|
所在平台: Udemy |
课程主页: https://www.udemy.com/course/cisco-asa-firewall-g/
课程评论：没有评论
课程名称：Cisco ASA Firewall 课程概述： Cisco ASA防火墙已成为中小型企业中最广泛使用的防火墙和VPN解决方案之一。防火墙作为可信网络与不可信网络之间的屏障，通常位于局域网（LAN）与广域网（WAN）之间。其作用是检查所有数据包，在此过程中决定是丢弃还是允许其通过。 架构方面，ASA软件基于Linux操作系统，运行一个称为lina的可执行连接格式程序。该程序内部调度进程，而不是使用Linux的设施。启动序列中，一个称为ROMMON的引导加载程序首先启动，加载Linux内核和lina_monitor，最终加载lina。ROMMON还包含一个命令行接口，用以加载或选择其他软件映像和配置。固件文件的名称包含版本指示符，其中-smp表示针对对称多处理器（64位架构），不同部分也指示是否支持3DES或AES。 ASA软件的接口类似于Cisco路由器上的IOS软件，用户可以通过命令行接口（CLI）查询、操作或配置设备。在配置模式下，配置语句被输入。配置最初在内存中作为运行配置存在，通常会保存到闪存中。 选项方面，5512-X、5515-X、5525-X、5545-X和5555-X可以添加额外的接口卡，而5585-X具有安全服务处理器（SSP）的选项，处理能力可以相差10倍（从SSP-10到SSP-60）。ASA 5585-X还有一个I/O模块插槽，可以划分为两个半宽模块。在低端型号中，一些功能受到限制，通过安装Security Plus许可证可以解除限制，这将启用更多的VLAN或VPN对等体，以及高可用性。Cisco AnyConnect是一项额外的可许可功能，可通过IPSec或SSL隧道在PC、iPhone或iPad客户端上运行。 状态过滤： 防火墙与路由器一样，可以使用访问列表检查源和/或目的地址或端口号。大多数路由器在过滤数据包时花费的时间较少，它们收到数据包后，仅检查该数据包是否符合访问列表的条目，并据此决定是允许还是丢弃该数据包。这称为无状态过滤。而防火墙使用状态过滤，跟踪所有进出连接。 例如，当局域网中的计算机使用邮件客户端连接互联网的邮件服务器时，客户端会通过TCP三次握手启动连接，防火墙记录下该连接。当邮件服务器响应时，防火墙会自动允许此流量返回客户端。另一个例子是，位于防火墙后的Web服务器，其平均每秒接受来自不同IP地址的20个新TCP连接。防火墙会跟踪所有连接，一旦看到某个源IP地址请求超过每秒10个新的TCP连接，就会丢弃该源IP地址的所有流量，从而防止拒绝服务（DoS）攻击。 课程没有提供详细的教学大纲。
Cisco ASA has become one of the most widely used firewall/VPN solutions for small to medium businesses.The firewall is the barrier between a trusted and untrusted network, often used between your LAN and WAN. It's typically placed in the forwarding path so that all packets have to be checked by the firewall, where we can drop or permit them.ArchitectureThe ASA software is based on Linux. It runs a single Executable and Linkable Format program called lina. This schedules processes internally rather than using the Linux facilities. In the boot sequence a boot loader called ROMMON (ROM monitor) starts, loads a Linux kernel, which then loads the lina_monitor, which then loads lina. The ROMMON also has a command line that can be used to load or select other software images and configurations. The names of firmware files includes a version indicator, -smp means it is for a symmetrical multiprocessor (and 64 bit architecture), and different parts also indicate if 3DES or AES is supported or not.The ASA software has a similar interface to the Cisco IOS software on routers. There is a command line interface (CLI) that can be used to query operate or configure the device. In config mode the configuration statements are entered. The configuration is initially in memory as a running-config but would normally be saved to flash memory.OptionsThe 5512-X, 5515-X, 5525-X, 5545-X and 5555-X can have an extra interface card addedThe 5585-X has options for SSP. SSP stands for security services processor. These range in processing power by a factor of 10, from SSP-10 SSP-20, SSP-40 and SSP-60. The ASA 5585-X has a slot for an I/O module. This slot can be subdivided into two half width modules.On the low end models, some features are limited, and uncrippling happens with installation of a Security Plus License. This enables more VLANs, or VPN peers, and also high availability. Cisco AnyConnect is an extra licensable feature which operates IPSec or SSL tunnels to clients on PCs, iPhones or iPads.Stateful filteringFirewalls, like routers can use access-lists to check for the source and/or destination address or port numbers. Most routers however, don't spend much time at filtering…when they receive a packet, they check if it matches an entry in the access-list and if so, they permit or drop the packet. That's it.No matter if they receive a single packet or thousands, each packet is treated individually and we don't keep track of packets we have seen before or not. This is called stateless filtering.Firewalls, on the other hand, use stateful filtering. They keep track of all incoming and outgoing connections. Here are some examples:A computer on the LAN uses its email client to connect to a mail server on the Internet. The client will start the connection with a TCP three-way handshake, which the firewall sees. The firewall will keep track of this connection and when the mail server responds, the firewall will automatically permit this traffic to return to the client.A web server is sitting behind a firewall, it's a busy server that accepts an average of 20 new TCP connections per second from different IP addresses. The firewall keeps track of all connections, once it sees a source IP address that is requesting more than 10 new TCP connections per second, it will drop all traffic from this source IP address, preventing a DoS (Denial of Service).
