windowsvista網(wǎng)路架構(gòu)、防火墻與ipsec的功能改進(jìn)(編輯修改稿)
2024-11-04 19:31 本頁面
【文章內(nèi)容簡介】 h Advanced Security” snapin –事先定義在管理工具集的主控臺 –能夠遠(yuǎn)端設(shè)定 –整合並簡化 IPsec 設(shè)定 ? 新的命令列指令 sh advfirewall 彈性的例外設(shè)定 Active Directory user/puter accounts and groups Source and destination IP addresses (individual or range) Source and destination TCP/UDP ports Commadelimited list of ports (but not lowhigh range) IP protocol number Types of interfaces (wired, wireless, VPN/RAS) ICMP type and code Services (used by service profiling to limit access) Network Location ? 自動偵測網(wǎng)路的變動 ? Network profile service在連結(jié)時建立設(shè)定檔 – Interfaces, DC, authenticated machine, gateway MAC, ? ? NPS在網(wǎng)路變動時會通知防火牆 – 防火牆在 200ms 內(nèi)變更 Location 設(shè)定 ? 未加入網(wǎng)域時，只有 public 或 private 兩種選擇 – 本機(jī)管理員才能定義私人網(wǎng)路的條件情形 Domain 當(dāng)電腦加入網(wǎng)域並連結(jié)時；自動選擇 Private 當(dāng)電腦連結(jié)到定義的私人網(wǎng)路 Public 所有其他網(wǎng)路 多網(wǎng)路介面的情形判斷 Examine all connected s Is an interface connected to a classified “public”? Set category to “public” Is an interface connected to a classified “private”? Set category to “private” All interfaces see domain controller? Host authenticate? Set category to “domain” Yes No Yes No Yes No 設(shè)定 Profile ? 允許本機(jī)管理員建立規(guī)則 ? 當(dāng) inbound 連線被阻隔時會出現(xiàn)通知訊息 規(guī)則種類 Program 允許特定程式的網(wǎng)路流 Port 允許特定 TCP or UDP 連接埠或連接埠清單 Predefined 允許 Windows網(wǎng)路功能的規(guī)則集合 (例如： file and printer sharing, work discovery, remote assistance, remote service administration, Windows collaboration, others) Custom 自行設(shè)定相關(guān)參數(shù) Windows Firewall with Advanced Security ?Profile設(shè)定 ?規(guī)則設(shè)定 防火牆規(guī)則 DO Action = {Bypass | Allow | Block} IF: Protocol = X AND Direction = {In | Out} AND Local TCP/UDP port is in {Port list} AND Remote TCP/UDP port is in {Port list} AND ICMP type code is in {ICMP typecode list} AND Interface NIC is in {Interface ID list} AND Interface type is in {Int
教學(xué)課件相關(guān)推薦
鄂ICP備17016276號-1