Juniper防火墻應(yīng)用策略配置命令2任務(wù)描述華云數(shù)據(jù)集團承建無錫地鐵云計算平臺，通過應(yīng)用虛擬化技術(shù)和云計算平臺來整合內(nèi)部IT系統(tǒng)，實現(xiàn)資源統(tǒng)籌管理，提升現(xiàn)有資源的可靠性和可用性，大幅度節(jié)約企業(yè)硬件成本和管理成本，提高資源使用率，為應(yīng)用提供動態(tài)、靈活、彈性、虛擬、共享和高效的資源服務(wù)，以加快生產(chǎn)和開發(fā)的效率，滿足無錫地鐵信息化建設(shè)構(gòu)建統(tǒng)一管理平臺的發(fā)展需求。本小節(jié)介紹項目出口Juniper防火墻應(yīng)用策略配置命令。目錄PolicyLanguageCreatingAddressBookEntriesPolicyMatchCriteria3BasicPolicyActionsDefiningCustomApplicationsPolicyLanguagePoliciesarecreatedunderacontextfrom-zonezone-nameto-zonezone-nameSetunderthe[editsecuritypolicies]hierarchyEachpolicy:由用戶自定義的zone-name來唯一標識由match和then參數(shù)部件來組成Match必須包括：sourceaddress,destinationaddress,andapplicationAction可以為：permit、deny、reject、log、count還有以下的可選項：SchedulingRematchingIDPFirewallauthentication4PolicyMatchCriteriaPolicymatchingcriteria:SourceaddressesIndividualaddressAddresssetDestinationaddressesIndividualaddressAddresssetApplicationsorapplicationsetsUserdefinedSystemdefined5Configuredwithinazone’saddressbookConfiguredwithinazone’saddressbookCreatingAddressBookEntries6Commandsforaddressbookentries:Addinganaddress

toanaddressbook:[editsecurityzones]security-zonename{address-book{addressname1

X.X.X.X/mask;

addressname2

X.X.X.X/mask;

…

}}[editsecurityzones]security-zonename{address-book{address-setname{addressname1;addressname2;…}

}}Creatingagroupofaddresses,calledaddresssets:DefiningCustomApplicationsSpecificsofimplementation:設(shè)備預(yù)定義好的應(yīng)用，如：junos-rsh,junos-sip,junos-bgp,junos-tacacs等?？梢宰远x單個應(yīng)用、應(yīng)用組合等：NorestrictionsforthenamingconventionYoucanmodifyprotocols,ports,inactivitytimers,andsoforth7[editapplications]applicationname{protocolprotocol;

source-portsource-port;destination-portdestination-port;}

…[editapplications]application-setname{applicationname1;applicationname2;…}

CreatingPolicyMatchEntriesSpecifics:Groupallpoliciestogetherintheproperorder,ensuringproperorderofexecutionApplydefinedmatchingparameters8[editsecuritypolicies]from-zonezone-name

to-zonezone-name

{policyname1

{match{source-addressaddress-name1;destination-addressaddress-name1;applicationapplication-name1;}…}policyname2

{match{source-addressaddress-name2;destination-addressaddress-name2;applicationapplication-name2;}…}…}BasicPolicyActionsPolicyactions:permit:allowstrafficflowdeny:silentlydropstrafficOptionallylogsandcountstrafficreject:dropstrafficandsendsanICMPunreachablemessageforUDPtrafficandaTCP(RST)messageforTCPtrafficOptionallylogsandcountstraffic9AdvancedPermitSettingsIftrafficisallowedtopassthesecuritypolicy,youcanalsoconfigurethefollowingactions:Firewallauthentication:在client傳輸數(shù)據(jù)前先做用戶認證，包括兩種認證方式：Pass-through:accessprofileandclientmatchWebauthentication:clientmatchIPsecVPN:對允許的流量進行IPsec加、解密IDP:進行IDP檢測10PolicyComponentsSummary11from-zoneandto-zonecontextMatchingcriteriaMatchingcriteriaActionAction[editsecuritypolicies]from-zonezone-nameto-zonezone-name

{policyname1

{match{source-addressaddress-name1;destination-addressaddress-name1;applicationapplication-name1;}then{<action>;}}policyname2

{match{source-addressaddress-name2;