网络安全高级应用
- 格式：doc
- 大小：29.00 KB
- 文档页数：4
1、 Cisco防火墙ASA: ciscoasa# conf t ciscoasa(config)# hostname ASA ASA(config)# domain-name asa.com ASA(config)# enable password asa(特权密码) ASA(config)# passwd cisco（远程密码） ASA(config-if)# security-level 0（0-100） ASA(config-if)# nameif inside(outside\dmz) 2、ASA5505配置： ASA(config)#interface vlan 1 ASA(config-if)# nameif inside ASA(config-if)# security-level 0（0-100） 3.配置路由： ASA(config)# route inside 0.0.0.0 0.0.0.0 1.1.1.1 ASA# show route 4、远程管理接入： ASA(config)# telnet {network | ip-address} mask interface-name ASA(config)# telnet 192.168.0.0 255.255.255.0 inside ASA(config)# telnet 192.168.1.10 255.255.255.255 inside ASA(config)# telnet timeout minuter ASA(config)# telnet timeout 30 ASA(config)# crypto key generate rsa(dsa) modulus 1024(512.768.2048) ASA(config)# ssh 192.168.0.0 255.255.255.0 inside ASA(config)# ssh 0 0 outside ASA(config)# ssh timeout 30 ASA(config)# ssh version 1(2) ASA(config)# show ssh sessions ASA(config)# http server enable [port](默认443) ASA(config)# http {network | ip-address} mask interface-name ASA(config)# http 192.168.0.0 255.255.255.0 inside ASA(config)# asdm image disk0:/asdmfile (ASA(config)# asdm image disk0:/asdm-613.bin) ASA(config)# username cisco password cisco privilege 15(0-15,max 15) 5、地址转换： ASA(config)# nat-control ASA(config)# nat (inside) 1 0 0 ASA(config)# global (outside) 1 interface ASA(config)# global (dmz) 1 192.168.1.100-192.168.1.200(与DMZ的ip段不同) ASA(config)# show xlate(查看转换条目) ASA(config)# access-list list-name permit(deny) 192.168.0.0 255.255.255.0 any ASA(config)# access-list list-name permit(deny) protocol 192.168.0.0 255.255.255.0 any ASA(config)# access-group list-name {in | out} interface inside(outside/dmz) ASA(config)# static (dmz,outside) 1.1.1.1 192.168.0.1 6、保存配置： ASA# write memory ASA# copy running-config startup-config ASA# clear configure all ASA# clear configure configurationcommand [level2configurationcommand] ASA# clear configure access-list ASA# clear configure accessl-list listname 7、高级应用： URL过滤 ASA(config)# access-list listname permit tcp 192.168.0.0 255.255.255.0 any eq www ASA(config)# class-map listname-class ASA(config-cmap)# match access-list listname ASA(config)# regex url1 "\.out\.com" ASA(config)# class-map type regex match-any url-class ASA(config-cmap)# match regex url1 ASA(config)# class-map type inspect http http-url-class ASA(config)# class-map not request headewr host regex class url-class ASA(config)# policy-map type inspect http http-url-policy ASA(config)# class http-url-class ASA(config-cmap)# drop-connection log ASA(config)# policy-map inside-http-url-policy ASA(config-pmap)# class listname-class ASA(config-pmap-c)#inspect http http-url-policy ASA(config)# service-policy inside-http-url-policy interface inside 日志管理 ASA(config)# logging enable ASA(config)# logging buffered informational ASA(config)# show logging ASA(config)# clear logging
ASA(config)# logging asdm informational ASA(config)# clear logging asdm
ASA(config)# logging enable ASA(config)# logging trap informational ASA(config)# logging host inside 192.168.0.1 8、ASA安全功能： ASA(config)# threat-detection basic-threat(基本威胁检测) ASA(config)# access-list 111 permit icmp any any echo-reply （防IP分片攻击） ASA(config)# access-list 111 permit icmp any any unreachable ASA(config)# access-list 111 permit icmp any any time-exceeded ASA(config)# access-group 111 in interface outside ASA(config)# fragment chain 1 ASA(config)# ip audit name name {info | attack} [action [alarm] [drop] [reset]] ASA(config)# ip audit name name inside-info info action alarm ASA(config)# ip audit name name outside-info info action alarm ASA(config)# ip audit name name outide-attack attack action alarm ASA(config)# ip audit name name outide-attack attack action alarm reset ASA(config)# ip audit interface inside inside….. ASA(config)# ip audit interface outside outside….. ASA(config)# ip audit signature 2000 disable(禁用签名) ASA(config)# no ip audit signature 2000(启用) 9、IPSecVPN Router： R(config)#crypto isakmp policy(1-10000) R(config-isakmp)#encryption aes(des,3des) R(config-isakmp)#hash sha(md5) R(config-isakmp)#authentication pre-share(rsa-encr | rsa-sig) R(config-isakmp)#group 2(1,5) R(config-isakmp)#lifetime 10000(默认86400s) R(config)#crypto isakmp key benet address 1.1.1.1 R#show crypto isakmp key R(config)#access-list access-list-number {deny | permit} protocol source source-wildcard destination destination-wildcard R(config)#crypto ipsec transform-set transform-set-name transform1[transform2 [transform3]] R(cfg-crypto-tran)# mode {tunnel | transport} R(config)#crypto map map-name 1(1-65535) ipsec-isakmp R(config-crypto-m)#match address access-list-number R(config-crypto-m)#set peer 1.1.1.1(对端地址) 10、IPSecVPN ASA： ASA(config)#access-list nonat permit ip 172.16.10.0 255.255.255.0 10.10.10.0 255.255.255.0 ASA(config)#nat (inside) 0 access-list nonat ASA(config)# crypto isakmp enable outside ASA (config)#crypto isakmp policy 1 ASA (config)-isakmp-policy# encryption aes ASA (config)-isakmp-policy#hash sha ASA (config)-isakmp-policy#authentication pre-share ASA (config)-isakmp-policy#group 2 ASA(config)#isakmp key benet address 200.0.0.1 ASA(config)# access-list yfvpn permit ip 172.16.10.0 255.255.255.0 10.10.10.0 255.255.255.0 ASA(config)#crypto ipsec transform-set benet-set esp-aes esp-sha-hmac ASA(config)#crypto map benet-map 1 match address yfvpn ASA(config)#crypto map benet-map 1 set peer 200.0.0.1 ASA(config)#crypto map benet-map 1 set transform-set benet-set ASA(config)#crypto map benet-map benet-map interface outside 11、路由器实现NAT-T： R(config)#ip nat inside source list access-list-number interface f0/1 overload
