untitled

Size: px

Start display at page:

Download "untitled"

しげじろうこいたばし
6 years ago
Views:

1 ScreenOS

2 Agenda NAT Routing IPsec UTM Authentication IPv6 ISG-IDP

3 NAT

4 IKE&IPsec NAT-TIKE&IPsec ALG NAT NAT DIP Src-NAT Policy Service IKE-NAT IKE ALG Security > ALG > IPSEC IPSEC Pinhole Lifetime(Default: 30 )

5 TCP Notification Notification TCP CLI Notification TCP reset Notify Connection Close

6 TCP Notification Notification TCP SYN check / Zone TCP reset ISG NS5000 TCP sequence check set flow tcp-syn-check TCP SYN check unset flow no-tcp-seq-check TCP sequence check

7 Proxy ARP Proxy ARP entry MAC IP MAC IP ARP (Dst-NAT ) set arp nat-dst VSYS VSD Proxy ARP ) set arp nat-dst IP Address Range

VIPDst-NAT Port Shift VIP Port Shift set interface <I/F > vip <IP> port-range <xx-xx> server-ip <IP>port-range <xx-xx> ) set interface eth0/0 vip 1.

8 VIPDst-NAT Port Shift VIP Port Shift set interface <I/F > vip <IP> port-range <xx-xx> server-ip <IP>port-range <xx-xx> ) set interface eth0/0 vip port-range server-ip port-range : : : : : :10110

9 Routing

10 DSCP ScreenOSDSCP BGP, OSPF, RIP, RIPNG, TELNET, SSH, WEB, TFTP, SNMP, SYSLOG, WEBTRENDS 10 50

11 IncomingQoS QoS Incoming DSCPQoS Incoming QoS QoS QoS Policy

12 IPsec

13 Proxy-ID VPN 1VPNProxy-ID VPN > AutoKey IKE > Advanced Proxy-ID Check VPN > AutoKey IKE > Proxy ID Proxy-ID

14 Diffie-Hellman key IKEv1Diffie-Hellman Group19 20Proposal Group19 20

15 Auto Connect VPN AC-VPN Hub SpokeHubVPN SpokeHubVPN monitorhub DownHub NHRP AC-VPNAC-VPN

16 Auto Connect VPN Hub(Master) Hub(Backup) Hub(Master) Hub(Backup) Spoke 1 Spoke 2 Spoke 1 Spoke 2 Host A Host B Host A Host B HostA HostB Hub(Master)VPN Spoke Hub(Master)Hub(Backup) VPN Spoke Spoke1 Spoke2 VPN

17 UTM

18 AV URL :32:15 system warn AV: VIRUS FOUND: :4933-> :25 file _Fromebihara_nox.co.jp Dateebihara_nox.co.jp Subj B k_9_f virus EICAR-Test-File, virus description:

19 WF Web < > Profile

20 WF Profile Priority Profile :07:18 system warn UF-MGR: URL BLOCKED: USER: user (1249)-> (80) CATEGORY: NOX REASON: BY_USER_DEFINED PROFILE: nox-profile

21 AV/WF extended/itw/standard 3 Juniper Full AntiVirus Database1 SSG520/550 Web Profile SSG SSG

23 SNMPv3 SNMPv3

24 Disable SSG140-> set interface ethernet0/0 disable Admin status for interface ethernet0/0 has been changed to disable SSG140-> SSG140-> get in A - Active, I - Inactive, U - Up, D - Down, R - Ready H - IPv6 Host Mode, O - IPv6 Router Mode Interfaces in vsys Root: Name IP Address Zone MAC/INT-ID VLAN State VSD eth0/ /24 Trust 0017.cb4c.6b00 - D - eth0/ /0 DMZ 0017.cb4c.6b05 - D - D(Down)

25 Log Serial Number CLIset log serial-number enable Jun 22 20:02: SSG140: NetScreen device_id= [Root]system-information-00767: System configuration saved

26 USB USB set env config=usb:my-config.txt my-config.txt USB System config (4023 bytes) loaded from USB. Load System Configuration......Disabled licensekey auto update...refresh user list...done system init it done.. USB Load

27 Authentication

28 Web Web Auth Web Auth80HTTP 80 HTTP 8000/ /

29 IPv6

30 OSPFv3 DNS AAAAIPv4 Link PPP DHCPv6IPv6DNS (CPE) )

31 ISG-IDP

32 IPv6 NSM IPv6Any- IPv6IPv6 Log IDP Security module(sm) get session sm-slot slot-id sm-cpu cpu-no SM CPU scio const set sc_enable_cpu_usage 1

33 SMRAMFlashCF set sm-ctx coresave SM CPU SNMP set flow multicast idp

35 Scripting Tool exec save SSG140-> set script record SSG140(sgc: recording)-> exec ntp update SSG140(sgc: recording)-> >save SSG140(sgc: recording)-> exit record SSG140-> SSG140-> SSG140-> get script command Script command: exec ntp update save exec save

36 Boot Upgrade Boot LoaderBoot UpgradeGateway TFTP Hit any key to run loader Serial Number [ ]: READ ONLY HW Version Number [1010]: READ ONLY Self MAC Address [0024-dcdd-1c80]: READ ONLY Boot File Name [Loadssg140v325.d]: ssg r1.0 Self IP Address [ ]: TFTP IP Address [ ]: IP MASK [ ]: GW IP Address [ ]: L SSG5 v133.d ISG1000 v103.d SSG140 v325.d SSG300 v308.dd ISG2000 v117.d NS5000 v104.d d SSG500 v107.d TFTP IP

37 Boot Loader Version get system Boot Loader SSG140-> get system Product Name: SSG-140 Serial Number: , Control Number: ffffffff Hardware Version: 1010(0)-(00), FPGA checksum: , VLAN1 IP ( ) Software Version: 6.3.0r3.0, 0 Type: Firewall+VPN Feature: AV-K BOOT Loader Version: Compiled by build_ master at: Wed Mar 31 20:59:15 PDT 2010 Base Mac: 0024.dcdd.1c80 File Name: ssg r3.0, Checksum: ae2c7a1b, Total Memory: 512MB Boot Loader

38 Netscreen Redundancy Protocol(NSRP) CLI get nsrp uptime() <> VSD group info: init hold time: 5 heartbeat lost threshold: 3 heartbeat interval: 1000(ms) master always exist: disabled group priority preempt holddown inelig master PB other members no 3 no myself total number of vsd groups: 1 Total iteration=363,time= ,max=71748,min=7506,average=10341 <OS6.3> VSD group info: init hold time: 8 Uptime() heartbeat lost threshold: 3 heartbeat interval: 1000(ms) master always exist: disabled group priority preempt holddown inelig master PB other members myself uptime no 3 no myself :04:11 total number of vsd groups: 1 Total iteration=589,time= ,max=86530,min=3349,average=9526

39 Track-IP Timeout I/F MonitorNSRP Track-IP ICMP Timeout Timeout1 60 (Default 1 ) Timeout

40 Policy CLI Policy 0 10( ) set policy install hold-interval < > set policy install hold-interval 1 1 set policy install hold-interval 10 10

41 ISG ISG ISG ISG/NS Ipsec-nat alg

42 SSG 550VPN SNMP NetScreen 5000BGP redistributable routes

43 Thank you

ScreenOS 5.0 ScreenOS 5.0 Deep Inspection VLAN NetScreen-25/-50/-204/-208 HA NetScreen-25 HA Lite NetScreen-25 NetScreen-50) ALG(Application Layer Gat

ScreenOS 5.0 1 2 ScreenOS 5.0 ScreenOS 5.0 Deep Inspection VLAN NetScreen-25/-50/-204/-208 HA NetScreen-25 HA Lite NetScreen-25 NetScreen-50) ALG(Application Layer Gateway NAT Destination NetScreen-Security