Introduction to Security and PIX Firewall

Transcription

1 Introduction to Security and PIX Firewall Agenda Dag 23 Föreläsning LAB CR 2006

2 Cisco Secure PIX Firewall Configuration Security Levels PIX Firewall Basic Commands CR 2006

3 Adaptive Security Algorithm (ASA) Levels The security level designates whether an interface is inside (trusted) or outside (untrusted) relative to another interface. An interface is considered inside in relation to another interface if its security level is higher than the other interface's security level, and is considered outside in relation to another interface if its security level is lower than the other interface's security level.

4 Adaptive Security Algorithm (ASA) Levels The primary rule for security levels is that an interface with a higher security level can access an interface with a lower security level. Conversely, an interface with a lower security level cannot access an interface with a higher security level without a conduit (which is discussed later). Security levels range from 0 to 100, and the following are more specific rules for these security levels:

5 Adaptive Security Algorithm (ASA) Levels

6 Adaptive Security Algorithm (ASA) Levels Security level 100 This is the highest security level for the inside interface of the PIX Firewall. This is the default setting for the PIX Firewall and cannot be changed. CR 2006

7 Adaptive Security Algorithm (ASA) Levels Because 100 is the most trusted interface security level, your corporate network should be set up behind it. This is so that no one else can access it unless they are specifically given permission, and so that every device behind this interface can have access outside the corporate network.

8 Adaptive Security Algorithm (ASA) Levels Security level 0 This is the lowest security level for the outside interface of the PIX Firewall. This is the default setting for the PIX Firewall and cannot be changed. CR 2006

9 Adaptive Security Algorithm (ASA) Levels Because 0 is the least trusted interface security level, you should set your most untrusted network behind this interface so that it does not have access to other interfaces unless it is specifically given permission. This interface is usually used for your Internet connection.

10 Adaptive Security Algorithm (ASA) Levels Security levels 1-99 These are the security levels that you can assign to the perimeter interfaces connected to the PIX Firewall. You assign the security levels based on the type of access you want each device to have. CR 2006

11 Adaptive Security Algorithm (ASA) Levels More secure interface (the higher security level) to a less secure interface (the lower security level) Traffic originating from the inside interface of the PIX Firewall with a security level of 100 to the outside interface of the PIX Firewall with a security level of 0 follows this rule: allow all IPbased traffic unless restricted by access lists, authentication, or authorization. CR 2006

12 Adaptive Security Algorithm (ASA) Levels Less secure interface (lower security level) to a more secure interface (higher security level) Traffic originating from the outside interface of the PIX Firewall with a security level of 0 to the inside interface of the PIX Firewall with a security level of 100 follows this rule: CR 2006

13 Adaptive Security Algorithm (ASA) Levels Drop all packets unless specifically allowed by the conduit command. Further restrict the traffic if authentication and authorization is used.

14 Adaptive Security Algorithm (ASA) Levels Same secure interface to a same secure interface No traffic flows between two interfaces with the same security level.

15 Adaptive Security Algorithm (ASA) Levels

16 Adaptive Security Algorithm (ASA) Levels Note: The PIX Firewall can have up to four perimeter networks for a total of six interfaces.

17 PIX Firewall Basic Commands

18 PIX Firewall Basic Commands nameif Assigns a name to each perimeter interface and specifies its security level. interface Configures the type and capability of each perimeter interface. CR 2006

19 PIX Firewall Basic Commands ip address Assigns an IP address to each interface. nat Shields IP addresses on the inside network from the outside network. CR 2006

20 PIX Firewall Basic Commands global Shields IP addresses on the inside network from the outside network using a pool of IP addresses. route Defines a static or default route for an interface. CR 2006

21 The nameif command The command nameif assigns a name to each perimeter interface on the PIX Firewall and specifies its security level (except for the inside and outside PIX Firewall interfaces, which are named by default).

22 The nameif command

23 The interface command The interface command identifies hardware, sets its hardware speed, and enables the interface. When an additional Ethernet interface card is installed on the PIX Firewall, the PIX Firewall automatically recognizes the additional card.

24 The interface command

25 The interface command hardware_id Specifies an interface and its slot location on the PIX Firewall. This is the same variable that was used during the nameif command. CR 2006

26 The interface command hardware_ speed Determines the connection speed. Enter auto so the PIX Firewall will sense the speed needed for the device. Shutdown Administratively shuts down the interface. CR 2006

27 The interface command Note: When a FDDI or Token Ring interface card is installed using the interface command, you must define the FDDI or Token Ring interface card because the PIX Firewall does not automatically recognize them.

28 The ip address command Each interface on the PIX Firewall must be configured with an IP address. The syntax for the interface command is as follows:

29 The ip address command

30 The ip address command if_name Describes the interface. This name is assigned by you, and must be used in all future configuration references to the interface. ip_address The IP address of the interface Netmask If a network mask is not specified, the default network mask is assumed. CR 2006

31 The nat command Network address translation (NAT) enables you to keep your internal IP addresses those behind the PIX Firewall unknown to external networks. NAT accomplishes this by translating the internal IP addresses, which are not globally unique, into globally accepted IP addresses before packets are forwarded to the external network. CR 2006

32 The nat command

33 The nat command

34 The nat command

35 The global command The global command defines the pool of addresses to be used for translation. These are typically public addresses.the syntax for the global command is as CR 2006

36 The global command

37

38 The global command Note: The PIX Firewall assigns addresses from the global pool starting from the low end to the high end of the range specified in the global command.

39 The global command Note: The PIX Firewall uses the global addresses to assign a virtual IP address to an internal NAT address. After adding, changing, or removing a global statement, use the clear xlate command to make the IP addresses available in the translation table.

40 The route command

41

42 Configuration example