计算机网络第11章：网络安全.pptVIP

* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * 防火墙技术一般分为两类 网络级防火墙——用来防止整个网络出现外来非法的入侵。属于这类的有分组过滤和授权服务器 前者检查所有流入本网络的信息，然后拒绝不符合事先制订好的一套准则的数据 后者则检查用户的登录是否合法 应用级防火墙——从应用程序来进行接入控制。通常使用应用网关或代理服务器来区分各种应用 例如，可以只允许通过访问万维网的应用，而阻止 FTP 应用通过 What Are ACLs? An ACL is a list of instructions that tells a router what type of packets to permit or deny. You must configure an ACL if you want a router to deny some packets. Otherwise, the router will accept and forward all packets as long as the link is up. You can permit or deny packets based upon such thing as: Source address Destination address Upper Layer protocols (e.g. TCP UDP ports) Testing Packets with ACLs To determine whether a packet is to be permitted or denied, it is tested against the ACL statements in sequential order. When a statement “matches,” no more statements are evaluated. The packet is either permitted or denied. There is an implicit “deny any” statement at the end of the ACL If a packet does not match any of the statements in the ACL, it is dropped. Testing Packets with ACLs Example: If we have an ACL list described as below: 1. Permit packets from to pass 2. Permit packets from to pass 3. Deny packets from Then: Packets from will be forwarded Packets from will be denied But how does the router process the packets from ? Packets from will be denied How a Router Uses an ACL (outbound) Check to see if packet is routable. If so, look up route in routing table Check for an ACL for the outbound interface If no ACL, switch the packet out the destination interface If an ACL, check the packet against the ACL statements sequentially--denying or permitting based on a matched condition. If no statement matches, what happens? Deny all these packets! Outbound Standard ACL Process Outgoing Packet Do route table lookup ACL on interface? Does source address match? Next entry in list More entries? Apply condition Permit Deny No No No Yes Yes Yes ICMP Message Forwar