網(wǎng)絡(luò)基礎(chǔ)設(shè)施安全-路由系統(tǒng)(完整版)
【正文】 st num permit|deny proc src dst interface eth 1 ip accessgroup 103 in accesslist 103 permit tcp any established access –list 103 permit tcp any host eq smtp Ethe 1 inter 實例 inter 內(nèi)部網(wǎng) 允許所有外出的數(shù)據(jù)流 允許所有由內(nèi)部發(fā)起的外來的數(shù)據(jù)流 拒絕其他的數(shù)據(jù)流，并記錄這些訪問企圖 s0 Router(config) accesslist 47 permit Router(config) accesslist 103 permit tcp any any established Router(config) accesslist 103 deny any any Router(config) interface serial 0 Router(configif) ip accessgroup 47 out Router(configif) ip accessgroup 103 in 路由系統(tǒng)安全 使用路由器防止拒絕服務(wù)的攻擊 防止 DOS 攻擊 ? no ip directedbroadcast ? 入流量過濾、出流量過濾 ? CAR(mitted access rate) 限制某種類型包的發(fā)送速率 interface serial 0 ratelimit output accessgroup 105 1540000 512022 786000 conformaction transmit exceedaction drop accesslist 105 permit icmp any any echoreply 過濾出入的包 進(jìn)入過濾： interface Serial 0 ip address ip accessgroup 11 in accesslist 11 deny accesslist 11 deny accesslist 11 deny accesslist 11 deny your internal work accesslist 11 permit any 離開過濾： interface Ether 0 ip address ip accessgroup 12 in accesslist 12 permit your internal work ip verify unicast reversepath 外部網(wǎng)絡(luò) s0 eth0 內(nèi)部網(wǎng)絡(luò) TCP 攔截 限制 SYN 攻擊 inter 客戶機(jī)請求被攔截和驗證 與客戶機(jī)建立連接 有效連接被交換，數(shù)據(jù)被傳遞 ip tcp intercept list 100 ip tcp intercept connectiontimeout 60 ip tcp intercept watchtimeout 10 ip tcp intercept oneminute low 1500 ip tcp intercept oneminute high 6000 accesslist 100 permit tcp any TCP 攔截 限制 SYN 攻擊 TCPClientTCPCollapsarSYNSEQ = 100ACK = 0SYN/ACKSEQ = 1000ACK = 101ACKSEQ = 101ACK = 1001TCPSYNSEQ = 80000ACK = 0SYN/ACKSEQ = 200ACK = 80001ACKSEQ = 80001ACK = 201ServerPSHSEQ = 101ACK = 1001PSHSEQ = 80001ACK = 201ACKSEQ = 201ACK = 8010ACKSEQ = 1001ACK = 110Hash( src ip/port , dst ip/port )存入內(nèi)存中的H a s h 表Hash( src ip/port , dst ip/port )查內(nèi)存中的H a s h 表9 byte9 byteTCP 攔截 限制 SYN 攻擊 – Can do as mu
范文總結(jié)相關(guān)推薦
鄂ICP備17016276號-1