Juniper-SRX-技术文档-SecurityPolicies

SecurityPoliciesChapterTitleINTERNALUSEONLYSecurityPolicies2©2008JuniperNetworks,Inc.Allrightsreserved.WhatisaSecurityPolicy?Asecuritypolicyisasetofstatementsthatcontrolstrafficfromaspecifiedsourcetoaspecifieddestinationusingaspecifiedservice.Ifapacketarrivesthatmatchesthosespecifications,theservicesgatewayperformstheactionspecifiedinthepolicy.Networksecuritypoliciesarehighlyvaluableforsecurenetworkfunctionality.Networksecuritypoliciesoutlineallnetworkresourceswithinabusinessandtherequiredsecuritylevelforeachresource.JUNOSsoftwareprovidesasetoftoolstoimplementanetworksecuritypolicywithinyourorganization.Securitypoliciesenforceasetofrulesfortransittraffic,identifyingwhichtrafficcanpassthroughthefirewallandtheactionstakenonthetrafficasitpassesthroughthefirewall.INTERNALUSEONLYSecurityPolicies©2008JuniperNetworks,Inc.Allrightsreserved.3Review:PacketFlowTheslidereviewspacketflowthroughtheflowmoduleofanSRX-seriesservicesgateway.Whentheservicesgatewayexaminesthefirstpacketofaflow,basedonincomingandoutgoingzones,itdeterminesthecorrespondingsecuritypolicy,anditperformsasecuritypolicylookup.Thesystemchecksthepacketagainstpoliciesthataredefinedtodeterminehowthepacketistobetreated.INTERNALUSEONLYSecurityPolicies4©2008JuniperNetworks,Inc.Allrightsreserved.TransitTrafficExaminationJUNOSsoftwarefortheSRX-seriesservicesgatewayalwaysexaminestransittrafficbyusingsecuritypolicies.Asillustratedontheslide,shouldnomatchexistinthesecuritypolicy,thedefaultsecuritypolicyappliestothepacket.Wehighlightthedefaultsecuritypolicyinasubsequentslide.INTERNALUSEONLYSecurityPolicies©2008JuniperNetworks,Inc.Allrightsreserved.5host-inbound-trafficExaminationIftrafficisdestinedtotheservicegateway’sincominginterface,securitypoliciesarenotapplicable.Theonlyexaminationthattakesplaceisthelistofservicesandprotocolsallowedintothatinterfaceusingthehost-inbound-trafficstatementwithinazonedefinition.Theservicesgatewayexaminessecuritypoliciesiftrafficisdestinedtoanyinterfaceotherthantheincominginterface.Thisprocessistrueregardlessofwhethertheincominginterfaceandthedestinationinterfaceareinthesamezone(intrazonetraffic)orindifferentzones(interzonetraffic).Theflowchartontheslideillustratestheorderofpacketexamination.Whentheservicesgatewayreceivestrafficdestinedtoitself,itfirstexamineswhetherthetrafficisdestinedtotheincominginterface.Ifso,thepolicyexaminationisskipped.Otherwise,thecorrespondingsecuritypoliciesevaluatethetraffic.Ifnopolicymatchexistsforthetraffic,thedefaultpolicyactionapplies.Wediscussthedefaultsecuritypolicyonthenextslide.Iftrafficmatchesasecuritypolicyandthetrafficispermitted,theservicesgatewaythenexaminesthelistofservicesandprotocolsspecifiedtobeallowedintothedestinationinterfacewithinthecorrespondingzone,andappliesthecorrespondingaction.INTERNALUSEONLYSecurityPolicies6©2008JuniperNetworks,Inc.Allrightsreserved.System-DefaultSecurityPolicyBydefault,JUNOSsoftwaredeniesalltrafficthroughtheservicesgateway.Infact,animplicitdefaultsecuritypolicyexiststhatdeniesallpackets.Youcanchangethisbehaviorbyconfiguringastandardsecuritypolicythatpermitscertaintypesoftrafficorbyconfiguringthedefaultpolicytopermitalltraffic.[editsecuritypolicies]user@host#setdefault-policypermit-all[editsecuritypolicies]user@host#Factory-DefaultSecurityPoliciesThefactory-defaultconfigurationfilehasthreepreconfiguredsecuritypolicies(nottobeconfusedwiththesystem-defaultsecuritypolicydiscussedinthepreviousparagraph).Thesepoliciesarethefollowing:1.Trust-to-trustzonepolicypermitsallintrazonetrafficwithinthetrustzone;2.Trust-to-untrustzonepolicypermitsalltrafficfromthetrustzonetotheuntrustzone;and3.Untrust-to-trustzonepolicydeniesalltrafficfromtheuntrustzonetothetrustzone.INTERNALUSEONLYSecurityPolicies©2008JuniperNetworks,Inc.Allrightsreserved.7SecurityPolicyConceptualExampleWenowexamineanexampleofapacketflowthroughanSRX-seriesservicesgateway.Theservicesgateway’sinterfacesareseparatedintothreesecurityzones—private,external,andpublic.ThebusinessrequirementcallsforanSSHapplicationtobeallowedfromHostB,locatedintheprivatezone,toHostD,locatedintheexternalzone.Tomeettherequirement,wecreatedthesecuritypolicyillustratedontheslide.Thefollowingisthesequenceofeventsthattakesplace:1.HostBinitiatestheSSHsessiontoHostD.2.Theservicesgatewayreceivestrafficandexaminesitusingitssecuritypolicyfromtheprivatezonetotheexternalzone.Thesecuritypolicypermitsthattraffic.3.TheHostB-to-HostDflowtriggersthecreationofthereverseflowfromHostDtoHostB.Theslideidentifiesthecontentsofthisnewlyformedsession.Itconsistsoftwoflows—sourcetodestinationanddestinationtosource.4.HostDsendsthereturntraffic,fromHostDtoHostB.Theservicesgateway,usingapre-createdsession,permitsthereturntrafficthroughtoHostB.INTERNALUSEONLYSecurityPolicies8©2008JuniperNetworks,Inc.Allrightsreserved.PolicyOrderingAspoliciesareexecutedintheorderoftheirappearanceintheconfigurationfile,youshouldbeawareofthefollowing:•Policyorderisimportant.•Newpoliciesareaddedtotheendofthepolicylist.•YoucanchangetheorderofpoliciesintheconfigurationfileusingtheJUNO