Cisco ASA, PIX, FWSM防火墙指南：全面详解与配置

需积分: 9 179 浏览量更新于2024-07-20 1 收藏 8.78MB PDF 举报

《Cisco ASA、PIX和FWSM防火墙手册》是一本由David Hucaby编著的专业著作，版权属于2008年的Cisco Systems, Inc。这本书是Cisco Press出版，专注于Cisco网络设备防火墙技术，特别是针对Cisco ASA（Advanced Security Appliance）、PIX（Personal Information eXchange）和FWSM（Firewall Services Module）的深入探讨。本书的核心内容涵盖了防火墙在计算机网络安全中的重要性，以及如何有效地利用这些Cisco设备进行网络安全控制。它不仅详细介绍了产品的基本配置和管理，还深入解析了防火墙策略的制定、访问控制列表（ACLs）、虚拟私有网络（VLANs）的隔离、安全区域划分、入侵检测和预防系统（IPS）等关键概念和技术。作为第二版，它可能包含了对早期版本《Cisco ASA和PIX防火墙手册》的扩展和更新内容，旨在帮助读者全面理解防火墙在现代网络架构中的角色和功能。值得注意的是，书中强调了版权的重要性，任何未经许可的复制或传播行为都必须得到出版社的书面许可，即使是引用部分也需要遵循适当的格式。该书印刷于美国，并在2007年8月首次发布。此外，还提供了图书馆馆藏信息和LC分类号，便于专业人员查找和引用。警告与免责声明部分提醒读者，本书的主要目的是提供指导和教育，尽管作者力求准确性，但读者在实际操作中仍需根据具体环境调整策略，并理解可能存在风险和局限性。因此，读者在应用书中介绍的技术时应谨慎行事，并结合自己的网络环境进行适当的评估和测试。《Cisco ASA、PIX和FWSM防火墙手册》是一部宝贵的资源，对于网络管理员、安全专家以及希望提升网络安全知识的专业人士来说，它提供了一个全面且实用的指南，帮助他们理解和管理Cisco防火墙技术以保护网络资产。

Figure 1-4 illustrates the concept behind xlate operation. A host outside the firewall (Host A) has

a registered public IP address, called a foreign address. A host on the inside of the firewall (Host

B) has an internal IP address, called the real or local address. The internal host's address is

translated through an xlate entry so that the local address appears on the outside of the firewall as

a mapped or global address. Address translation is covered in greater detail in Chapter 6,

"Controlling Access Through the Firewall."

Figure 1-4. The Basic Concept Behind Xlate

[View full size image]

Each entry in the xlate table is maintained with the following parameters:

• Protocol used (ICMP, UDP, or TCP)

• Local and global interfaces

• Local and global IP addresses

• Local and global port numbers (if applicable; UDP and TCP only)

• Flags (type of xlate)

• Idle timer (incremented if no packets have used the xlate)

• Absolute timer (incremented since the xlate entry was created)

• Uauth bindings (originating user if user authentication or cut-through proxy is used)

• Connections using the xlate entry:

- Number of connections

- Number of embryonic (not yet fully established) connections

- A list of the active connections

Xlate table lookups occur at different points in the inspection process, depending on the direction

of the connection. For an outbound connection (initiated from the inside), the xlate entry must be

created early in the sequence of events. This is because the translated (global) address is used to

build the actual connection entry and is used as the reference point for any access control list

(ACL) operations. For inbound connections, the opposite is true—any connections and ACL

operations must look at the untranslated (global) addresses, so xlate lookup must occur late in the

game.

A firewall controls several aspects of each xlate entry:

• The number of active connections allowed to use an entry can be held to a maximum

limit or can be unlimited (the default).

• The number of embryonic connections attempting to use an entry can be held to a

maximum limit or can be unlimited (the default).

• An entry is aged out of the table if it has been idle for a timeout period.

Conn Lookup

A Cisco firewall examines and keeps track of the state of each connection attempting to go

through it. This is often called stateful inspection. If a connection is allowed to form (the access

list permits the traffic flow), each state change is updated in the firewall's connection or conn

table. As soon as a connection initiates and a conn table entry is created, traffic from the source

to the destination is allowed to pass. As well, the return traffic for that connection is allowed

back through the firewall toward the source.

The connection state and the behavior of packets from the source and destination must follow the

rules of the IP protocol being used. Any deviation from the accepted behavior causes the

connection to be dropped and logged.

Each entry in the conn table is maintained with the following parameters:

• Protocol used (ICMP, UDP, or TCP)

• Local and foreign IP addresses (note that local addresses are used here, after the xlate

lookup)

• Local and foreign port numbers (if applicable; UDP and TCP only)

• Flags for fixup type and connection state

• Idle timer (incremented if no packets have used the connection)

• Byte counter (total traffic volume using the connection)

• Local and foreign TCP sequence numbers

Conn entries are aged out of the table if they have been idle (no data passing through) for a

timeout period. Conn entries can also age out after a short period if the connections are not fully

established.

When Transmission Control Protocol (TCP) is used for a connection, a Cisco firewall can

generate a random initial sequence number (ISN) toward the foreign host. Some hosts do not

generate a truly random ISN, resulting in predictable values that can be exploited. The firewall

can substitute a truly random ISN into the TCP packets when the connection is negotiated. This

reduces the risk of session hijacking and is totally transparent to the local and foreign hosts.

ACL Lookup

Before a connection can be completed or actually allowed to form, its traffic must be permitted

by an ACL. You can configure any number of ACLs in a firewall, but only one ACL can be

applied to a firewall interface in a specific direction.

Note

Before ASA 7.0(1), ACLs could be applied in only the inbound direction, to inspect traffic as it

enters the interface. In later releases, ACLs can be applied in the inbound or outbound direction.

All releases of FWSM support ACLs in both directions.

ACLs are not used to inspect a connection's state. Rather, they are used only to permit or deny

packets in a single direction, only as connections are being initiated. For connectionless

protocols such as Internet Control Message Protocol (ICMP), ACLs permit or deny all packets in

the direction in which they are applied.

By default, no ACLs are configured or applied to any of a firewall's interfaces. Connections are

permitted to initiate from a higher-security interface to a lower one—even with no ACL applied

to the higher-security interface. One exception is the Catalyst 6500 Firewall Services Module

(FWSM), which requires an ACL on any interface before permitting traffic to pass. However, no

connections are allowed to initiate from a lower-security interface to a higher one until an ACL

is applied to the lower-security interface.

ACL configuration and use are covered in greater detail in Section "6-3: Controlling Access with

Access Lists," in Chapter 6.

Uauth Lookup

A Cisco firewall can authenticate users as they pass through to initiate connections. After a user

is successfully authenticated, the firewall keeps the user credentials cached so that additional

connections can be quickly approved. In other words, the firewall acts as a cut-through

authentication proxy so that no further authentication is needed.

User authentication occurs by a request-reply exchange between the firewall and an

authentication, authorization, and accounting (AAA) server, such as Remote Authentication

Dial-In User Service (RADIUS) or Terminal Access Controller Access Control System Plus

(TACACS+).

After a user is authenticated, the firewall can also request authorization information from the

server. This information is used to limit users to reaching only specific resources through the

firewall. The firewall can authorize users through one of the following methods:

• Retrieving a AAA attribute for the user

• Controlling the user's connections with an ACL referenced by the AAA server

• Controlling the user's connections with an ACL that has been downloaded from the AAA

server

The firewall performs these functions by keeping a table of authenticated users and their user

authentication (uauth) attributes. The uauth table records each authenticated user, along with his

or her source IP address, the authorization ACL name (if any), and session timer values. In

Chapter 5, "Managing Firewall Users," Section "5-5: Configuring AAA for End-User Cut-

Through Proxy," covers AAA functions in greater detail.

After a user authenticates with the firewall, he can use and create new connections until his

absolute uauth timer expires. As well, the firewall tracks to see if the user has not sent or

received data on any of his connections for an idle uauth timer period. If the idle timer expires,

that user is deleted from the uauth table, and all current connections are closed. That user is

required to reauthenticate when he attempts a new connection. If the absolute timer expires, all

the user's existing connections are allowed to remain open. However, the user is prompted to

reauthenticate when a new connection is initiated.

Inspection Engine

The firewall inspects each connection and applies rules according to the protocol being used.

This process has traditionally been called fixup, and more recently an inspection engine or

application layer protocol inspection.

Some protocols are simple and have very loose guidelines about the traffic between source and

destination. These are called connectionless protocols, and they include ICMP and UDP. Other

protocols are very strict about the handshaking and packet exchange between source and

destination. These are called connection-oriented protocols, and they include TCP.

1-2. Inspection Engines for ICMP, UDP, and TCP

The following sections outline the basic stateful inspection of each type of applicable protocol.

ICMP Inspection

ICMP is a connectionless protocol, because it allows one host to send another host a message

without expecting a reply. Because of this, a firewall cannot examine or track the state of ICMP

traffic between two machines. However, beginning with ASA 7.0(1) and FWSM 3.1(1), a

firewall can track the state of ICMP packet exchanges, offering an approximation of a stateful

inspection.

A firewall must rely on some of its basic mechanisms for inspecting ICMP traffic—the xlate

table and ACLs. Note that no connections are used with ICMP, so no conn entries are created for

ICMP traffic. Figure 1-5

shows how a Cisco firewall reacts when it needs to handle ICMP traffic

between two hosts on different interfaces.

Figure 1-5. How a Firewall Handles ICMP Traffic

剩余963页未读，继续阅读

x火志x

粉丝: 0
资源: 3

Cisco ASA, PIX, FWSM防火墙指南：全面详解与配置

Cisco ASA, PIX, and FWSM Firewall Handbook (2nd Edition)

思科 ASA 和 PIX 防火墙配置手册

Cisco ASA PIX and FWSM Handbook 2nd Edition英文版

Cisco PIX防火墙配置详解

CycleGAN and pix2pix

pytorch-cyclegan-and-pix2pix

pytorch-cyclegan-and-pix2pix怎么用预训练好的模型

CycleGAN and pix2pix in PyTorch

mac深度学习PIX2PIX

pix2pix pypi

最新资源