Juniper防火墻安全策略

ITman論壇SecurityZonesandPoliciesInter-ZonetrafficmustbecheckedbypolicyIntra-ZonetrafficmaybecheckedbypolicyExternalZonePrivateZone50/24/24B/24PublicZone.254ABCD/24/24.1 .254.1 .254/24/24.254 .1SrcIPDestIPProtocolSrcPortDstPortData

50063603380#$%&PolicyComponentsSource&DestinationAddressBookAddressGroupServicePre-definedServiceCustomServiceCustomServiceGroupActionPermitDenyTunnelOptionsCoveredinnextchapterStep1:AddressBookEntriesExternalZonePrivateZone50/24/24B/24PublicZone.254ABCD/24/24.1 .254.1 .254/24/24.254 .1E1–E2–E7–E8–AddressBook-WebUIEntriesdisplayedbasedonzoneUsealphabetbuttonstofilterdisplaywhenlargenumbersofaddressesareconfiguredClickon“New”buttontoaddanentryObjects>Addresses>ListNewAddressEntryAddressnameisusedinaddresslistandpolicylistMakethenamemeaningfultoyournetwork!CommentisyouropportunityforembeddeddocumentationChoiceofaddress/maskordomainnameDomainnamerequiresDNSconfigurationObjects>Addresses>List(New)AddressBook–CLIsetaddress<zone><name><X.X.X.X>/<mask>ns208->setaddressPrivatePrivatePC/32setaddress<zone><naddressExternalame><domain_name>ns208->setYahoons208->getaddress<someoutputomitted>addrzonenamePrivatePrivateAddresses:NameAddressNetmaskFlagCommentsAny02AllAddrDial-UpVPN555502Dial-UpVPNAddrPrivatePC5500IPAddressViewingtheaddressbookDomainnameStep2:ServicesAddressbookentriesdefinewheretrafficcanflowfromandtoServiceentriesdefinethetypeoftrafficProtocolandportnumbersPredefinedServicesgetservicepre-definedObjects>Services>PredefinedCreatingaCustomServicesetservicename<protocol><(parametersvary)>Objects>Services>Custom(New)Step3:CreatePolicy-WebUISelectzonepairs,thenclick“New”PoliciesCreatePolicy-WebUIComponentsSource&DestinationZoneSource&DestinationAddressUsepull-downmenutodisplayaddressbookentriesServiceUsepull-downmenutodisplayserviceentriesActionPermit,deny,ortunnelCreatePolicy–CLIsetpolicyfrom<zone>to<zone><source_addr><dest_addr><service>[permit|deny]Example:ns208->setpolicyfromprivatetopublic/32anyhttppermitViewingPolicyEntries–WebUIPoliciesViewingPolicyEntries-CLIns208->getpolicyTotalregularpolicies6,Defaultdeny.IDFromToSrc-addressDst-addressServiceActionStateASTLCB1PrivatePublicAnyAnyH.323Denyenabled-----X2PrivatePublicAdmins50/~Allowed~Permitenabled-----X3PrivatePublic00~00/~ANYPermitenabled-----X4PrivatePublic6/~00/~Allowed~Permitenabled-----X5PrivatePublicAny00/~HTTPDenyenabled-----X6PrivatePublicAny00/~FTPPermitenabled-----XStep4:PolicyOrderingNewpoliciesaddedtoendoflistDefaultconditionisdenyalltrafficOrderisimportant!Re-OrderingPolicies-WebUIButtonallowsmovebynumberArrowallowsplacementbyposition(pointandclick)MoveButtonMoveArrowRe-OrderingPolicies(cont.)UsingthebuttonUsingtheArrowsRe-OrderingPolicies–CLIsetpolicyid<number>[before<number>|top]ns208->setpolicyid5before4ns208->setpolicyid1topConfigurationOptionsAddressGroupsServiceGroupsMulti-CellPoliciesAddressGroupsGroupofindividualaddressbookentriesTreatedassingleentitybyapolicyAppearsasaselectionintheWebUIpull-downmenuCreatingAddressGroups–WebUIObjects>Addresses>GroupCreatingAddressGroups-CLIsetgroupaddress<zone><name>add<addr-name>ns208->setgroupaddressPrivateAdminsaddAdmin1ns208->setgroupaddressPrivateAdminsaddAdmin2ViewingAddressGroupsObjects>Addresses>Groupgetgroupaddress<zone>ns208->getgroupaddressPrivateGroupNameCountCommentAdmins2getgroupaddress<zone><group-name>ns208->getgroupaddressPrivateAdminsGroupName:AdminsComment:GroupItems:2Members:"Admin1""Admin2"CreatingaServiceGroupsetgroupservice<name>add<service>Objects>Services>Group(New)ViewingServiceGroupsgetgroupservicens208->getgroupserviceGroupNameCountCommentAllowedServices5getgroupservice<group-name>ns208->getgroupserviceAllowedServicesGroupName:AllowedServicesComment:GroupItems:5Members:"FTP""HTTP""PING""TELNET""TFTP"Objects>Services>GroupMulti-CellPoliciesAnalternativetogroupsEachpolicyisanentitycomprisingmultipleaddressentriesand/orserviceentriesLimitedto8“cells”percategory(sourceaddress,destinationaddress,service)Multi-CellPolicyCreation–WebUIMulti-CellPolicyCreation-WebUI“NegatetheFollowing”–applypolicytoallexceptthelistedaddressesMulti-CellPolicyCreation–CLIns208->setpolicyfromprivatetoexternalmy-pcanyanypermitpolicyid=5ns208->setpolicyid5ns208(policy:5)->set?attackattackgroupavAntiVirus(CSP)scanningcountcountingoptiondst-addressdestinationaddressidp-alert-disabledisableidpalertlogloggingoptionnamepolicynameserviceserviceseverityattackseveritysrc-addresssourceaddressns208(policy:5)->setsrc-address?negatemodifynegattionsettingforthisdimension<namestring>namens208(policy:5)->setsrc-addressViewingMulti-CellPoliciesns208->getpolicyTotalregularpolicies2,Defaultdeny.IDFromToSrc-addressDst-addressServiceActionStateASTLCB11PrivateExternalmy-otherPCAnyFTPPermitenabled-----Xmy-pcHTTPPINGModifyingMulti-CellPoliciesns208->setpolicyid11ns208(policy:11)->unset?attackattackgroupavAntiVirus(CSP)scanningdst-addressdestinationaddressims-alertimsalertoptionims-logimslogoptionserviceserviceseverityattackseveritysrc-addresssourceaddressns208(policy:11)->CommonProblemsOrderingproblemsNamesaddressesGroupmembershipsNamesAddressesPolicylistshowsaddressnames,notactualentriesWouldthismakeanydifferenceinthisexample?GroupMembershipGlobalZoneUsetocreatedefaultpoliciessetpolicyfr