fortigate02-防火墻策略(參考版)
2025-05-18 08:04本頁(yè)面
【正文】 Q: 是否可以選擇性的清除用戶認(rèn)證狀態(tài)？ A: 是。 意味著可以有選擇的刪除用戶認(rèn)證狀態(tài)！ Debug：防火墻會(huì)話 ? 有認(rèn)證的會(huì)話將有更多的信息 session info: proto=6 proto_state=11 expire=3588 timeout=3600 flags=00000000 sockflag=00000000 sockport=80 av_idx=0 use=5 originshaper= replyshaper= ha_id=0 hakey=58157 policy_dir=0 tunnel=/ user=user2 group=group2 state=redir local may_dirty authed rem statistic(bytes/packets/allow_err): =4876/20/1 reply=5642/11/1 tuples=3 insink: prepost, reply prepost dev=89/98 gwy=hook=post dir= act=snat :1095:80(:38595) hook=pre dir=reply act=dnat :80:38595(:1095) hook=post dir=reply act=noop :80:1095(:0) pos/(before,after) 0/(0,0), 0/(0,0) misc=20212 policy_id=1 auth_info=2 chk_client_info=0 vd=4 serial=0000072b tos=ff/ff app=0 dd_type=0 dd_rule_id=0 Debug : authd, fnbamd ? 當(dāng)用戶在 Web登錄頁(yè)面成功認(rèn)證后 …… FG3600A1 (global) message_loop: checking timeouts :792 authd__read: called :1671 authd__wait_credential: called :262 authd__read__message: called :218 authd__is_full__message: called :2277 authd__change_state: called change state to: 15 :2053 authd__wait_auth: called :511 authd_fnbam_auth_user: called authd_fnbam_auth_user: username=user2, policy_id=1 authd_fnbam_locked_out: username=user2, src_addr=, n_failures=0, record_ttl=14244 user2(group2) authentication successful: grp_info=2 av_info=0, av_grp=0 timeout=300 :1381 authd__authentication_done: called :2277 authd__change_state: called change state to: 16 :2103 authd__send_ok: called :145 authd__send_data: called :2277 authd__change_state: called change state to: 20 :2197 authd__disconnect: called :2277 authd__change_state: called change state to: 21 :2242 authd__done: called message_loop: checking timeouts Qamp。 ? 如果 authpolicyexactmatch設(shè)置成 enable，則訪問(wèn) dst1和dst2都分別需要認(rèn)證 ? 如果 authpolicyexactmatch設(shè)置成 disable，則訪問(wèn) dst1和dst2只需要認(rèn)證一次 認(rèn)證事件日志 ? 格式化后 ? 原始 注意：如果一個(gè)用戶停留在認(rèn)證界面長(zhǎng)時(shí)間不操作，也會(huì)產(chǎn)生事件日志 1 20210318 21:54:06 warning authenticateUser failed to authenticate within the allowed period 用戶監(jiān)視 Firewall ? GUI下可以監(jiān)視已認(rèn)證的用戶 Syslog ? 認(rèn)證成功 Dec 18 23:59:05 date=20211218 time=14:54:34 devname=FG3600A1 device_id=FG3K6A3406600033 log_id=0106038001 type=event subtype=auth pri=notice vd=VDB user=user1 group=group1 ui=HTTP() action=authenticate status=success msg=User user1(group1) succeeded in authentication Dec 19 00:10:29 date=20211218 time=15:05:58 devname=FG3600A1 device_id=FG3K6A3406600033 log_id=0106038002 type=event subtype=auth pri=warning vd=VDB user= service=HTTP action=authenticate status=timeout reason=timeout src= srame=N/A dst= dstname=N/A msg=User failed to authenticate within the allowed period ? 長(zhǎng)時(shí)間停留在認(rèn)證頁(yè) 認(rèn)證超時(shí) ? 與 config system global set authkeepalive enable Debug：用戶認(rèn)證狀態(tài) ? diagnose firewall auth lis
環(huán)評(píng)公示相關(guān)推薦
鄂ICP備17016276號(hào)-1