园区网络安全设计——出口防火墙

网络接入人员众多，业务复杂，流量构成丰富多样；容易成为DDoS攻击的目标，而且一旦攻击成功，业务损失巨大；网络病毒活跃，严重威胁网络安全和终端的安全；出于业务需求，内网对外提供网络服务，例如公司网站、邮件服务等，这些潜在的不安全因素都威胁着园区网络的安全。

防火墙作为整个网络和出口，肩负着整个网络的安全责任，针对上述安全需求，可在出口防火墙上部署如下安全业务：

1. 将企业员工网络、公司服务器网络、外部网络划分到不同安全区域，对安全区域间的流量进行检测和保护。
2. 根据公司对外提供的网络服务的类型开启相应的内容安全防护功能。例如针对文件服务器开启文件过滤和内容过滤，针对邮件服务器开启邮件过滤，并且针对所有服务器开启反病毒和入侵防御。
3. 针对内网员工访问外部网络的行为，开启URL过滤、文件过滤、内容过滤、应用行为控制、反病毒等功能，既保护内网主机不受外网威胁，又可以防止企业机密信息的泄露，提高企业网络的安全性。
4. 开启DDoS防御功能，抵抗外网主机对内网服务器进行的大流量攻击，保证企业业务的正常开展。
5. 针对内外网之间的流量部署带宽策略，控制流量带宽和连接数，避免网络拥塞，同时也可辅助进行DDoS攻击的防御。
6. 部署华为网管系统（需要单独采购），记录网络运行的日志信息。日志信息可以帮助管理员进行配置调整、风险识别和流量审计。

安全区域划分

系统缺省已经创建了四个安全区域。但是如果用户还需要划分更多的安全等级，可以自行创建新的安全区域并定义其安全等级。安全区域创建完成后，还需要将相应接口加入安全区域。之后，从该接口接收的或发送出去的报文才会被认为是属于该安全区域。否则接口默认不属于任何安全区域，将不能通过该接口与其他安全区域通信。

接口划分不同的安全区域。

[FW] firewall zone untrust
[FW-zone-untrust] add interface GigabitEthernet 1/0/1
[FW-zone-untrust] quit
[FW] firewall zone trust
[FW-zone-trust] add interface GigabitEthernet 1/0/3
[FW-zone-trust] quit# 配置安全策略（默认deny所有流量）。

配置安全策略，允许内部网络中的PC访问Internet。

[FW] security-policy
[FW-security-policy] rule name policy_sec_1
[FW-security-policy-sec_policy_1] source-address 10.3.0.0 mask 255.255.255.0
[FW-security-policy-sec_policy_1] source-zone trust
[FW-security-policy-sec_policy_1] destination-zone untrust
[FW-security-policy-sec_policy_1] action permit
[FW-security-policy-sec_policy_1] quit
[FW-security-policy] quit

过滤功能

URL过滤

配置URL过滤配置文件。

[FW] profile type url-filter name profile_url_research 
[FW-profile-url-filter-profile_url_research] category user-defined action block
[FW-profile-url-filter-profile_url_research] category pre-defined action block
[FW-profile-url-filter-profile_url_research] category pre-defined category-id 15 action allow
[FW-profile-url-filter-profile_url_research] category pre-defined category-id 17 action allow
[FW-profile-url-filter-profile_url_research] quit

配置安全策略。

[FW-policy-security] rule name policy_sec_research
[FW-policy-security-rule-policy_sec_research] source-zone trust
[FW-policy-security-rule-policy_sec_research] destination-zone untrust
[FW-policy-security-rule-policy_sec_research] user user-group /default/research
[FW-policy-security-rule-policy_sec_research] action permit
[FW-policy-security-rule-policy_sec_research] profile url-filter profile_url_research
[FW-policy-security-rule-policy_sec_research] quit

提交内容安全配置文件。

[FW] engine configuration commit
Info: The operation may last for several minutes, please wait.
Info: URL submitted configurations successfully.
Info: Finish committing engine compiling.文件过滤

新建配置文件profile_file_internet，禁止上传可执行文件。

[FW] profile type file-block name profile_file_internet
[FW-profile-file-block-profile_file_internet] rule name rule1
[FW-profile-file-block-profile_file_internet-rule-rule1] application all
[FW-profile-file-block-profile_file_internet-rule-rule1] file-type pre-defined name EXE MSI RPM OCX A ELF DLL PE SYS
[FW-profile-file-block-profile_file_internet-rule-rule1] direction upload
[FW-profile-file-block-profile_file_internet-rule-rule1] action block
[FW-profile-file-block-profile_file_internet-rule-rule1] quit
[FW-profile-file-block-profile_file_internet] quit

配置untrust到dmz的安全策略policy_sec_internet，并引用配置文件profile_file_internet。

[FW-policy-security] rule name policy_sec_internet
[FW-policy-security-rule-policy_sec_internet] source-zone untrust
[FW-policy-security-rule-policy_sec_internet] destination-zone dmz
[FW-policy-security-rule-policy_sec_internet] destination-address 10.2.0.5 24
[FW-policy-security-rule-policy_sec_internet] profile file-block profile_file_internet
[FW-policy-security-rule-policy_sec_internet] action permit
[FW-policy-security-rule-policy_sec_internet] quit

提交内容安全配置文件。

[FW] engine configuration commit
Info: The operation may last for several minutes, please wait.
Info: DLP submitted configurations successfully.
Info: Finish committing engine compiling.内容过滤

配置关键字组keyword1。

[FW] keyword-group name keyword1
[FW-keyword-group-keyword1] pre-defined-keyword name confidentiality weight 1
[FW-keyword-group-keyword1] user-defined-keyword name abc
[FW-keyword-group-keyword1-keyword-abc] expression match-mode Text "abcd"
[FW-keyword-group-keyword1-keyword-abc] weight 1
[FW-keyword-group-keyword1-keyword-abc] quit

为用户新建配置文件profile_data_research。

[FW] profile type data-filter name profile_data_research
[FW-profile-data-filter-profile_data_research] rule name rule1
[FW-profile-data-filter-profile_data_research-rule-rule1] keyword-group name keyword1
[FW-profile-data-filter-profile_data_research-rule-rule1] application all
[FW-profile-data-filter-profile_data_research-rule-rule1] file-type all
[FW-profile-data-filter-profile_data_research-rule-rule1] direction upload
[FW-profile-data-filter-profile_data_research-rule-rule1] action block
[FW-profile-data-filter-profile_data_research-rule-rule1] quit

为用户配置安全策略policy_sec_research，并引用配置文件profile_data_research。

[FW] security-policy
[FW-policy-security] rule name policy_sec_research
[wzh_x3-policy-security-rule-policy_sec_research] source-zone trust
[wzh_x3-policy-security-rule-policy_sec_research] destination-zone untrust
[wzh_x3-policy-security-rule-policy_sec_research] user user-group /default/research
[wzh_x3-policy-security-rule-policy_sec_research] profile data-filter profile_data_research
[wzh_x3-policy-security-rule-policy_sec_research] action permit
[wzh_x3-policy-security-rule-policy_sec_research] quit

提交内容安全配置文件。

[FW] engine configuration commit
Info: The operation may last for several minutes, please wait.
Info: DLP submitted configurations successfully.
Info: Finish committing engine compiling.

反病毒和入侵防御

部署反病毒

当内网用户通过HTTP协议下载带有病毒的文件时，下载连接被阻断。当内网用户通过POP3协议下载带有病毒的邮件时，附件被删除。

配置针对HTTP和POP3协议的反病毒配置文件。

[FW] profile type av name av_http_pop3
[FW-profile-av-av_http_pop3] http-detect direction download action block
[FW-profile-av-av_http_pop3] pop3-detect action delete-attachment
[FW-profile-av-av_http_pop3] exception application name Netease_Webmail
[FW-profile-av-av_http_pop3] exception av-signature-id 1000
[FW-profile-av-av_http_pop3] quit

配置内网用户到外网服务器方向（trust到untrust方向）的安全策略。

[FW] security-policy
[FW-policy-security] rule name policy_av_1
[FW-policy-security-rule-policy_av_1] source-zone trust
[FW-policy-security-rule-policy_av_1] destination-zone untrust
[FW-policy-security-rule-policy_av_1] action permit
[FW-policy-security-rule-policy_av_1] profile av av_http_pop3
[FW-policy-security-rule-policy_av_1] quit部署入侵防御

创建入侵防御配置文件profile_ips_pc，保护内网用户。

[FW] profile type ips name profile_ips_pc
[FW-profile-ips-profile_ips_pc] description profile for intranet users
[FW-profile-ips-profile_ips_pc] capture-packet enable
[FW-profile-ips-profile_ips_pc] signature-set name filter1
[FW-profile-ips-profile_ips_pc-sigset-filter1] target client
[FW-profile-ips-profile_ips_pc-sigset-filter1] severity high
[FW-profile-ips-profile_ips_pc-sigset-filter1] protocol HTTP
[FW-profile-ips-profile_ips_pc-sigset-filter1] quit
[FW-profile-ips-profile_ips_pc] quit# 提交配置。

[FW] engine configuration commit

配置Trust区域和Untrust区域之间的安全策略，引用入侵防御配置文件profile_ips_pc。

[FW] security-policy
[FW-policy-security] rule name policy_sec_1
[FW-policy-security-rule-policy_sec_1] source-zone trust
[FW-policy-security-rule-policy_sec_1] destination-zone untrust
[FW-policy-security-rule-policy_sec_1] source-address 10.3.0.0 24
[FW-policy-security-rule-policy_sec_1] profile ips profile_ips_pc
[FW-policy-security-rule-policy_sec_1] action permit
[FW-policy-security-rule-policy_sec_1] quit

DDoS攻击防御

例如，防火墙部署在内网出口处，企业内网部署了Web服务器。经检测，Web服务器经常受到SYN Flood、UDP Flood和HTTP Flood攻击，为了保障Web服务器的正常运行，需要在FW上开启攻击防范功能，用来防范以上三种类型的DDoS攻击。

配置攻击防范参数。

[FW] interface GigabitEthernet1/0/1
[FW-GigabitEthernet1/0/1] anti-ddos flow-statistic enable
[FW-GigabitEthernet1/0/1] quit
[FW] ddos-mode detect-clean

配置阈值学习功能。

[FW] anti-ddos baseline-learn start
[FW] anti-ddos baseline-learn tolerance-value 100
[FW] anti-ddos baseline-learn apply

开启攻击防范功能。

[FW] anti-ddos syn-flood source-detect
[FW] anti-ddos udp-flood dynamic-fingerprint-learn
[FW] anti-ddos udp-frag-flood dynamic-fingerprint-learn
[FW] anti-ddos http-flood defend alert-rate 2000
[FW] anti-ddos http-flood source-detect mode basic

带宽策略

例如：通过每用户的动态均分方式，根据实际在线用户数量动态为每个用户平均分配带宽资源。

为用户配置带宽通道。

[FW] traffic-policy
[FW-policy-traffic] profile profile_dep_a
[FW-policy-traffic-profile-profile_dep_a] bandwidth maximum-bandwidth whole downstream 60000
[FW-policy-traffic-profile-profile_dep_a] bandwidth average per-user manual multiplier 2 minimum 1000
[FW-policy-traffic-profile-profile_dep_a] quit

针对用户进行带宽管理。

[FW-policy-traffic] rule name policy_dep_a
[FW-policy-traffic-rule-policy_dep_a] source-zone trust
[FW-policy-traffic-rule-policy_dep_a] destination-zone untrust
[FW-policy-traffic-rule-policy_dep_a] user user-group /default/dep_a
[FW-policy-traffic-rule-policy_dep_a] action qos profile profile_dep_a
[FW-policy-traffic-rule-policy_dep_a] quit

上网行为审计和管理

防火墙作为企业网关部署在网络边界，管理员希望通过配置审计功能记录员工的上网行为。

针对用户配置审计配置文件。

[FW] profile type audit name profile_audit_1
[FW-profile-audit-profile_audit_1] http-audit url all
[FW-profile-audit-profile_audit_1] http-audit url recorded-title
[FW-profile-audit-profile_audit_1] http-audit file direction download
[FW-profile-audit-profile_audit_1] ftp-audit file direction download
[FW-profile-audit-profile_audit_1] http-audit bbs-content
[FW-profile-audit-profile_audit_1] http-audit micro-blog
[FW-profile-audit-profile_audit_1] quit

针对用户配置审计策略并引用审计配置文件。

[FW] audit-policy
[FW-policy-audit] rule name policy_audit_1
[FW-policy-audit-rule-policy_audit_1] description Policy of auditing for research.
[FW-policy-audit-rule-policy_audit_1] source-zone trust
[FW-policy-audit-rule-policy_audit_1] destination-zone untrust
[FW-policy-audit-rule-policy_audit_1] user user-group /default/research
[FW-policy-audit-rule-policy_audit_1] time-range time_range
[FW-policy-audit-rule-policy_audit_1] action audit profile profile_audit_1
[FW-policy-audit-rule-policy_audit_1] quit