【正文】 ESP使用的加密算法為DES、完整性驗證算法使用SHA1。[FW1zonedmz]firewall zone trust[FW1zonedmz]add interface Ethernet 0/0/0[FW1zonetrust]firewall zone untrust[FW1zoneuntrust]add interface Ethernet 2/0/0[FW2zonedmz]firewall zone trust[FW2zonedmz]add interface Ethernet 0/0/0[FW2zonetrust]firewall zone untrust[FW2zoneuntrust]add interface Ethernet 2/0/0步驟二. 配置區(qū)域間的安全過濾在防火墻上配置從Trust區(qū)域發(fā)往Untrust區(qū)域的數(shù)據(jù)包被放行，從Untrust區(qū)域發(fā)往Local區(qū)域的數(shù)據(jù)包被放行，其他方向數(shù)據(jù)流被禁止。并且分支辦公室也需要能夠訪問總部的Trust區(qū)域。執(zhí)行命令display interzone查看域間的配置，核對域間是否正確配置了ASPF功能。創(chuàng)建兩條ACL。[R1]ping a PING : 56 data bytes, press CTRL_C to break Reply from : bytes=56 Sequence=1 ttl=254 time=4 ms Reply from : bytes=56 Sequence=2 ttl=254 time=3 ms Reply from : bytes=56 Sequence=3 ttl=254 time=3 ms Reply from : bytes=56 Sequence=4 ttl=254 time=3 ms Reply from : bytes=56 Sequence=5 ttl=254 time=3 ms ping statistics 5 packet(s) transmitted 5 packet(s) received % packet loss roundtrip min/avg/max = 3/3/4 ms配置靜態(tài)黑名單功能，始終丟棄其發(fā)來的報文，直至手工將其從黑名單中刪除。[R1]int LoopBack 1[R1LoopBack1]ip address 24[FW]ip routestatic 24 配置端口掃描攻擊防范，使端口掃描攻擊的檢測結(jié)果可以被自動導(dǎo)入到黑名單中。R1ping PING : 56 data bytes, press CTRL_C to break Reply from : bytes=56 Sequence=1 ttl=254 time=3 ms Reply from : bytes=56 Sequence=2 ttl=254 time=2 ms Reply from : bytes=56 Sequence=3 ttl=254 time=2 ms Reply from : bytes=56 Sequence=4 ttl=254 time=4 ms Reply from : bytes=56 Sequence=5 ttl=254 time=2 ms ping statistics 5 packet(s) transmitted 5 packet(s) received % packet loss roundtrip min/avg/max = 2/2/4 msR1ping PING : 56 data bytes, press CTRL_C to break Request time out Request time out Request time out Request time out Request time out ping statistics 5 packet(s) transmitted 0 packet(s) received % packet lossR1telnet Press CTRL_] to quit telnet mode Trying ... Connected to ...R3quit Configuration console exit, please retry to log on The connection was closed by the remote hostR1telnet Press CTRL_] to quit telnet mode Trying ...步驟三. 配置黑名單黑名單僅對IP地址進(jìn)行識別，能夠以很高的速度實現(xiàn)黑名單表項匹配，從而快速有效地屏蔽特定IP地址的用戶。[R2]ping a PING : 56 data bytes, press CTRL_C to break Reply from : bytes=56 Sequence=1 ttl=254 time=3 ms Reply from : bytes=56 Sequence=2 ttl=254 time=3 ms Reply from : bytes=56 Sequence=3 ttl=254 time=3 ms Reply from : bytes=56 Sequence=4 ttl=254 time=3 ms Reply from : bytes=56 Sequence=5 ttl=254 time=3 ms ping statistics 5 packet(s) transmitted 5 packet(s) received % packet loss roundtrip min/avg/max = 3/3/3 msTrust區(qū)域到DMZ區(qū)域。R2ping a PING : 56 data bytes, press CTRL_C to break Reply from : bytes=56 Sequence=1 ttl=254 time=5 ms Reply from : bytes=56 Sequence=2 ttl=254 time=3 ms Reply from : bytes=56 Sequence=3 ttl=254 time=3 ms Reply from : bytes=56 Sequence=4 ttl=254 time=4 ms Reply from : bytes=56 Sequence=5 ttl=254 time=3 ms ping statistics 5 packet(s) transmitted 5 packet(s) received % packet loss roundtrip min/avg/max = 3/3/5 msDMZ區(qū)域到Untrust區(qū)域。 || IPv6acl: null dmz untrust : inbound : default: permit。 || IPv6acl: null local untrust : inbound : default: permit。[Quidway]sysname S1[S1]vlan batch 11 to 13[S1]interface GigabitEthernet 0/0/1[S1GigabitEthernet0/0/1]port linktype access[S1GigabitEthernet0/0/1]port default vlan 11[S1GigabitEthernet0/0/1]interface GigabitEthernet 0/0/2[S1GigabitEthernet0/0/2]port linktype access[S1GigabitEthernet0/0/2]port default vlan 12[S1GigabitEthernet0/0/2]interface GigabitEthernet 0/0/3[S1GigabitEthernet0/0/3]port linktype access[S1GigabitEthernet0/0/3]port default vlan 13[S1GigabitEthernet0/0/3]interface GigabitEthernet 0/0/21[S1GigabitEthernet0/0/21]port linktype access[S1GigabitEthernet0/0/21]port default vlan 11[S1GigabitEthernet0/0/21]interface GigabitEthernet 0/0/22[S1GigabitEthernet0/0/22]port linktype access[S1GigabitEthernet0/0/22]port default vlan 12[S1GigabitEthernet0/0/22]interface GigabitEthernet 0/0/23[S1GigabitEthernet0/0/23]port linktype access[S1GigabitEthernet0/0/23]port default vlan 13配置完成后在FW設(shè)備上測試相同區(qū)域的連通性。 掌握應(yīng)用層包過濾的配置方法拓?fù)鋱D圖11 Eudemon防火墻區(qū)域配置場景你是你們公司的網(wǎng)絡(luò)管理員。本書引導(dǎo)讀者循序漸進(jìn)地掌握華為安全產(chǎn)品與技術(shù)、可靠性HA技術(shù)和QoS技術(shù)原理以及在華為產(chǎn)品中的實現(xiàn)，讀者也可以根據(jù)自身情況選擇感興趣的章節(jié)閱讀。HCDPEnterprise包括IESN（Implement Enterprise Switching Network，部署企業(yè)級交換網(wǎng)絡(luò)）、IERN（Implement Enterprise Routing Network，部署企業(yè)級路由網(wǎng)絡(luò)）、IENP（Improving Enterprise Network Performance，提升企業(yè)級網(wǎng)絡(luò)性能）三個部分。版權(quán)所有 侵權(quán)必究。 保留一切權(quán)利。HCDA（Huawei Certified Data Associate，華為認(rèn)證數(shù)據(jù)通信工程師）主要面向IP網(wǎng)絡(luò)維護(hù)工程師，以及其他希望學(xué)習(xí)IP網(wǎng)絡(luò)知識的人士。Module1 詳細(xì)介紹了華為Eudemon防火墻產(chǎn)品功能特性和業(yè)務(wù)特性，使讀者對華為安全產(chǎn)品及網(wǎng)絡(luò)安全有一個較為深入的了解。 掌握域間包過濾的配置方法實驗中我們在防火墻上配置VLAN12，定義Vlanif12，配置IP地址作為Inside區(qū)域的網(wǎng)關(guān)。[FW]firewall zone dmz[FWzonedmz]add interface Ethernet 2/0/0[FWzonedmz]firewall zone trust[FWzonetrust]add interface Vlanif 12[FWzonetrust]firewall zone untrust[FWzoneuntrust]add interface Ethernet 0/0/0默認(rèn)情況下，所有區(qū)域之間可以正常通訊，不被檢查。 || IPv6acl: null outbound : default: permit。R1ping a PING : 56 data bytes, press CTRL_C to break Reply from : bytes=56 Sequence=1 ttl=254 time=3 ms Reply from : bytes=56 Sequence=2 ttl=254 time=3 ms Reply from : bytes=56 Sequence=3 ttl=254 time=3 ms Reply from : bytes=56 Sequence=4 ttl=254 time=3 ms Reply from : bytes=56 Sequence=5 ttl=254 time=3 ms ping statistics 5 packet(s) transmitted 5 packet(s) received % packet lossroundtrip min/avg/max = 3/3/3 msUntrust區(qū)域到DMZ區(qū)域。Untrust區(qū)域到Trust區(qū)域。同時為了測試網(wǎng)絡(luò)，需要開放ICMP Ping測試功能。，希望直接屏蔽掉從該IP發(fā)來的流量。這樣攻擊防范功能所生成的動態(tài)黑名單表項將在30分鐘后被刪除。在向內(nèi)網(wǎng)開放的Web網(wǎng)站上可能存在危險的java控件。應(yīng)用detect userdefine，實現(xiàn)TFTP報文的正常轉(zhuǎn)發(fā)。 掌握在路由器上配置GRE over IPSec VPN的方法拓?fù)鋱D圖12 Eudemon