动手配置防火墙.pptVIP

防火墙-动手配置 议程 系统管理 透明模式 路由模式 安全策略 地址翻译 应用层和网络层防攻击 系统管理 系统组成 所有关键的系统功能都在内存中运行 。 可以通过控制线和webu对防火墙的配置进行修改。 显示状态信息 - CLI In the CLI, get commands provide valuable status about operational conditions: System serial number Software version Operating mode Interface status Interface address Management addresses 图形化界面 - WebUI NetScreen 防火墙可以通过图形化的界面进行管理。 需要的条件 (ie. one IP address) 一台PC机与防火墙在同一个网段 口令保护 Zone 和 Interface 的分配 A strict hierarchical linkage exists between zones and interfaces in a NetScreen device Zones are assigned to a virtual router Interfaces are assigned to a security zone An interface can only belong to one security zone Individual configuration parameters are assigned to interfaces IP addresses Management services Others Zone 的类型 安全zone Pre-defined: Trust, Untrust, DMZ; V1-Trust, V1-Untrust, V1-DMZ User-defined Tunnel Zone 功能 Zones Null MGT HA Self VLAN Configuring Zones/Interfaces - WebUI License Keys　的管理 以下的特征需要增加license key: Capacity expansion (extended/advanced releases) Anti-virus URL filtering Deep Inspection 两种安装key的方法 Manual – get key from Juniper/reseller Automatic – register device at Juniper Website, then download licenses 文件管理 备份/恢复 netscreen 防火墙所需要的重要的配置文件信息。 ScreenOS image Configuration files 备份/恢复 配置文件的存放 On-board Flash TFTP server External storage (SANdisk) Management station (WebUI only) 保存配置 WebUI Saves automatically when you click “Apply” or “OK” Console displays save messages CLI Manual command Writes to on-board flash configuration file 配置文件管理 - CLI 只有根管理员才能进行这些操作 配置文件备份 配置文件恢复 Option 1: copies file into flash – available at next reboot Option 2: merges file into RAM – BE CAREFUL!!! 配置文件管理 – WebUI 配置的回退（ Rollback） Provides “safety net” for failed/corrupted config If default config in flash can’t be loaded, system will try to load “last known good” file Can be forced manually to correct config mistakes Create rollback file Force rollback 软件包的管理 Image backup Image importing (Upgrade) Downgrade from 5.0 or higher to prior rel