網(wǎng)絡(luò)基礎(chǔ)設(shè)施安全-路由系統(tǒng)-在線(xiàn)瀏覽
2024-11-05 19:48本頁(yè)面
【正文】 group 103 in accesslist 103 permit tcp any established access –list 103 permit tcp any host eq smtp Ethe 1 inter 實(shí)例 inter 內(nèi)部網(wǎng) 允許所有外出的數(shù)據(jù)流 允許所有由內(nèi)部發(fā)起的外來(lái)的數(shù)據(jù)流 拒絕其他的數(shù)據(jù)流，并記錄這些訪(fǎng)問(wèn)企圖 s0 Router(config) accesslist 47 permit Router(config) accesslist 103 permit tcp any any established Router(config) accesslist 103 deny any any Router(config) interface serial 0 Router(configif) ip accessgroup 47 out Router(configif) ip accessgroup 103 in 路由系統(tǒng)安全 使用路由器防止拒絕服務(wù)的攻擊 防止 DOS 攻擊 ? no ip directedbroadcast ? 入流量過(guò)濾、出流量過(guò)濾 ? CAR(mitted access rate) 限制某種類(lèi)型包的發(fā)送速率 interface serial 0 ratelimit output accessgroup 105 1540000 512022 786000 conformaction transmit exceedaction drop accesslist 105 permit icmp any any echoreply 過(guò)濾出入的包 進(jìn)入過(guò)濾： interface Serial 0 ip address ip accessgroup 11 in accesslist 11 deny accesslist 11 deny accesslist 11 deny accesslist 11 deny your internal work accesslist 11 permit any 離開(kāi)過(guò)濾： interface Ether 0 ip address ip accessgroup 12 in accesslist 12 permit your internal work ip verify unicast reversepath 外部網(wǎng)絡(luò) s0 eth0 內(nèi)部網(wǎng)絡(luò) TCP 攔截 限制 SYN 攻擊 inter 客戶(hù)機(jī)請(qǐng)求被攔截和驗(yàn)證 與客戶(hù)機(jī)建立連接 有效連接被交換，數(shù)據(jù)被傳遞 ip tcp intercept list 100 ip tcp intercept connectiontimeout 60 ip tcp intercept watchtimeout 10 ip tcp intercept oneminute low 1500 ip tcp intercept oneminute high 6000 accesslist 100 permit tcp any TCP 攔截 限制 SYN 攻擊 TCPClientTCPCollapsarSYNSEQ = 100ACK = 0SYN/ACKSEQ = 1000ACK = 101ACKSEQ = 101ACK = 1001TCPSYNSEQ = 80000ACK = 0SYN/ACKSEQ = 200ACK = 80001ACKSEQ = 80001ACK = 201ServerPSHSEQ = 101ACK = 1001PSHSEQ = 80001ACK = 201ACKSEQ = 201ACK = 8010ACKSEQ = 1001ACK = 110Hash( src ip/port , dst ip/port )存入內(nèi)存中的H a s h 表Hash( src ip/port , dst ip/port )查內(nèi)存中的H a s h 表9 byte9 byteTCP 攔截 限制 SYN 攻擊 – Can do as much good as bad – If enabled : process switching and not “full” C
范文總結(jié)相關(guān)推薦
鄂ICP備17016276號(hào)-1