防火墙初级动手配置.pptVIP

* * * * * Policy-based NAT * * Web Filtering配置 Web Filtering配置 Web Filtering 配置 Web Filtering 配置 Web filtering 测试 配置结果 流量日志（地址翻译） 防DDoS攻击 基于Syn-cookie方式防syn flooding 其他配置 其他配置请参考Configuration Guide的配置说明 /techpubs/software/screenos/screenos5.1.0/translated/（中文版本：5.1） /techpubs/software/screenos/screenos5.3.0/index.html （英文版本：5.3） Thank You * Transparent Mode * * Transparent Mode * * * * * * * * * * * * * Transparent Mode Lab * * * * * Step 1: 定义MIP Network Interface (Select Interface – click on MIP) set int name mip publicIP host privateIP ns208 set int e8 mip 5 host Step 2: 配置MIP策略 Policies Edit set policy from zone to zone SA MIP(addr) service permit Verifying MIP Operation – WebUI Policies Verifying MIP Operation - CLI Ping to MIP from external host Ping from internal host to external host Packet egress is the interface where the MIP is defined ns208- get session alloc 225/max 128000, alloc failed 0 id 292/s**,vsys 0,flag00/00,policy 2,time 1 10(01):/1728-5/1024,1,0010db21c041,vlan 0,tun 0,vsd 0 0(20):/1728-/1024,1,0010db12cea1,vlan 0,tun 0,vsd 0 ns208- get session alloc 2/max 128000, alloc failed 0 id 38/s**,vsys 0,flag00/00,policy 1,time 1 0(01):/7936-/512,1,0010db12cea1,vlan 0,tun 0,vsd 0 10(20):5/7936-/512,1,0010db21c041,vlan 0,tun 0,vsd 0 e1 e2 e3 e7 e8 ???????? MIP “Shortcut” – Using Masks A mask specifies which bits in the network portion of the IP address are translated What public address does 00 map to? Hint: binary for 100 isDotted Decimal Binary 26 Bits =0101011100XXXXXX 4 =0000101101XXXXXX Convert only this side 4/26 E8: 00/16 ? 5 ? 6 ? 7 ? 8 Etc. A Host A: 00 MIP(/26) MIPs 使用掩码 Network Interface (Select Interface – click on MIP) set int name mip publicIP host privateIP netmask mask ns208 set int e8 mip 2 host 2 netmask 48 MIP Complications – Other Interfaces? What if Host C wants to communicate