下载文档原格式
深信服NGAF解决方案深信服科技有限公司2011年7月4日第1章需求概述1.1背景介绍互联网及IT技术的应用在改变人类生活的同时，也滋生了各种各样的新问题，其中信息网络安全问题将成为其面对的最重要问题之一。
网络带宽的扩充、IT应用的丰富、互联网用户的膨胀式发展，使得网络和信息平台早已成为攻击爱好者和安全防护者最激烈斗争的舞台。
Web时代的安全问题已远远超于早期的单机安全问题，尽管防火墙、IDS、UTM等传统安全产品在不断的发展和自我完善，但是道高一尺魔高一丈，黑客们不仅专门针对安全设备开发各种工具来伪装攻击、逃避检测，在攻击和入侵的形式上也与应用相结合越来越紧密。
这些都使传统的安全设备在保护网络安全上越来越难。
目前更多的出现了以下的安全问题：投资成本攀升，运维效率下降许多企业为了应对复杂的安全威胁,购买了多个厂商的安全产品,安全建设犹如堆积木一般。
购买的安全防护产品愈来愈多，问题也随之出现：大量的安全防护产品部署，需要大量专业安全管理人员负责维护，复杂的安全架构使得管理同样变得复杂化，由于企业采用了多套安全解决方案，这就要求有很多技术人员精通不同厂商的解决方案。
购买产品很简单，日常运维很复杂，这对企业本来就有限的IT人员、安全管理人员来讲是非常痛苦和困难的事情。
而且不同厂商安全解决方案之间的协调性也有待商榷，当专业化的攻击和威胁来临时，这些安全产品之间能不能发挥协同作用抵御威胁这还是一个很大的问号。
对企业的管理者来说，如何降低管理成本、提高运维效率、提升企业安全水平，是目前最急待解决的问题。
“数据库泄密”、“网页遭篡改”等应用层安全事件频现2011年上半年，索尼超过1亿个客户帐户的详细资料和1200万个没有加密的信用卡号码失窃，索尼已花掉了1.71亿美元用于泄密事件之后的客户挽救、法律成本和技术改进这笔损失只会有增无减。
2011年5月10日上午消息，一些兜售廉价软件的黑客攻击了多个知名网站，包括美国宇航局(以下简称“NASA”)和斯坦福大学的网站。
SANGFOR_AF_安全防护方案建议模板v10深信服科技有限公司201X-XX-XX目录1 网络与应用环境面临的安全挑战41.1 应用多样化，端口的单一化41.2 黑客攻击方式和目的的变化41.3 端到端的万兆处理能力 52 传统安全设备日趋“无力”62.1 防火墙成为了“摆设” 62.2 IPS+A V+W AF补丁式的方案72.3 简单堆砌的UTM 73 下一代防火墙的产生与价值83.1 Gantner定义下一代防火墙83.2 深信服NGAF的特点与用户价值94 XXX网络安全现状104.1 网络与应用系统现状114.2 面临的内容安全威逼114.2.1 漏洞利用114.2.2 拒绝服务攻击和分布式拒绝服务攻击12 4.2.3 零时差攻击 134.2.4 间谍软件144.2.5 协议专门和违规检测144.2.6 侦测和扫描 154.2.7 Web入侵154.2.8 病毒木马165 NGAF安全加固解决方案165.1 总体方案165.2 数据中心服务器爱护175.3 广域网边界安全隔离与防护185.4 互联网出口边界防护196 深信服NGAF产品介绍206.1 更精细的应用层安全操纵20 6.2 更全面的内容级安全防护21 6.3 更高性能的应用层处理能力22 6.4 更完整的安全防护方案 23网络与应用环境面临的安全挑战应用多样化，端口的单一化在传统的网络安全建设中，为网络设置一个“尽职尽责”的门卫操纵应用访咨询的合法性依旧能够做到的。
因为，那时端口=应用、IP=用户，只要在交换机、路由器、防火墙做些基于“端口+IP”的访咨询操纵策略，就能够轻松实现用户的访咨询权限。
然而随着网络、应用的持续的进展，为了便于应用的跨平台、灵活部署，现在有成千上万种应用趋向于更少数的端口运行，差不多上基于HTTP 或者HTTPS协议（80、443端口）。
例如“快乐网”网站上能够运行159种应用程序（还在持续丰富）——谈天、游戏、图片分享等；“谷歌”的企业级应用套件甚至能够提供类似于Office、协作办公、视频分享如此的企业应用程序。
深信服下一代防火墙NGAF技术白皮书深信服科技有限公司二零一一年八月目录1.概述 (3)2. 为什么需要下一代防火墙 (3)2.1网络发展的趋势使防火墙以及传统方案失效 (3)2.2替代性方案能否弥补 (4)2.2.1“打补丁式的方案” (4)2.2.2 UTM统一威胁管理 (4)3.下一代防火墙的诞生与价值 (4)3.1Gantner定义下一代防火墙 (4)3.2深信服下一代应用防火墙—NGAF (5)4.产品功能特点 (6)4.1更精细的应用层安全控制 (6)4.1.1可视化应用识别 (7)4.1.2多种用户识别方式 (7)4.1.3一体化应用访问控制策略 (8)4.1.4基于应用的流量管理 (9)4.2更全面的内容级安全防护 (10)4.2.1灰度威胁关联分析技术 (10)4.2.2基于攻击过程的服务器保护 (12)4.2.3强化的WEB安全防护 (13)4.2.4完整的终端安全保护 (14)4.3更高性能的应用层处理能力 (15)4.3.1单次解析架构 (15)4.3.2多核并行处理技术 (16)4.4更完整的安全防护方案 (16)5.关于深信服 (17)1.概述防火墙自诞生以来，在网络安全防御系统中就建立了不可替代的地位。
作为边界网络安全的第一道关卡防火墙经历了包过滤技术、代理技术和状态监视技术的技术革命，通过ACL 访问控制策略、NAT地址转换策略以及抗网络攻击策略有效的阻断了一切未被明确允许的包通过，保护了网络的安全。
防火墙就像故宫的城墙，对进出防火墙的一切数据包进行检查，保证合法数据包能够进入网络访问合法资源同时防止非法人员通过非法手段进入网络或干扰网络的正常运行。
防火墙技术在当时被堪称完美！随着时代的变迁，故宫的城墙已黯然失色，失去了它原有的防御能力。
同样防火墙在面对网络的高速发展，应用的不断增多的时代也失去了它不可替代的地位。
自2009年10月Gartner提出“Defining the Next-Generation Firewall”一文，重新定义下一代防火墙，下一代防火墙的概念在业内便得到了普遍的认可。
等保一体机5.0.0运维手册v1.0深信服科技有限公司目录1.关于文档 (2)2.等保一体机控制台登陆方式............................................错误！未定义书签。
3.等保一体机授权导入 (3)4.等保一体机安全架构配置................................................错误！未定义书签。
4.1.创建业务物理出口.............................................................错误！未定义书签。
4.2.创建安全应用 (15)4.3.自定义网络拓扑 (16)4.4.模板 (17)4.5.单点登陆 (18)5.等保一体机日常管理功能使用 (19)5.1.首页 (20)5.2.运营中心 (21)5.3.应用市场 (22)5.4.资源池 (18)5.5.系统管理 (22)6.常见问题 (29)1.关于文档介绍如何在日常工作中对等保一体机进行运维。
2.等保一体机控制台的登录方式等保一体机默认IP地址是10.251.251.251，将笔记本电脑配置一个10.251.251.0/24的IP，并与安装完成的主机eth0口直连。
在浏览器中输入https://10.251.251.251，并使用默认账号密码：admin/admin登录安全服务平台。
3.等保一体机授权导入当等保一体机授权需要更改的时候，可以在控制台“系统”——“平台授权”进行授权的更改，导入授权文件，授权文件为.cert格式的除了平台授权，部署安全应用还需要开相应的应用授权，否则没有应用授权创建不了安全应用。
因此，除了平台授权外，还需要导入相应的应用授权。
等保一体机支持安全应用列表为：安全应用应用规格AF下一代防火墙100M、200M、500M、1G、2G、3G、4G AD应用交付100M、200M、500M、1G、2G、3G、4G AC上网行为管理100M、200M、500M、1G、2G、3G、4G SSLVPN1-10000并发DAS数据库审计100M、200M、400MEDR1-2000并发10资产、20资产、50资产、100资产、OSM运维安全管理200资产、300资产、500资产20资产、50资产、100资产、LAS日志审计200资产、300资产、500资产50资产、100资产、BVT基线核查200资产、300资产、500资产20资产、50资产、100资产、聚铭日志审计200资产、300资产安全应用授权有效期包括安全应用功能有效期和服务有效期，功能有效期是永久的，但是服务有效期是有期限的，超出服务有效期，产品版本不能更新，规则库不能更新。
安恒网站卫士网页防篡改系统操作手册目录1产品简介······················································································································ 1-1 2登录防篡改管理系统······································································································· 2-12.2 注销 ························································································································2-22.3 主题 ························································································································2-32.3.1 黑色风格主题····································································································2-32.3.2 Metro风格 ·······································································································2-32.4 关于 ························································································································2-4 3监控频道······················································································································ 3-43.1 组查询······················································································································3-53.2 监控端查询················································································································3-5 4监控端管理··················································································································· 4-64.1 组管理······················································································································4-64.1.2 添加················································································································4-64.1.3 查询················································································································4-64.1.4 删除················································································································4-74.1.5 查看编辑··········································································································4-74.2 监控端管理················································································································4-84.2.2 立即激活··········································································································4-84.2.3 取消激活··········································································································4-94.2.4 查询················································································································4-94.2.5 删除·············································································································· 4-114.2.6 批量分组········································································································ 4-114.2.7 绑定模板········································································································ 4-114.2.8 解除模板········································································································ 4-124.2.9 查看编辑········································································································ 4-134.2.10 监控端配置 ··································································································· 4-134.2.11 发布端配置 ··································································································· 4-224.3 模板配置管理··········································································································· 4-254.3.1 添加·············································································································· 4-254.3.2 查询·············································································································· 4-264.3.3 删除·············································································································· 4-274.3.4 编辑查看········································································································ 4-27i / 78安恒网站卫士网页防篡改系统操作手册4.3.5 绑定模板········································································································ 4-274.3.6 模板配置········································································································ 4-28 5发布端管理··················································································································5-355.1 发布端管理·············································································································· 5-355.1.1 查询·············································································································· 5-355.1.2 删除·············································································································· 5-365.1.3 编辑查看········································································································ 5-365.1.4 发布端配置····································································································· 5-375.2 发布日志················································································································· 6-385.2.1 查询·············································································································· 6-385.2.2 删除·············································································································· 6-395.2.3 快速查询········································································································ 6-39 6日志···························································································································6-386.1 篡改日志················································································································· 6-386.1.1 查询·············································································································· 6-406.1.2 删除·············································································································· 6-406.1.3 快速查询········································································································ 6-416.1.4 导出·············································································································· 6-416.2 攻击日志················································································································· 6-416.2.1 查询·············································································································· 6-426.2.2 删除·············································································································· 6-426.2.3 快速查询········································································································ 6-426.2.4 导出·············································································································· 6-436.3 事件日志················································································································· 6-436.3.1 查询·············································································································· 6-436.3.2 删除·············································································································· 6-446.3.3 快速查询········································································································ 6-446.3.4 导出·············································································································· 6-44 7报表···························································································································7-457.1 报表 ······················································································································ 7-457.1.1 篡改日志报表·································································································· 7-457.1.2 攻击日志报表·································································································· 7-49 8系统管理·····················································································································8-538.1 服务器状态·············································································································· 8-538.2 用户信息················································································································· 8-548.2.1 修改admin帐号 ······························································································ 8-54ii / 78。
SANGFOR_AF_等保场景 配置指导手册2019年8月修订历史编号修订内容简述修订日期修订前版本号修订后版本号修订人1 编写20190808 V1.0 chenke■版权声明本文中出现的任何文字叙述、文档格式、插图、照片、方法、过程等内容，除另有特别注明，版权均属深信服所有，受到有关产权及版权法保护。
任何个人、机构未经深信服的书面授权许可，不得以任何方式复制或引用本文的任何片断。
目录第1章前言 (2)第2章典型案例 (2)第3章下一代防火墙的作用 (3)第4章下一代防火墙的配置内容 (4)4.1安全功能配置 (4)4.1.1划分区域 (4)4.1.2访问控制 (5)4.1.3高可用 (6)4.1.4 IPSec VPN功能 (7)4.1.5 IPS功能 (8)4.1.6网络杀毒功能 (11)4.1.7 WAF功能 (12)4.1.8网页防篡改 (14)4.1.9 DoS/DDoS防护 (15)4.1.10 APT攻击检测 (17)4.2安全计算环境 (17)4.2.1身份鉴别&访问控制 (17)4.2.2入侵防范 (20)4.2.3数据备份恢复 (22)4.3安全审计 (22)第1章 前言为了保障等保项目的顺利交付，协助用户满足GB/T-22239-2019等保三级的相关技术要求，特编写此配置指导文档。
第2章 典型案例第3章 下一代防火墙的作用安全域产品名称部署位置产品作用配置内容互联网出口域基础级防火墙互联网出口隔离互联网和内部网络防范网络入侵攻击网络层恶意代码过滤流量管理与控制区域划分访问控制IPS防病毒流量控制核心业务域（三级系统域）增强级防火墙核心业务服务区的外联口隔离核心业务服务器区和其他区域防范网络入侵攻击防范web应用层攻击访问控制IPSWAF对外服务器域增强级防火墙对外服务器区的外联口隔离对外服务器区和其他区域防范网络入侵攻击防范web应用层攻击网页防篡改访问控制IPSWAF网页防篡改运维管理域基础级防火墙运维管理域的外联口隔离运维区和其他区域访问控制第4章 下一代防火墙的配置内容4.1安全功能配置4.1.1划分区域GB/T 22239技术要求：1)应划分不同的网络区域，并按照方便管理和控制的原则为各网络区域分配地址；配置步骤：1、点击【网络】-【接口/区域】。
深信服网页篡改防护解决方案深信服科技有限公司2013年8月29日目录深信服网页篡改防护解决方案................................................................................- 1 -1应用背景.............................................................................................................- 3 -2需求分析.............................................................................................................- 3 -3深信服网页篡改防护解决方案.........................................................................- 4 -3.1方案概述 ..................................................................................................- 4 -3.2解决方案 ..................................................................................................- 5 -3.2.1网关型的网页防篡改，对服务器零消耗、零影响....................- 5 -3.2.2深度内容检测技术，可解析网站交互流量中隐藏的威胁........- 5 -3.2.3典型的Web攻击防护，防止Owasp十大web安全威胁 ........- 6 -3.2.4基于应用的漏洞防御，有效防止服务器漏洞利用攻击............- 6 -3.2.5多种匹配方式，灵活适合动静态网页篡改防护........................- 6 -3.2.6网站防护深度自定义，适应各行业网站特点............................- 7 -3.2.7丰富的篡改类型识别，可防护黑客的任意篡改形式................- 7 -3.2.8独立的网站更新通道，实现安全管理与业务更新两权分立....- 8 -3.2.9网站更新通道短信认证，提升网站更新通道的安全性............- 8 -3.2.10多种方式的篡改快照，可清晰界定网页内容合法性...............- 8 -3.2.11多种篡改应急处理机制，确保用户访问网站连续性...............- 8 -3.2.12快速及时的报警方式，便于应急响应并及时修复...................- 9 -4关于深信服.........................................................................................................- 9 -1应用背景近年来，网站安全事件数量不断攀升，网站成为了主要目标，国家互联网应急中心（CNCERT/CC）《2012年我国互联网网络安全态势综述》显示“网站安全类事件占到61.7%；境内被篡改网站数量为36612个，较2011年增加5.1%；4月-12月被植入网站后门的境内网站为12513个。
CNVD接受的漏洞中，涉及网站相关的漏洞占22.7%，较2011年大幅上升，排名由第三位上升至第二位。
而网站安全问题进一步引发网站用户信息和数据的安全问题。
2012年底，CSDN、天涯等网站发生用户泄露事件引起社会广泛关注，被公开的疑似泄露数据库26个，涉及账号、密码信息2.78亿条，严重威胁互联网用户的合法权益和互联网安全。
”2需求分析网站是网络中被访问最多的一种服务，也是最容易遭受攻击的。
网站直接代表着政府、企业的形象，一旦页面被篡改，将导致企业、政府形象和无形资产的巨大损失。
这种攻击方式和攻击后果屡见不鲜。
根据Gartner 的调查，信息安全攻击有75% 都是发生在Web 应用层，2/3的Web 站点都相当脆弱，易受攻击。
而针对web的攻击往往隐藏在大量的正常访问业务行为中，导致传统防火墙、入侵防御系统无法发现和阻止这些攻击。
即使部署了层层的应用安全防护设备，网页还是被篡改了！这是因为安全防护并不能百分之百的确保所有攻击都被拦截，因为也不能确保网页不被篡改。
聪明的黑客甚至会利用最新的“0”day漏洞获取服务器权限，篡改网页。
基于此类现象和问题，按照各行业对网站及发布业务安全性的要求，对于网站的安全防护主要需要解决的问题和具备的防篡改措施如下：1、具备防护篡改网站各类攻击的完整安全防御体系。
包括针对web应用程序的web攻击；针对承载网站应用的发布服务器漏洞攻击、数据库应用的漏洞利用攻击等；针对网站服务器群的系统漏洞利用攻击等攻击手段。
防止网页篡改需要具备从网络到系统再到应用层面的各类安全威胁的防护能力；2、具备事后验证网页内容发布合法性的检查。
一切发布于互联网或者内网用户的网页内容需要经过篡改与否的合规性检验，防止绕过防御体系潜入网站篡改网页的风险和管理员账号被窃取后正常发布的非法内容发布；3、具备网站更新人员的强认证通道，也便于网站更新业务的正常运转。
由于网站更新人员和安全设备管理人员通常不会是同一个部门，为了方便网站更新业务的正常运转，需要给网站内容维护人员一个专门的通道用于界定更新网站内容、界定网站内容是否为篡改行为。
同时为了增强该通道的安全性，需要增加强认证机制，比如短信认证、2次认证等手段以保证网站更新人员的合法性。
4、具备篡改后应急处理机制。
网页被篡改后，需要有良好的善后保障措施和业务承接能力。
以便于网站用户访问网站的连续性。
因此网页篡改防护需要能够提供动态防护L2-L7层的攻击，被攻击了也有篡改判定机制做到事后补偿的保护手段，确保网页不被篡改；同时需要具备篡改后应急响应的机制，即使网页内容被篡改了也不会发布与众。
3深信服网页篡改防护解决方案3.1方案概述深信服网页防篡改解决方案是网站的守护者，针对网站提供双重的防御体系。
深信服网页防篡改解决方案提供针对L2-L7层网站攻击的完整安全防御能力。
其攻击防护部分功能解决方案解决了传统防火墙不能防护应用层安全威胁的问题，弥补了IPS入侵防护系统无法防护web攻击的弱点，弥补了基于web应用的WAF无法防止底层漏洞攻击的缺陷，为用户提供完整的网站应用层安全防护方案；此外深信服网页防篡改解决方案提供的一种事后补偿防护手段，即使黑客绕过安全防御体系修改了网站内容，其修改的内容也不会发布到最终用户处，从而避免因网站内容被篡改给组织单位造成的形象破坏、经济损失等问题，保护网站的完整性。
3.2解决方案3.2.1网关型的网页防篡改，对服务器零消耗、零影响深信服网页防篡改解决方案无需在服务器上装任何插件，对服务器性能无任何损耗，对服务器本身的生产环境无需做任何修改，是通过集成在设备中的防篡改技术的完整解决方案。
可适用于各种复杂的网站建设场景，可通过路由、网桥部署于网络中，不改变网络及网站服务器的原有环境，对于网站已经建设完成需要增强安全防御能力以及防篡改能力的网站尤为适合，针对安装于服务器上的防篡改软件或需要在服务器上安全插件的防篡改系统，具有很明显的优势。
深信服防篡改解决方案只需要管理员预先在控制台设置好需要防护的网站，设置后，系统会向该网站请求页面并且缓存到设备。
当用户访问网站的时候，数据经过防篡改系统，防篡改系统会根据预先缓存的页面与用户访问的页面进行比对，如有变动，则判断为篡改，跳转到指定页面并且通知管理员。
深信服防篡改系统的样本采样模块会将首次获取到的防护页面作为基准页面，通过一定时间反复或者通过手动更新轮询方式更新采集网站的样本，再次之后获取的页面为轮询页面。
采样得到的基准页面与轮询页面将通过模块中的检测算法进行轮询的检测与匹配。
若经过算法计算的基准页面与轮询页面出现不一致时，则判定网页存在篡改的风险，通过提交管理员审核的方式判定更新内容是合法更新还是非法篡改。
3.2.2深度内容检测技术，可解析网站交互流量中隐藏的威胁深信服防篡改解决方案具备深度的内容检测技术，通过该技术可以解析用户端到服务端完整的http请求，可解析在网站交互流量中隐藏的威胁并予以防御。
相对于纯软件的防篡改系统具有防攻击特性的优势，防止黑客入侵服务器获取服务器权限后，可随意将防篡改软件关闭，或者修改的风险。
深度内容检测技术实现对HTTP/HTTPS协议的深入解析，精确识别出协议中的各种要素，如cookie、Get参数、Post表单等，并对这些数据进行快速的解析，以还原其原始通信的信息，根据这些解析后的原始信息，可以精确的检测其是否包含威胁内容。
而传统的IPS基于DPI深度数据包解析技术，只能实现在网络层数据包层面进行重组还原及特征匹配，无法解析基于HTTP协议的内容分析，很难有效检测针对web应用的攻击。
而具备简单web攻击防护的IPS，仅仅是基于简单的特征检测技术，存在大量的漏报误报的信息。
作为web客户端与服务器请求与响应的中间人，能够有效的避免web服务器直接暴露在互联网之上，双向内容检测技术可检测过滤HTTP双向交互的数据流包括response报文，对恶意流量，以及服务器外发的有风险信息进行实时的清洗与过滤。
3.2.3典型的Web攻击防护，防止Owasp十大web安全威胁该方案有效结合了web攻击的静态规则及基于黑客攻击过程的动态防御机制，实现双向的内容检测，提供OWASP定义的十大安全威胁的攻击防护能力，有效防止常见的web攻击。
（如，SQL注入、XSS跨站脚本、CSRF跨站请求伪造）从而保护电子政务网站免受网站篡改、网页挂马、隐私侵犯、身份窃取、经济损失、名誉损失等问题。
3.2.4基于应用的漏洞防御，有效防止服务器漏洞利用攻击该方案漏洞防御功能可有效防止利用web服务器、数据库服务器、中间件服务器等网站服务器本身应用程序、操作系统、应用软件的漏洞通过缓冲区溢出、恶意蠕虫、病毒等应用层攻击，使黑客获取更高的服务器权限、使服务器瘫痪导致服务器、存储等资源被攻击的问题。
3.2.5多种匹配方式，灵活适合动静态网页篡改防护深信服网页篡改防护解决方案可能实现动态、静态网页的篡改检测，通过两种匹配方式对网页篡改进行检测与匹配。
一般情况下纯静态网页，则选择[精确匹配]，全动态页面的网站选择[模糊匹配-灵敏度低]，静/动态网页都有的网站可选择[模糊匹配-灵敏度高]或者[模糊匹配-灵敏度中]。
