。的应用。PIX Troubleshooting案例分析案例分析第九步：看看这台主机在做什么？第九步：看看这台主机在做什么？pix#sh local-host 10.1.1.99Interface inside:250 active,250 maximum active,0 deniedlocal host:,TCP connection count/limit=146608/unlimited TCP embryonic count=146606 TCP intercept watermark=unlimited UDP connection coun

32、t/limit=0/unlimited AAA:Xlate(s):Global 209.165.201.21 Local 10.1.1.99 Conn(s):TCP out 64.101.32.153:135 in 10.1.1.99:34580 idle 0:00:15 Bytes 0 flags saATCP out 64.103.108.191:135 in 10.1.1.99:8688 idle 0:00:29 Bytes 0 flags saATCP out 64.100.205.160:135 in 10.1.1.99:12335 idle 0:00:15 Bytes 0 flag

33、s saATCP out 64.101.25.195:135 in 10.1.1.99:2978 idle 0:00:20 Bytes 0 flags saATCP out 64.101.33.128:135 in 10.1.1.99:41589 idle 0:00:20 Bytes 0 flags saAFlags:A-awaiting inside ACK to SYN,a-awaiting outside ACK to SYN,s-awaiting outside SYN都是半连接状态，都是半连接状态，TCP 135，冲击波病毒，冲击波病毒!PIX Troubleshooting案例分析

34、案例分析第十步：如何处理？第十步：如何处理？PIX提供了两种方法限制每台主机的连接数。提供了两种方法限制每台主机的连接数。TCP InterceptMax ConnectionsTCP Intercept主要针对源地址欺骗情况，这里不能使用，因为源地址主机是合法的。主要针对源地址欺骗情况，这里不能使用，因为源地址主机是合法的。第十一步：用第十一步：用nat命令或者命令或者static命令限制最大连接数。命令限制最大连接数。Pix（config)#nat(inside)1 0.0.0.0 0.0.0.0 50 0Pix#clear local-host 10.1.1.99pix#sh local-host 10.1.1.99Interface inside:250 active,250 maximum active,0 deniedlocal host:,TCP connection count/limit=50/50 TCP embryonic count=50pix#sh conn126 in use,147456 most used-show memory-Free memory:47716152 bytesUsed memory:19392712 bytes-Total memory:67108864 bytes新网络建筑师