配置加密流量洞察
开始之前
-
将 SRX 系列防火墙注册到瞻博网络 ATP 云。有关更多信息，请参阅 使用 CLI 注册 SRX 系列防火墙。
要在 SRX 系列防火墙上启用加密流量洞察，请加入以下 CLI 配置：
-
配置 security-metadata-streaming 策略。
set services security-metadata-streaming policy sms_policy http detections encryptedc2 action permit set services security-metadata-streaming policy sms_policy http detections encryptedc2 notification log
-
将 security-metadata-streaming 策略附加到安全防火墙策略。
set security policies from-zone trust to-zone untrust application-services security-metadata-streaming-policy sms_policy set security policies from-zone untrust to-zone trust application-services security-metadata-streaming-policy sms_policy
-
提交配置。
commit
使用该命令查看 show services security-metadata-streaming http statistics 安全元数据流策略的统计信息。
show services security-metadata-streaming http statistics
show services security-metadata-streaming http statistics Security Metadata Streaming session statistics: Session inspected: 10 Session whitelisted: 0 Session detected: 6 Security Metadata Streaming submission statistics: Records submission success: 8 Records submission failure: 2
要查看已列入加密流量洞察允许列表的服务器列表，请使用命令 show services security-metadata-streaming http whitelist 。
show services security-metadata-streaming http whitelist
show services security-metadata-streaming http whitelist No. IP-start IP-end Feed Address 1 192 0.5.0 192.0.5.1 eta_custom_whitelist ID-80001400