园区网络安全设计——出口防火墙
网络接入人员众多，业务复杂，流量构成丰富多样；容易成为DDoS攻击的目标，而且一旦攻击成功，业务损失巨大；网络病毒活跃，严重威胁网络安全和终端的安全；出于业务需求，内网对外提供网络服务，例如公司网站、邮件服务等，这些潜在的不安全因素都威胁着园区网络的安全。
防火墙作为整个网络和出口，肩负着整个网络的安全责任，针对上述安全需求，可在出口防火墙上部署如下安全业务：
将企业员工网络、公司服务器网络、外部网络划分到不同安全区域，对安全区域间的流量进行检测和保护。
根据公司对外提供的网络服务的类型开启相应的内容安全防护功能。例如针对文件服务器开启文件过滤和内容过滤，针对邮件服务器开启邮件过滤，并且针对所有服务器开启反病毒和入侵防御。
针对内网员工访问外部网络的行为，开启URL过滤、文件过滤、内容过滤、应用行为控制、反病毒等功能，既保护内网主机不受外网威胁，又可以防止企业机密信息的泄露，提高企业网络的安全性。
开启DDoS防御功能，抵抗外网主机对内网服务器进行的大流量攻击，保证企业业务的正常开展。
针对内外网之间的流量部署带宽策略，控制流量带宽和连接数，避免网络拥塞，同时也可辅助进行DDoS攻击的防御。
部署华为网管系统（需要单独采购），记录网络运行的日志信息。日志信息可以帮助管理员进行配置调整、风险识别和流量审计。
安全区域划分
系统缺省已经创建了四个安全区域。但是如果用户还需要划分更多的安全等级，可以自行创建新的安全区域并定义其安全等级。安全区域创建完成后，还需要将相应接口加入安全区域。之后，从该接口接收的或发送出去的报文才会被认为是属于该安全区域。否则接口默认不属于任何安全区域，将不能通过该接口与其他安全区域通信。
接口划分不同的安全区域。
[FW] firewall zone untrust [FW-zone-untrust] add interface GigabitEthernet 1/0/1 [FW-zone-untrust] quit [FW] firewall zone trust [FW-zone-trust] add interface GigabitEthernet 1/0/3 [FW-zone-trust] quit#
配置安全策略（默认deny所有流量）。
配置安全策略，允许内部网络中的PC访问Internet。
[FW] security-policy [FW-security-policy] rule name policy_sec_1 [FW-security-policy-sec_policy_1] source-address 10.3.0.0 mask 255.255.255.0 [FW-security-policy-sec_policy_1] source-zone trust [FW-security-policy-sec_policy_1] destination-zone untrust [FW-security-policy-sec_policy_1] action permit [FW-security-policy-sec_policy_1] quit [FW-security-policy] quit
过滤功能
URL过滤
配置URL过滤配置文件。
[FW] profile type url-filter name profile_url_research [FW-profile-url-filter-profile_url_research] category user-defined action block [FW-profile-url-filter-profile_url_research] category pre-defined action block [FW-profile-url-filter-profile_url_research] category pre-defined category-id 15 action allow [FW-profile-url-filter-profile_url_research] category pre-defined category-id 17 action allow [FW-profile-url-filter-profile_url_research] quit
配置安全策略。
[FW-policy-security] rule name policy_sec_research [FW-policy-security-rule-policy_sec_research] source-zone trust [FW-policy-security-rule-policy_sec_research] destination-zone untrust [FW-policy-security-rule-policy_sec_research] user user-group /default/research [FW-policy-security-rule-policy_sec_research] action permit [FW-policy-security-rule-policy_sec_research] profile url-filter profile_url_research [FW-policy-security-rule-policy_sec_resea
提交内容安全配置文件。
[FW] engine configuration commit Info: The operation may last for several minutes, please wait. Info: URL submitted configurations successfully. Info: Finish committing engine compiling.文件过滤
新建配置文件profile_file_internet，禁止上传可执行文件。
[FW] profile type file-block name profile_file_internet [FW-profile-file-block-profile_file_internet] rule name rule1 [FW-profile-file-block-profile_file_internet-rule-rule1] application all [FW-profile-file-block-profile_file_internet-rule-rule1] file-type pre-defined name EXE MSI RPM OCX A ELF DLL PE SYS [FW-profile-file-block-profile_file_internet-rule-rule1] direction upload [FW-profile-file-block-profile_file_internet-rule-rule1] action block [FW-profile-file-block-profile_file_internet-rule-rule1] quit [FW-profile-file-block-profile_file_internet] quit
配置untrust到dmz的安全策略policy_sec_internet，并引用配置文件profile_file_internet。
[FW-policy-security] rule name policy_sec_internet [FW-policy-security-rule-policy_sec_internet] source-zone untrust [FW-policy-security-rule-policy_sec_internet] destination-zone dmz [FW-policy-security-rule-policy_sec_internet] destination-address 10.2.0.5 24 [FW-policy-security-rule-policy_sec_internet] profile file-block profile_file_internet [FW-policy-security-rule-policy_sec_internet] action permit [FW-policy-security-rule-policy_sec_internet] quit
提交内容安全配置文件。
[FW] engine configuration commit Info: The operation may last for several minutes, please wait. Info: DLP submitted configurations successfully. Info: Finish committing engine compiling.内容过滤
配置关键字组keyword1。
[FW] keyword-group name keyword1 [FW-keyword-group-keyword1] pre-defined-keyword name confidentiality weight 1 [FW-keyword-group-keyword1] user-defined-keyword name abc [FW-keyword-group-keyword1-keyword-abc] expression match-mode Text "abcd" [FW-keyword-group-keyword1-keyword-abc] weight 1 [FW-keyword-group-keyword1-keyword-abc] quit
为用户新建配置文件profile_data_research。
[FW] profile type data-filter name profile_data_research [FW-profile-data-filter-profile_data_research] rule name rule1 [FW-profile-data-filter-profile_data_research-rule-rule1] keyword-group name keyword1 [FW-profile-data-filter-profile_data_research-rule-rule1] application all [FW-profile-data-filter-profile_data_research-rule-rule1] file-type all [FW-profile-data-filter-profile_data_research-rule-rule1] direction upload [FW-profile-data-filter-profile_data_research-rule-rule1] action block [FW-profile-data-filter-profile_data_research-rule-rule1] quit
为用户配置安全策略policy_sec_research，并引用配置文件profile_data_research。
[FW] security-policy [FW-policy-security] rule name policy_sec_research [wzh_x3-policy-security-rule-policy_sec_research] source-zone trust [wzh_x3-policy-security-rule-policy_sec_research] destination-zone untrust [wzh_x3-policy-security-rule-policy_sec_research] user user-group /default/research [wzh_x3-policy-security-rule-policy_sec_research] profile data-filter profile_data_research [wzh_x3-policy-security-rule-policy_sec_research] action permit [wzh_x3-policy-security-rule-policy_sec_research] quit
提交内容安全配置文件。
[FW] engine configuration commit Info: The operation may last for several minutes, please wait. Info: DLP submitted configurations successfully. Info: Finish committing engine compiling.
反病毒和入侵防御
部署反病毒
当内网用户通过HTTP协议下载带有病毒的文件时，下载连接被阻断。当内网用户通过POP3协议下载带有病毒的邮件时，附件被删除。
配置针对HTTP和POP3协议的反病毒配置文件。
[FW] profile type av name av_http_pop3 [FW-profile-av-av_http_pop3] http-detect direction download action block [FW-profile-av-av_http_pop3] pop3-detect action delete-attachment [FW-profile-av-av_http_pop3] exception application name Netease_Webmail [FW-profile-av-av_http_pop3] exception av-signature-id 1000 [FW-profile-av-av_http_pop3] quit
配置内网用户到外网服务器方向（trust到untrust方向）的安全策略。
[FW] security-policy [FW-policy-security] rule name policy_av_1 [FW-policy-security-rule-policy_av_1] source-zone trust [FW-policy-security-rule-policy_av_1] destination-zone untrust [FW-policy-security-rule-policy_av_1] action permit [FW-policy-security-rule-policy_av_1] profile av av_http_pop3 [FW-policy-security-rule-policy_av_1] quit部署入侵防御
创建入侵防御配置文件profile_ips_pc，保护内网用户。
[FW] profile type ips name profile_ips_pc [FW-profile-ips-profile_ips_pc] description profile for intranet users [FW-profile-ips-profile_ips_pc] capture-packet enable [FW-profile-ips-profile_ips_pc] signature-set name filter1 [FW-profile-ips-profile_ips_pc-sigset-filter1] target client [FW-profile-ips-profile_ips_pc-sigset-filter1] severity high [FW-profile-ips-profile_ips_pc-sigset-filter1] protocol HTTP [FW-profile-ips-profile_ips_pc-sigset-filter1] quit [FW-profile-ips-profile_ips_pc] quit# 提交配置。 [FW] engine configuration commit
配置Trust区域和Untrust区域之间的安全策略，引用入侵防御配置文件profile_ips_pc。
[FW] security-policy [FW-policy-security] rule name policy_sec_1 [FW-policy-security-rule-policy_sec_1] source-zone trust [FW-policy-security-rule-policy_sec_1] destination-zone untrust [FW-policy-security-rule-policy_sec_1] source-address 10.3.0.0 24 [FW-policy-security-rule-policy_sec_1] profile ips profile_ips_pc [FW-policy-security-rule-policy_sec_1] action permit [FW-policy-security-rule-policy_sec_1] quit
DDoS攻击防御
例如，防火墙部署在内网出口处，企业内网部署了Web服务器。经检测，Web服务器经常受到SYN Flood、UDP Flood和HTTP Flood攻击，为了保障Web服务器的正常运行，需要在FW上开启攻击防范功能，用来防范以上三种类型的DDoS攻击。
配置攻击防范参数。
[FW] interface GigabitEthernet1/0/1 [FW-GigabitEthernet1/0/1] anti-ddos flow-statistic enable [FW-GigabitEthernet1/0/1] quit [FW] ddos-mode detect-clean
配置阈值学习功能。
[FW] anti-ddos baseline-learn start [FW] anti-ddos baseline-learn tolerance-value 100 [FW] anti-ddos baseline-learn apply
开启攻击防范功能。
[FW] anti-ddos syn-flood source-detect [FW] anti-ddos udp-flood dynamic-fingerprint-learn [FW] anti-ddos udp-frag-flood dynamic-fingerprint-learn [FW] anti-ddos http-flood defend alert-rate 2000 [FW] anti-ddos http-flood source-detect mode basic
带宽策略
例如：通过每用户的动态均分方式，根据实际在线用户数量动态为每个用户平均分配带宽资源。
为用户配置带宽通道。
[FW] traffic-policy [FW-policy-traffic] profile profile_dep_a [FW-policy-traffic-profile-profile_dep_a] bandwidth maximum-bandwidth whole downstream 60000 [FW-policy-traffic-profile-profile_dep_a] bandwidth average per-user manual multiplier 2 minimum 1000 [FW-policy-traffic-profile-profile_dep_a] quit
针对用户进行带宽管理。
[FW-policy-traffic] rule name policy_dep_a [FW-policy-traffic-rule-policy_dep_a] source-zone trust [FW-policy-traffic-rule-policy_dep_a] destination-zone untrust [FW-policy-traffic-rule-policy_dep_a] user user-group /default/dep_a [FW-policy-traffic-rule-policy_dep_a] action qos profile profile_dep_a [FW-policy-traffic-rule-policy_dep_a] quit
网行为审计和管理
防火墙作为企业网关部署在网络边界，管理员希望通过配置审计功能记录员工的上网行为。
针对用户配置审计配置文件。
[FW] profile type audit name profile_audit_1 [FW-profile-audit-profile_audit_1] http-audit url all [FW-profile-audit-profile_audit_1] http-audit url recorded-title [FW-profile-audit-profile_audit_1] http-audit file direction download [FW-profile-audit-profile_audit_1] ftp-audit file direction download [FW-profile-audit-profile_audit_1] http-audit bbs-content [FW-profile-audit-profile_audit_1] http-audit micro-blog [FW-profile-audit-profile_audit_1] quit
针对用户配置审计策略并引用审计配置文件。
[FW] audit-policy [FW-policy-audit] rule name policy_audit_1 [FW-policy-audit-rule-policy_audit_1] description Policy of auditing for research. [FW-policy-audit-rule-policy_audit_1] source-zone trust [FW-policy-audit-rule-policy_audit_1] destination-zone untrust [FW-policy-audit-rule-policy_audit_1] user user-group /default/research [FW-policy-audit-rule-policy_audit_1] time-range time_range [FW-policy-audit-rule-policy_audit_1] action audit profile profile_audit_1 [FW-policy-audit-rule-policy_audit_1] quit
