juniper技术培训
Juniper防火墙产品培训+#
市场领导地位-Gartnet 2004年报告
Juniper #1 out of 18 vendors
Gartner Magic Quadran报 告是针对IT特定细分市场 上的厂商实力所进行的极 具声望的评价，它从各个 方面来全方位评价厂商， 包括产品线的完整度和功 能、技术实力、创新性、 成功实施情 况、满足客户 现有和未来需求的能力， 以及包括服务和支持在内 的执行能力、市场 份额、 财务健康状况和其它关键 指标
• 广电总局国家骨干网
•
全国骨干网，50%以上设备
市场机会，约超过70 亿美元
• 安全市场上估计存在超过 70 亿美元的机会 • 包括 IPS、SSL VPN、路由功能和防火墙 VPN • 防火墙 VPN 仍然是安全市场最大的组成部分 • 我们的强项是防火墙/VPN产品 • 继续推动安全类产品的发展
先进的硬件设计通用结构的处理?数据在几个非优化的接口传送?每个api引入安全风险?处理的延迟导致无法预测的行为?数据通道无法优化pcappliancespseudoappliancesosvpncoprocessorcpurambusioinoutapplications专用的安全处理?基于流的线性的数据包处理?每个处理模块被优化?优化的应用和硬件用于安全处理和性能gigascreenasiccpuhighspeedbackplaneinoutramionetscreenadvancedarchitecturesecurityspecificrealtimeosintegratedsecurityapplicationsasicjuniper防火墙产品培训149152020screenos特点?安全性专用的实时操作系统?完全设计用于执行计算密集型安全功能而不会影响吞吐量?与硬件设备安全操作系统及安全应用紧密集成?状态协议级智能?集成深层检测防病毒和web过滤等?专用操作系统减少补丁和测试?所有防火墙ipsecvpn系列产品上部署相同的安全性专用操作系统juniper防火墙产品培训159152020screenosipv6?为状态防火墙和ipsecvpn提供生产级的商用ipv6支持?支持双堆栈架构使客户能够在一个设备上同时支持并保护ipv4与ipv6网络?支持所有主要的ipv6迁移机制包括ipv4ipv6和ipv6ipv4迁移ipv6隧道中的ipv4和ipv4隧道中的ipv6?以及面向ipv6的natpt?支持ripng动态路由协议允许客户提高生产网络中的ipv6部署的可扩展性?防止ipv6网络遭受synflood攻击和其他攻击使客户能够抵御从ipv4或ipv6网络中发起的拒绝服务攻击juniper防火墙产品培训169152020juniper防火墙产品线ns5gtns2550nshscns5400isg2000isg1000ssg520mssg550mnsseriesisgseriesssgseriesns5200ns500ns208ns204ssg20ssg5ssg140ssg350ssg320juniper防火墙产品培训179152020议程?juniper简介?juniper防火墙vpn产品线?juniperisg集成安全网关系列?juniperssg安全业务网关系列?产品对比?案例分析juniper防火墙
Juniper_基础篇
• 适用的环境： 一般用于处于相同网段的不同网络之间的安全隔离。
• 优点： 不需要重新配置路由器或受保护服务器的 IP 设置 不需要为到达受保护服务器的内向信息流创建地址映 射或端口映射
NetScreen Confidential
4 4 4
防火墙的作用
• 是基于TCP/IP七层协议中的2～4层协议开 发的。 • 可以防止和缓解基于TCP/IP协议2～4层的 攻击行为所造成的安全方面的影响。 • 部分防火墙设备可以提供有限的应用层防 护功能。
NetScreen Confidential
NetScreen Confidential
1212 12
应用模式的选择
• Juniper NetScreen防火墙有三种的应用模式 透明模式 NAT模式 路由模式 • 特殊模式： 二层模式与三层模式混合部署 (需要一些条件支持)
NetScreen Confidential
1313 13
1、透明模式
• 优点： 针对内网对互联网的访问，可以大量节省公共 IP地址，路由结构清晰。
NetScreen Confidential
1616 16
3、路由模式
• 与NAT模式类似，也是基于TCP/IP第三层协议的 设备，数据流在通过防火墙设备时，IP地址信息 不发生替换，以源地址的方式访问互联网或进入 网络访问。
9 9 9
基础应用
• 防火墙的应用部分
1、应用模式的选择和实现
NetScreen Confidential
1010 10
设备调试思路
• 1、了解网络状况。 • 2、确定防火墙的部署位置。 • 3、选择防火墙的部署模式，规划网络路由 信息。 • 4、确定策略方向、地址、服务信息。 • 5、合理设定访问策略。
Juniper_SRX3600_产品配置维护培训
SRX3400
机箱式设计(3U)
– 7个插槽 (前4后3) – 最大4块IOC;4块SPC;2块NPC
固定接口(SCB)
– 8-10/100/1000 + 4-SFP
模块化接口（IOC）
– 16-10/100/1000;16-SFP;2-XFP
多核架构 2电源冗余(N+1) 性能
fxp1
•该接口为做HA时，用作“HA control link”，该端口必须为 SPC的Port 0端口互联
lo0
•Loopback 0 •你可以配置一个物理loopback端口lo0, 可以在这个端口上 配置一个或者多个IP地址
©2009 Juniper Networks, Inc. All rights reserved.
SRX3400
8 GE+4 SFP 7 16 SFP, 16 GE, 2 XFP 4 4 2 1/No 1/No 10/20 Gbps 8 Gbps 3 Mpps 6 Gbps
SRX3600
8 GE+4 SFP 12 7 7 3 2/Yes 1/No 10/2030 Gbps 18 Gbps 6 Mpps 10 Gbps
18
JUNOS结构
结构层次化
Less Specific
clear configure monitor set show
bgp chassis interfaces isis ospf route version
brief
exact
protocol
table
terse
More Specific
©2009 Juniper Networks, Inc. All rights reserved.
juniper防火墙培训PPT--JNSA-SSC对比sec2
Copyright ©2004 Juniper网络公司，Inc.
Proprietary and Confidential
3
安全市场格局 – 主要产品系列定位
2003年下半年企业防火墙 Gartner Magic Quadrant Research Note：M-22-5175，R. Stiennon，2004年4月21日
• SonicWALL
• Fortinet
Copyright ©2004 Juniper网络公司，Inc.
Proprietary and Confidential
6
如何针对Cisco进行全面定位
卖点
• 使购买决策成为安全决策
• 向安全人员销售－让他们帮助说服管理层
Cisco Systems
Cisco PIX 防火墙
他们怎么说/做：
PIX • FWSM • IOS路由器防火墙
• PIX是带集成 VPN的专用防火墙，
• 通过PCI总线卡实现3DES加速 PIX 535
成本
PIX 525 PIX 515E
PIX 506E PIX 501
• 可通过―Fix Up” (ALG)很好地支持复杂 的协议 • 通过H.323 “可随时支持VoIP‖ ，体积 小，支持SIP • PIX 525是低价位的GigE基本产品 (330mbps 防火墙)
• PIX • FWSM • IOS路由器防火墙
PIX 防火墙 – 从低端到高端的独立设备 • 优点 – 很吸引人的产品规范，‖足够好的‖防火
•
墙，防火墙/VPN 缺点 – 在负载情况下性能会降低，较弱的VPN， 管理，不能提供应用层攻击防护功能
JUNIPER培训资料-产品篇
• 无源背板 • 分布式包转发的系统架构 • 冗余电源以及风扇系统
物理参数
• 高度: 8RU (大约1/6机架), 深度: <800mm深
系统容量
• 整机最大双工达到1.44T bps的转发性能
与MX960的通用硬件组件
• 相同的RE/SCB板卡 • 相同的DPC/MPC板卡
Copyright © 2012 Juniper Networks, Inc.
Proprietary and Confidential
‹#›
MX960系统组件如何连接?
A-PEM3 A-PEM2 A-PEM1 A-PEM0 A-FAN0 A-FAN1 A-FPB0
A-RE0 A-SCB0
业务槽位上线/下线按钮
Copyright © 2012 Juniper Networks, Inc.
Proprietary and Confidential
‹#›
MX960 电源参数
系统设计2+2 电源冗余 电源配置
• MX960的机框分为2个供电区域,每个区域需要1个电源模块 -> 2个电源模块 是非冗余的配置 • 如果要冗余, 则每个供电区域需要增加第2个电源模块 • 供电区域1: 电源模块 0 & 2 供电给 DPC 6到11, SCB 1和 2以及下部风扇托 盘 • 供电区域2:电源模块 1 & 3供电给DPC 0到5, SCB 0, 以及上部风扇托盘
A-RE1 A-SCB1 A-SCB21
A-DPC0
A-DPC11
A-DPC1
A-DPC10
A-DPC2
A-DPC9
A-DPC3
培训资料Juniper网络安全防火墙设备售前培训v
– 完全和ScreenOS 5.3 整合
• 客户可以选择采用Kaspersky还是Trend – 推荐用卡 巴斯基
25
内嵌防垃圾邮件
– 阻断垃圾邮件和网页仿冒攻击
• 将赛门铁克的防垃圾邮件功能集成到SSG 520/550中 • 使用基于IP的、强韧的、始终更新的垃圾邮件发送人和网页仿
• Source/Destination ip Session number limit
20
SSG：多种领先的安全技术的集成
• 入侵防御功能：
• 防病毒：卡巴斯基
• 防垃圾邮件：赛门铁克
• 网页过滤：美讯智
其他厂家主要依靠自己开发，特征库不完善，不专业；或者只能支 持部分的UTM功能
21
更多应用层协议的DI（IPS）支持
3
Juniper将电信级的技术精髓带入金融企业
2006
M-Series
1996
Incorporated
1998
1999
Revenue Employees
2000
2001
2002
$500M 1000
T-Series
1500
5
2004
$1B 2500
2005
#789
Acorn
UAC
SSG
$2B $2.3B
– 2个选项：集成 (SurfControl) 或重新定向 (SurfControl 或Websense)
URL 请求
许可接入
XOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXO
Juniper_SSG__防火墙培训进阶篇
总部A IKE VPN配置
在下拉菜单选取前面定义 的IKE Gateway
总部A IKE VPN配置
高级选项
总部A VPN策略的设置
Action选择Tunnel
选择A到C的VPN
分部C Gateway的设置
对方VPN设备的网关
分部C Gateway的设置
共享密钥双方必须一致 选择VPN通道的出口
总部 Trust 10.50.0.1
移动用户
▪ 拨号用户
▪ 地址对象+拨号用户地址池 ▪ 服务对象 ▪ VPN网关+L2TP ▪ IKE 对象 ▪ 安全策略
Untrust 1.1.1.1
ERP 10.50.0.5
L2TP 客户端 访问总部A的ERP服务器
L2TP User 设定部分 － 设定L2TP用户名/密码
策略的组成
地址
服务
▪ 源地址＆目的地址 • 地址 • 地址群
▪ 服务 • 预定义服务 • 定制服务 • 定制服务群
动作 日志 流量统计 认证
▪ 动作 ▪ 会话控制 ▪ 日志 ▪ 高级选项
时间、流量控制/统计、认证
创建策略 WebUI模式
▪ 组成
选择From与To的安全区
源＆目的地址
通过下拉菜单选取前面设 定的地址
▪ 地址对象 ▪ 服务对象 ▪ VPN网关 ▪ IKE 对象 ▪ 安全策略
总部
Trust 10.50.0.1
Untrust 1.1.1.1
ERP 10.50.0.5
总部A与分部C之间的Site to Site VPN
▪ 总部A部分的Site to Site VPN设置
• VPN Gateway的设置 • VPN 的设置 • VPN策略设置
Juniper产品培训
交换控制板（ Switching Control Board ）
不同路由器的型号使用不同的控制板的命名方式:
M20—系统交换板 (System Switching Board) M160—交换和转发模块 (Switching and Forwarding Module) M10/M7i/M10i/M120—转发引擎板 (Forwarding Engine
M5/M7i/M10/M10i/M20的PIC插槽号从右至左进行编号 M120/M160/T640/T1600的PIC插槽号是从上至下 PIC端口号是以0为起始号.PIC上对端口进行了标识,端口号的编
PIC port Numbers
号方式根据PIC的不同而不同
北京千禧维讯科技有限公司
Page 12
标签 MASTE R OK
颜色 蓝色 绿色
状态 持续 持续
描述 SCG处于主用状态 SCG在线，并且工作正常
FAIL
琥珀色
持续
SCG发生故障
北京千禧维讯科技有限公司
Page 18
Craft interface
可以通过Craft interface 查看运行状态以及故障诊断的信息 ，并且执行许多系统控制功能。 Craft interface 是可以热 插拔的部件 Craft interface包括如下： 告警LED和告警取消/灯光测试按钮 LCD和导航按钮 主机子系统 SIB LED FPC LED FPC oneline/offline 按钮
北京千禧维讯科技有限公司
Page 25
议程
硬件体系介绍
产品系列介绍
板卡插拔/硬件更换ห้องสมุดไป่ตู้
Juniper_防火墙应用培训资料
3
1、安全防护功能的实现
• Juniper防火墙可以防止31类攻击行为。 • 在防火墙中提供一个独立的位置对安全防护的设 置进行细化设置。 • 具体的安全设置会体现在对应的安全域中。 • 防火墙作为网络安全设备，可以防止一部分的网 络攻击，主要是防护基于TCP/IP协议的二层、三 层、四层的攻击行为的防止。 • 注意：目前所有的防火墙设备对DDOS的攻击行 为的防护效果欠佳。 • 设置的位置为：SCREENING>SCREEN
22
2、动态VPN的拓扑图
23
2、动态VPN的设置
24
2、动态VPN的设置
25
2、C/S方式的VPN应用
• 基于客户端软件和中心端防火墙方式的 VPN应用。 • 一般建议在临时性外出的移动用户中使 用，VPN连接后，数据的流量一般不大。 • 需要注意的地方：NAT穿越的选择。
26
2、C/S方式的拓扑图
10
2、静态VPN连接的设置
• 环境：位于两地的两个网络通过防火墙实 现VPN应用。 • 位于两地的两台防火墙的外连端口具有固 定的公共IP地址。
11
2、静态VPN的拓扑图
12
2、VPN设置阶段一（1）基本
13
2、VPN设置阶段一（2）高级
14
2、VPN设置阶段一说明
• • • • • • • • • 阶段一的名称定义. 阶段一的VPN网关指向（指向IP，指向用户）. 阶段一的公共密钥. *(C/S方式)本地ID. 高级部分： 加密算法、认证算法、加密长度。 VPN的模式：主模式、主动模式。 NAT穿越的选择。 UDP的保持时间
15
2、VPN设置阶段二（1）基本
16
2、VPN设置阶段二（2）高级
Juniper Bras培训之设备维护管理
风扇模块的装卸
• E系列支持风扇模块的热插拨，但在拨出风扇 模块后，必须在60秒的时间内将风扇模块重新 插回，否则整个系统会进入过热保护模式，这 时所有的线卡模块均停止运转，业务中断，只 有SRP能维持部分工作性能。
• 文件系统 • 系统操作 • 密码恢复 • 软件升级与重装 • 常用维护命令
– 在加电情况下，线卡模块不处于online或standby两种状态中的一种 （线卡处于异常或过程状态），则不需执行命令，直接先卸前卡再 卸后卡
– 在下电情况下，拆卸顺序无硬性要求。
SRP 的装卸
• 如果需要对SRP 进行插拔，为防止SRP 上存储的数 据丢失，请根据E系列的配置和需要按如下方法之 一操作。正确的关机方法也在此处一并说明。
• 查看当前所使用的配置文件
– e320#show boot
System Release: erx_7-3-4p0-7.rel
System Configuration: running-configuration
• 还原配置一，此种方式需重启系统才能生效
– e320(config)#boot config ?
– 在下电情况下，安装顺序无硬性要求，但加电时，前卡与后卡必须 是成对安装完成的，否则如果缺少任何一个，此槽的均不工作。
• 拆卸步骤
– 在加电情况下，并且线卡模块的状态为online或standby，卸之前应 首先登录系统使用slot disable <0-16>命令将指定槽道的板卡禁用， 然后先卸前卡再卸后卡
系统常用文件类型
• .dmp 当板卡异常重启或crash时，会将相关内存 信息写成一个以此后缀结尾的文件
Jniper防火墙培训资料 Juniper-FW-Training
Juniper防火墙培训黄卓超Boscohuang@培训日程▪Juniper防火墙产品型号介绍▪Juniper防火墙优势与卖点▪产品更新情况▪防火墙概念▪Troubleshooting▪日常维护企业核心网/运营商/数据中心性能Juniper防火墙产品线一览中小企业/远程办公室大中型企业/分支机构价格Juniper防火墙产品市场定位▪中低端防火墙针对中小型企业•购买成本及维护成本是首要的需求•安全功能All in one•统一的配置界面•Juniper SSG产品具备无可比拟的优势•购买成本较低•无需管理多台设备•性能可接受(出口带宽<100M)▪高端防火墙针对运营商及大型企业•性能与稳定性是用户首要的需求•防火墙不能因为开启新业务成为网络处理能力的瓶颈•防火墙需具备高稳定性，不能影响业务的正常开展•往往使用独立硬件完成病毒防护,入侵检测防御,垃圾邮件过滤等功能,专物专用•Juniper ISG/NS5000的目标客户Secure Services Gateway 5▪160Mbps防火墙处理能力▪40Mbps VPN处理能力▪16K并发会话，5.5K新建会话▪深度检测能力▪病毒扫描能力▪反垃圾邮件, Web 过滤▪支持Security zones, VLANs, Virtual Routers 以灵活地把网络分段灵活的接口选项▪固化7个10M/100MEtherne以太网接口+ 1低速广域网接口interface•ISDN BRI S/T•V.92•RS-232 Serial/Aux▪可选配无线接入802.11a/b/g▪共6个具体型号Secure Services Gateway 20灵活的接口选项▪固化5个10M/100MEtherne 以太网接口+ 2个Mini-PIM 扩展槽•ISDN BRI S/T •V.92•ADSL2+•E1/T1•千兆以太网•同步串口▪可选配无线接入802.11a/b/g ▪共6个具体型号▪160Mbps 防火墙处理能力▪40Mbps VPN 处理能力▪16K 并发会话，5.5K 新建会话▪深度检测能力▪病毒扫描能力▪反垃圾邮件, Web 过滤▪支持Security zones, VLANs, Virtual Routers 以灵活地把网络分段Secure Services Gateway 140前面板▪前面板8个10/100M 以太网接口+ 2 个10/100/1000M 接口扩展槽▪后面板4个PIM 扩展槽•2* T1/E1•2*Serial •2*SHDSL •1*E3/T3•1*ADSL•1*ISDN BRI S/T •16口GE •8口GE •6口GE •1口GE▪350 Mbps 防火墙处理能力▪100 Mbps VPN 处理能力▪48K 并发会话数，8K 新建会话数▪深度检测能力▪病毒扫描能力▪反垃圾邮件, Web 过滤▪支持Security zones, VLANs, Virtual Routers 以灵活地把网络分段后面板Secure Services Gateway 300M Series▪Juniper Networks SSG 350M•550Mbps FW •225 Mbps VPN •深度检测能力•病毒扫描能力• 5 I/O Slots•单电源, AC or DC•128K 并发会话, 12.5K 新建会话数•350 VPN tunnels •1.5U▪Juniper Networks SSG 320M •450Mbps FW •175Mbps VPN •深度检测能力•病毒扫描能力)• 3 I/O slots •单电源, AC or DC•64K 并发会话,10K 新建会话数•250 VPN tunnels •1U▪共同特点•固化4个10M/100M/1000M 以太网接口•2个RJ45 Console/AUX 接口•2 个USB可外接存储设备以导出日志或其他系统信息Secure Services Gateway 500 Series▪Juniper Networks SSG 550•4Gbps FW •500 Mbps VPN •深度检测能力•病毒扫描能力• 6 I/O Slots•冗余电源, AC or DC•256K 并发会话, 32K 新建会话数•1,000 VPN tunnels▪Juniper Networks SSG 520•2Gbps FW•300 Mbps VPN •深度检测能力•病毒扫描能力• 6 I/O slots •单电源, AC or DC•128K 并发回话, 23k 新建会话数•500 VPN tunnels▪共同特点•2U 高，固化4个10M/100M/1000M 以太网接口•2个RJ45 Console/AUX 接口•2 个USB可外接存储设备以导出日志或其他系统信息丰富的SSG接口模块：PIMs8口10M/100M/1000M电口16口10M/100M/1000M电口6口1000M光口2口E1/T12口同步串口1口ISDN BRI S/TJuniper ISG防火墙概览•ISG2000•集中转发架构,系统性能为设计值•整机4Gbps防火墙处理能力(大包)•2Gbps防火墙处理能力(64bytes小包)•整机2Gbps 3DES或AES VPN能力•整机1百万并发连接•最多支持10000 IPSec VPN tunnels •最多支持16个千兆接口或28个百兆接口•最多支持250个虚拟防火墙系统•最多支持4094个VLANs •ISG1000•集中转发架构,系统性能为设计值•最大2Gbps防火墙处理能力(大包)整机1Gbps防火墙处理能力(64bytes小包)•最大1Gbps 3DES或AES VPN能力•整机50万并发连接•最多支持2000 IPSec VPN tunnels•最多支持12个千兆接口或20个百兆接口•最多支持50个虚拟防火墙系统•最多支持4094个VLANsISG 2000 升级为带硬件IDP 的防火墙IDP LicenseKey1－3 块安全模块++=ISG System+ISG System w/ IDPJuniper NS5000防火墙概览•NS5400•分布式处理，随着板卡数量增加性能线性递增•最大30Gbps 防火墙处理能力(256bytes)•12Gbps 防火墙处理能力(64bytes 小包)•最大15 Gbps 3DES 或AES VPN 能力•整机2 百万并发连接•支持25,000 IPSec VPN tunnels •支持24个千兆接口或6个万兆接口•支持500个虚拟防火墙系统•支持4094个VLANs •NS52000•分布式处理，随着板卡数量增加性能线性递增•最大10Gbps 防火墙处理能力(256bytes)整机4Gbps 防火墙处理能力(64bytes 小包)•最大5Gbps 3DES 或AES VPN 能力•整机1百万并发连接•支持25,000 IPSec VPN tunnels •支持8个千兆接口或2个万兆接口•支持500个虚拟防火墙系统•支持4094个VLANsJuniper NS5000接口板卡系列▪NetScreen-5000 8G2接口模块•8口千兆mini-GBIC 接口•8Gbps 防火墙/4Gbps 3DES/AES VPN性能•支持最多4口聚合▪NetScreen-5000 2XGE接口模块•2口万兆XFP接口•10Gbps防火墙/4Gbps 3DES/AES VPN性能•支持短距或长距Transceivers▪共同点•每块接口卡内置2块GigaScreen3ASIC•支持9.6K帧长的Jumbo Frames•跟5000-MGT2管理模块兼容培训日程▪Juniper防火墙产品型号介绍▪Juniper防火墙优势与卖点▪产品更新情况▪防火墙概念▪Troubleshooting▪日常维护防火墙操作系统SreenOSRISC CPUSecurity -Specific, Real -Time OS •Dynamic Routing •Virtualization •High Availability•Centralized Management•VPN•Denial of Service •Firewall•Traffic management Purpose Built Hardware Platform CPU MemoryASICInterfacesSecurity –Specific, Real-Time OS▪Dynamic Routing ▪Virtualization▪High Availability ▪Centralized Management Integrated Security Applications ▪Denial of Service ▪VPN ▪Firewall ▪Traffic management 转为安全业务而设计的软件系统-▪电信级路由能力:RIP/OSPF/BGP4/PBR ▪高可用性:Redundant Interface/Track IP/NSRP ▪虚拟化能力:虚拟防火墙▪UTM 功能:AV/IPS/Anti-SPAM/URL Filtering…▪支持:RADIUS, LDAP , PKI, internal DB,SecurID,MS AD 等认证手段▪超过10年行业经验累积▪支持大量的企业应用如H323/SIP/MGCP/Skinny 等▪安全域／全状态检测／深度检测▪VPN 特性:IPsec/XAuth/L2TP/GRE防火墙安全业务引擎GigaScreen3ASIC•Juniper/Netscreen第4代安全业务处理芯片(2003 年发布)•3Mpps状态检测/NAT性能• 1.5Mpps 加解密性能( IPsec VPN)•集成16种常见攻击的防护能力(Syn-flood/ICMP flood//UDP Flood等)•集成6*Packet Processing Units (PPU)加速单元:•VPN 加/解密(AES, 3DES, DES,SHA-1, MD5)•TCP 4 Way close•IP 分段重组•IKE协商加速•流量计数•支持微代码编程，可通过软件版本升级更新ASIC芯片的功能•用于ISG/NS5000产品系列全状态防火墙检测机制▪支持对TCP协议进行状态检测▪支持IP/ICMP/UDP等无状态协议进行状态检测▪支持对复杂协议进行状态检测•H.323(Cisco/Avaya/Polycom/NEC…)•SIP•MGCP•Skinny•FTP/TFTP•RTSP/Real•Microsoft RPC/Sun RPC•SQL•PPTP•SCTP•GTP/GPRS完善的VPN特性支持▪支持IETF IPsec VPN标准•可与所有兼容RFC标准的IPsec网关互联互通•支持IPsec VPN NAT Traversal•支持Remote-Access w/ Xauth•支持透明模式下的IPsec VPN•独特的ACVPN特性，可简化大规模full-mesh VPN部署▪支持L2TP VPN，支持L2TP over IPsec，方便Windows用户VPN远程接入▪支持GRE Tunnel,支持GRE over IPsec；方便通过VPN隧道透传组播应用统一威胁管理(UTM)来自入方向的威胁来自出方向的威胁SurfControl to block to Spyware /Phishing / Unapproved Site Access Web过滤Kaspersky Lab AV stops Viruses, file-based Trojans, Spyware, Adware,KeyloggersKaspersky Lab AV stops Viruses, file-based Trojans or spread of Spyware,Adware, Keyloggers防病毒Symantec stops Spam / Phishing防垃圾邮件Juniper IPS detects/stopsWorms, TrojansJuniper IPS detects/stops Worms,Trojans, DoS, Recon, Scans入侵检测防护Juniper Stateful Firewall, VPN, AccessControl核心安全Juniper Stateful Firewall, VPN,Access Control经济灵活的虚拟系统(Virtual Systems)IEEE 802.1Q VLAN Trunk业务流量按照VLANs 映射至虚拟防火墙客户区域物理分割到客户A 的VLAN虚拟防火墙逻辑分割每个客户独立管理自己的设备: 分离的路由表/安全策略/地址本/管理员账号到客户C 的VLAN到客户B 的VLAN灵活的部署方式▪路由模式:电信级路由能力•RIP•OSPF•BGP•策略路由•ECMP▪透明模式(桥模式)•无需更改现有网络拓扑，即插即用•支持透明模式下的NAT(ScreenOS 6.2)/IPsec VPN ▪支持丰富的广域网接口卡类型，适应各种网络连接▪虚拟路由器/虚拟防火墙提高业务灵活性▪IPv6 Ready•支持IPv4/IPv6双栈•支持NAT-PT•支持6to4 Tunnel•支持6in4,4in6 Tunnel•支持RIPng，即将支持OSPFv3高可用性▪主要特性•支持A/P、A/A、A/A fullmesh的高可用部署•同步FW/VPN的所有信息，切换时包括•Active sessions•NAT•VPN tunnels•Security Associations▪优点•业务无中断，切换对用户透明•改进了业务的弹性▪Juniper HA防火墙结构解决的问题•防多点故障•链路故障或周边设备故障，用接口切换屏蔽，设备不用切换，无丢包•双HA心跳线冗余•Track IP机制检测全路径健康状况•配置自动同步，维护简单友好的人机管理界面集成管理平台Telnet SSHHTTP HTTPSDMISNMPSyslogJuniper 防火墙开放,基于标准的管理框架ScreenOS CLI▪Telnet ▪SSHWeb▪Quick Setup with Templates ▪Dashboard View▪Performance MonitoringJuniper NSM▪Discovery & Configuration ▪Policy Management ▪Inventory Management ▪Log ManagementDevice ManagementNetwork & Security ManagementThird party NMSJuniper STRM▪Threat Detection▪Event Log Management ▪Compliance & IT Efficiency培训日程▪Juniper防火墙产品型号介绍▪Juniper防火墙优势与卖点▪产品更新情况▪防火墙概念▪Troubleshooting▪日常维护新一代安全操作系统JUNOS-ES JUUNOS Enhanced Service▪电信级路由操作系统JUNOS和安全操作系统ScreenOS的完美融合•来自JUNOS的MPLS/NSF/NSR等高级功能•来自JUNOS的层次化CLI配置风格•来自ScreenOS的安全特性: 安全域/NAT/IPsec VPN/Screen/深度检测/UTM •Commit/JUNOS Scripts等高级管理特性▪集成的统一安全平台•状态检测•IPsec VPN•入侵检测与防御•病毒防御/垃圾邮件过滤(Roadmap)•DDoS攻击防护▪分布式体系架构•控制/转发平面清晰分离•全冗余分布式系统架构，性能随着安全业务板数量增加而线性递增•满足性能按需增长的要求▪Only for SRX and J系列路由器▪SRX5600▪管理引擎/安全服务引擎/交换矩阵/电源/风扇组全冗余▪8U/8槽位▪防火墙性能–60 Gbps ▪VPN –18 Gbps ▪IDP –18 Gbps▪Concurrent sessions –4M▪New and sustained cps –300k ▪Concurrent VPN tunnels –100kJuniper 新一代防火墙产品SRX5000系列▪SRX5800▪管理引擎/安全服务引擎/交换矩阵/电源/风扇组全冗余▪16U/14槽位▪防火墙性能–120 Gbps ▪VPN –36Gbps ▪IDP –36Gbps▪Concurrent sessions –8M ▪New and sustained cps –300k ▪Concurrent VPN tunnels –100k▪SRX3400▪关键部件冗余▪3U/7扩展槽位▪防火墙性能–10 Gbps ▪VPN –8 Gbps▪IDP –6Gbps▪Concurrent sessions –1M ▪New and sustained cps –120k ▪Concurrent VPN tunnels –10kJuniper 新一代防火墙产品SRX3000系列▪SRX3600▪关键部件冗余▪5U/12扩展槽位▪防火墙性能–30 Gbps ▪VPN –14Gbps ▪IDP –10Gbps▪Concurrent sessions –2M ▪New and sustained cps –120k ▪Concurrent VPN tunnels –30kSRX竞争优势▪支持关键部件全冗余，相比传统防火墙的双机部署成本更低且冗余设计更简单▪突破传统防火墙没有真正的交换矩阵的设计缺陷，采用Juniper骨干网路由器的Switch Farbric(960Gbps),易于容量扩展▪融合来自Juniper骨干网路由器的路由特性，更好的支持ISIS, BGP，NSF/NSR等高级路由特性▪完全集成来自ScreenOS的安全特性，是可以信赖的安全解决方案培训日程▪Juniper防火墙产品型号介绍▪Juniper防火墙优势与卖点▪产品更新情况▪防火墙概念▪Troubleshooting▪日常维护安全区（Security Zone）：Juniper 防火墙增加了全新的安全区域（Security Zone）的概念，安全区域是一个逻辑的结构，是多个处于相同属性区域的物理接口的集合。
Juniper路由器内部培训资料-JUNOS_Lab_Guide_Module1_Sec7
V1.0, 02/15/08 -----------------------------------------------------------Lab 7-1 TroubleshootingObjectivesThe objective of this lab it to provide you with a series of outputs you can use to troubleshoot and diagnose issues that may arise from the configuration of policies, protocols, firewalls, and enhanced services. This module is not intended to be an all inclusive document but rather a reference to help you ensure that your configurations meet the assignments in the previous labs. It is understood that time may not permit you to use all of these commands. As mentioned in module one, however, it is imperative that you verify correct operation of your configuration therefore we are including some of the more common outputs used. Assignment:Use the command line interface to issue commands that verify the correct operation of your configurations from all labs done in this course. Specifically, verify correct operation of the following:-Interfaces-Protocols-OSPF-RIP-Policy-Firewall-Stateful firewall-Screen OptionsV1.0, 02/15/08 -----------------------------------------------------------Lab 7-2 InterfacesUse the show interfaces terse command to display a terse listing of all interfaces installed in the router along with their administrative and link-layer status.Above we can see the status of all the interfaces on our router. It helps to have an understanding of what the different Admin and Link status may indicate.When an interface is administratively disabled, the physical interface has an Admin status of down and a Link status of up, and the logical interface has an admin status of up and a link status of down. The physical interface has a link status of up because the physical link is healthy (no alarms). The logical interface has a link status of down because the data link layer cannot be established end to end.V1.0, 02/15/08 -----------------------------------------------------------When an interface is not administratively disabled and the data-link layer between the local router and the remote router is not functioning, the physical interface has an Admin status of up and a Link status of up while the logical interface has an admin status of up and a link status of down. The physical interface has a link status of up because the physical link is healthy (no alarms). The logical interface has a link status of down because the data-link layer cannot be established end to end.If we see that our interface is not listed as UP/UP, but rather Admin Up but Link down, we can troubleshoot inconsistencies in the configuration or settings on both sides of the link. The show interfaces (interface name) <extensive, brief, detail, statistics> output will show us specific information about settings on the interface as well as drops, errors, alarms, flags, and hardware specific media alarms. The following are some examples of these outputs.V1.0, 02/15/08 -----------------------------------------------------------The output of a show interfaces command displays the device-level configuration and provides additional information about the device’s operation through various flags. These flags include the following:-Down: Device was administratively disabled.-Hear-Own-Xmit: Device will hear its own transmissions.-Link-Layer-Down: The link-layer protocol failed to successfully connect with the remote endpoint.-Loopback: Device is in physical loopback.-Loop-Detected: The link layer received frames that it sent and suspects a physical loopback.-No-Carrier: Where the media supports carrier recognition, this indicates that no carrier is currently seen.-No-Multicast: Device does not support multicast traffic.-Present: Device is physically present and recognized.-Promiscuous: Device is in promiscuous mode and sees frames addressed to all physical addresses on the medium.V1.0, 02/15/08 ------------------------------------------------------------Quench: Device is quenched because it overran its output buffer.-Recv-All-Multicasts: No multicast filtering (multicast promiscuous).-Running: Device is active and enabled.The status of the interface is communicated with one or more flags. These flags include the following:-Admin-Test: Interface is in test mode, which means that some sanity checking, such as loop detection, is disabled.-Disabled: Interface is administratively disabled.-Hardware-Down: Interface is nonfunctional or incorrectly connected.-Link-Layer-Down: Interface keepalives indicate that the link is incomplete.-No-Multicast: Interface does not support multicast traffic.-Point-To-Point: Interface is point to point.-Promiscuous: Interface is in promiscuous mode and sees frames addressed to all physical addresses.-Recv-All-Multicasts: No multicast filtering (multicast promiscuous).-SNMP-Traps: SNMP traps are enabled.-Up: Interface is enabled and operational.The operational status of the device’s link layer protocol is also indicated with flags. These flags include the following:-Give-Up: Link protocol does not continue to retry to connect after repeated failures.-Keepalives: Link protocol keepalives are enabled.-Loose-LCP: PPP does not use LCP to indicate whether the link protocol is up.-Loose-LMI: Frame Relay will not use LMI to indicate whether the link protocol is up.-Loose-NCP: PPP does not use NCP to indicate whether the device is up.-No-Keepalives: Link protocol keepalives are disabled.The output also summarizes the device-level traffic load, which is displayed in both bits and packets per second, as well as any alarms that might be active. The final portion of the command output displays the configuration and status of each logical unit defined on that deviceV1.0, 02/15/08 -----------------------------------------------------------V1.0, 02/15/08 -----------------------------------------------------------V1.0, 02/15/08 -----------------------------------------------------------Now we look at the show interfaces extensive command. In the output above we have narrowed our output to show the section for traffic statistics, and input and output errors. The following is a list of some of the fields displayed here and a brief explanation of what some of the non-obvious ones mean.Input-Errors: Displays the sum of the incoming frame aborts and frame check sequence (FCS) errors.-Policed discards: Displays the frames that the incoming packet match code discarded because they were not recognized or of interest. Usually, this field reports protocolsthat JUNOS software does not handle, such as Cisco Discovery Protocol(CDP)/Spanning Tree Protocol (STP), or any protocol type JUNOS software does notunderstand. (On an Ethernet network, numerous possibilities exist.) -L3 incompletes: This counter increments when the incoming packet fails Layer 3 (usually IPv4) checks of the header. For example, a frame with less than 20 bytes ofavailable IP header would be discarded, and this counter would increment.-L2 channel errors: This counter increments when the software cannot find a valid logical interface (such as e3-1/2/3.0) for an incoming frame.-L2 mismatch timeouts: Displays the count of malformed or short packets that cause the incoming packet handler to discard the frame as unreadable.-SRAM errors: This counter increments when a hardware error occurs in the SRAM on the PIC. The value in this field should always be 0. If it increments, the PIC ismalfunctioning.Output-HS link CRC errors: Displays the count of errors on the high-speed links between the ASICs responsible for handling the router interfaces.-Carrier transitions: Displays the number of times the interface has gone from down to up. This number should not increment quickly, increasing only when the cable isunplugged, the far-end system is powered down and up, or a similar problem occurs.If it does increment quickly (perhaps every 10 seconds), then either the transmission line, the far-end system, or the PIC is broken.-Errors: Displays the sum of the outgoing frame aborts and FCS errors.-Drops: Displays the number of packets dropped by the output queue of the I/O Manager ASIC. If the interface is saturated, this number increments once for everypacket that is dropped by the ASIC’s RED mechanism.-Aged packets: Displays the number of packets that remained in shared packet SDRAM for so long that the system automatically purged them. The value in this field shouldnever increment. If it does, it is most likely a software bug or possibly malfunctioning hardware.V1.0, 02/15/08 -----------------------------------------------------------Lab 7-3 ProtocolsThe first protocol that we configured in our labs was OSPF. Lets take a look at some outputs that will help us determine the overall health of OSPF. In doing this we will look to see if the interfaces are configured for OSPF, if we are seeing adjacencies, and if we are learning our routes.V1.0, 02/15/08 -----------------------------------------------------------The show ospf route command display those routes in the unicast routing table, inet.0, that were installed by OSPF. The use of additional keywords allows you to display only OSPF routes learned by specific LSA types. The output fields of the show ospf route command are the following:-Prefix: Displays the destination of the route.-Route/Path Type: Displays how the route was learned:-ABR: Route to area border router;-ASBR: Route to AS border router;-Ext: External router;-Inter: Interarea route;-Intra: Intra-area route; or-Network: Network router.-Metric: Displays the route's metric value.-Next hop i/f: Displays the interface through which the route's next hop is reachable.-Next hop addr: Displays the address of the next hop.-area: (detail output only) Displays the area ID of the route.-options: (detail output only) Displays the option bits from the LSA.-origin: (detail output only) Displays the router from which the route was learned.V1.0, 02/15/08 -----------------------------------------------------------The show ospf interface command displays information relating to the interfaces on which the respective protocol is configured to run. In the case of OSPF, the output fields are the following:-Interface: Displays the name of the interface running OSPF.-State: Displays the state of the interface. It can be BDR, Down, DR, DRother, Loop, PtToPt, or Waiting.-Area: Displays the number of the area in which the interface is located.-DR ID: Displays the address of the area's DR.-BDR ID: Displays the BDR for a particular subnet.-Nbrs: Displays the number of neighbors on this interface.V1.0, 02/15/08 ------------------------------------------------------------Type (detail and extensive output only): Displays the type of interface. It can be LAN, NBMA, P2MP, P2P, or Virtual.-Address (detail and extensive output only): Displays the IP address of the neighbor.-Mask (detail and extensive output only): Displays the mask of the interface.-MTU (detail and extensive output only): Displays the interface's MTU.-Cost (detail and extensive output only): Displays the interface's cost (metric).-DR addr (detail and extensive output only): Displays the address of the DR.-BDR addr: Displays the address of the BDR.-Adj count (detail and extensive output only): Displays the number of adjacent neighbors.-Flood list (extensive output only): Displays the list of LSAs pending flood on this interface.-Ack list (extensive output only): Displays the list of pending acknowledgments on this interface.-Descriptor list (extensive output only): Displays the list of packet descriptors.-Dead (detail and extensive output only): Displays the configured value for the dead timer.-Hello (detail and extensive output only): Displays the configured value for the hello timer.-ReXmit (detail and extensive output only): Displays the configured value for the retransmit timer.-OSPF area type (detail and extensive output only): Displays the type of OSPF area, which can be Stub, Not Stub, or NSSA.V1.0, 02/15/08 -----------------------------------------------------------Next we can check to see if the interfaces we have configured for OSPF are forming adjacencies. The show ospf neighbor command displays adjacency status for their respective protocols. In the case of OSPF, the output fields include the following: -Address: Displays the address of the neighbor.-Intf: Displays the interface through which the neighbor is reachable.-State: Displays the state of the neighbor, which can be Attempt, Down, Exchange, ExStart, Full, Init, Loading, or 2Way.-ID: Displays the RID of the neighbor.-Pri: Displays the priority of the neighbor to become the DR.-Dead: Displays the number of seconds until the neighbor becomes unreachable.-area (detail and extensive output only): Displays the area in which the neighbor is located.-opt (detail and extensive output only): Displays the option bits from the neighbor.-DR (detail and extensive output only): Displays the address of the DR.-BDR (detail and extensive output only): Displays the address of the BDR.-Up (detail and extensive output only): Displays the length of time since the neighbor came up.-adjacent (detail and extensive output only): Displays the length of time since the adjacency with the neighbor was established.V1.0, 02/15/08 -----------------------------------------------------------Now that we have taken a look at OSPF, let’s take a brief look at some of the commands we can use to verify operation of the RIP protocol.This output displays information about RIP neighbors. This is a list of the fields and what they mean.-Neighbor: Name of RIP neighbor.-State: State of the connection: Up or Dn (Down).-Source Address: Source Address.-Destination Address: Destination Address.-Send Mode: Send options: broadcast, multicast, none, or version 1.-Receive Mode: Type of packets to accept: both, none, version1 or version2.-In Met: Metric added to incoming routes when advertising into RIP routes that were learned from other protocols.V1.0, 02/15/08 -----------------------------------------------------------This output above displays the route entries in the routing table that were learned from protocols RIP. A description of some of the fields follows.-active: Number of routes that are active.-holddown: Number of routes that are in the hold-down state prior to being declared inactive.-hidden: Number of routes not used because of routing policy.-+: A plus sign before [protocol/preference] indicates the active route, which is the route installed from the routing table into the forwarding table.--: A hyphen before [protocol/preference] indicates the last active route.-*: An asterisk before [protocol/preference] indicates that the route is both the active and the last active route. An asterisk before a ‘to’ line indicates the best subpath to the route.V1.0, 02/15/08 -----------------------------------------------------------To see what RIP routes are being sent or received on the router issue the show route advertising-protocol rip<egress interface address> and show route receive-protocol rip<remote advertising interface address> commands. The field definitions follow:-active: Number of routes that are active.-holddown: Number of routes that are in the hold-down state prior to being declared inactive.-hidden: Number of routes not used because of routing policy.-+: A plus sign before [protocol/preference] indicates the active route, which is the route installed from the routing table into the forwarding table.--: A hyphen before [protocol/preference] indicates the last active route.-*: An asterisk before [protocol/preference] indicates that the route is both the active and the last active route. An asterisk before a ‘to’ line indicates the best subpath to theroute.V1.0, 02/15/08 -----------------------------------------------------------Lab 7-4 PolicyWhen troubleshooting policy two of the most common commands are show route receive-protocol and show route advertising-protocol. When issuing these commands it’s important to understand where we are getting the outputs from. The commands on the slide show routing updates received before import policy processing and the routing updates sent after export policy processing.Use the show route receive-protocol protocol neighbor command to show the specified protocol-type route advertisements that a particular neighbor is advertising to your router before import policy is applied. Use the show route advertising-protocol protocolneighbor command to show the protocol-type route advertisements that you are advertising to a particular neighbor after export policy is applied.The use of route filters marks an exception to the behavior documented previously. JUNOS software evaluates route filters before the output of a show route receive-protocol command is generated. Thus, you must specify the hidden switch to the show routereceive-protocol command to display received routes filtered by your import policy.If you want to monitor the effects of an import policy, use the show route protocol protocol command to monitor the effects of your import policy. This command shows all routes from the protocol type specified that are installed in the routing table.Another way we can troubleshoot policy is to use the function test policy <policy name><prefix>. By using this command you can test policies that are created (and committed) on the router for a specific prefix to see if the policy will have the desired effect on the prefix being tested.V1.0, 02/15/08 -----------------------------------------------------------V1.0, 02/15/08 -----------------------------------------------------------It is important to keep in mind that the default action of ‘test’ is to accept. Note the difference in behavior once we add a second term catch-all to reject any remaining routes.V1.0, 02/15/08 -----------------------------------------------------------Lab 7-5 Stateless Firewall Filters (Packet Filters)One of the more common ways to test firewall filters is to set up counters to capture discarded and accepted packets. If we see packets increment in the discard counter then we can at least be assured that our filter is applied and that packets are matching. Please recall that in a previous lab we used a firewall filter to match on ICMP and a counter to show that it was working correctly. The following command, show firewall, shows the counter we created and the amount of traffic that has been matched it.-----------------------------------------------------------V1.0, 02/15/08 -----------------------------------------------------------Another method for troubleshooting is to look at the firewall log created specially for dropped packets due to firewall match criteria. The log modifier writes packet header information to a memory resident buffer in the PFEV1.0, 02/15/08 -----------------------------------------------------------The following chart shows the output field definitions:Time of Log Time that the event occurred. to be providedFilter Name of a filter that has been configured with the filterstatement at the [edit firewall] hierarchy level.• A hyphen (-) indicates that the packet was handled bythe Packet Forwarding Engine.• A space (no hyphen) indicates the packet was handledby the Routing Engine.•The notation pfe indicates packets logged by thePacket Forwarding Engine hardware filters.to beprovidedFilter Action Filter action:•A—Accept•D—Discard•R—Rejectto beprovidedName of Interface Ingress interface for the packet.to beprovidedName of protocol Packet's protocol name: egp, gre, ipip, ospf, pim, rsvp, tcp, orudp.to beprovidedPacket length Length of the packet. to be providedSource address Packet's source address. to be providedDestination address Packet's destination address and port.to beprovidedV1.0, 02/15/08 -----------------------------------------------------------Finally one more way to look at the results of our firewall filters is to create a system log file that matches on the packets that have been dropped as a result of the firewall applied to the router. First of all, take a look at the system syslog settings that allow us to analyze the log filesThen as part of the firewall filter, we include the action of syslog:V1.0, 02/15/08 -----------------------------------------------------------Finally, we can now take a look at the log files created as a result of our work:In this section we will see a couple outputs that give us useful information on stateful firewalls, zones, and interfaces that participate. One thing to keep in mind is that the output for flows shows up only if traffic has passed within a certain amount of time. This means that even though your configuration may be correct, the output may not show incrementing valueswithout traffic.V1.0, 02/15/08 -----------------------------------------------------------This output is shown to let you see that with JES configured on your router, a showinterfaces output references the zones assigned to the logical portion of your interface. This can be helpful when determining if your zones have been applied correctly and give you some basic information as to the amount and type of traffic being allowed to traverse your interface.V1.0, 02/15/08 -----------------------------------------------------------Conversely, if you would rather take a look at the zones configured on your router, the show security zones output will show you the zones configured as well as the interfaces associated with these zones. Additional information can be found here that let’s us know any settings we have for the return traffic. For instance, if we have decided to send a reset for non-SYN session TCP packets, this information would be shown under the security zone section of this output.V1.0, 02/15/08 -----------------------------------------------------------The output above summarizes all of the active sessions that have been created.V1.0, 02/15/08 -----------------------------------------------------------From time to time it may become necessary to clear flows on your router, the output above shows this. You also have the ability to clear specific sessions with the session identifier.V1.0, 02/15/08 -----------------------------------------------------------Lab 7-7 Screen OptionsFor the lab and objective assignments, sending ping packets that are obviously too large and then monitoring the command show security screen statistics zone <zone name> should give us an indication of whether or not our configuration will account for the specific type of attack we are mitigating. Because this output has all ready been seen in module 6, the output above may look a bit familiar. ☺。
juniperFW售后培训PPT教案
最简捷的设置时间的方法是按“Sync Clock With Client”按钮。系统将自身时 钟与网管客户端的本地时钟作同步。 如果用户网络中有NTP服务器存在，也可在此页面设置。
21
基本系统配置-----系统DNS设置
Network > DNS > Host
28
灾难恢复-----恢复系统文件 II
29
灾难恢复-----恢复系统文件 III
• 当出现“Save to on-board flash disk？”提示时，按“Y”键将OS存入FLASH。 • 当出现“Run download system image？”提示时，按“Y”键运行新的OS。
30
•b.通过Console线缆来连接防火墙的Console端口
设备正常启动后，Power LED（电源灯）常绿；Status LED（状态灯）闪烁绿色。
•c.使用PC的终端连接工具，访问防火墙的Console进程。
5
登录防火墙-----Log in from Console III
选择正确的串口
采用Windows系统超级终端的默认值参数即可
深层检测（Deep Inspection/IPS
23
License Key管理 -----Capacity License Key管理 Configuration > Update > ScreenOS/Keys
选中“License Key Update”，点击“浏览”按钮，在客户端文件目录中选择license文件；再点 击
Configuration > Admin > Management
Enable Web Management Idle Timeout 用来设置Webui登录的空闲超时时限。 各种 Port用来设置该种方式登录的端口；建议在外网访问WEB的时候，修改默认端口。
JuniperEX系列交换机销售培训
Module Description
Max InterPorts face
– MPLS & L3 VPNs
48-port 10/100/1000B-T
768 RJ45
– GRE tunnels – IPv6
48-port 100B-FX/1000B-X 8-port 10GbE
768 SFP 128 SFP+
Juniper EX系列交换机
Agenda
• 交换机市场情况 • EX系列介绍 • 和Cisco的比较 • 销售竞争指导
全球交换机市场情况
• 全球以太网交换机市场整体规模呈现增长态势
– 全球市场以太网交换机同比去年增加了10%左右 – 2008年全球以太网交换机预计有“18亿美元”市场份额
• 千兆、万兆以太网交换机逐渐成为市场的主流 • 三层交换机侵入路由器市场 • Cisco全球市场占72％的市场份额
• 支持外接的冗余供电系统
• LCD显示 • 1RU高
# Ports
Port Type
24
10/100/1000B-T
24
10/100/1000B-T
48
10/100/1000B-T
48
10/100/1000B-T
PoE Ports
0 24 0 48
Max Power Consumption
(incl. PoE) 50 (0) W
8
190 (320) W
• LCD显示及按键控制 • 基本版本支持三层路由功能 • 1RU高
24
10/100/1000B-T
24
190 (600) W
24
100B-FX/1000B-X N/A
Juniper M系列(Jncie)认证培训-产品说明书
汤姆一通互联网技术训练中心 JUNIPER-JINCIE-产品手册A 部分：Juniper(M/T)系列认证培训服务 ..................................................................................... 2 A.1 收费标准............................................................................................................................ 2 A.2 JNCIE 认证培训服务 ........................................................................................................ 3 A.2.1 JNCIE 快速考证指导 ............................................................................................ 3 A.2.2 JNCIE 课程学习及考证指导(在线) .................................................................... 4 A.2.3 JNCIE 课程学习及考证指导(现场学习) ............................................................ 5 A.2.4 JNCIE 认证学习体验 ............................................................................................ 6 B 部分：Juniper(M/T)系列认证体系详解 .................................................................................... 7 B.1 M 系列及 T 系列认证系列课程 ........................................................................................ 7 B.1.1 JNCIS-M................................................................................................................. 7 B.1.2 JNCIP-M................................................................................................................. 8 B.1.3 JNCIE-M................................................................................................................. 8 C 部分：JNCIE 课程内容及安排 ..................................................................................................... 9 C.1 试地点....................................................................................................................... 9 C.1.2 课程内容及学习安排 .......................................................................................... 10 D 部分：培训常见问题解答 ......................................................................................................... 10 E 部分：Juniper 的发展 ............................................................................................................... 11 E.1 Juniper 中国发展历程 .................................................................................................. 11 E.2 全球领先的联网及安全方案供应商 .............................................................................. 12 E.3 Juniper 的产品.............................................................................................................. 12 E.3.1 网络基础设施平台 .............................................................................................. 12 E.3.2 网络安全解决方案 .............................................................................................. 13 E.3.3 应用加速解决方案 .............................................................................................. 131汤姆一通互联网技术训练中心 A 部分：Juniper(M/T)系列认证培训服务A.1 收费标准2汤姆一通互联网技术训练中心 A.2 JNCIE 认证培训服务 A.2.1 JNCIE 快速考证指导3汤姆一通互联网技术训练中心 A.2.2 JNCIE 课程学习及考证指导(在线)4汤姆一通互联网技术训练中心 A.2.3 JNCIE 课程学习及考证指导(现场学习)5汤姆一通互联网技术训练中心 A.2.4 JNCIE 认证学习体验6汤姆一通互联网技术训练中心 B 部分：Juniper(M/T)系列认证体系详解B.1 M 系列及 T 系列认证系列课程Juniper 网络公司技术认证计划（JNTCP）M 系列及 T 系列认证系列课程是多级认证课程，考 生可通过笔试、 动手配置和故障排除考试相结合的形式来证明自己具备 Juniper 网络公司技 术方面的能力。
Juniper路由器内部培训资料-JUNOS Lab Guide_Module1_Sec1
JUNOS Lab GuideV1.0, 02/15/08-----------------------------------------------------------Juniper Networks Security Products GroupJunOS Enhanced Services Version 1.0a Student Lab GuideJUNOS Lab Guide (Section 1) E-VRC-00xx-ER-08-A01 Juniper Networks, Inc. Page 1-1JUNOS Lab GuideV1.0, 02/15/08----------------------------------------------------------Lab 1: Product Sales/Positioning Overview Background:The locally popular Willson’s Sports Equipment Company is opening a larger office. The company is emerging from a modest storefront location selling a large variety of equipment while also offering an assortment of their own professional training and clothing. They have a website with an online store that is managed by a neighborhood whiz-kid and hosted by a local provider. The new office will have several computers requiring Internet access.Primary Topics:Enterprise router platforms Describe Juniper Networks platforms targeted at the customer edge and enterprise markets Describe the design architecture of Juniper Networks routers List model Specifics JES architecture and advantages Show the leverage of JunOS Show the Leverage of ScreeOS security Packet Flow Show the flow of a packet using the flow module JunOS vs. JES Compare the differences of JunOS and JES--JUNOS Lab Guide (Section 1) E-VRC-00xx-ER-08-A01 Juniper Networks, Inc. Page 1-2JUNOS Lab GuideV1.0, 02/15/08----------------------------------------------------------Lab 1-1: Enterprise Routing Platforms Customer Edge and Enterprise markets.JunOS Enhanced Services is the first operating system that leverages the distinct strengths of JunOS feature-rich routing software and ScreenOS feature-rich security software. It enables the extension of the flow-based firewall functionalities to the boundaries of branch-office networks, positioning enterprise customers with the unique ability to protect their networks at their boundaries on a single platform, rather than using multiple platforms, allowing malicious traffic into the demilitarized zone (DMZ).JUNOS Lab Guide (Section 1) E-VRC-00xx-ER-08-A01 Juniper Networks, Inc. Page 1-3JUNOS Lab GuideV1.0, 02/15/08----------------------------------------------------------Architecture -Control PlaneJunOS Enhanced Services Control PlaneJunOS Enhanced Services deploys a combination of JunOS software and some features of ScreenOS software for its control plane, including the network security daemon (NSD), the VPN daemon, the authentication daemon, and a Dynamic Host Configuration Protocol (DHCP) client/server/relay. The network security daemon includes policy-based packet forwarding, interfaces and security zones interrelationship, the ability to perform NAT, and so on.JUNOS Lab Guide (Section 1) E-VRC-00xx-ER-08-A01 Juniper Networks, Inc. Page 1-4JUNOS Lab GuideV1.0, 02/15/08----------------------------------------------------------Architecture -Data or Forwarding PlaneJunOS Enhanced Services Data PlaneThe JunOS Enhanced Services data plane consists of JunOS packet handling modules compounded with a ScreenOS-like flow engine and session management. Intelligent packet processing ensures that one single thread exists for packet flow processing associated with a single flow. Real-time daemons enable JunOS Enhanced Services software to perform flowbased packet forwarding.JUNOS Lab Guide (Section 1) E-VRC-00xx-ER-08-A01 Juniper Networks, Inc. Page 1-5JUNOS Lab GuideV1.0, 02/15/08----------------------------------------------------------Model SpecificsJunOS Enhanced Services software runs on J-series routers, including the J6350, J4350, J2320, and J2350 platforms.JUNOS Lab Guide (Section 1) E-VRC-00xx-ER-08-A01 Juniper Networks, Inc. Page 1-6JUNOS Lab GuideV1.0, 02/15/08----------------------------------------------------------Lab 1-2: Architecture Approach and AdvantagesThe approach used in J-series routers is multifold. It consists of maintaining control and data planes separation and leveraging the industry-proven JunOS software. J-series routers, unlike the M-series and the T-series routers do not depend on specialized application-specific integrated circuit (ASIC) hardware to implement their main forwarding functionality. J-series routers maintain predictable forwarding performance by using a real-time operating system, which ensures that packet forwarding processes are given the highest priority level. The Tseries router maintains this forwarding performance even when you enable services. J-series devices deploy the existing RE code used on the M/T-series routers, which includes the deployment of the existing daemons, and layer 2 protocols, and support for interfaces types such as ISDN, E1, T1, T3, and Ethernet. This simplifies and accelerates the software development of new features.Strengths taken from JunOS:1. 2. 3. 4. 5. Modular architecture Clear separation of control and Data plane From the J series: Layer 2 Protocols Interfaces: ISDN, E1, T1, T3, Ethernet, etc JunOS CLI: hierarchical, 2-phase commitJunOS Enhanced Services leverages the strength of the JunOS control plane, thereby benefitting from a full suite of JunOS features. The features include an XML-based management interface, industry-proven routing and network management protocols, qualityof-service (QoS) features, the Multilink Point-to-Point Protocol (MLPPP), stateless packet filtering, and so on.Strengths taken from Screen OS:1. 2. 3. Flow based forwarding Framework for security around zones and policy Features around NAT, VPN, Screens, …JunOS Enhanced Services leverages a strong security portfolio from ScreenOS software. That portfolio includes flow-based routing, a concept of security zones, and simpler configurations of stateful firewall, NAT, and secure tunnels (that is, IPSec).JUNOS Lab Guide (Section 1) E-VRC-00xx-ER-08-A01 Juniper Networks, Inc. Page 1-7JUNOS Lab GuideV1.0, 02/15/08----------------------------------------------------------Lab 1-3: Packet Flow When a packet enters the device’s interface, the system queues the packet, if necessary. If the ingress interface has an input filter, the packet transits the input filter. Note that the applied input filter is stateless (that is, packet based) and not flow based. If the ingress interface has an input policer, the packet transits the input policer. Again, note that the applied policer is packet based, not flow based. Next, the packet transits the ScreenOS-like flow module, which includes session management and the mapping and unmapping of a packet format to a session. The pre-created session includes forwarding lookup information, which is where the system maintains the egress interface and encapsulation data.JUNOS Lab Guide (Section 1) E-VRC-00xx-ER-08-A01 Juniper Networks, Inc. Page 1-8JUNOS Lab GuideV1.0, 02/15/08---------------------------------------------------------- If the packet matches a session, all the packets of a flow first and consecutive use the Fast Path to process the packet forwarding. Once the packet is forwarded to the egress interface and the interface has an output filter, the system applies the filter to the packet. Similar to the ingress directions, the output filter is stateless (that is, packet based). If the egress interface has an output shaper, the system applies the shaper to the packet. The output shaper is packet based, not flow based. Now the packet is ready for Layer 2 encapsulation; finally, the packet enters an output queue, if necessary. If a packet does not match a session, it is checked to see if any gates have been created that can be referenced for session creation. A gate is a logical representation of a policy decision that has been installed on the device. This typically involves parameters such as the protocol and application used as well as the age, incoming zones and source and destination addresses and ports. If a gate exists, the information from the gate is used to create a session and then all the packets of a flow first and consecutive use the Fast Path to process the packet forwarding. If a gate does not exist, the packet is matched against any policies that may have been written for it. If the resulting action of this policy does not allow the packet to continue it is discarded. If the policy allows the packet to continue, or if policy is not specifically written for the packet, it is matched against a route lookup. If a route exists for the packet it is passed on to the next step, otherwise it is discarded. Next we see if any services will require an ALG (Application Level Gateway). If they do, we will inspect the packets’ IP/port, NAT or other match criteria based on the application and assign a gate to match. Whether the service does not require an ALG, or if we created a gate for the ALG, the next step is to create the session. We create this session based on routing policies etc and then implement session management parameters such as the session hash table and we give the session a default timeout. If the session becomes stale (not used in the time allotted by the default timeout), resources are released for further use. Finally, all the packets of a flow first and consecutive use the Fast Path to process the packet forwarding JUNOS Lab Guide (Section 1) E-VRC-00xx-ER-08-A01 Juniper Networks, Inc. Page 1-9JUNOS Lab GuideV1.0, 02/15/08----------------------------------------------------------Lab 1-4: JunOS VS JES JunOS CLI No ‘get’ command, use “show” No “unset command”, use “delete” You must issue a “COMMIT” for configuration changes to be activeInterfaces None of the interfaces are bound to zones by default. Interfaces can have IP addresses without zone assignment Loopback interfaces cannot be used for NAT and VPN configuration No Manage-IP configurationZones No default zones existIPSec No ‘compatible’ proposal for P1 and P2 Tunnel interface “tunnel.x” is secure tunnel interface “st0.x” Huge differences in debuggingSystem limits No artificial limit on configured VPN’s, address book entries, policies etc. Good for dynamic configurations Bad to determine overall system capacitiesJUNOS Lab Guide (Section 1) E-VRC-00xx-ER-08-A01 Juniper Networks, Inc.Page 1-10。
JuniperBras培训
7
国脉中讯 PPPoE帧头格式(RFC 2516)
版本
类型 代码
会话ID
长度域
净载荷
4 bit 4 bit
1 Byte
2 Byte
2 Byte
Up to 1494 Byte
版本：PPPOE数据报文最开始的4位为版本域，协议中给出了 明确的规定，这个域的内容填充0x0 类型：紧接在版本域后的4位是类型域，协议中同样规定，这 个域的内容填充为0x01。 代码：对于PPPOE 的不同阶段这个域内的内容也是不一样的 会话ID：当访问集中器还未分配唯一的会话ID给用户主机的话， 则该域内的内容必须填充为0x0000，一旦主机获取了会话ID后， 那么在后续的所有报文中该域必须填充那个唯一的会话ID值。 长度：用来指示PPPOE数据报文中净载荷的长度。
8
国脉中讯
PPPoE帧结构分析Leabharlann Ethernet Frame
Ethernet Frame payload 46~1500 Byte
6 6 2B
4b 4b 8b
16 b
16 b
PPPOE max MTU 1494 Byte
4
DA SA Type
VER TYPE CODE SESSION_I LENGTH
- 1、下载文档前请自行甄别文档内容的完整性，平台不提供额外的编辑、内容补充、找答案等附加服务。
- 2、"仅部分预览"的文档,不可在线预览部分如存在完整性等问题,可反馈申请退款(可完整预览的文档不适用该条件!)。
- 3、如文档侵犯您的权益，请联系客服反馈,我们会尽快为您处理(人工客服工作时间：9:00-18:30)。
Configuration>Admin>Administrators
PPT文档演模板
juniper技术培训
更改根管理员用户名/密码
PPT文档演模板
Configuration>Admin>Administrators
set admin name <name> set admin password <password>
Network>Interfaces>Edit
set interface <name> manage-ip <address) ns208> set interface e1 manage-ip 1.1.1.250
PPT文档演模板
juniper技术培训
校验接口配置 - WebUI
Network>Interfaces>Edit
• 透明模式允许在2层安全域之间通过策略控制流量
PPT文档演模板
juniper技术培训
透明模式的作用
10.1.0.0/16
A
V1-Trust
10.100.1.0/16
C
B
B B
D V1-DMZ
E
V1-Untrust
10.200.1.0/16
• 可以简单快速的部署防火墙到现有网络中
– 不需要改变现有网络拓扑结构
get
get system information
ping
ping other host
reset
reset system
save
save command
ห้องสมุดไป่ตู้
set
configure system parameters
trace-route trace route
unset
unconfigure system parameters
命令行接口（CLI）的功能
• 打开一个终端会话; 使用默认账号登陆
– login: netscreen password: netscreen
• 登陆后默认就是命令行接口（CLI）模式
– 使用上、下箭头可调用以前使用过的命令 – 使用 CTL-A 可将光标移动到当前命令的前端 – 使用CTL-E可将光标移动到当前命令的末端 – 使用左右箭头可自由移动命令行中的光标 – 使用 TAB 可快速自动完成命令输入 – 简单易用帮助功能
• 输入 ?以后, 将显示两列 信息:
– 左列显示命令的名称
– 右列显示命令的解释
PPT文档演模板
juniper技术培训
显示防火墙状态信息 - CLI
ns208-> get system Product Name: NS208 Serial Number: 0043042002000034, Control Number: 00000000 Hardware Version: 0110(0)-(11), FPGA checksum: 00000000, VLAN1 IP (0.0.0.0) Software Version: 5.0.0.0, Type: Firewall+VPN Base Mac: 0010.db1d.1c30 File Name: n200-LAS0z0ad, Checksum: 00000000
管理访问 – 配置概述
• 为IP连接配置接口
– 分配地址 – 选择管理服务 – 管理IP地址 (可选)
• 更改根管理员密码 • 创建系统管理员 • 管理选项
– 超时 – 管理IP地址
PPT文档演模板
juniper技术培训
配置安全域/接口 - WebUI
PPT文档演模板
Network > Interfaces (edit)
– 所需的最小配置 (ie浏览器. 和一个 IP 地址) – PC 可以配置一个和防火墙相同子网的IP地址来访问防火墙的WEBUI – 通过用户名密码访问
PPT文档演模板
juniper技术培训
主页 - WebUI
PPT文档演模板
• 主页显示的信息与 get system 输出的信息类似
juniper技术培训
Date 04/15/2003 22:06:53, Daylight Saving Time enabled
The Network Time Protocol is Disabled
• 在 CLI中, get Up 2 hours 31 minutes 14 seconds Since 15 Apr 2003 19:35:39
--- more ---
– Software version – Operating mode – Interface status – Interface address – Management addresses
PPT文档演模板
juniper技术培训
图形界面 - WebUI
• NetScreen 可以提供web图形界面的管理接口给系统管理员
PPT文档演模板
juniper技术培训
PPT文档演模板
系统管理
juniper技术培训
基本原理-接口
PPT文档演模板
juniper技术培训
基本原理-子接口
PPT文档演模板
juniper技术培训
基本原理-物理接口
PPT文档演模板
juniper技术培训
建立Console 口的连接
NetScreen Device
Interface ethernet1: number 0, if_info 0, if_index 0, mode nat link up, phy-link up/full-duplex vsys Root, zone Trust, vr trust-vr dhcp disabled *ip 1.1.1.1/24 mac 0010.db1d.1c30 *manage ip 1.1.1.1, mac 0010.db1d.1c30
juniper技术培训
选择管理服务 – WebUI
• 默认状态下防火墙安全域的管理服务配置
– Trust安全域: 所有服务打开 – 其他安全域: 所有服务都关闭
Network>Interfaces>Edit
PPT文档演模板
juniper技术培训
管理IP地址
• 管理IP可以单独定义，默认采用接口IP地址
• 组网功能
– 工作模式 – 路由协议(OSPF, RIP) – 组播 – PPPoE – DHCP Client/Server, Relay –…
PPT文档演模板
juniper技术培训
NetScreen 安全架构
PPT文档演模板
juniper技术培训
安全体系的构成
Policy Check A -> C
– V1-Trust – V1-Untrust – V1-DMZ
• User-defined
– Layer-2 (L2) zones
• 通过CONSOLE口来设置系统超时
– 默认值是10分钟 – 如果要关闭次功能，则将其设置为0
set console timeout <number of minutes> ns208> set console timeout 5
PPT文档演模板
juniper技术培训
超时设置 - WebUI
Configuration>Admin>Management
Total Device Resets: 0
system命令可以
System in NAT/route mode.
Use interface IP, Config Port: 80 User Name: netscreen
提供一些关于防火墙系统有价值 的信息:
– System serial number
R.T.
VSYS
NetScreen Device
R.T.
E1 E2
Zone A
E3 E4
Zone B
E5 E6
Zone C
E7 E8
Zone D
Virtual Router 1
Virtual Router 2
Interfaces Zones Policy
Virtual Router Forwarding Table
PPT文档演模板
set admin auth timeout <minutes>
juniper技术培训
管理IP地址
• 为了提供更高的安全保障，NETSCREEN设备能够通过设置 Manage-ip来允许某些特定的地址来管理防火墙
• 通过 ‘Permitted IP’ 来定义可信的管理地址 • ‘Permitted IP ’地址内容包括一个有点和十位数值的掩码
Console Port
• 通过Console口可以直接连接和管理NetScreen 设备
• 通过Console口连接的几点好处
– 安全专用的物理端口连接 – 完成配置不需要连接网络电缆 – 不需要IP地址 – 能够查看系统引导信息 – 能够实时查看DEBUG或SNOOP的输出信息
PPT文档演模板
juniper技术培训
PPT文档演模板
运行模式
juniper技术培训
PPT文档演模板
1. 透明模式
juniper技术培训
什么是透明模式?
zone V1-Trust
E1
E3
E2
zone V1-DMZ
zone V1-Untrust
10.1.0.0/16
• 防火墙接口工作在2层模式下，类似于交换机，桥接模式