飞塔防火墙的防火墙策略.pptVIP

* TACACS+ provides separate authentication, authorization and accounting services. TACACS+ is based on TACACS, but, in spite of its name, it is an entirely new protocol which is incompatible with any previous version of TACACS. TACACS+ and RADIUS have generally replaced the earlier protocols in more recently built or updated networks, although TACACS and XTACACS are still running on many older systems. TACACS+ offers multiprotocol support such as IP, and AppleTalk. Normal operation fully encrypts the body of the packet for more secure communications. It is a Cisco proprietary enhancement to the original TACACS protocol. Whereas RADIUS combines authentication and authorization in a user profile, TACACS+ separates the two operations RADIUS encrypts only the password in the access-request packet, from the client to the server. The remainder of the packet is unencrypted. Other information, such as username, authorized services, and accounting, can be captured by a third party. TACACS+ encrypts the entire body of the packet but leaves a standard TACACS+ header. RADIUS does not allow users to control which commands can be executed on a router and which cannot. Therefore, RADIUS is not as useful for router management or as flexible for terminal services. TACACS+ provides two methods to control the authorization of router commands on a per-user or per-group basis. The first method is to assign privilege levels to commands and have the router verify with the TACACS+ server whether or not the user is authorized at the specified privilege level. The second method is to explicitly specify in the TACACS+ server, on a per-user or per-group basis, the commands that are allowed. * 第一页，共二十四页。 二层协议的穿越——基于接口控制 非ip的二层协议的穿过 FortiGate本身不能够参与STP协议，但是可以设置其通过 控制vlan数据包是否直接放过 控制arp广播包穿过 config system interface edit interface_name set l2forward enable set stpforward enable set vlanforward enable set arpforward enable end 第二页，共二十四页。 多播流量的控制 多播流量在缺省状态下不能透明穿越防火墙 部署多播策略允许多播流量