精编【安全生产】网神安全网关配置方法

  • 格式:doc
  • 大小:223.00 KB
  • 文档页数:17

【安全生产】网神安全网关配置方法

xxxx年xx月xx日

xxxxxxxx集团企业有限公司

Please enter your company's name and contentv 1. 将计算机IP地址设置为10.50.10.44,掩码255.255.255.0,网关10.50.10.45,连接在VPN网关的FE1口。

2. 打开VPN网关配套光盘中的Admin Cert目录,双击证书文件SecGateAdmin.p12,弹出如下窗口。

按提示进行安装,密码为“123456”,其它按默认即可安装成功。

3. 在IE浏览器中输入: https://10.50.10.45:8889,密码为firewall

进入VPN网关管理 界面。

4. 进入VPN网关管理 界面。

5. 选择系统配置——》导入导出。

点击“浏览”,选择配置文件fwconfig.txt。

fwconfig.txt 如下:

# hardware version: SecGate 3600-F3(SJW79)A

# software version: 3.6.4.26

# hostname: SecGate

# serial number: f6f335072669bb05

defaddr delalladdr defaddr add DMZ 0.0.0.0/0.0.0.0 comment "DMZ"

defaddr add Trust 0.0.0.0/0.0.0.0 comment "Trust"

defaddr add Untrust 0.0.0.0/0.0.0.0 comment "Untrust"

vpn set default prekey PleaseInputPrekey ikelifetime 28800 ipseclifetime 3600

vpnstatus on vpnbak off

vpn on

vpn add remote static main psk name xian addr 222.91.74.218 prekey

PleaseInputPrekey ike 3des-sha1-dh5,aes-sha1-dh5 initiate on obey off nat_t

on ikelifetime 28800 dpddelay 0 dpdtimeout 0

vpn add tunnel name xian_qianxian local 61.185.40.23 remote xian auth esp

ipsec aes128-md5,3des-sha1 pfs on dh_group 5 ipseclifetime 3600

proxy_localip 0.0.0.0 proxy_localmask 0.0.0.0 proxy_remoteip 0.0.0.0

proxy_remotemask 0.0.0.0

anti synflood fe1 200

anti icmpflood fe1 1000

anti pingofdeath fe1 800

anti udpflood fe1 1000

anti pingsweep fe1 10

anti tcpportscan fe1 10

anti udpportscan fe1 10

anti synflood fe2 200

anti icmpflood fe2 1000 anti pingofdeath fe2 800

anti udpflood fe2 1000

anti pingsweep fe2 10

anti tcpportscan fe2 10

anti udpportscan fe2 10

anti synflood fe3 200

anti icmpflood fe3 1000

anti pingofdeath fe3 800

anti udpflood fe3 1000

anti pingsweep fe3 10

anti tcpportscan fe3 10

anti udpportscan fe3 10

anti synflood fe4 200

anti icmpflood fe4 1000

anti pingofdeath fe4 800

anti udpflood fe4 1000

anti pingsweep fe4 10

anti tcpportscan fe4 10

anti udpportscan fe4 10

sysif set fe1 speed auto mtu 1500 ipmac off macpolicy permit mode route

sroute off log off anti off nonip deny idsblock off vlan off

sysif set fe2 speed auto mtu 1500 ipmac off macpolicy permit mode route sroute off log off anti off nonip deny idsblock off vlan off

sysif set fe3 speed auto mtu 1500 ipmac off macpolicy permit mode route

sroute off log off anti off nonip deny idsblock off vlan off

sysif set fe4 speed auto mtu 1500 ipmac off macpolicy permit mode route

sroute off log off anti off nonip deny idsblock off vlan off

sysip add fe1 10.50.10.45 255.255.255.0 ping off admin on adminping on

traceroute on

sysip add fe4 61.185.40.23 255.255.255.128 ping on admin on adminping off

traceroute off

sysip add fe3 172.24.40.100 255.255.255.0 ping on admin on adminping off

traceroute off

vrrpbunch delay 10

route add droute any 61.185.40.1

mngglobal set cpu 80 mem 80 fs 80 rcomm "public" wcomm "private" trapc

"public" username "snmpuser" level "AuthnoPriv" authpass "12345678" crypt

"MD5"

mngglobal add snmpip 222.91.74.218

mngglobal on

logsrv set 222.91.74.218 514 udp mngacct set admin password "firewall"

mngacct multi on

mngacct failtime 5 blocktime 30 period 120

dns set sysname SecGate

ipcftcheck off

longconn set 1800

statetable udp 20 icmp 5

statetable overtime establish 1800 syn 120

dnsrelay set auto

rdweb srcaddr any dstaddr any

rdweb dstport 80

vpn set dhcp active off dhcpserver 127.0.0.1 interface lo

timeout set web 600

bandwidth add p2p_band priority 3 minbw 60 maxbw 160 comment "建议仅用于P2P带宽限制"

ftpactive port20 keep off tcpmss set 1460

defsvc set ftp ftp 21

defsvc set h323 h323 1720

defsvc set sqlnet sqlnet 1521

defsvc set sip sip 5060

defsvc set rtsp rtsp 554

defsvc set mms mms 1755

defsvc set pptp pptp 1723

defsvc set gk gk 1719

defsvc set tftp tftp 69

defsvc set ftp comment "文件传输协议"

defsvc set h323 comment "Netmeeting服务"

defsvc set sqlnet comment "oracle数据库网络连接"

defsvc set sip comment "基于sip协议的动态服务"

defsvc set rtsp comment "RTSP服务"

defsvc set mms comment "MMS服务"

defsvc set pptp comment "点到点隧道协议的动态服务"

defsvc set gk comment "H.323网守服务"

defsvc set tftp comment "TFTP协议"