橡C22.PDF

Size: px

Start display at page:

Download "橡C22.PDF"

ためひとちゅうか
5 years ago
Views:

1 Internet Week 99 Tutorial C ( ) 1

2 FIREWALL Firewall TCP/IP DNS 2

3 Firewall Firewall ( ) FTP FTP data connection port 20 port data connection ncftp, FFF, ws_ftp, Fetch 3 PORT 3

4 Firewall FTP (Windows QuickFTP) data connection Passive mode data connection source port port (Windows FTP ) Firewall FTP data connection Firewall FTP Welcome Firewall FTP port 21 Welcome FTP Firewall FTP CR+LF FTP LF Firewall FTP 4

5 ( ) Firewall FTP PORT IP (TCP ) Firewall PORT RFC Firewall FTP Firewall TCP 5

6 TCP/IP Firewall ( ) NAT Firewall Destination Connection connection IP port IP address port 6

7 IP packet destination address proxy server DeleGate TCPrelay, UDPrelay FWTK ftp, telnet gateway http proxy SOCKS IP transparent dest. address SOCKS S IP HTTP Proxy S URL Transparent Proxy IP S 7

8 Transparent Proxy (1) Transparent (on the fly) proxy proxy process Operating System Transparent Proxy Firewall transparent Transparent Proxy (2) Transparent Proxy routing URL Filtering/Virus Check Redirection/Reverse Proxy routing Firewall redirection/reverse proxy, static map Firewall 8

9 Transparent Cache Web Cache Proxy Transparent port 80 ( ) L4 Switch, Policy Routing, WCCP, IP Filter Transparent Cache port 80 Cache URL filtering Virus check cascade Cache array Proxy Server http Proxy Server Proxy Automatic Configuration JavaScript /IP PAC URL SQUID acl /IP /URL 9

10 Proxy Server Round Robin DNS Proxy Automatic Configuration L4 Switch Hit Disk NFS SQUID ICP URL CARP L4 Switch Transparent Cache IP NAT/ NAT = Network Address Translation NAT = RFC1631 Port NAT NAPT, IP masquerade, PAT,... 10

11 NAT NAT ( ) ( Cisco IOS PIX NAT ) ( routing ) Firewall ident sendmail 8.8.X sendmail.cf SMTP ident (port 113) ICMP destination unreachable (port unreachable) ICMP destination unreachable (host unreachable) timeout connection tcp_wrapper 11

12 Firewall DNS DNS DNS (Split Brain DNS/Dual DNS) DNS: slave forward primary secondary DNS DNS: sub allocation / primary/secondary : primary, Firewall secondary : Firewall primary, ISP secondary Firewall DNS/ delegation authority (NS ) (...) BIND 4.9 with No Forward Patch, BIND 8.2 Private Address (RFC1918) read-rfc1918-for-details.iana.net 12

13 Firewall Routing Transparent proxy routing firewall default gateway firewall Firewall dynamic routing protocol subnet static ICMP redirect packet forward default gateway Private address Private Address (RFC1918) 10/8, /12, /16 Private Address /N VPN Local address renumber (or NAT) IP address Local address Firewall, NAT 13

14 AUTHENTICATION Reusable Password ( ) Replay One Time Password ( ) Reusable Password One Time Password 14

15 One Time Password Challenge Response challenge Local password (secret) response challenge / One Time Password S/Key, OTP, TokenCard (SecurID, SafeWord) One Time Password Challenge/Response S/Key, OTP dotkey, optsock Software Token Cut & Paste PC SmartCard (IC Card) secret 15

16 / Challenge & Response ( / ) ( ) VPN Web RADIUS Token Card NT LDAP ( ) ( Firewall Web ) Single Sign On IP ( Web cookie) 16

17 Digital Certificate Digital Certificate CA(Certificate Authority) CA X

18 X.509 PKI X.509v3 Digital Certificate ITU SSL/TLS, S/MIME, SET, IPsec PKI (Public Key Infrastructure) Digital Certificate IETF PKIX Working Group RFC2510, 2511, 2527, 25287, 2528, 2559 RSA Data Security PKCS Entrust/PKI PKI (X.509v3) (Certificate Revocation List) (enrollment) (Certificate Management Protocol) (LDAP ) (Online Certificate Status Protocol) CA (Cross Certification) Key Management 18

19 PKI (1) ( ) ( ) challenge & response CA PKI (2) CA CA ( ) CA Enrollment( ) 19

20 , PIN,,, etc. Token Card, IC Card, SmartCard, etc. 20

21 REMOTE ACCESS PPP 21

22 Caller-ID ( ) Call Back Windows Call Back PPP PAP: ( ) CHAP: Challenge & Response RADIUS RADIUS (Livingston Ascend ) One Time Password One Time Password RADIUS 22

23 Token Card = VPN ISP, VAN VPN ISP VPN 23

24 ISP,VAN VPN Internet One Time Password telnet, ftp SSL-Telnet SSH (Secure Shell) PET (Privacy Enhanced Telnet) VPN (IPsec, PPTP) 24

25 SSH (Secure Shell) SSH = Secure r- DES/Triple-DES/IDEA/RC4 RSA 256bit MD5 port forwarding SSH X-window POP VPN Windows SSH SSH Windows win32 Cedomir Igaly SSH Windows Client GUI F-Secure TeraTerm SSH plug-in 25

26 Internet POP Challenge & Response qpopper, DeleGate EudoraPro, Winbiff, Becky!, AL-Mail32 WebMail Web Virtual Private Network 26

27 Ethernet, WAN PPTP(PPP) IPSec SSL/TLS SOCKS V5 SSH, SSL-Telnet, PET PGP, S/MIME VPN 27

28 LAN Remote Access LAN VPN WAN Remote Access VPN Internet VPN LAN IPsec (IP security) IPsec IPv4 IPv6 IPsec 1995 Aug RFC Nov RFC2401-RFC2412 Sequence Number Field (replay attack ) ESP (ESP only ) IKE 28

29 Transport and Tunnel Mode Transport Tunnel Transport : / Tunnel : IP /VPN Host A Host B Host A Gateway X Gateway Y Host B AH and ESP headers AH (Authentication Header) ( ) ESP (Encapsulating Security Payload) ( ) ( ) ( ) ( ) 29

30 AH and ESP Datagram IPsec /IKE (Manual Key Management) IKE (Internet Key Exchange: ISAKMP/Oakley) IKE Phase 1 IKE SA Phase 2 IPSec SA IKE 30

31 IPsec IKE IKE Shared Secret ( ) Public Key Encryption Digital Certificate (X.509) ( ) X.509 PKI (Public Key Encryption) IP ec RFC2510,RFC2511,RFC2559 VPN IPsec Firewall VPN VPN LAN Cisco, Ascend, Yamaha PC-UNIX BSD KAME, Linux SWAN Microsoft IPSec Windows 2000 Firewall, VPN 31

32 IPsec Interoperability IPsec S/WAN, ANX, ICSA, Interoperability Workshops NTT (98/5,98/9,99/5), vpnops (99/4,99/6) Manual IKE(shared secret) IKE(X.509) rekey reboot VPN Firewall VPN Firewall Firewall VPN VPN Firewall Firewall VPN Firewall Firewall 32

33 VPN IP /DNS LAN VPN VPN WAN RFC1918 NAT, Proxy VPN DNS BIND 8.2 VPN NAT IPsec NAT VPN VPN IPsec NAT AH ESP only ( ESP IP ) 1 1 ( ) NAT tcp/udp port 1 N IKE udp source/dest ports=500 port 33

34 VPN VPN IP IPsec/IKE Shared Secret IP X.509 Digital Certificate VPN RADIUS /One Time Password IPsec/IKE IETF VPN IP ( ) Global address VPN VPN DHCP IETF IPsec/IKE 34

35 VPN VPN ( ) VPN Source/Destination IP address, Port, TCP ( ) ( ) PPTP/L2F/L2TP PPTP (Point to Point Tunneling Protocol) Microsoft Ascend RAS GRE(Generic Routing Encapsulation) TCP port 1723 RAS MPPE RC4 40bit, MS-CHAP MS-CHAP RADIUS MS-CHAPv2 IPX IP PPTP Cisco L2F (Layer 2 Forwarding) L2TP (Layer 2 Tunneling Protocol) 35

36 PPTP Windows NT 4.0 Server LAN Routing and RAS Update Extranet Switch, MN128SOHO/R ( ) Ascend MAX, 3COM Total Control Windows NT 4.0, Windows 98 Windows 95 + DialUp Networking 1.3 Upgrade IPsec PPTP IPSec PPTP LAN Remote Access Multi Vendor Interoperability 36

37 L2TP ISP VPN NTT IP LAC (L2TP Access Concentrator) LNS (L2TP Network Server) PPTP IPsec/IKE L2TP+IPsec L2TP IPsec PPP Cisco, Ascend, 3COM / (LAC LNS) Nortel Extranet Switch (LNS ) 37

38 (1) (2) NAT H.323 ICQ IDS( ) 38

39 (3) ( ) SSH VPN UNIX, Windows, Macintosh Windows Linux < > 39

40 ISBN ISBN VPN/VLAN ISBN "IPSec The New Security Standard for the Internet, Intranets, and Virtual Private Networks", Prentice Hall, $44.90, ISBN "Virtual Private Networks", O'Reilly, 180, 4790, ISBN

41 (VPN) IPSEC VPN IPsec & LAN TCP/IP IPSec Internet Magazine VPN, : VPN VPN VPN INTEROP MAGAZINE ( ) PKI INTEROP MAGAZINE INTEROP MAGAZINE PKI ! IC INTEROP MAGAZINE PKI INTEROP MAGAZINE

橡sirahasi.PDF

橡sirahasi.PDF Internet Week 2000 T5 IPsec VPN 2000/12/18 1 Virtual Private Network 2 IPsec 3 IPsec VPN 4 IPsec VPN 2 1 Virtual Private Network 3 Ethernet, WAN PPTP(PPP) IPSec SSL/TLS SOCKS V5 SSH, SSL-Telnet, PET PGP,

橡C22.PDF

橡C22.PDF