当前位置：网站首页>Yyds dry inventory hcie security Day12: concept of supplementary package filtering and security policy

Yyds dry inventory hcie security Day12: concept of supplementary package filtering and security policy

2022-07-03 21:20:00 【Xiao Liang L】

Packet filtering technology

For packets that need to be forwarded , Get the header information first , Then compare it with the set rules , According to the results of the comparison, the packets are forwarded or discarded . The main technology used is ACL.

State detection mechanism

For only one connection （ A stream ） The first packet of is checked for packet filtering , If the first package passes the inspection , The session table will be established , Subsequent messages are quickly forwarded according to the session table , No longer detected by packet filtering .

Security policy of firewall

According to certain rules （ Packet filtering ） The control device forwards the traffic and integrates the content security of the traffic （ Not only is 5 Tuples detect the legitimacy of messages and analyze the content characteristics of messages to determine whether they are malicious messages such as diseases * Poison, etc ） Detection strategy . It is mainly used to control network mutual access across firewalls or access to the firewall itself .

Firewall security policy principle

       
       [
       
       USG6000V1
       
       ]
       
       security-policy 
       
       [
       
       USG6000V1-policy-security
       
       ]
       
       rule 
       
       name 
       
       p1 
       
       [
       
       USG6000V1-policy-security-rule-p1
       
       ]
       
       rule 
       
       name 
       
       p2
       
       [
       
       USG6000V1-policy-security-rule-p2
       
       ]
       
       rule 
       
       name 
       
       p3
       
       [
       
       USG6000V1-policy-security
       
       ]
       
       dis 
       
       this
       
       2022
       
       -
       
       01
       
       -
       
       28 
       
       15
       
       :
       
       08
       
       :
       
       50.000 
       
       #
       
       security-policy
       
       rule 
       
       name 
       
       p1
       
       (
       
       not 
       
       configure 
       
       the 
       
       action
       
       )
       
       rule 
       
       name 
       
       p2
       
       (
       
       not 
       
       configure 
       
       the 
       
       action
       
       )
       
       rule 
       
       name 
       
       p3
       
       (
       
       not 
       
       configure 
       
       the 
       
       action
       
       )
       
       #
       
       return
      
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.

#yyds Dry inventory # HCIE-Security Day12： Supplement the concept of packet filtering and security policy _HCIE

Filter the traffic passing through the firewall according to the defined rules , And determine how to proceed with the next operation of the filtered traffic according to the keywords .

Firewall inter domain forwarding

#yyds Dry inventory # HCIE-Security Day12： Supplement the concept of packet filtering and security policy _ A firewall _02

Query and create session

#yyds Dry inventory # HCIE-Security Day12： Supplement the concept of packet filtering and security policy _ A firewall _03

The position of the session in the forwarding process

#yyds Dry inventory # HCIE-Security Day12： Supplement the concept of packet filtering and security policy _ Huawei _04

1、 Match the firewall session table according to the five tuples of the message , If the match is successful, carry out state detection , And security checks （ If done IPS Configuration ）, And refresh the session table , Forward the message .

2、 If no match succeeds , Then conduct status detection to determine whether it is the first package , Check whether there is a route with destination address in the routing table , Some words , According to the message Access interface And the message determined in the routing table Exit interface Determine inter domain traffic Direction , Check the corresponding security policy according to the direction of inter domain traffic , If the match , Create a session , Forward , If it doesn't match , Direct discarding .

View session table information

       
       [
       
       USG6000V1
       
       ]
       
       dis 
       
       firewall 
       
       session 
       
       table
       
       2022
       
       -
       
       01
       
       -
       
       28 
       
       15
       
       :
       
       48
       
       :
       
       03.600 
       
       Current 
       
       Total 
       
       Sessions 
       
       : 
       
       1
       
       bootps  
       
       VPN
       
       : 
       
       default 
       
       --
       
       > 
       
       default  
       
       192.168
       
       .191
       
       .1
       
       :
       
       68 
       
       --
       
       > 
       
       192.168
       
       .191
       
       .254
       
       :
       
       67
       
       [
       
       USG6000V1
       
       ]
       
       dis 
       
       firewall 
       
       session 
       
       table 
       
       verbose
       
       2022
       
       -
       
       01
       
       -
       
       28 
       
       15
       
       :
       
       48
       
       :
       
       12.850 
       
       Current 
       
       Total 
       
       Sessions 
       
       : 
       
       1
       
       bootps  
       
       VPN
       
       : 
       
       default 
       
       --
       
       > 
       
       default  
       
       ID
       
       : 
       
       c487f66beef5cf8231561f40fd8
       
       Zone
       
       : 
       
       trust 
       
       --
       
       > 
       
       trust  
       
       TTL
       
       : 
       
       00
       
       :
       
       02
       
       :
       
       00  
       
       Left
       
       : 
       
       00
       
       :
       
       00
       
       :
       
       21
       
       Recv 
       
       Interface
       
       : 
       
       GigabitEthernet0
       
       /
       
       0
       
       /
       
       0
       
       Interface
       
       : 
       
       GigabitEthernet0
       
       /
       
       0
       
       /
       
       0  
       
       NextHop
       
       : 
       
       192.168
       
       .191
       
       .254  
       
       MAC
       
       : 
       
       0050
       
       -
       
       56
       
       f6-a752
       
       <
       
       --
       
       packets
       
       : 
       
       2 
       
       bytes
       
       : 
       
       656 
       
       --
       
       > 
       
       packets
       
       : 
       
       1 
       
       bytes
       
       : 
       
       344
       
       192.168
       
       .191
       
       .1
       
       :
       
       68 
       
       --
       
       > 
       
       192.168
       
       .191
       
       .254
       
       :
       
       67 
       
       PolicyName
       
       : 
       
       --
       
       -
      
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.

current total sessions： Statistics of current session tables
bootp: Name of agreement
VPN:default-->default:VPN Instance name , The expression is ： Source direction --> Goal direction
192.168.191.1：68-->192.168.191.254:67: Session table information
ID: Current session id
zone：trust-->trust: The security zone of the session , The expression is ： Source security area --> Objective safe area
TTL: The total lifetime of the session entry
Left： The remaining lifetime of the session table entry
Output-interface： Exit interface
NextHop： Next jump ip Address
MAC: Next jump MAC Address

原网站

版权声明
本文为[Xiao Liang L]所创，转载请带上原文链接，感谢
https://yzsam.com/2022/02/202202142324501757.html