1、Firewall Tranning,Eccom Network,内容,1、PIX系列硬件 2、ASA系列硬件 3、防火墙配置命令 4、防火墙维护,思科防火墙分类,硬件分类思科防火墙主要分为2类，老产品系列为PIX，新产品系列为ASA5500。 软件分类思科防火墙以配置命令格式主要分为2类软件版本：7.0以上包括7.0和7.0以下。,PIX系列硬件,PIX系列,PIX Firewall 515E,PIX Firewall 525,PIX Firewall 535,PIX License Type,PIX License Type,501：Provided with a 10-user, 50-u
2、ser, or unlimited user licenses 506E： Provided in a single, unlimited-user license. 515E、525、535 provide 4 types of license：Unrestricted（UR） Restricted（R）Failover（FO）Failover-Active/Active（FO-A/A）,PIX Firewall License Comparison,Cisco PIX 500 防火墙性能参考,ASA系列硬件,ASA系列,ASA 5500 系列5505 5520 55505510 55405
3、580,ASA 5510,* Upgrade available with Cisco ASA 5510 Security Plus license,ASA 5520,* Separately licensed feature; includes two with base system,ASA 5540,* Separately licensed feature; includes two with base system,ASA 5550,* Separately licensed feature; includes two with base system,Characteristics
4、 of Cisco ASA 5500 Series Adaptive Security Appliances,Characteristics of Cisco ASA 5500 Series Adaptive Security Appliances,防火墙配置命令,7.0版本以下配置命令讲解,interface ethernet0 auto 设定端口0 速率为自动 interface ethernet1 100full 设定端口1 速率为100兆全双工 nameif ethernet0 outside security0 设定端口0 名称为 outside 安全级别为0 nameif ethe
5、rnet1 inside security100 设定端口1 名称为 inside 安全级别为100 nameif ethernet2 dmz security50 设定端口2 名称为 dmz 安全级别为50 enable password Dv0yXUGPM3Xt7xVs encrypted 特权密码 passwd 2KFQnbNIdI.2KYOU encrypted 登陆密码,访问控制列表,access-list 101 permit ip 192.168.99.0 255.255.255.0 192.168.170.0 255.255.255.0 access-list 101 perm
6、it ip 192.168.12.0 255.255.255.0 192.168.180.0 255.255.255.0 access-list 101 permit ip 192.168.23.0 255.255.255.0 192.168.180.0 255.255.255.0 access-list 101 permit ip 192.168.99.0 255.255.255.0 192.168.101.0 255.255.255.0 建立访问列表，允许特定网段的地址访问某些网段 access-group 101 in interface outside access-group 101
7、 in interface inside access-group 101 in interface dmz 应用访问列表到接口上,接口地址及MTU,mtu outside 1500 mtu inside 1500 mtu dmz 1500 ip address outside 10.1.1.4 255.255.255.224 设定外端口地址 ip address inside 192.168.1.254 255.255.255.0 设定内端口地址 ip address dmz 192.168.19.1 255.255.255.0 设定DMZ端口地址,日志记录,logging on loggi
8、ng timestamp logging buffered warnings logging trap warnings 打开设备日志记录功能并设定记录的日志等级 查看日志命令：show logging,NAT配置,global (outside) 1 10.1.1.13-10.1.1.28 global (outside) 1 10.1.1.7-10.1.1.9 global (outside) 1 10.1.1.10定义内部网络地址将要翻译成的全局地址或地址范围 nat (inside) 0 access-list 101使得符合访问列表为101地址不通过翻译，对外部网络是可见的 nat
9、(inside) 1 192.168.0.0 255.255.0.0 0 0内部网络地址翻译成外部地址 nat (dmz) 1 192.168.0.0 255.255.0.0 0 0DMZ区网络地址翻译成外部地址 static (inside,outside) 10.1.1.5 192.168.12.100 netmask 255.255.255.255 static (inside,outside) 10.1.1.12 192.168.12.158 netmask 255.255.255.255 static (inside,outside) 10.1.1.3 192.168.2.4 net
10、mask 255.255.255.255 设定固定主机与外网固定IP之间的一对一静态转换 static (dmz,outside) 10.1.1.2 192.168.19.2 netmask 255.255.255.255设定DMZ区固定主机与外网固定IP之间的一对一静态转换,静态路由设置,route inside 192.168.2.0 255.255.255.0 192.168.1.1 route inside 192.168.3.0 255.255.255.0 192.168.1.1 route outside 192.168.4.0 255.255.255.0 192.168.10.1
11、,7.0版本以上配置命令讲解,防火墙7.0及以上版本的命令格式与路由器基本一样，在这里不再详述。举例如下：,防火墙维护,PIX Troubleshooting工具show command,Show connect和show connect detail,pix#sh conn 1514 in use, 66418 most used TCP out 210.72.32.92:4826 in 10.6.99.97:1433 idle 0:00:15 Bytes 4454 flags UIOB TCP out 210.72.32.92:4825 in 10.6.99.97:1433 idle 0:
12、00:29 Bytes 4453 flags UIOBpix#sh conn det 1521 in use, 66418 most used Flags: A - awaiting inside ACK to SYN, a - awaiting outside ACK to SYN,B - initial SYN from outside, C - CTIQBE media, D - DNS, d - dump,E - outside back connection, F - outside FIN, f - inside FIN,G - group, g - MGCP, H - H.323
13、, h - H.225.0, I - inbound data, i - incomplete,k - Skinny media, M - SMTP data, m - SIP media, O - outbound data,P - inside back connection, q - SQL*Net data, R - outside acknowledged FIN,R - UDP RPC, r - inside acknowledged FIN, S - awaiting inside SYN,s - awaiting outside SYN, T - SIP, t - SIP tr
14、ansient, U - up TCP dmz:210.72.32.92/4826 inside:10.6.99.97/1433 flags UIOB TCP dmz:210.72.32.92/4825 inside:10.6.99.97/1433 flags UIOB显示当前连接情况。,Show xlate和show xlate detail,pix#sh xlate 861 in use, 8295 most used Global 210.72.33.20 Local 210.72.33.20 Global 219.235.129.18 Local 10.6.99.158 Global
15、210.72.32.178 Local 210.72.32.178pix#sh xlate det 873 in use, 8295 most used Flags: D - DNS, d - dump, I - identity, i - inside, n - no random,o - outside, r - portmap, s - static NAT from dmz:210.72.33.20 to outside:210.72.33.20 flags s NAT from inside:10.6.99.158 to outside:219.235.129.18 flags s显
16、示当前NAT转换情况。,Show cpu usage,pix#show cpu usage CPU utilization for 5 seconds = 2%; 1 minute: 2%; 5 minutes: 2%显示当前CPU利用情况。,Show traffic,pix#sh traffic outside:received (in 2.890 secs):0 packets 189971 bytes0 pkts/sec 65733 bytes/sectransmitted (in 2.890 secs):0 packets 2914252 bytes0 pkts/sec 1008391
17、 bytes/sec inside:received (in 2.890 secs):0 packets 2627283 bytes0 pkts/sec 909094 bytes/sectransmitted (in 2.890 secs):0 packets 170788 bytes0 pkts/sec 59096 bytes/sec dmz:received (in 2.890 secs):0 packets 305187 bytes0 pkts/sec 105601 bytes/sectransmitted (in 2.890 secs):0 packets 23331 bytes0 p
18、kts/sec 8073 bytes/sec,显示在PIX各个接口的流量情况，出、入包和字节数等。,Show local-host,pix#sh local-host Interface dmz: 282 active, 282 maximum active, 0 denied local host: ,TCP connection count/limit = 0/unlimitedTCP embryonic count = 0TCP intercept watermark = unlimitedUDP connection count/limit = 0/unlimitedAAA:Xlate
19、(s):Global 210.72.33.20 Local 210.72.33.20Conn(s):显示本地主机的TCP、UDP连接和NAT情况。,PIX 调试中的问题应用不能正常使用,检查： Permissions:安全策略设置是否正确 Translation:地址翻译设置是否正确。Static和NAT语句，global语句 Routing：路由表是否正确强烈建议：在PIX的安全策略、接口、路由，甚至配置改动的时候，尽可能在条件允许的情况下使用clear xlate、clear arp、clear local-host清除原有的xlate、arp和连接！,PIX Troubleshootin
20、g案例分析,问题现象： 用户不能正常访问Internet。 新连接不能正常使用。 原有连接可正常使用。分析过程： 第一步：检查Syslog %PIX-3-211001:Memory allocation Error %PIX-3-211001:Memory allocation Error 第二步：检查可用内存 Hardware: PIX-515E, 64M RAM - show memory -Free memory: 714696 bytes Used memory: 66394168 bytes - - Total memory: 67108864 bytes,PIX Troublesh
21、ooting案例分析,第三步：是什么用尽了内存？第四步：检查Xlate pix#sh xlate 251 in use, 258 most used第五步：检查连接数 pix#sh conn 147456 in use, 147456 most used 为什么连接数这么高？,PIX Troubleshooting案例分析,第六步：检查流量情况，用show traffic命令。 检查结果：大多数的流量都是流入Inside接口，从Outside接口流出。- show traffic -outside:received (in 25.000 secs):1475 packets 469050 by
22、tes59 pkts/sec 18762 bytes/sectransmitted (in 25.000 secs):167619 packets 9654480 bytes6704 pkts/sec 386179 bytes/sec inside:received (in 25.000 secs):180224 packets 10410480 bytes7208 pkts/sec 416419 bytes/sectransmitted (in 25.000 secs):1050 packets 118650 bytes42 pkts/sec 4746 bytes/sec,PIX Troub
23、leshooting案例分析,第七步：分析 为什么连接数如此高，但Xlate数却不高？结论： 每一个Xlate使用了大量的connection。 可能某个或者几个主机正在使用大量的connection。 大多数情况下是由病毒或者攻击引起的。,PIX Troubleshooting案例分析,第八步：查找产生大量connection的主机 pix#sh local-host | include host | count/limit local host: ,TCP connection count/limit =146608/unlimitedUDP connection count/limit
24、= 0/unlimited使用正则表达式，只查看host或者count/limit行。 结果表明：主机10.1.1.99几乎用了所有的连接，都是基于TCP的应用。,PIX Troubleshooting案例分析,第九步：看看这台主机在做什么？ pix#sh local-host 10.1.1.99 Interface inside: 250 active, 250 maximum active, 0 denied local host: ,TCP connection count/limit = 146608/unlimitedTCP embryonic count = 146606TCP i
25、ntercept watermark = unlimitedUDP connection count/limit = 0/unlimitedAAA:Xlate(s):Global 209.165.201.21 Local 10.1.1.99Conn(s): TCP out 64.101.32.153:135 in 10.1.1.99:34580 idle 0:00:15 Bytes 0 flags saA TCP out 64.103.108.191:135 in 10.1.1.99:8688 idle 0:00:29 Bytes 0 flags saA TCP out 64.100.205.
26、160:135 in 10.1.1.99:12335 idle 0:00:15 Bytes 0 flags saA TCP out 64.101.25.195:135 in 10.1.1.99:2978 idle 0:00:20 Bytes 0 flags saA TCP out 64.101.33.128:135 in 10.1.1.99:41589 idle 0:00:20 Bytes 0 flags saAFlags: A - awaiting inside ACK to SYN, a - awaiting outside ACK to SYN, s - awaiting outside
27、 SYN,都是半连接状态，TCP 135，冲击波病毒!,PIX Troubleshooting案例分析,第十步：如何处理？ PIX提供了两种方法限制每台主机的连接数。 TCP Intercept Max Connections TCP Intercept主要针对源地址欺骗情况，这里不能使用，因为源地址主机是合法的。第十一步：用nat命令或者static命令限制最大连接数。 Pix（config)#nat (inside) 1 0.0.0.0 0.0.0.0 50 0 Pix#clear local-host 10.1.1.99pix#sh local-host 10.1.1.99 Interface inside: 250 active, 250 maximum active, 0 denied local host: ,TCP connection count/limit = 50/50TCP embryonic count = 50 pix#sh conn 126 in use, 147456 most used - show memory -Free memory: 47716152 bytes Used memory: 19392712 bytes - - Total memory: 67108864 bytes,新网络建筑师,
