中文字幕无码久久精品,13—14同岁无码A片,99热门精品一区二区三区无码,菠萝菠萝蜜在线观看视频高清1

您當(dāng)前的位置是:  首頁(yè) > 新聞 > 國(guó)內(nèi) >
 首頁(yè) > 新聞 > 國(guó)內(nèi) >

瞻博網(wǎng)絡(luò)防護(hù)有效應(yīng)對(duì)勒索軟件(更新)

2017-05-25 09:30:09   作者:   來(lái)源:CTI論壇   評(píng)論:0  點(diǎn)擊:


\  
  關(guān)于Wannacry勒索軟件的網(wǎng)絡(luò)防護(hù)的更新:
  一、Juniper防火墻設(shè)備:
  1. 采用防火墻策略,阻止protocol為tcp的目的端口的445(135/137/138/139的類似)的訪問;
  2. 更新IDP的入侵防御特征庫(kù)并部署特征匹配;
  3. 采用Sky ATP的防御機(jī)制;
  4. 結(jié)合軟件定義的安全網(wǎng)絡(luò)解決方案(SDSN)實(shí)施整體防護(hù)。
  Juniper路由設(shè)備:
  1、定義filter,阻止protocol tcp的445端口(135/137/138/139的類似,在discard的term里面加入即可)
  set firewall family inet filterDENY_WANNACRY term deny_wannacry from destination-port 445
  set firewall family inetfilter DENY_WANNACRY term deny_wannacry from protocol tcp
  ##set firewall family inet filterDENY_WANNACRY term deny_wannacry from destination-port 135-139 ##
  set firewall family inet filterDENY_WANNACRY term deny_wannacry then discard
  set firewall family inet filterDENY_WANNACRY term default then accept
  2、在forwarding-options下應(yīng)用
  set forwarding-options family inet filter input DENY_WANNACRY
  Juniper交換設(shè)備:
  采用group方式在接口上批量應(yīng)用filter(有大量業(yè)務(wù)接口時(shí)使用這種方法可節(jié)省工作量)
  1、定義groupIFS_DENY_WANNACRY:所有g(shù)e接口的所有子接口入方向應(yīng)用filter DENY_WANNACRY
  set groups IFS_DENY_WANNACRY interfaces<ge-*> unit <*> family ethernet-switching filter inputDENY_WANNACRY
 。ㄗⅲ河惺褂玫狡渌涌陬愋,使用上述配置方法增加)
  2、定義filterDENY_WANNACRY, 阻止ip-protocol tcp的445端口(135/137/138/139的類似)
  set firewall family ethernet-switchingfilter DENY_WANNACRY term deny_wannacry from destination-port 445
  set firewall familyethernet-switching filter DENY_WANNACRY term deny_wannacry from ip-protocol tcp
  ##setfirewall family ethernet-switching filter DENY_WANNACRY term deny_wannacry fromdestination-port 135-139 ##
  set firewall family ethernet-switchingfilter DENY_WANNACRY term deny_wannacry then discard
  set firewall family ethernet-switchingfilter DENY_WANNACRY term default then accept
  3、應(yīng)用group配置
  set apply-groups IFS_DENY_WANNACRY
  注意事項(xiàng):
  1)、需要在firewall filter或者application對(duì)象定義里面加入protocol tcp(防火墻和路由設(shè)備)或者ip-protocol tcp(交換設(shè)備),才能更精確地匹配可能的惡意訪問
  2)、如果接口下已有filter配置,這個(gè)接口下的group配置不會(huì)生效,要在接口已有filter配置下修改
  3)、filter最后一個(gè)term要放行其他所有流量,否則會(huì)影響業(yè)務(wù)

專題