培训资料Juniper网络安全防火墙设备售前培训v
Juniper防火墙产品培训+#
市场领导地位-Gartnet 2004年报告
Juniper #1 out of 18 vendors
Gartner Magic Quadran报 告是针对IT特定细分市场 上的厂商实力所进行的极 具声望的评价，它从各个 方面来全方位评价厂商， 包括产品线的完整度和功 能、技术实力、创新性、 成功实施情 况、满足客户 现有和未来需求的能力， 以及包括服务和支持在内 的执行能力、市场 份额、 财务健康状况和其它关键 指标
• 广电总局国家骨干网
•
全国骨干网，50%以上设备
市场机会，约超过70 亿美元
• 安全市场上估计存在超过 70 亿美元的机会 • 包括 IPS、SSL VPN、路由功能和防火墙 VPN • 防火墙 VPN 仍然是安全市场最大的组成部分 • 我们的强项是防火墙/VPN产品 • 继续推动安全类产品的发展
先进的硬件设计通用结构的处理?数据在几个非优化的接口传送?每个api引入安全风险?处理的延迟导致无法预测的行为?数据通道无法优化pcappliancespseudoappliancesosvpncoprocessorcpurambusioinoutapplications专用的安全处理?基于流的线性的数据包处理?每个处理模块被优化?优化的应用和硬件用于安全处理和性能gigascreenasiccpuhighspeedbackplaneinoutramionetscreenadvancedarchitecturesecurityspecificrealtimeosintegratedsecurityapplicationsasicjuniper防火墙产品培训149152020screenos特点?安全性专用的实时操作系统?完全设计用于执行计算密集型安全功能而不会影响吞吐量?与硬件设备安全操作系统及安全应用紧密集成?状态协议级智能?集成深层检测防病毒和web过滤等?专用操作系统减少补丁和测试?所有防火墙ipsecvpn系列产品上部署相同的安全性专用操作系统juniper防火墙产品培训159152020screenosipv6?为状态防火墙和ipsecvpn提供生产级的商用ipv6支持?支持双堆栈架构使客户能够在一个设备上同时支持并保护ipv4与ipv6网络?支持所有主要的ipv6迁移机制包括ipv4ipv6和ipv6ipv4迁移ipv6隧道中的ipv4和ipv4隧道中的ipv6?以及面向ipv6的natpt?支持ripng动态路由协议允许客户提高生产网络中的ipv6部署的可扩展性?防止ipv6网络遭受synflood攻击和其他攻击使客户能够抵御从ipv4或ipv6网络中发起的拒绝服务攻击juniper防火墙产品培训169152020juniper防火墙产品线ns5gtns2550nshscns5400isg2000isg1000ssg520mssg550mnsseriesisgseriesssgseriesns5200ns500ns208ns204ssg20ssg5ssg140ssg350ssg320juniper防火墙产品培训179152020议程?juniper简介?juniper防火墙vpn产品线?juniperisg集成安全网关系列?juniperssg安全业务网关系列?产品对比?案例分析juniper防火墙
juniper技术培训
Configuration>Admin>Administrators
PPT文档演模板
juniper技术培训
更改根管理员用户名/密码
PPT文档演模板
Configuration>Admin>Administrators
set admin name <name> set admin password <password>
Network>Interfaces>Edit
set interface <name> manage-ip <address) ns208> set interface e1 manage-ip 1.1.1.250
PPT文档演模板
juniper技术培训
校验接口配置 - WebUI
Network>Interfaces>Edit
• 透明模式允许在2层安全域之间通过策略控制流量
PPT文档演模板
juniper技术培训
透明模式的作用
10.1.0.0/16
A
V1-Trust
10.100.1.0/16
C
B
B B
D V1-DMZ
E
V1-Untrust
10.200.1.0/16
• 可以简单快速的部署防火墙到现有网络中
– 不需要改变现有网络拓扑结构
get
get system information
ping
ping other host
reset
reset system
save
save command
ห้องสมุดไป่ตู้
set
configure system parameters
juniper防火墙培训PPT--JNSA-SSC对比sec2
Copyright ©2004 Juniper网络公司，Inc.
Proprietary and Confidential
3
安全市场格局 – 主要产品系列定位
2003年下半年企业防火墙 Gartner Magic Quadrant Research Note：M-22-5175，R. Stiennon，2004年4月21日
• SonicWALL
• Fortinet
Copyright ©2004 Juniper网络公司，Inc.
Proprietary and Confidential
6
如何针对Cisco进行全面定位
卖点
• 使购买决策成为安全决策
• 向安全人员销售－让他们帮助说服管理层
Cisco Systems
Cisco PIX 防火墙
他们怎么说/做：
PIX • FWSM • IOS路由器防火墙
• PIX是带集成 VPN的专用防火墙，
• 通过PCI总线卡实现3DES加速 PIX 535
成本
PIX 525 PIX 515E
PIX 506E PIX 501
• 可通过―Fix Up” (ALG)很好地支持复杂 的协议 • 通过H.323 “可随时支持VoIP‖ ，体积 小，支持SIP • PIX 525是低价位的GigE基本产品 (330mbps 防火墙)
• PIX • FWSM • IOS路由器防火墙
PIX 防火墙 – 从低端到高端的独立设备 • 优点 – 很吸引人的产品规范，‖足够好的‖防火
•
墙，防火墙/VPN 缺点 – 在负载情况下性能会降低，较弱的VPN， 管理，不能提供应用层攻击防护功能
JUNIPER培训资料-产品篇
• 无源背板 • 分布式包转发的系统架构 • 冗余电源以及风扇系统
物理参数
• 高度: 8RU (大约1/6机架), 深度: <800mm深
系统容量
• 整机最大双工达到1.44T bps的转发性能
与MX960的通用硬件组件
• 相同的RE/SCB板卡 • 相同的DPC/MPC板卡
Copyright © 2012 Juniper Networks, Inc.
Proprietary and Confidential
‹#›
MX960系统组件如何连接?
A-PEM3 A-PEM2 A-PEM1 A-PEM0 A-FAN0 A-FAN1 A-FPB0
A-RE0 A-SCB0
业务槽位上线/下线按钮
Copyright © 2012 Juniper Networks, Inc.
Proprietary and Confidential
‹#›
MX960 电源参数
系统设计2+2 电源冗余 电源配置
• MX960的机框分为2个供电区域,每个区域需要1个电源模块 -> 2个电源模块 是非冗余的配置 • 如果要冗余, 则每个供电区域需要增加第2个电源模块 • 供电区域1: 电源模块 0 & 2 供电给 DPC 6到11, SCB 1和 2以及下部风扇托 盘 • 供电区域2:电源模块 1 & 3供电给DPC 0到5, SCB 0, 以及上部风扇托盘
A-RE1 A-SCB1 A-SCB21
A-DPC0
A-DPC11
A-DPC1
A-DPC10
A-DPC2
A-DPC9
A-DPC3
juniper防火墙培训(SRX系列)
Config），在执行commit后配置模式下可通过
run show config命令查看当前有效配置 （Active config）。此外可通过执行show | compare比对候选配置和有效配置的差异。
1
4
SRX可对模块化配置进行功能关闭与激活，如执 行deactivate 命令可使相关配置不生效，并可通
用节点id）
指定Control Port 指定Fabric Link Port 配置Redundancy Group 每个机箱的个性化配置 地址等） 配置Redundant Ethernet Interface （类似NSRP的Redundant冗余接口） 配置Interface Monitoring 依据）
同类产品相比，SRX3000系列还可实现最大的I/O端口密度。每一个SRX3000业务网关均可
以安装一个或多个输入/输出卡(IOC)，每一个IOC可以支持16个千兆位接口（16个铜线或光 纤千兆以太网），或者20个千兆位接口（2个万兆XFP以太网）。凭借能够添加更多IOC的出 色灵活性，SRX3000业务网关系列可支持在接口和处理能力之间实现最佳平衡。（注：要想 实现正常的系统功能，至少需要1个NPC和1个SPC）
JUNOS作为电信级产品的精髓是Juniper真正成功的基石，它让企业级产品同样具有电
信级的不间断运营特性，更好的安全性和管理特性，JUNOS软件创新的分布式架构为高性 能、高可用、高可扩展的网络奠定了基础。基于NP架构的SRX系列产品产品同时提供性能优 异的防火墙、NAT、IPSEC、IPS、UTM等全系列安全功能，其安全功能主要来源于已被广
root@srx5800b> request chassis cluster failover reset redundancy-group 1 c) 查看cluster interface
Juniper产品培训
交换控制板（ Switching Control Board ）
不同路由器的型号使用不同的控制板的命名方式:
M20—系统交换板 (System Switching Board) M160—交换和转发模块 (Switching and Forwarding Module) M10/M7i/M10i/M120—转发引擎板 (Forwarding Engine
M5/M7i/M10/M10i/M20的PIC插槽号从右至左进行编号 M120/M160/T640/T1600的PIC插槽号是从上至下 PIC端口号是以0为起始号.PIC上对端口进行了标识,端口号的编
PIC port Numbers
号方式根据PIC的不同而不同
北京千禧维讯科技有限公司
Page 12
标签 MASTE R OK
颜色 蓝色 绿色
状态 持续 持续
描述 SCG处于主用状态 SCG在线，并且工作正常
FAIL
琥珀色
持续
SCG发生故障
北京千禧维讯科技有限公司
Page 18
Craft interface
可以通过Craft interface 查看运行状态以及故障诊断的信息 ，并且执行许多系统控制功能。 Craft interface 是可以热 插拔的部件 Craft interface包括如下： 告警LED和告警取消/灯光测试按钮 LCD和导航按钮 主机子系统 SIB LED FPC LED FPC oneline/offline 按钮
北京千禧维讯科技有限公司
Page 25
议程
硬件体系介绍
产品系列介绍
板卡插拔/硬件更换ห้องสมุดไป่ตู้
Juniper_防火墙应用培训资料
3
1、安全防护功能的实现
• Juniper防火墙可以防止31类攻击行为。 • 在防火墙中提供一个独立的位置对安全防护的设 置进行细化设置。 • 具体的安全设置会体现在对应的安全域中。 • 防火墙作为网络安全设备，可以防止一部分的网 络攻击，主要是防护基于TCP/IP协议的二层、三 层、四层的攻击行为的防止。 • 注意：目前所有的防火墙设备对DDOS的攻击行 为的防护效果欠佳。 • 设置的位置为：SCREENING>SCREEN
22
2、动态VPN的拓扑图
23
2、动态VPN的设置
24
2、动态VPN的设置
25
2、C/S方式的VPN应用
• 基于客户端软件和中心端防火墙方式的 VPN应用。 • 一般建议在临时性外出的移动用户中使 用，VPN连接后，数据的流量一般不大。 • 需要注意的地方：NAT穿越的选择。
26
2、C/S方式的拓扑图
10
2、静态VPN连接的设置
• 环境：位于两地的两个网络通过防火墙实 现VPN应用。 • 位于两地的两台防火墙的外连端口具有固 定的公共IP地址。
11
2、静态VPN的拓扑图
12
2、VPN设置阶段一（1）基本
13
2、VPN设置阶段一（2）高级
14
2、VPN设置阶段一说明
• • • • • • • • • 阶段一的名称定义. 阶段一的VPN网关指向（指向IP，指向用户）. 阶段一的公共密钥. *(C/S方式)本地ID. 高级部分： 加密算法、认证算法、加密长度。 VPN的模式：主模式、主动模式。 NAT穿越的选择。 UDP的保持时间
15
2、VPN设置阶段二（1）基本
16
2、VPN设置阶段二（2）高级
Juniper路由器内部培训资料-JUNOS_Lab_Guide_Module1_Sec7
V1.0, 02/15/08 -----------------------------------------------------------Lab 7-1 TroubleshootingObjectivesThe objective of this lab it to provide you with a series of outputs you can use to troubleshoot and diagnose issues that may arise from the configuration of policies, protocols, firewalls, and enhanced services. This module is not intended to be an all inclusive document but rather a reference to help you ensure that your configurations meet the assignments in the previous labs. It is understood that time may not permit you to use all of these commands. As mentioned in module one, however, it is imperative that you verify correct operation of your configuration therefore we are including some of the more common outputs used. Assignment:Use the command line interface to issue commands that verify the correct operation of your configurations from all labs done in this course. Specifically, verify correct operation of the following:-Interfaces-Protocols-OSPF-RIP-Policy-Firewall-Stateful firewall-Screen OptionsV1.0, 02/15/08 -----------------------------------------------------------Lab 7-2 InterfacesUse the show interfaces terse command to display a terse listing of all interfaces installed in the router along with their administrative and link-layer status.Above we can see the status of all the interfaces on our router. It helps to have an understanding of what the different Admin and Link status may indicate.When an interface is administratively disabled, the physical interface has an Admin status of down and a Link status of up, and the logical interface has an admin status of up and a link status of down. The physical interface has a link status of up because the physical link is healthy (no alarms). The logical interface has a link status of down because the data link layer cannot be established end to end.V1.0, 02/15/08 -----------------------------------------------------------When an interface is not administratively disabled and the data-link layer between the local router and the remote router is not functioning, the physical interface has an Admin status of up and a Link status of up while the logical interface has an admin status of up and a link status of down. The physical interface has a link status of up because the physical link is healthy (no alarms). The logical interface has a link status of down because the data-link layer cannot be established end to end.If we see that our interface is not listed as UP/UP, but rather Admin Up but Link down, we can troubleshoot inconsistencies in the configuration or settings on both sides of the link. The show interfaces (interface name) <extensive, brief, detail, statistics> output will show us specific information about settings on the interface as well as drops, errors, alarms, flags, and hardware specific media alarms. The following are some examples of these outputs.V1.0, 02/15/08 -----------------------------------------------------------The output of a show interfaces command displays the device-level configuration and provides additional information about the device’s operation through various flags. These flags include the following:-Down: Device was administratively disabled.-Hear-Own-Xmit: Device will hear its own transmissions.-Link-Layer-Down: The link-layer protocol failed to successfully connect with the remote endpoint.-Loopback: Device is in physical loopback.-Loop-Detected: The link layer received frames that it sent and suspects a physical loopback.-No-Carrier: Where the media supports carrier recognition, this indicates that no carrier is currently seen.-No-Multicast: Device does not support multicast traffic.-Present: Device is physically present and recognized.-Promiscuous: Device is in promiscuous mode and sees frames addressed to all physical addresses on the medium.V1.0, 02/15/08 ------------------------------------------------------------Quench: Device is quenched because it overran its output buffer.-Recv-All-Multicasts: No multicast filtering (multicast promiscuous).-Running: Device is active and enabled.The status of the interface is communicated with one or more flags. These flags include the following:-Admin-Test: Interface is in test mode, which means that some sanity checking, such as loop detection, is disabled.-Disabled: Interface is administratively disabled.-Hardware-Down: Interface is nonfunctional or incorrectly connected.-Link-Layer-Down: Interface keepalives indicate that the link is incomplete.-No-Multicast: Interface does not support multicast traffic.-Point-To-Point: Interface is point to point.-Promiscuous: Interface is in promiscuous mode and sees frames addressed to all physical addresses.-Recv-All-Multicasts: No multicast filtering (multicast promiscuous).-SNMP-Traps: SNMP traps are enabled.-Up: Interface is enabled and operational.The operational status of the device’s link layer protocol is also indicated with flags. These flags include the following:-Give-Up: Link protocol does not continue to retry to connect after repeated failures.-Keepalives: Link protocol keepalives are enabled.-Loose-LCP: PPP does not use LCP to indicate whether the link protocol is up.-Loose-LMI: Frame Relay will not use LMI to indicate whether the link protocol is up.-Loose-NCP: PPP does not use NCP to indicate whether the device is up.-No-Keepalives: Link protocol keepalives are disabled.The output also summarizes the device-level traffic load, which is displayed in both bits and packets per second, as well as any alarms that might be active. The final portion of the command output displays the configuration and status of each logical unit defined on that deviceV1.0, 02/15/08 -----------------------------------------------------------V1.0, 02/15/08 -----------------------------------------------------------V1.0, 02/15/08 -----------------------------------------------------------Now we look at the show interfaces extensive command. In the output above we have narrowed our output to show the section for traffic statistics, and input and output errors. The following is a list of some of the fields displayed here and a brief explanation of what some of the non-obvious ones mean.Input-Errors: Displays the sum of the incoming frame aborts and frame check sequence (FCS) errors.-Policed discards: Displays the frames that the incoming packet match code discarded because they were not recognized or of interest. Usually, this field reports protocolsthat JUNOS software does not handle, such as Cisco Discovery Protocol(CDP)/Spanning Tree Protocol (STP), or any protocol type JUNOS software does notunderstand. (On an Ethernet network, numerous possibilities exist.) -L3 incompletes: This counter increments when the incoming packet fails Layer 3 (usually IPv4) checks of the header. For example, a frame with less than 20 bytes ofavailable IP header would be discarded, and this counter would increment.-L2 channel errors: This counter increments when the software cannot find a valid logical interface (such as e3-1/2/3.0) for an incoming frame.-L2 mismatch timeouts: Displays the count of malformed or short packets that cause the incoming packet handler to discard the frame as unreadable.-SRAM errors: This counter increments when a hardware error occurs in the SRAM on the PIC. The value in this field should always be 0. If it increments, the PIC ismalfunctioning.Output-HS link CRC errors: Displays the count of errors on the high-speed links between the ASICs responsible for handling the router interfaces.-Carrier transitions: Displays the number of times the interface has gone from down to up. This number should not increment quickly, increasing only when the cable isunplugged, the far-end system is powered down and up, or a similar problem occurs.If it does increment quickly (perhaps every 10 seconds), then either the transmission line, the far-end system, or the PIC is broken.-Errors: Displays the sum of the outgoing frame aborts and FCS errors.-Drops: Displays the number of packets dropped by the output queue of the I/O Manager ASIC. If the interface is saturated, this number increments once for everypacket that is dropped by the ASIC’s RED mechanism.-Aged packets: Displays the number of packets that remained in shared packet SDRAM for so long that the system automatically purged them. The value in this field shouldnever increment. If it does, it is most likely a software bug or possibly malfunctioning hardware.V1.0, 02/15/08 -----------------------------------------------------------Lab 7-3 ProtocolsThe first protocol that we configured in our labs was OSPF. Lets take a look at some outputs that will help us determine the overall health of OSPF. In doing this we will look to see if the interfaces are configured for OSPF, if we are seeing adjacencies, and if we are learning our routes.V1.0, 02/15/08 -----------------------------------------------------------The show ospf route command display those routes in the unicast routing table, inet.0, that were installed by OSPF. The use of additional keywords allows you to display only OSPF routes learned by specific LSA types. The output fields of the show ospf route command are the following:-Prefix: Displays the destination of the route.-Route/Path Type: Displays how the route was learned:-ABR: Route to area border router;-ASBR: Route to AS border router;-Ext: External router;-Inter: Interarea route;-Intra: Intra-area route; or-Network: Network router.-Metric: Displays the route's metric value.-Next hop i/f: Displays the interface through which the route's next hop is reachable.-Next hop addr: Displays the address of the next hop.-area: (detail output only) Displays the area ID of the route.-options: (detail output only) Displays the option bits from the LSA.-origin: (detail output only) Displays the router from which the route was learned.V1.0, 02/15/08 -----------------------------------------------------------The show ospf interface command displays information relating to the interfaces on which the respective protocol is configured to run. In the case of OSPF, the output fields are the following:-Interface: Displays the name of the interface running OSPF.-State: Displays the state of the interface. It can be BDR, Down, DR, DRother, Loop, PtToPt, or Waiting.-Area: Displays the number of the area in which the interface is located.-DR ID: Displays the address of the area's DR.-BDR ID: Displays the BDR for a particular subnet.-Nbrs: Displays the number of neighbors on this interface.V1.0, 02/15/08 ------------------------------------------------------------Type (detail and extensive output only): Displays the type of interface. It can be LAN, NBMA, P2MP, P2P, or Virtual.-Address (detail and extensive output only): Displays the IP address of the neighbor.-Mask (detail and extensive output only): Displays the mask of the interface.-MTU (detail and extensive output only): Displays the interface's MTU.-Cost (detail and extensive output only): Displays the interface's cost (metric).-DR addr (detail and extensive output only): Displays the address of the DR.-BDR addr: Displays the address of the BDR.-Adj count (detail and extensive output only): Displays the number of adjacent neighbors.-Flood list (extensive output only): Displays the list of LSAs pending flood on this interface.-Ack list (extensive output only): Displays the list of pending acknowledgments on this interface.-Descriptor list (extensive output only): Displays the list of packet descriptors.-Dead (detail and extensive output only): Displays the configured value for the dead timer.-Hello (detail and extensive output only): Displays the configured value for the hello timer.-ReXmit (detail and extensive output only): Displays the configured value for the retransmit timer.-OSPF area type (detail and extensive output only): Displays the type of OSPF area, which can be Stub, Not Stub, or NSSA.V1.0, 02/15/08 -----------------------------------------------------------Next we can check to see if the interfaces we have configured for OSPF are forming adjacencies. The show ospf neighbor command displays adjacency status for their respective protocols. In the case of OSPF, the output fields include the following: -Address: Displays the address of the neighbor.-Intf: Displays the interface through which the neighbor is reachable.-State: Displays the state of the neighbor, which can be Attempt, Down, Exchange, ExStart, Full, Init, Loading, or 2Way.-ID: Displays the RID of the neighbor.-Pri: Displays the priority of the neighbor to become the DR.-Dead: Displays the number of seconds until the neighbor becomes unreachable.-area (detail and extensive output only): Displays the area in which the neighbor is located.-opt (detail and extensive output only): Displays the option bits from the neighbor.-DR (detail and extensive output only): Displays the address of the DR.-BDR (detail and extensive output only): Displays the address of the BDR.-Up (detail and extensive output only): Displays the length of time since the neighbor came up.-adjacent (detail and extensive output only): Displays the length of time since the adjacency with the neighbor was established.V1.0, 02/15/08 -----------------------------------------------------------Now that we have taken a look at OSPF, let’s take a brief look at some of the commands we can use to verify operation of the RIP protocol.This output displays information about RIP neighbors. This is a list of the fields and what they mean.-Neighbor: Name of RIP neighbor.-State: State of the connection: Up or Dn (Down).-Source Address: Source Address.-Destination Address: Destination Address.-Send Mode: Send options: broadcast, multicast, none, or version 1.-Receive Mode: Type of packets to accept: both, none, version1 or version2.-In Met: Metric added to incoming routes when advertising into RIP routes that were learned from other protocols.V1.0, 02/15/08 -----------------------------------------------------------This output above displays the route entries in the routing table that were learned from protocols RIP. A description of some of the fields follows.-active: Number of routes that are active.-holddown: Number of routes that are in the hold-down state prior to being declared inactive.-hidden: Number of routes not used because of routing policy.-+: A plus sign before [protocol/preference] indicates the active route, which is the route installed from the routing table into the forwarding table.--: A hyphen before [protocol/preference] indicates the last active route.-*: An asterisk before [protocol/preference] indicates that the route is both the active and the last active route. An asterisk before a ‘to’ line indicates the best subpath to the route.V1.0, 02/15/08 -----------------------------------------------------------To see what RIP routes are being sent or received on the router issue the show route advertising-protocol rip<egress interface address> and show route receive-protocol rip<remote advertising interface address> commands. The field definitions follow:-active: Number of routes that are active.-holddown: Number of routes that are in the hold-down state prior to being declared inactive.-hidden: Number of routes not used because of routing policy.-+: A plus sign before [protocol/preference] indicates the active route, which is the route installed from the routing table into the forwarding table.--: A hyphen before [protocol/preference] indicates the last active route.-*: An asterisk before [protocol/preference] indicates that the route is both the active and the last active route. An asterisk before a ‘to’ line indicates the best subpath to theroute.V1.0, 02/15/08 -----------------------------------------------------------Lab 7-4 PolicyWhen troubleshooting policy two of the most common commands are show route receive-protocol and show route advertising-protocol. When issuing these commands it’s important to understand where we are getting the outputs from. The commands on the slide show routing updates received before import policy processing and the routing updates sent after export policy processing.Use the show route receive-protocol protocol neighbor command to show the specified protocol-type route advertisements that a particular neighbor is advertising to your router before import policy is applied. Use the show route advertising-protocol protocolneighbor command to show the protocol-type route advertisements that you are advertising to a particular neighbor after export policy is applied.The use of route filters marks an exception to the behavior documented previously. JUNOS software evaluates route filters before the output of a show route receive-protocol command is generated. Thus, you must specify the hidden switch to the show routereceive-protocol command to display received routes filtered by your import policy.If you want to monitor the effects of an import policy, use the show route protocol protocol command to monitor the effects of your import policy. This command shows all routes from the protocol type specified that are installed in the routing table.Another way we can troubleshoot policy is to use the function test policy <policy name><prefix>. By using this command you can test policies that are created (and committed) on the router for a specific prefix to see if the policy will have the desired effect on the prefix being tested.V1.0, 02/15/08 -----------------------------------------------------------V1.0, 02/15/08 -----------------------------------------------------------It is important to keep in mind that the default action of ‘test’ is to accept. Note the difference in behavior once we add a second term catch-all to reject any remaining routes.V1.0, 02/15/08 -----------------------------------------------------------Lab 7-5 Stateless Firewall Filters (Packet Filters)One of the more common ways to test firewall filters is to set up counters to capture discarded and accepted packets. If we see packets increment in the discard counter then we can at least be assured that our filter is applied and that packets are matching. Please recall that in a previous lab we used a firewall filter to match on ICMP and a counter to show that it was working correctly. The following command, show firewall, shows the counter we created and the amount of traffic that has been matched it.-----------------------------------------------------------V1.0, 02/15/08 -----------------------------------------------------------Another method for troubleshooting is to look at the firewall log created specially for dropped packets due to firewall match criteria. The log modifier writes packet header information to a memory resident buffer in the PFEV1.0, 02/15/08 -----------------------------------------------------------The following chart shows the output field definitions:Time of Log Time that the event occurred. to be providedFilter Name of a filter that has been configured with the filterstatement at the [edit firewall] hierarchy level.• A hyphen (-) indicates that the packet was handled bythe Packet Forwarding Engine.• A space (no hyphen) indicates the packet was handledby the Routing Engine.•The notation pfe indicates packets logged by thePacket Forwarding Engine hardware filters.to beprovidedFilter Action Filter action:•A—Accept•D—Discard•R—Rejectto beprovidedName of Interface Ingress interface for the packet.to beprovidedName of protocol Packet's protocol name: egp, gre, ipip, ospf, pim, rsvp, tcp, orudp.to beprovidedPacket length Length of the packet. to be providedSource address Packet's source address. to be providedDestination address Packet's destination address and port.to beprovidedV1.0, 02/15/08 -----------------------------------------------------------Finally one more way to look at the results of our firewall filters is to create a system log file that matches on the packets that have been dropped as a result of the firewall applied to the router. First of all, take a look at the system syslog settings that allow us to analyze the log filesThen as part of the firewall filter, we include the action of syslog:V1.0, 02/15/08 -----------------------------------------------------------Finally, we can now take a look at the log files created as a result of our work:In this section we will see a couple outputs that give us useful information on stateful firewalls, zones, and interfaces that participate. One thing to keep in mind is that the output for flows shows up only if traffic has passed within a certain amount of time. This means that even though your configuration may be correct, the output may not show incrementing valueswithout traffic.V1.0, 02/15/08 -----------------------------------------------------------This output is shown to let you see that with JES configured on your router, a showinterfaces output references the zones assigned to the logical portion of your interface. This can be helpful when determining if your zones have been applied correctly and give you some basic information as to the amount and type of traffic being allowed to traverse your interface.V1.0, 02/15/08 -----------------------------------------------------------Conversely, if you would rather take a look at the zones configured on your router, the show security zones output will show you the zones configured as well as the interfaces associated with these zones. Additional information can be found here that let’s us know any settings we have for the return traffic. For instance, if we have decided to send a reset for non-SYN session TCP packets, this information would be shown under the security zone section of this output.V1.0, 02/15/08 -----------------------------------------------------------The output above summarizes all of the active sessions that have been created.V1.0, 02/15/08 -----------------------------------------------------------From time to time it may become necessary to clear flows on your router, the output above shows this. You also have the ability to clear specific sessions with the session identifier.V1.0, 02/15/08 -----------------------------------------------------------Lab 7-7 Screen OptionsFor the lab and objective assignments, sending ping packets that are obviously too large and then monitoring the command show security screen statistics zone <zone name> should give us an indication of whether or not our configuration will account for the specific type of attack we are mitigating. Because this output has all ready been seen in module 6, the output above may look a bit familiar. ☺。
Jniper防火墙培训资料_Juniper-FW-Training
Juniper防火墙培训黄卓超Boscohuang@培训日程▪Juniper防火墙产品型号介绍▪Juniper防火墙优势与卖点▪产品更新情况▪防火墙概念▪Troubleshooting▪日常维护企业核心网/运营商/数据中心性能Juniper防火墙产品线一览中小企业/远程办公室大中型企业/分支机构价格Juniper防火墙产品市场定位▪中低端防火墙针对中小型企业•购买成本及维护成本是首要的需求•安全功能All in one•统一的配置界面•Juniper SSG产品具备无可比拟的优势•购买成本较低•无需管理多台设备•性能可接受(出口带宽<100M)▪高端防火墙针对运营商及大型企业•性能与稳定性是用户首要的需求•防火墙不能因为开启新业务成为网络处理能力的瓶颈•防火墙需具备高稳定性，不能影响业务的正常开展•往往使用独立硬件完成病毒防护,入侵检测防御,垃圾邮件过滤等功能,专物专用•Juniper ISG/NS5000的目标客户Secure Services Gateway 5▪160Mbps防火墙处理能力▪40Mbps VPN处理能力▪16K并发会话，5.5K新建会话▪深度检测能力▪病毒扫描能力▪反垃圾邮件, Web 过滤▪支持Security zones, VLANs, Virtual Routers 以灵活地把网络分段灵活的接口选项▪固化7个10M/100MEtherne以太网接口+ 1低速广域网接口interface•ISDN BRI S/T•V.92•RS-232 Serial/Aux▪可选配无线接入802.11a/b/g▪共6个具体型号Secure Services Gateway 20灵活的接口选项▪固化5个10M/100MEtherne 以太网接口+ 2个Mini-PIM 扩展槽•ISDN BRI S/T •V.92•ADSL2+•E1/T1•千兆以太网•同步串口▪可选配无线接入802.11a/b/g ▪共6个具体型号▪160Mbps 防火墙处理能力▪40Mbps VPN 处理能力▪16K 并发会话，5.5K 新建会话▪深度检测能力▪病毒扫描能力▪反垃圾邮件, Web 过滤▪支持Security zones, VLANs, Virtual Routers 以灵活地把网络分段Secure Services Gateway 140前面板▪前面板8个10/100M 以太网接口+ 2 个10/100/1000M 接口扩展槽▪后面板4个PIM 扩展槽•2* T1/E1•2*Serial •2*SHDSL •1*E3/T3•1*ADSL•1*ISDN BRI S/T •16口GE •8口GE •6口GE •1口GE▪350 Mbps 防火墙处理能力▪100 Mbps VPN 处理能力▪48K 并发会话数，8K 新建会话数▪深度检测能力▪病毒扫描能力▪反垃圾邮件, Web 过滤▪支持Security zones, VLANs, Virtual Routers 以灵活地把网络分段后面板Secure Services Gateway 300M Series▪Juniper Networks SSG 350M•550Mbps FW •225 Mbps VPN •深度检测能力•病毒扫描能力• 5 I/O Slots•单电源, AC or DC•128K 并发会话, 12.5K 新建会话数•350 VPN tunnels •1.5U▪Juniper Networks SSG 320M •450Mbps FW •175Mbps VPN •深度检测能力•病毒扫描能力)• 3 I/O slots •单电源, AC or DC•64K 并发会话,10K 新建会话数•250 VPN tunnels •1U▪共同特点•固化4个10M/100M/1000M 以太网接口•2个RJ45 Console/AUX 接口•2 个USB可外接存储设备以导出日志或其他系统信息Secure Services Gateway 500 Series▪Juniper Networks SSG 550•4Gbps FW •500 Mbps VPN •深度检测能力•病毒扫描能力• 6 I/O Slots•冗余电源, AC or DC•256K 并发会话, 32K 新建会话数•1,000 VPN tunnels▪Juniper Networks SSG 520•2Gbps FW•300 Mbps VPN •深度检测能力•病毒扫描能力• 6 I/O slots •单电源, AC or DC•128K 并发回话, 23k 新建会话数•500 VPN tunnels▪共同特点•2U 高，固化4个10M/100M/1000M 以太网接口•2个RJ45 Console/AUX 接口•2 个USB可外接存储设备以导出日志或其他系统信息丰富的SSG接口模块：PIMs8口10M/100M/1000M电口16口10M/100M/1000M电口6口1000M光口2口E1/T12口同步串口1口ISDN BRI S/TJuniper ISG防火墙概览•ISG2000•集中转发架构,系统性能为设计值•整机4Gbps防火墙处理能力(大包)•2Gbps防火墙处理能力(64bytes小包)•整机2Gbps 3DES或AES VPN能力•整机1百万并发连接•最多支持10000 IPSec VPN tunnels •最多支持16个千兆接口或28个百兆接口•最多支持250个虚拟防火墙系统•最多支持4094个VLANs •ISG1000•集中转发架构,系统性能为设计值•最大2Gbps防火墙处理能力(大包)整机1Gbps防火墙处理能力(64bytes小包)•最大1Gbps 3DES或AES VPN能力•整机50万并发连接•最多支持2000 IPSec VPN tunnels•最多支持12个千兆接口或20个百兆接口•最多支持50个虚拟防火墙系统•最多支持4094个VLANsISG 2000 升级为带硬件IDP 的防火墙IDP LicenseKey1－3 块安全模块++=ISG System+ISG System w/ IDPJuniper NS5000防火墙概览•NS5400•分布式处理，随着板卡数量增加性能线性递增•最大30Gbps 防火墙处理能力(256bytes)•12Gbps 防火墙处理能力(64bytes 小包)•最大15 Gbps 3DES 或AES VPN 能力•整机2 百万并发连接•支持25,000 IPSec VPN tunnels •支持24个千兆接口或6个万兆接口•支持500个虚拟防火墙系统•支持4094个VLANs •NS52000•分布式处理，随着板卡数量增加性能线性递增•最大10Gbps 防火墙处理能力(256bytes)整机4Gbps 防火墙处理能力(64bytes 小包)•最大5Gbps 3DES 或AES VPN 能力•整机1百万并发连接•支持25,000 IPSec VPN tunnels •支持8个千兆接口或2个万兆接口•支持500个虚拟防火墙系统•支持4094个VLANsJuniper NS5000接口板卡系列▪NetScreen-5000 8G2接口模块•8口千兆mini-GBIC 接口•8Gbps 防火墙/4Gbps 3DES/AES VPN性能•支持最多4口聚合▪NetScreen-5000 2XGE接口模块•2口万兆XFP接口•10Gbps防火墙/4Gbps 3DES/AES VPN性能•支持短距或长距Transceivers▪共同点•每块接口卡内置2块GigaScreen3ASIC•支持9.6K帧长的Jumbo Frames•跟5000-MGT2管理模块兼容培训日程▪Juniper防火墙产品型号介绍▪Juniper防火墙优势与卖点▪产品更新情况▪防火墙概念▪Troubleshooting▪日常维护防火墙操作系统SreenOSRISC CPUSecurity -Specific, Real -Time OS •Dynamic Routing •Virtualization •High Availability•Centralized Management•VPN•Denial of Service •Firewall•Traffic management Purpose Built Hardware Platform CPU MemoryASICInterfacesSecurity –Specific, Real-Time OS▪Dynamic Routing ▪Virtualization▪High Availability ▪Centralized Management Integrated Security Applications ▪Denial of Service ▪VPN ▪Firewall ▪Traffic management 转为安全业务而设计的软件系统-▪电信级路由能力:RIP/OSPF/BGP4/PBR ▪高可用性:Redundant Interface/Track IP/NSRP ▪虚拟化能力:虚拟防火墙▪UTM 功能:AV/IPS/Anti-SPAM/URL Filtering…▪支持:RADIUS, LDAP , PKI, internal DB,SecurID,MS AD 等认证手段▪超过10年行业经验累积▪支持大量的企业应用如H323/SIP/MGCP/Skinny 等▪安全域／全状态检测／深度检测▪VPN 特性:IPsec/XAuth/L2TP/GRE防火墙安全业务引擎GigaScreen3ASIC•Juniper/Netscreen第4代安全业务处理芯片(2003 年发布)•3Mpps状态检测/NAT性能• 1.5Mpps 加解密性能( IPsec VPN)•集成16种常见攻击的防护能力(Syn-flood/ICMP flood//UDP Flood等)•集成6*Packet Processing Units (PPU)加速单元:•VPN 加/解密(AES, 3DES, DES,SHA-1, MD5)•TCP 4 Way close•IP 分段重组•IKE协商加速•流量计数•支持微代码编程，可通过软件版本升级更新ASIC芯片的功能•用于ISG/NS5000产品系列全状态防火墙检测机制▪支持对TCP协议进行状态检测▪支持IP/ICMP/UDP等无状态协议进行状态检测▪支持对复杂协议进行状态检测•H.323(Cisco/Avaya/Polycom/NEC…)•SIP•MGCP•Skinny•FTP/TFTP•RTSP/Real•Microsoft RPC/Sun RPC•SQL•PPTP•SCTP•GTP/GPRS完善的VPN特性支持▪支持IETF IPsec VPN标准•可与所有兼容RFC标准的IPsec网关互联互通•支持IPsec VPN NAT Traversal•支持Remote-Access w/ Xauth•支持透明模式下的IPsec VPN•独特的ACVPN特性，可简化大规模full-mesh VPN部署▪支持L2TP VPN，支持L2TP over IPsec，方便Windows用户VPN远程接入▪支持GRE Tunnel,支持GRE over IPsec；方便通过VPN隧道透传组播应用统一威胁管理(UTM)来自入方向的威胁来自出方向的威胁SurfControl to block to Spyware /Phishing / Unapproved Site Access Web过滤Kaspersky Lab AV stops Viruses, file-based Trojans, Spyware, Adware,KeyloggersKaspersky Lab AV stops Viruses, file-based Trojans or spread of Spyware,Adware, Keyloggers防病毒Symantec stops Spam / Phishing防垃圾邮件Juniper IPS detects/stopsWorms, TrojansJuniper IPS detects/stops Worms,Trojans, DoS, Recon, Scans入侵检测防护Juniper Stateful Firewall, VPN, AccessControl核心安全Juniper Stateful Firewall, VPN,Access Control经济灵活的虚拟系统(Virtual Systems)IEEE 802.1Q VLAN Trunk业务流量按照VLANs 映射至虚拟防火墙客户区域物理分割到客户A 的VLAN虚拟防火墙逻辑分割每个客户独立管理自己的设备: 分离的路由表/安全策略/地址本/管理员账号到客户C 的VLAN到客户B 的VLAN灵活的部署方式▪路由模式:电信级路由能力•RIP•OSPF•BGP•策略路由•ECMP▪透明模式(桥模式)•无需更改现有网络拓扑，即插即用•支持透明模式下的NAT(ScreenOS 6.2)/IPsec VPN ▪支持丰富的广域网接口卡类型，适应各种网络连接▪虚拟路由器/虚拟防火墙提高业务灵活性▪IPv6 Ready•支持IPv4/IPv6双栈•支持NAT-PT•支持6to4 Tunnel•支持6in4,4in6 Tunnel•支持RIPng，即将支持OSPFv3高可用性▪主要特性•支持A/P、A/A、A/A fullmesh的高可用部署•同步FW/VPN的所有信息，切换时包括•Active sessions•NAT•VPN tunnels•Security Associations▪优点•业务无中断，切换对用户透明•改进了业务的弹性▪Juniper HA防火墙结构解决的问题•防多点故障•链路故障或周边设备故障，用接口切换屏蔽，设备不用切换，无丢包•双HA心跳线冗余•Track IP机制检测全路径健康状况•配置自动同步，维护简单友好的人机管理界面集成管理平台Telnet SSHHTTP HTTPSDMISNMPSyslogJuniper 防火墙开放,基于标准的管理框架ScreenOS CLI▪Telnet ▪SSHWeb▪Quick Setup with Templates ▪Dashboard View▪Performance MonitoringJuniper NSM▪Discovery & Configuration ▪Policy Management ▪Inventory Management ▪Log ManagementDevice ManagementNetwork & Security ManagementThird party NMSJuniper STRM▪Threat Detection▪Event Log Management ▪Compliance & IT Efficiency培训日程▪Juniper防火墙产品型号介绍▪Juniper防火墙优势与卖点▪产品更新情况▪防火墙概念▪Troubleshooting▪日常维护新一代安全操作系统JUNOS-ES JUUNOS Enhanced Service▪电信级路由操作系统JUNOS和安全操作系统ScreenOS的完美融合•来自JUNOS的MPLS/NSF/NSR等高级功能•来自JUNOS的层次化CLI配置风格•来自ScreenOS的安全特性: 安全域/NAT/IPsec VPN/Screen/深度检测/UTM •Commit/JUNOS Scripts等高级管理特性▪集成的统一安全平台•状态检测•IPsec VPN•入侵检测与防御•病毒防御/垃圾邮件过滤(Roadmap)•DDoS攻击防护▪分布式体系架构•控制/转发平面清晰分离•全冗余分布式系统架构，性能随着安全业务板数量增加而线性递增•满足性能按需增长的要求▪Only for SRX and J系列路由器▪SRX5600▪管理引擎/安全服务引擎/交换矩阵/电源/风扇组全冗余▪8U/8槽位▪防火墙性能–60 Gbps ▪VPN –18 Gbps ▪IDP –18 Gbps▪Concurrent sessions –4M▪New and sustained cps –300k ▪Concurrent VPN tunnels –100kJuniper 新一代防火墙产品SRX5000系列▪SRX5800▪管理引擎/安全服务引擎/交换矩阵/电源/风扇组全冗余▪16U/14槽位▪防火墙性能–120 Gbps ▪VPN –36Gbps ▪IDP –36Gbps▪Concurrent sessions –8M ▪New and sustained cps –300k ▪Concurrent VPN tunnels –100k▪SRX3400▪关键部件冗余▪3U/7扩展槽位▪防火墙性能–10 Gbps ▪VPN –8 Gbps▪IDP –6Gbps▪Concurrent sessions –1M ▪New and sustained cps –120k ▪Concurrent VPN tunnels –10kJuniper 新一代防火墙产品SRX3000系列▪SRX3600▪关键部件冗余▪5U/12扩展槽位▪防火墙性能–30 Gbps ▪VPN –14Gbps ▪IDP –10Gbps▪Concurrent sessions –2M ▪New and sustained cps –120k ▪Concurrent VPN tunnels –30kSRX竞争优势▪支持关键部件全冗余，相比传统防火墙的双机部署成本更低且冗余设计更简单▪突破传统防火墙没有真正的交换矩阵的设计缺陷，采用Juniper骨干网路由器的Switch Farbric(960Gbps),易于容量扩展▪融合来自Juniper骨干网路由器的路由特性，更好的支持ISIS, BGP，NSF/NSR等高级路由特性▪完全集成来自ScreenOS的安全特性，是可以信赖的安全解决方案培训日程▪Juniper防火墙产品型号介绍▪Juniper防火墙优势与卖点▪产品更新情况▪防火墙概念▪Troubleshooting▪日常维护安全区（Security Zone）：Juniper 防火墙增加了全新的安全区域（Security Zone）的概念，安全区域是一个逻辑的结构，是多个处于相同属性区域的物理接口的集合。
Juniper netscreen防火墙培训
▪ 在windows XP下面要修改注册表： ▪ 开始/运行/regedit.exe，找到下面这个路径 ▪ HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlS
et\Services\RasMan\Parameters, ▪ 新增或修改ProhibitIpSec的值为1。
置。
根据前面在安全网关中IKE VPN中PhБайду номын сангаасse 2Proposal的
选择，选择一致的选项。
SSL VPN介绍
▪ SSL VPN网关首先它是一种基于B/S架构的远程访问 方式，作为一种新兴的VPN技术，与传统的IPSec VPN技术各具特色，各有千秋。
▪ SSL VPN比较适合用于移动用户的远程接入(ClientSite)，而IPSec VPN则在网对网(Site-Site)的VPN连 接中具备先天优势。
▪ L2TP Tunnel的设置 ▪ VPN 安全策略 ▪ Windows客户端的设置
配置L2TP用户
设定用户名 设定密码
分配给L2TP用户的地址
配置L2TP Tunnel
选择L2TP用户 选择Tunnel的接口
L2TP Tunnel策略的设置
源地址选择Dial-Up VPN（系统自定义）
Action选择Tunnel
总部A IKE VPN配置
在下拉菜单选取前面定义 的IKE Gateway
总部A IKE VPN配置
高级选项
总部A VPN策略的设置
Action选择Tunnel
选择A到C的VPN
分部C Gateway的设置
对方VPN设备的网关
Juniper Sales Training 1.2- Value Discover
确定客户的决策标准 • 客户会基于什么决策要素才决定购买产品？你必须把这些要素摆在台面上并尽可能的确定，你就不会跑题， 这样再你的方案介绍时，您就会不断重申客户的关键要素并让客户集中精力于他们所关心的要素及相应您 的产品的解决之道。
Copyright © 2003 Juniper Networks, Inc.
Copyright © 2003 Juniper Networks, Inc.
Proprietary and Confidential
12
了解公司的主营业务及目标
你们现在采用什么样的应用软件？（Juniper的产 品支持所有的IP服务，包括Web, mail, ftp , dns , ldap, firewall, lotus Notes , Oracle , Bea . 通过 发现这些关键应用软件，你可以挖掘出巨大的商 业机会） 那些应用系统是最关键的？ 在您即将开展的众多项目中，哪一个项目最重要？ 哪个项目最迫切呢？ 资金到位了么？
Proprietary and Confidential
11
了解公司的主营业务及目标
公司如何从现营业务获利 您今年的业务目标是 您是负责公司整体的业务，还是某个部门的业务？ 你们的主要客户是什么客户？ 你们采用什么样的应用软件？什么应用是最关键的？（客 户可能有许多的解决方案，包括：ERP,OA, e-commerce , email, web hosting , etc. 关键程度决定客户会花多少资 金在维持这些应用的运行） 您公司的组织结构怎样？
10
您所提的问题可归类为：
了解客户的业务及客户群 • 大部分的这类问题可以在拜访一个公司之前来完成。所有得到的信息都需要问客户相关问题来确认。您要 客户认识到您了解并关心他的业务。
JUNIPER培训文档2013
Juniper配置文档二零一三年二月目录JUNOS配置简介 (2)JUNOS软件简介 (2)JUNOS软件安装 (3)JUNOS命令行简介 (5)初始化配置 (6)路由器的调试 (6)端口配置 (7)系统整体配置 (10)IS-IS配置 (12)OSPF配置 (14)BGP配置 (15)Routing Policy (17)JUNOS配置简介JUNOS软件简介JUNOS软件的三大功能：1）ROUTING2）ENHANCED ROUTING SERVICES3）MPLSTRAFFIC ENGINEERINGVPNS它所支持的特性有：1）模块化设计2）EGP：BGP4Route reflectorsConfederationsCommunitiesRoute flap dampingTCP MD5 authenticationREGEX3）IGP：Integrated IS-ISOSPFRIPv24）Juniper policy engine5）MulticastDVMRP PIM DIM PIM SM MSDP(Multicast Source Discovery Protocol)6）MPLSTraffic engineeringVPNs7）Class of Service在传统VPN方面，JUNIPER路由器需加插一块Tunnel PIC板来支持。
它支持PIM SM隧道模式和GRE封装。
JUNOS软件安装1、启动设备和媒介启动顺序1、可移动媒介：a)用于安装和升级，通常为空b)M40使用120MB软驱c)M20/160使用110MB PCMCIA FLASH卡2、FLASH驱动器a)在一个新的Juniper路由器中，JUNOS软件预先安装在FLASH驱动器中3、硬盘a)在一个新的Juniper路由器中，与安装一个备份JUNOS软件，还用于存储系统log文件和诊断文件2、软件安装1、出厂预安装软件a)FLASH驱动器b)硬盘（备份）c)可移动媒介（用于系统恢复）2、存储媒介使用下列设备名，在路由器启动的时候显示出来a)FLASH驱动器－wd0b)硬盘－wd2c)可移动媒介－wfd03、可以从各种拷贝启动a)如果FLASH驱动器坏了，还可以从硬盘或者软驱启动4、升级a)可以从可移动媒介或者从Internet上升级3、完全安装－准备阶段1、记录下基本信息a)路由器名b)管理接口IP地址c)缺省路由器IP地址d)域名和DNS服务器IP地址2、将已存在的配置文件COPY到安全的地方a)配置文件位于/config/juniper.conf3、确定你要安装的媒介4、完全安装－重新安装1、插入安装媒介a)M40 LS-120软盘b)M20 PCMCIA FLASH卡2、重新启动路由器a)从console口使用命令：root @ lab2 >system haltb)重新启动电源3、输入安装前保存的一些信息4、系统安装完后自动重新启动5、升级软件1、JUNOS软件包含三个包a)jkernel-操作系统b)jroute－路由引擎软件c)jpfe－包转发引擎软件d)jbundle－所有的三个软件包2、下列是软件包的名字举例：a)jroute-4.0R1.tgzb)jkernel-4.0R1.tgzc)jpfe-4.0R1.tgz3、每个包可以个别的单独升级4、CLI命令模式下使用show system software显示安装的软件信息5、命名规范：package-m.n.Znumber.tgza)m.n是主版本号b)number是release号码c)Z是大写字母i.A-Alphaii.B-Betaiii.R-Releaseiv.I-Internal6、例如：jbundle-3.4R1.2.tgz6、升级软件包root@lab2> request system software add new-package-nameroot@lab2> request system reboot7、备份已存在的软件系统软件和配置可以备份到硬盘中，最好在稳定的时候进行使用request system snapshot命令备份软件到/altroot和/altconfig文件系统中，通常情况下，root文件系统/备份到/altroot中，/config备份到/altconfig中。
20070204-培训资料-Juniper网络安全防火墙设备售前培训v1
Juniper将电信级的技术精髓带入金融企业
2006
M-Series
1996
Incorporated
1998
1999
Revenue Employees
2000
2001
2002
$500M 1000
T-Series
1500
5
2004
$1B 2500
2005
#789
Acorn
UAC
SSG
$2B $2.3B
control)
探测保护 • Port scan • IP address sweep
PROTECTION
DoS 和 DDoS 防护
• SYN flood • 包括syn proxy和syn
cookie 方式
• ICMP flood • UDP flood • IP spoofing • Per-session limiting • SYN fragments •恶D意e数fau据lt包pa防c护ket deny •• SPiYnNg-AofCdKe-aAtChK attack • Land attack • Tear drop attack • WinNuke attack • IP source route • Loose source route
冒人的全球名单来阻断（及/或标记出）垃圾邮件 • 使用特定的域、电子邮件发送方或IP地址来创建定制的“黑名
单”和“白名单”
• 过滤垃圾邮件，由赛门铁克提供
XOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOX OXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXO XOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOX
Juniper防火墙渠道指导培训
SSL VPN产品$3.853亿
防火墙产品 $37亿
集成安全功能的路由器产品$13亿
来源: Infonectics Research 2007
企业路由器产品$43亿
防火墙架构演进路线 …
“就像广泛应用于企业和服务提供商骨干网上的基于ASIC结构的路由器/交换机竞争一样， 安全领域同样存在软件和硬件产品之间的竞争。任何关注高性能网络安全的经理们都应
Workstation + software (1991 DEC SEAL)
Software based firewall (1994 CheckPoint Firewall-1)
ASIC based firewall (1999 Netscreen NS-1000)
防火墙功能演进路线 …
1989 路由器集成包过滤功能
DMZ
Internal security Content protection Limited IT staff
Wi Fi
Bandwidth usage Direct Internet Remote mgmt
2007年度安全市场细分
防火墙已成为承载网络安全功能的基础平台
入侵检测与防御产品$7.237亿
性能
中小企业/远程办公室
大中型企业/分支机构
价格 企业核心网/运营商/数据中心
Juniper防火墙产品市场定位
中低端防火墙针对中小型企业
购买成本及维护成本是首要的需求
安全功能All in one 统一的配置界面
Juniper SSG产品具备无可比拟的优势
购买成本较低 无需管理多台设备 性能可接受(出口带宽<100M)
Routers 以灵活地把网络分段
多厂商防火墙系列之八：Juniper-netscreen--防火墙培训基础篇
添加缺省路由后路由表
11
创建Trust- Untrust区域策略
源区域
目的区域
创建
12
创建Trust Untrust区域策略
自定义策略名 称
内网的所有地址可 以访问外网的所有
地址
开启LOG; 并把该策略置顶执行
13
创建Trust- Untrust区域策略
点击此处可以 查看策略日志
完成策略配置
Juniper netscreen 防火墙培训
1
课程目标
. NS防火墙部署方式介绍，部署方式主要有以下几种 1、路由模式 2、透明模式 3、混合模式（1、2两种模式的结合）
. 内网各种应用服务器（WEB、ERP、 EMAIL）的发布
1、MIP、VIP、DIP 2、访问应用服务器的安全策略
2
防火墙部署方式一、路由模式
E 0/2
E 0/0
5
接口地址一览表(初始)
编辑缺省 外网接口
6
配置缺省外网接口IP及管理项
公网远程管理 开关
外网口为ROUTE 内网口为NAT
配置静态公网IP
选择管理 项
7
内外网接口配置完成后一览表
8
路由一览表
添加路由 条目按键
9
添加缺省路由
选择外 网接口
缺省路由配置 格式
防火墙互联 网网关地址
35
MIP、VIP配置步骤
第一步、选择做MIP、VIP对应的外网口 第二步、确定是用MIP还是VIP发布服务器 第三步、设置MIP或VIP与内网服务器对应关系 第三步、配置与MIP、VIP对应的安全策略 下面以最常用的VIP发布WEB服务为例具体说明，MIP
的设置方法与之基本相同。
JuniperWX-售前培训-广域网优化解决方案销售培训PPT49页
46、我们若已接受最坏的，就再没有什么损失。——卡耐基 47、书到用时方恨少、事非经过不知难。——陆游 48、书籍把我们引入最美好的社会，使我们认识各个时代的伟大智者。——史美尔斯 49、熟读唐诗三百首，不会作诗也会吟。——孙洙 50、谁和我一样用功，谁就会和我一样成功。——莫扎特
JuniperWXቤተ መጻሕፍቲ ባይዱ售前培训-广域 网优化解决方案销售培训
26、机遇对于有准备的头脑有特别的 亲和力 。 27、自信是人格的核心。
28、目标的坚定是性格中最必要的力 量泉源 之一， 也是成 功的利 器之一 。没有 它，天 才也会 在矛盾 无定的 迷径中 ，徒劳 无功。- -查士 德斐尔 爵士。 29、困难就是机遇。--温斯顿．丘吉 尔。 30、我奋斗，所以我快乐。--格林斯 潘。
- 1、下载文档前请自行甄别文档内容的完整性，平台不提供额外的编辑、内容补充、找答案等附加服务。
- 2、"仅部分预览"的文档,不可在线预览部分如存在完整性等问题,可反馈申请退款(可完整预览的文档不适用该条件!)。
- 3、如文档侵犯您的权益，请联系客服反馈,我们会尽快为您处理(人工客服工作时间：9:00-18:30)。
– 完全和ScreenOS 5.3 整合
• 客户可以选择采用Kaspersky还是Trend – 推荐用卡 巴斯基
25
内嵌防垃圾邮件
– 阻断垃圾邮件和网页仿冒攻击
• 将赛门铁克的防垃圾邮件功能集成到SSG 520/550中 • 使用基于IP的、强韧的、始终更新的垃圾邮件发送人和网页仿
• Source/Destination ip Session number limit
20
SSG：多种领先的安全技术的集成
• 入侵防御功能：
• 防病毒：卡巴斯基
• 防垃圾邮件：赛门铁克
• 网页过滤：美讯智
其他厂家主要依靠自己开发，特征库不完善，不专业；或者只能支 持部分的UTM功能
21
更多应用层协议的DI（IPS）支持
3
Juniper将电信级的技术精髓带入金融企业
2006
M-Series
1996
Incorporated
1998
1999
Revenue Employees
2000
2001
2002
$500M 1000
T-Series
1500
5
2004
$1B 2500
2005
#789
Acorn
UAC
SSG
$2B $2.3B
– 2个选项：集成 (SurfControl) 或重新定向 (SurfControl 或Websense)
URL 请求
许可接入
XOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXO
Malformed Packet Protection • SYN and FIN bit set • No flags in TCP • FIN with no ACK • ICMP fragment • Large ICMP • IP strict source route • IP record route • IP security options • IP timestamp • IP stream • IP bad options • Unknown protocols
control)
探测保护 • Port scan • IP address sweep
PROTECTION
DoS 和 DDoS 防护
• SYN flood • 包括syn proxy和syn
cookie 方式
• ICMP flood • UDP flood • IP spoofing • Per-session limiting • SYN fragments •恶D意e数fau据lt包pa防c护ket deny •• SPiYnNg-AofCdKe-aAtChK attack • Land attack • Tear drop attack • WinNuke attack • IP source route • Loose source route
性能
小型/中型办事处/远程站点 /远程工作人员
大中型站点/分支办事处 /远程办事处
18
内部网络、服务供应商、 高速网关
网络分区有助加强安全性和管理
Untrust
Internet
Custom Zone (DMZ #2)
Custom Zone (DMZ #1)
Trust
• 接口与安全域是对应的 • 多个接口可与同一安全域对应 • 安全域间的流量必须通过安全策略控制
• Juniper 是全球IDP领域市场分额第二 2004-2006 Frost & Suቤተ መጻሕፍቲ ባይዱlivan
• Juniper在2006年国内网络安全市场分额第一 (Frost & Sullivan)
6
客户影响力不断提升－中国
• Juniper在大中国
– 已经为大中国各顶尖 运营商提供战略性网 络系统。
• 对入站和出站流量进行病毒扫描
XOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOX OXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXO XOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOX
19
HA Link
Custom Zone (Wireless LAN)
基于安全区的Denial-of-Service 防护
Firewall
Protected Network
防火墙保护 • 状态检测 (i.e., TCP and
UDP) • TCP顺序检测 • MAC 地址检测 • CRC 检测
内容保护 • Java/ActiveX/Zip/Exe 阻断 • 用户定义的恶意 URLs • URL 阻断 (Websense、surf
入侵防护解决方案
Intrusion prevention appliances that help protect networks and critical resources from attacks
整合接入控制解决方案
Juniper Unified Access Control (UAC) combines user identity, device security state and location information for session-specific access policy by user
致：John Subject：请打开这 个文件
丢弃受感染的电子邮件， 并向用户发送消息
24
Juniper的防病毒引擎
• 和业界领先的防病毒厂家(卡巴斯基Kaspersky)合作
– 一直以来该都被评为最佳的检测和响应引擎
• 新的防病毒解决方案包括的向内方向的Spyware / Adware / Keyloggers的阻断
Screen OS 5.1 and 5.2
Screen OS 5.3
FTP, Gnutella, HTTP, IMAP, NetBIOS, POP3, DNS, MSRPC, SMB, SMTP and Instant Messaging (AOL, MSN, Yahoo).
CHARGEN, DHCP, DISCARD, ECHO, FINGER, Gopher, ICMP, IDENT, IKE, IRC, LDAP, LPR, MS-SQL, NFS, NNTP, NTP, PortMapper, RADIUS, Rexec, rlogin, SunRPC, Rsh, RTSPRusers, SNMP/Trap, SQL Mon, SSH, SSL, Syslog, TELNET, TFTP, VNC, WHOIS
冒人的全球名单来阻断（及/或标记出）垃圾邮件 • 使用特定的域、电子邮件发送方或IP地址来创建定制的“黑名
单”和“白名单”
• 过滤垃圾邮件，由赛门铁克提供
XOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOX OXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXO XOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOXOX
– 已经为尖端教育科研 系统、银行系统、能 源系统、以及广泛的 商用市场/中小企业等 提供尖端网络系统服 务。
9
Juniper 安全系列产品 防火墙
防火墙议程
1. Juniper简介 2. Juniper 防火墙整合的安全功能 3. Juniper 防火墙硬件结构及性能方面与其
它产品的区别 4. Juniper 防火墙产品型号
SSL VPN Solutions
Product lines for secure LAN, extranet and intranet access to mobile employees, customers and partners with no client software deployment
Juniper Networks
防火墙产品
防火墙议程
1. Juniper简介 2. Juniper 防火墙整合的安全功能 3. Juniper 防火墙硬件结构及性能方面与其
它产品的区别 4. Juniper 防火墙产品型号
2
Gartner历年的评价 (2007年报告)
Juniper #1 out of 11 vendors
不希望的 / 主动发 送的电子邮件
全球垃圾 邮件数据库
减少没有价值的电子 邮件流量
26
内嵌Web过滤
• 控制Web的使用以提高员工生产率和网络资源利用率 并避免诉讼
– 防止用户访问已知的间谍软件和网页仿冒站点 – 通过预定义的或定制的URL列表来控制对网站的访问
• 可基于站点、内容类型或用户群来制订策略
11
SSG使用了业界最好的引擎与技术
保护 的企 业
入侵 防护
防病毒
反垃圾 邮件
网页过 滤
基本防 火墙
IPSec VPN
“ ” Layered protection model
12
安全产品分类
UAC Agent
企业安全路由解决方案
Service provider quality routers for the enterprise designed for remote, branch or regional offices