【正文】 使用預(yù)共享機(jī)密或證書來(lái)設(shè)置基于路由的“自動(dòng)密鑰IKE”通道，包括以下步驟: 地址。Trust 區(qū)段的接口是ethernet1 且擁有IP 。選擇ws3，并使用 按鈕將地址從Available Members 欄移動(dòng)到GroupMembers 欄中。Screening Screen (Zone: Untrust): 選擇IP Address Spoof Protection，然后單擊Apply。您也許還能估計(jì)攻擊者的能力。這八種排列為:? High priority? 2nd priority? 3rd priority? 4th priority? 5th priority? 6th priority? 7th priority? Low priority ( 缺省)策略的優(yōu)先級(jí)設(shè)置意味著未分配給其它策略的帶寬基于高優(yōu)先級(jí)在前和低優(yōu)先級(jí)在后的原則進(jìn)行了排列。所有安全區(qū)都在trustvr 路由選擇域中。如果存在另外一個(gè)連接同一目標(biāo)的路由，NetScreen 設(shè)備就會(huì)重新定向信息流以使用新路由。在NetScreen 設(shè)備與這些IP 地址重新取得聯(lián)系后，禁用的路由就恢復(fù)為活動(dòng)路由。(V1Trust 。適當(dāng)?shù)膸挃?shù)量指在保證服務(wù)質(zhì)量(QoS) 的前提下具成本效益的載流容量。WebUI1. 接口帶寬Interfaces Edit ( 對(duì)于ethernet1 ): 輸入以下內(nèi)容，然后單擊OK:Traffic Bandwidth: 40000Interfaces Edit ( 對(duì)于ethernet3 ): 輸入以下內(nèi)容，然后單擊OK:Traffic Bandwidth: 400002. 策略帶寬Policies (From: Trust, To: Untrust) New: 輸入以下內(nèi)容，然后單擊OK:Name: SupoutSource Address:Address Book Entry: (選擇), SupportDestination Address:Address Book Entry: (選擇), AnyService: AnyAction: Permit Advanced: 輸入以下內(nèi)容，然后單擊Return，設(shè)置高級(jí)選項(xiàng)并返回基本配置頁(yè):Traffic Shaping: ( 選擇)Guaranteed Bandwidth: 5000Maximum Bandwidth: 40000Traffic Priority: High priorityDiffServ Codepoint Marking5 : (選擇)Policies (From: Trust, To: Untrust) New: 輸入以下內(nèi)容，然后單擊OK:Name: SaloutSource Address:Address Book Entry: (選擇), SalesDestination Address:Address Book Entry: (選擇), AnyService: AnyAction: Permit Advanced: 輸入以下內(nèi)容，然后單擊Return，設(shè)置高級(jí)選項(xiàng)并返回基本配置頁(yè):Traffic Shaping: ( 選擇)Guaranteed Bandwidth: 2500Maximum Bandwidth: 40000Traffic Priority: 2nd priorityDiffServ Codepoint Marking: EnablePolicies (From: Trust, To: Untrust) New: 輸入以下內(nèi)容，然后單擊OK:Name: MaroutSource Address:Address Book Entry: (選擇), MarketingDestination Address:Address Book Entry: (選擇), AnyService: AnyAction: Permit Advanced: 輸入以下內(nèi)容，然后單擊Return，設(shè)置高級(jí)選項(xiàng)并返回基本配置頁(yè):Traffic Shaping: ( 選擇)Guaranteed Bandwidth: 2500Maximum Bandwidth: 40000Traffic Priority: 3rd priorityDiffServ Codepoint Marking: ( 選擇)Policies (From: Untrust, To: Trust) New: 輸入以下內(nèi)容，然后單擊OK:Name: SupinSource Address:Address Book Entry: (選擇), AnyDestination Address:Address Book Entry: (選擇), SupportService: AnyAction: Permit Advanced: 輸入以下內(nèi)容，然后單擊Return，設(shè)置高級(jí)選項(xiàng)并返回基本配置頁(yè):Traffic Shaping: ( 選擇)Guaranteed Bandwidth: 5000Maximum Bandwidth: 40000Traffic Priority: High priorityDiffServ Codepoint Marking: ( 選擇)Policies (From: Untrust, To: Trust) New: 輸入以下內(nèi)容，然后單擊OK:Name: SalinSource Address:Address Book Entry: (選擇), AnyDestination Address:Address Book Entry: (選擇), SalesService: AnyAction: Permit Advanced: 輸入以下內(nèi)容，然后單擊Return，設(shè)置高級(jí)選項(xiàng)并返回基本配置頁(yè):Traffic Shaping: ( 選擇)Guaranteed Bandwidth: 3500Maximum Bandwidth: 40000Traffic Priority: 2nd priorityDiffServ Codepoint Marking: ( 選擇)Policies (From: Untrust, To: Trust) New: 輸入以下內(nèi)容，然后單擊OK:Name: MarinSource Address:Address Book Entry: (選擇), AnyDestination Address:Address Book Entry: (選擇), MarketingService: AnyAction: Permit Advanced: 輸入以下內(nèi)容，然后單擊Return，設(shè)置高級(jí)選項(xiàng)并返回基本配置頁(yè):Traffic Shaping: ( 選擇)Guaranteed Bandwidth: 1500Maximum Bandwidth: 40000Traffic Priority: 3rd priorityDiffServ Codepoint Marking: ( 選擇)CLI1. 接口帶寬set interface ethernet1 bandwidth 40000set interface ethernet3 bandwidth 400002. 策略帶寬set policy name supout from trust to untrust support any any permit trafficgbw 5000 priority 0 mbw 40000 dscp enableset policy name salout from trust to untrust sales any any permit traffic gbw2500 priority 2 mbw 40000 dscp enableset policy name marout from trust to untrust marketing any any permit trafficgbw 2500 priority 3 mbw 40000 dscp enableset policy name supin from untrust to trust any support any permit traffic gbw5000 priority 0 mbw 40000 dscp enableset policy name salin from untrust to trust any sales any permit traffic gbw3500 priority 2 mbw 40000 dscp enableset policy name marin from untrust to trust any marketing any permit trafficgbw 1500 priority 3 mbw 40000 dscp enable 典型配置（4）――攻擊監(jiān)視雖然您通常希望 NetScreen設(shè)備封鎖攻擊，有時(shí)也可能希望收集有關(guān)這些攻擊的信息。NetScreen 具有兩種 IP 欺騙檢測(cè)方法，這兩種方法能完成同樣的任務(wù):確定封包并非來(lái)自其包頭所指示的位置。利用三方封包交換，即常說(shuō)的三方握手，兩個(gè)主機(jī)之間建立TCP 連接:A向B發(fā)送SYN 片段； B用SYN/ACK 片段進(jìn)行響應(yīng)；然后A又用ACK 片段進(jìn)行響應(yīng)。但是，URL 過(guò)濾過(guò)程確定所請(qǐng)求的URL 是被禁止的。由于遠(yuǎn)程網(wǎng)關(guān)的IP 地址保持不變而可以到達(dá)，因此，位于通道任一端的主機(jī)可使用靜態(tài)站點(diǎn)到站點(diǎn)VPN 發(fā)起VPN 通道設(shè)置。WebUI (東京)1. 接口Network Interfaces Edit (對(duì)于ethernet1 ): 輸入以下內(nèi)容，然后單擊Apply:Zone Name: TrustStatic IP: (出現(xiàn)時(shí)選擇此選項(xiàng))IP Address/Netmask: 選擇以下內(nèi)容，然后單擊OK:Interface Mode: NATNetwork Interfaces Edit (對(duì)于ethernet3 ): 輸入以下內(nèi)容，然后單擊OK:Zone Name: UntrustStatic IP: (出現(xiàn)時(shí)選擇此選項(xiàng))IP Address/Netmask: Network Interfaces New Tunnel IF: 輸入以下內(nèi)容，然后單擊OK:Tunnel Interface Name: Zone (VR): Untrust (trustvr)Unnumbered: (選擇)Interface: ethernet3 (trustvr)2. 地址Objects Addresses List New: 輸入以下內(nèi)容，然后單擊OK:Address Name: Trust_LANIP Address/Domain Name:IP/Netmask: (選擇), Zone: TrustObjects Addresses List New: 輸入以下內(nèi)容，然后單擊OK:Address Name: Paris_OfficeIP Address/Domain Name:IP/Netmask: (選擇), Zone: Untrust3. VPNVPNs AutoKey Advanced Gateway New: 輸入以下內(nèi)容，然后單擊OK:Gateway Name: To_ParisSecurity Level: CustomRemote Gateway Type:Static IP Address: (選擇), IP Address/Hostname: 預(yù)共享密鑰Preshared Key: h1p8A24nG5Outgoing Interface: ethernet3Advanced: 輸入以下高級(jí)設(shè)置，然后單擊Return，返回基本Gateway配置頁(yè):Security Level: CustomPhase 1 Proposal (for Custom Security Level ):preg23desshaMode (Initiator): Main (ID Protection)(或)證書Outgoing Interface: ethernet3 Advanced: 輸入以下高級(jí)設(shè)置，然后單擊Return，返回基本Gateway配置頁(yè):Security Level: CustomPhase 1 Proposal (for Custom Security Level ):rsag23desshaPreferred certificate (optional)Peer CA: EntrustPeer Type: X509SIGVPNs AutoKey IKE New: 輸入以下內(nèi)容，然后單擊OK:VPN Name: Tokyo_ParisSecurity Level: CompatibleRemote GatewayPredefined: (選擇), To_ParisAdvanced: 輸入以下高級(jí)設(shè)置，然后單擊Return，返回基本“AutoKeyIKE”配置頁(yè):Security Level: CompatibleBind To: Tunnel Interface, ProxyID: (選擇)Local IP/Netmask: Remote IP/Netmask: Service: ANY4. 路