ScreenOS防火墙高级特性介绍.pdf

White Paper Advanced Firewall Features with ScreenOS Stefan Brunner Table of Contents    Introduction 2  Overview of screens and flows 4  Understanding Action and Bias 9  Considerations for screens and flows on ASIC platforms 13  Configuring screens and flows 17  Monitoring screens and flows 24  Appendix 27  Stefan Brunner © 2010 Juniper Networks, Inc. 1 Advanced Firewall Features Introduction Policies are protecting hosts behind firewalls by allowing legitimate sources access to selected hosts and specific protocols and sockets and denying anybody else access. But what is about protecting hosts from malicious network attacks which is actually permitted by a policy or attacks directed towards exhausting resources on the firewall itself? ScreenOS has a suite of tools to protect from such network and transport layer attacks directed towards resource exhaustion of hosts protected by the firewall as well as the firewall itself. Those features are organized in two independent feature sets under the screen hierarchy, configurable per zone, and the flow hierarchy, configurable for the entire device. You will find screens under set zone name  screen and flows under the set flow CLI hierarchies respectively. While screens are optional, flows change the behavior of the firewall probably more than any other feature on ScreenOS. With flows, you can decide how the firewall sets such core features as TCP SYN check or whether simultaneous outgoing interfaces (oif) are allowed with multicast. While screens, with the exception of the Untrust zone, are switched off per default and need to be carefully tuned, flows have default settings, which work for most environments out of the box. Screens and flows can prote