HC120312000 HCNP-Security-CISN 第七章 防火墙基础特性故障排除V1.0.pptxVIP

本页不打印修订记录课程编码适用产品产品版本课程版本ISSUEXXXXXXXXXXXXXXXXX开发/优化者时间审核人开发类型（新开发/优化）XXXXXXXXXXXXXX第三章 防火墙基础特性故障排除目标学完本课程后，您将能够:掌握安全策略故障排除掌握NAT故障排除掌握攻击防范故障排除掌握IP-Car故障排除掌握双机热备故障排除目录安全策略故障排除NAT故障排除攻击防范故障排除IP-Car故障排除双机热备故障排除包过滤导致业务不通故障排除思路原因一：ACL配置错误执行命令display policy interzone，查看ACL配置：USG display policy interzone untrust trust inbound policy interzone trust untrust inbound firewall default packet-filter is deny policy 0 (2478 times matched) action deny policy service service-set ip policy source any policy destination any policy 1 (0 times matched) action permit policy service service-set ip policy source 55 policy destination 55原因二：域间应用错误执行命令display policy interzone，查看域间包过滤情况：USG display policy interzone untrust trust inbound policy interzone trust untrust inbound firewall default packet-filter is deny policy 0 (0 times matched) action permit policy service service-set ip policy source 55 policy destination 55policy 1 (2478 times matched) action deny policy service service-set ip policy source any policy destination any案例：包过滤配置问题导致网页打开慢trustuntrustWeb ServerPCFW故障现象PC通过NAT Outbound访问Web Server；通过精确的ACL严格控制PC可访问的Web Server地址范围；访问部分网站速度慢，有时打开一个网页需要20多秒。案例：包过滤配置问题导致网页打开慢原因分析解决方法将ga.js文件所在的IP地址203.208.39.XX加入到ACL的运行范围目录安全策略故障排除NAT故障排除2.1 基于源地址转换的故障排除2.2 基于目的地址转换的故障排除2.3 NAT故障排除案例攻击防范故障排除IP-Car故障排除双机热备故障排除源地址转换故障排除思路源地址转换故障排除（一）原因一：域间包过滤错误原因二：NAT配置错误nat-policy interzone trust untrust outbound policy 0 action source-nat policy source 55 address-group 1 源地址转换故障排除（二）原因三：路由问题USG display nat-policy interzone trust untrust inboundnat-policy interzone trust untrust inbound firewall default packet-filter is permit nat-policy 0 (23424 times matched) action source-nat nat-policy source address-set a (group) address-group 1 no-pat nat-policy 5 (0times matched) action source-nat nat-policy source address-set b (group) address-group 2源地址转换故障排除（三）原因四：特殊应用场景多通道协议：如：FTP、MSN、PPTP、RSTP等，需要在域间开启NAT ALG功能，目的是识别多通道协议，并自动转换报文载荷中的IP地址和端口信息；域内NAT：应用在域内，配置与域间NAT相同，主要应用场景如下图所示。用户InternetSwitc