拠点/支社向けSRXシリーズおよびJシリーズのWebフィルタリング

Size: px

Start display at page:

Download "拠点/支社向けSRXシリーズおよびJシリーズのWebフィルタリング"

さなえかがんじ
7 years ago
Views:

..15...15...15 1 SurfControl...3 2 Websense...4 3 UTM...6 4.

3 Web /URL UTM Unified Threat Management Web 2.0 URL Web Web URL Junos OS 9.5 J SRX UTM Web UTM 1 URL URL SurfControl Websense 2 Web J SRX SRX SRX100 SRX210 SRX240 SRX650 J2320 J2350 J4350 J6350 J Junos OS 9.5 Web SurfControl Websense 2 SRX J Web SurfControl Web Web URL SurfControl SurfControl Web J SRX URL SurfControl Web SurfControlサーバー URLルックアップカテゴリインターネットクライアント HTTP 要求 SRX210 1 SurfControl Webサーバー Copyright 2014, Juniper Networks, Inc. 3

4 SurfControl URL SurfControl 1 SurfControl Web SRX J STRM Security Threat Response Manager URL SurfControl IPS Websense Web 1 Websense Websense SurfControl URL Websense Websense Web Websense URL SRX J URL 2 Websense HTTP 要求 SRX210 インターネットトラフィックリダイレクト Webサーバー Websenseサーバー 4 Copyright 2014, Juniper Networks, Inc.

SurfControl URL Websense Websense Web Websense URL SRX J URL 2 Websense HTTP 要求

5 Websense Websense HTTPS URL URL URL URL URL URL URL URL URL URL URL URL SurfControl Websense SurfControl SurfControl Websense "show system license" run show system license License usage: Licenses Licenses Licenses Expiry Feature name used installed needed av_key_kaspersky_engine :00:00 UTC anti_spam_key_symantec_sbl :00:00 UTC wf_key_surfcontrol_cpa :00:00 UTC idp-sig :00:00 UTC Copyright 2014, Juniper Networks, Inc. 5

name used installed needed av_key_kaspersky_engine 1 1 0 2009-11-20 00:00:00 UTC anti_spam_key_symantec_sbl 0 1 0 2009-11-20

6 Web UTM 1 UTM UTM HTTP Web ポリシールックアップ順序付けされたルックアップ ( 送信元 / 宛先ゾーン毎にインデックス付加 ) ポリシー1... ポリシーのマッチング UTMポリシーポリシーN セキュリティポリシー UTMポリシーを指定してトラフィックをアプリケーションサービスに送信 WFプロファイル 3 UTM UTM UTM Web UTM Web UTM UTM security { utm-policy <policy name> { anti-spam { anti-virus { content-filtering { http-profile <web-filtering profile name>; Web [security utm feature-profiles] security { feature-profile { url-blacklist <black-list user defined category>; url-whitelist <white-list user defined category>; type surf-control-integrated websense-redirect; surf-control-integrated { cache { size <max number of entries in the cache>; timeout <time, in seconds, after which an entry is declared invalid>; profile <profile name> { category <category name> { #One or more categories are allowed action block log-and-permit permit; custom-block-message <block-message>; default block log-and-permit permit; fallback-settings { ; timeout <request timeout in seconds>; 6 Copyright 2014, Juniper Networks, Inc.

7 traffic>; websense-redirect profile <profile-name>{ account <account-name>; custom-block-message <block-message>; fallback-settings { server { host <host-name or IP address>; port <server port>; sockets <number of open sockets used to redirect timeout <redirect timeout in seconds>; [security utm custom-objects] SurfControl security { custom-objects { utl-pattern <url pattern name> { value [<list of URLs>]; custom-url-category <category name> { value [<list of url-paterns>]; URL URL URL support URL URL net/techpubs URL Copyright 2014, Juniper Networks, Inc. 7

custom-objects { utl-pattern <url pattern name> { value [<list of URLs>]; custom-url-category <category name> { value [<list of url-paterns>]; URL URL www.juniper.

8 IP SurfControl 4 SurfControl Trust Zone Untrust Zone SRX210 インターネット 4 Web SurfControl security { policies { from-zone trust to-zone untrust { policy match { source-address any; destination-address any; application any; then { permit { application-services { utm-policy wf-block-specfic-categories; feature-profile { type surf-control-integrated; #This causes the device to use # the surfcontrol integrated solution surf-control-integrated { profile block-selected-sites { category { Criminal_Skills { 8 Copyright 2014, Juniper Networks, Inc.

9 Remote_Proxies { Violence { Weapons { default permit; utm-policy wf-block-specfic-categories { http-profile block-selected-sites; IT www. addictivesite.com URL bad-sites URL custom-objects { url-pattern { badsite { value addictivesite { value custom-url-category { bad-sites { value [ addictivesite badsite ]; Copyright 2014, Juniper Networks, Inc. 9

com URL bad-sites URL custom-objects { url-pattern { badsite { value www.badsite.com; addictivesite { value www.

10 Web policies { from-zone trust to-zone untrust { policy match { source-address any; destination-address any; application any; then { permit { application-services { utm-policy wf-block-specfic-categories; feature-profile { url-blacklist bad-sites; #This causes sites in the bad-sites category type surf-control-integrated; surf-control-integrated { profile block-selected-sites { category { Criminal_Skills { Remote_Proxies { Violence { Weapons { default permit; utm-policy wf-block-specfic-categories { http-profile block-selected-sites; #to be blocked 10 Copyright 2014, Juniper Networks, Inc.

$category type surf-control-integrated; surf-control-integrated { profile block-selected-sites { category { Criminal_Skills { Remote_Proxies {$

11 Web "The site requested is not a work-related site.go back to work! " policies { from-zone trust to-zone untrust { policy match { source-address any; destination-address any; application any; then { permit { application-services { utm-policy wf-block-specfic-categories; feature-profile { url-blacklist bad-sites; type surf-control-integrated; surf-control-integrated { profile block-selected-sites { category { Criminal_Skills { Remote_Proxies { Violence { Weapons { default permit; custom-block-message The site requested is not a workrelated site!go back to work! ; utm-policy wf-block-specfic-categories { http-profile block-selected-sites; Copyright 2014, Juniper Networks, Inc. 11

$category { Criminal_Skills { Remote_Proxies { Violence { Weapons { default permit; custom-block-message The site requested is not a workrelated site!go back to work!$

12 2 Web security { policies { from-zone trust to-zone management { policy webfilter-on-business-hours { match { source-address any; destination-address any; application any; then { permit { application-services { utm-policy wf-block-specfic-categories; scheduler-name Business-hours; policy accept-all { match { source-address any; destination-address any; application any; then { permit; feature-profile { url-blacklist bad-sites; type surf-control-integrated; surf-control-integrated { profile block-selected-sites { category { Criminal_Skills { Remote_Proxies { Violence { Weapons { default permit; custom-block-message The site requested is not a workrelated site!go back to work! ; 12 Copyright 2014, Juniper Networks, Inc.

$Criminal_Skills { Remote_Proxies { Violence { Weapons { default permit; custom-block-message The site requested is not a workrelated site!go back to work!$

13 utm-policy wf-block-specfic-categories { http-profile block-selected-sites; schedulers { scheduler Business-hours { daily { start-time 09:00:00 stop-time 17:00:00; sunday exclude; saturday exclude; Websense Websense Web SRX J Websense policies { from-zone trust to-zone management { policy webfilter-websense { match { source-address any; destination-address any; application any; then { permit { application-services { utm-policy wf-redirect; feature-profile { type websense-redirect; websense-redirect { profile server1-redirect { server { host ; port 15868; custom-block-message Websense says... you are not allowed! ; sockets 3; Copyright 2014, Juniper Networks, Inc. 13

14 utm-policy wf-redirect { http-profile server1-redirect; sockets Junos OS Websense Websense SurfControl policies { from-zone trust to-zone management { policy webfilter-websense { match { source-address any; destination-address any; application any; then { permit { application-services { utm-policy wf-redirect; feature-profile { type websense-redirect; websense-redirect { profile server1-redirect { server { host ; port 15868; custom-block-message Websense says... you are not allowed! ; fallback-settings { default block; too-many-requests log-and-permit; sockets 8; utm-policy wf-redirect { http-profile server1-redirect; 14 Copyright 2014, Juniper Networks, Inc.

15 >show security utm web-filtering statistics UTM web-filtering statistics: Total requests: 0 white list hit: 0 Black list hit: 0 Server reply permit: 0 Server reply block: 0 Web-filtering sessions in total:4000 Web-filtering sessions in use: 0 Fall back: log-and-permit block Default 0 0 Timeout 12 0 Connectivity 0 0 Too-many-requests URL URL URL / URL URL URL Junos OS 9.5 SRX J Web URL Twitter Facebook Copyright 2014, Juniper Networks, Inc. 15

block Default 0 0 Timeout 12 0 Connectivity 0 0 Too-many-requests 0 0 2 30 40 50 URL 15 20 30 URL URL 500 1000 1500 / URL 8192 8192 8192

16 Juniper Networks, Inc. Juniper Networks International B.V F FAX URL North Mathilda Ave Sunnyvale, CA USA 888-JUNIPER ( ) FAX URL Boeing Avenue PZ Schiphol-Rijk Amsterdam, The Netherlands FAX Copyright 2014, Juniper Networks, Inc. All rights reserved. Juniper Networks Junos QFabric Juniper Networks Juniper Networks, Inc JP Apr Copyright 2014, Juniper Networks, Inc.

net Boeing Avenue 240 1119 PZ Schiphol-Rijk Amsterdam, The Netherlands 31-0-207-125-700 FAX 31-0-207-125-701 Copyright 2014, Juniper Networks, Inc.

SRXシリーズおよびJシリーズのネットワークアドレス変換

SRXシリーズおよびJシリーズのネットワークアドレス変換 APPLICATION NOTE SRX J SRX J NAT Copyright 2014, Juniper Networks, Inc. ...1...1...1... 1... 1...1... 1...2 NAT...3 NAT...4 NAT...4 NAT...5 NAT...6 NAT...7....7 NAT....7 NAT...7 NAT....8 NAT....8 NAT...9