用于数据包捕获的 IDP 实用程序
用于数据包捕获的 IDP 实用程序是 SRX 系列防火墙上的专用工具，用于捕获、管理和分析与 IDP 事件相关的数据包数据。
数据包捕获实用程序用于分析数据包捕获文件，即记录网络流量的文件。IDP 实用程序允许网络管理员检查这些数据包捕获文件，以识别网络流量中的潜在安全威胁或异常。
使用 功能浏览器 确认平台和版本对特定功能的支持。
查看特定 于平台的数据包捕获行为 部分，了解与您的平台相关的说明。
了解数据包捕获
在 SRX300、SRX320、SRX340、SRX345、SRX550 SRX550HM设备上，为了改进 IDP 验证过程，引入了 CLI 命令来显示和清除仅用于数据包捕获 （PCAP） 流量的上下文和关联数据。
您可以在 inet 模式或透明模式下运行数据包捕获实用程序以生成协议上下文。您应该从 UNIX shell 提示符 （%） 运行命令行 PCAP 馈线实用程序工具。
PCAP 馈线实用程序使用流量中可用的一对源和目的 IPv4 地址、要馈送数据包的接口以及为注入这些 PCAP 的接口配置的 IPV4 地址。 将 PCAP 馈送到这些接口后，系统将与 PCAP 关联的上下文列表以及与上下文匹配的数据。仅针对 PCAP 馈线生成的流量显示上下文、命中和关联数据。不会捕获实时流量统计信息。馈送数据包时，请确保将数据包馈送到接口的子网 IP。如果将数据包馈送到接口 IP，则 IDP 安全处理可能无法检测到上下文。除接口 IP 外，可使用所有其他子网 IP。
在通过 PCAP 馈线实用程序工具运行新的 PCAP 之前，请使用以下 clear contexts 命令清除现有上下文和数据：
[edit security] user@host> clear security idp attack context user@host> clear security flow session interface <intf1> user@host> clear security flow session interface <intf2> user@host> clear security flow session idp user@host> clear security idp attack table
用于 Inet 模式 PCAP 馈线的示例命令：
% pcapfeed –verbose --interface-ip1 5.0.0.13 --interface-ip2 15.0.0.14 --pcap-ip1 6.0.0.1 --pcap-ip2 7.0.0.1 --interface1 ge-0/0/6 --interface2 ge-0/0/7 --pcap /var/tmp/http.pcap
或
% pcapfeed –quiet --interface-ip1 5.0.0.13 --interface-ip2 15.0.0.14 --pcap-ip1 6.0.0.1 --pcap-ip2 7.0.0.1 --interface1 ge-0/0/6 --interface2 ge-0/0/7 --pcap /var/tmp/http.pcap
用于透明模式 PCAP 馈线的示例命令：
% pcapfeed –verbose –transparent --pcap-ip1 6.0.0.1 --pcap-ip2 7.0.0.1 --interface1 ge-0/0/6 --interface2 ge-0/0/7 --pcap /var/tmp/http.pcap
或
% pcapfeed –quiet –transparent --pcap-ip1 6.0.0.1 --pcap-ip2 7.0.0.1 --interface1 ge-0/0/6 --interface2 ge-0/0/7 --pcap /var/tmp/http.pcap
表 1 定义了上述示例输出中的 PCAP 进纸器工具字段。
Fields |
Description |
pcap --quiet |
禁止日志出现在控制台中 |
pcap --详细 |
使日志能够显示在控制台中 |
接口 IP1 |
用于提供 PCAP 数据包的第一个接口的 IP 地址 |
接口-ip2 |
用于提供 PCAP 数据包的其他接口的 IP 地址 |
PCAP-IP1 |
PCAP 中看到的 IP 地址 |
PCAP-IP2 |
PCAP 中看到的另一个 IP 地址 |
接口 1 |
SRX 设备中的接口 1 |
接口2 |
SRX 设备中的接口 1 |
PCAP 馈线不支持：
IPv6
FTP 等多通道协议
示例：在 inet 模式下配置数据包捕获馈送器
此示例说明如何在 inet 模式下运行数据包捕获 （PCAP） 馈线以生成协议上下文。
要求
开始之前：
配置网络接口。
概述
使用相关 IDP 策略运行 PCAP 馈线以获取关联的协议上下文。在本例中，PCAP 在安静模式下使用 pcap-ip1 6.0.0.1 和 pcap-ip2 7.0.0.1 馈送。
配置
程序
CLI 快速配置
要快速配置此示例，请复制以下命令，将其粘贴到文本文件中，删除所有换行符，更改详细信息，以便与网络配置匹配，然后将命令复制并粘贴到层 [edit] 级的 CLI 中，然后从配置模式进入 commit 。
set security idp idp-policy idppolicy rulebase-ips rule 1 match from-zone any set security idp idp-policy idppolicy rulebase-ips rule 1 match source-address any set security idp idp-policy idppolicy rulebase-ips rule 1 match to-zone any set security idp idp-policy idppolicy rulebase-ips rule 1 match destination-address any set security idp idp-policy idppolicy rulebase-ips rule 1 match application default set security idp idp-policy idppolicy rulebase-ips rule 1 match attacks predefined-attack-groups “HTTP - All” set security idp idp-policy idppolicy rulebase-ips rule 1 then action close-client-and-server set security idp idp-policy idppolicy rulebase-ips rule 1 then notification log-attacks set security forwarding-options family inet6 mode flow-based set security policies from-zone trust to-zone untrust policy 1 match source-address any set security policies from-zone trust to-zone untrust policy 1 match destination-address any set security policies from-zone trust to-zone untrust policy 1 match application any set security policies from-zone trust to-zone untrust policy 1 then permit application-services idp-policy idppolicy set security policies from-zone untrust to-zone trust policy 1 match source-address any set security policies from-zone untrust to-zone trust policy 1 match destination-address any set security policies from-zone untrust to-zone trust policy 1 match application any set security policies from-zone untrust to-zone trust policy 1 then permit application-services idp-policy idppolicy set security zones security-zone untrust host-inbound-traffic system-services all set security zones security-zone untrust host-inbound-traffic protocols all set security zones security-zone untrust interfaces ge-0/0/0.0 set security zones security-zone untrust application-tracking set security zones security-zone trust host-inbound-traffic system-services all set security zones security-zone trust host-inbound-traffic protocols all set security zones security-zone trust interfaces ge-0/0/2.0 set interfaces ge-0/0/0 unit 0 family inet address 5.0.0.15/24 set interfaces ge-0/0/2 unit 0 family inet address 15.0.0.16/24
分步过程
下面的示例要求您在各个配置层级中进行导航。有关作说明，请参阅 CLI 用户指南中的在配置模式下使用 CLI 编辑器。
要创建应用程序并将其与 IDP 策略关联，请执行以下作：
通过为其分配有意义的名称来创建策略，将规则库与策略相关联，向规则库添加规则，并为规则定义匹配条件。
[edit security] user@host#set idp idp-policy idppolicy rulebase-ips rule 1 match from-zone any user@host#set idp idp-policy idppolicy rulebase-ips rule 1 match source-address any user@host#set idp idp-policy idppolicy rulebase-ips rule 1 match to-zone any user@host#set idp idp-policy idppolicy rulebase-ips rule 1 match destination-address any user@host#set idp idp-policy idppolicy rulebase-ips rule 1 match application default user@host#set idp idp-policy idppolicy rulebase-ips rule 1 match attacks predefined-attack-groups “HTTP - All” user@host#set idp idp-policy idppolicy rulebase-ips rule 1 then action close-client-and-server user@host#set idp idp-policy idppolicy rulebase-ips rule 1 then notification log-attacks user@host#set forwarding-options family inet6 mode flow-based
配置策略。
[edit security] user@host#set policies from-zone trust to-zone untrust policy 1 match source-address any user@host#set policies from-zone trust to-zone untrust policy 1 match destination-address any user@host#set policies from-zone trust to-zone untrust policy 1 match application any user@host#set policies from-zone trust to-zone untrust policy 1 then permit application-services idp-policy idppolicy user@host#set policies from-zone untrust to-zone trust policy 1 match source-address any user@host#set policies from-zone untrust to-zone trust policy 1 match destination-address any user@host#set policies from-zone untrust to-zone trust policy 1 match application any user@host#set policies from-zone untrust to-zone trust policy 1 then permit application-services idp-policy idppolicy
配置区域并分配接口。
[edit security] user@host# set zones security-zone untrust host-inbound-traffic system-services all user@host# set zones security-zone untrust host-inbound-traffic protocols all user@host# set zones security-zone untrust interfaces ge-0/0/0.0 user@host# set zones security-zone untrust application-tracking user@host# set zones security-zone trust host-inbound-traffic system-services all user@host# set zones security-zone trust host-inbound-traffic protocols all user@host# set zones security-zone trust interfaces ge-0/0/2.0
配置转发接口。
[edit] user@host# set interfaces ge-0/0/0 unit 0 family inet address 5.0.0.15/24 user@host# set interfaces ge-0/0/2 unit 0 family inet address 15.0.0.16/24
结果
在配置模式下，输入 show security idp 和 show applications 命令，以确认您的配置。如果输出未显示预期的配置，请重复此示例中的配置说明，以便进行更正。
[edit]
user@host# show security idp
idp-policy idppolicy {
rulebase-ips {
rule 1 {
match {
from-zone any;
source-address any;
to-zone any;
destination-address any;
application default;
}
then {
action {
close-client-and-server;
}
notification {
log-attacks;
}
}
}
}
}
[edit]
user@host# show security policies
from-zone trust to-zone untrust {
policy 1 {
match {
source-address any;
destination-address any;
application any;
}
then {
permit {
application-services {
idp-policy idppolicy;
}
}
}
}
[edit]
user@host# show security zones
security-zone untrust {
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
interfaces {
ge-0/0/0.0;
}
application-tracking;
}
[edit]
user@host# show interfaces
ge-0/0/0 {
unit 0 {
family inet {
address 5.0.0.15/24;
}
}
}
ge-0/0/2 {
unit 0 {
family inet {
address 15.0.0.16/24;
}
}
}
如果完成设备配置，请从配置模式输入 commit 。
验证
要确认配置工作正常，请执行以下任务：
验证配置
目的
在使用 PCAP 馈线工具运行 PCAP 后，验证 IDP 攻击上下文。
行动
在作模式下，输入 show security idp attack context 命令。
示例输出
命令-名称
user@host> show security idp attack context IDP context statistics: Context name #Hits #Data http-url 1 / http-get-url 1 / http-header-host 1 7.0.0.1 http-header-user-agent 1 lwp-request/5.827 libwww-perl/5.833 http-header 2 te: deflate,gzip;q=0.3 && connection: TE, close http-request 1 GET / HTTP/1.1 http-request-method 1 GET / HTTP/1.1
示例：在透明模式下配置数据包捕获馈线
此示例说明如何在透明模式下运行数据包捕获 （PCAP） 馈线以生成协议上下文。
要求
开始之前：
配置网络接口。
概述
使用相关 IDP 策略运行某些 PCAP 馈线，以便从数据包捕获中运行的数据包中获取关联的协议上下文。在此示例中，PCAP 馈线 pcap-ip 2 7.0.0.1 在安静模式下用于馈送数据包。
配置
程序
CLI 快速配置
要快速配置此示例，请复制以下命令，将其粘贴到文本文件中，删除所有换行符，更改详细信息，以便与网络配置匹配，然后将命令复制并粘贴到层 [edit] 级的 CLI 中，然后从配置模式进入 commit 。
set groups global protocols l2-learning global-mode transparent-bridge set security idp idp-policy idppolicy rulebase-ips rule 1 match from-zone any set security idp idp-policy idppolicy rulebase-ips rule 1 match source-address any set security idp idp-policy idppolicy rulebase-ips rule 1 match to-zone any set security idp idp-policy idppolicy rulebase-ips rule 1 match destination-address any set security idp idp-policy idppolicy rulebase-ips rule 1 match application default set security idp idp-policy idppolicy rulebase-ips rule 1 match attacks predefined-attack-groups “HTTP - All” set security idp idp-policy idppolicy rulebase-ips rule 1 then action close-client-and-server set security idp idp-policy idppolicy rulebase-ips rule 1 then notification log-attacks set security policies from-zone trust to-zone untrust policy 1 match source-address any set security policies from-zone trust to-zone untrust policy 1 match destination-address any set security policies from-zone trust to-zone untrust policy 1 match application any set security policies from-zone trust to-zone untrust policy 1 then permit application-services idp-policy idppolicy set security policies from-zone untrust to-zone trust policy 1 match source-address any set security policies from-zone untrust to-zone trust policy 1 match destination-address any set security policies from-zone untrust to-zone trust policy 1 match application any set security policies from-zone untrust to-zone trust policy 1 then permit application-services idp-policy idppolicy set security zones security-zone untrust host-inbound-traffic system-services all set security zones security-zone untrust host-inbound-traffic protocols all set security zones security-zone untrust interfaces ge-0/0/0.0 set security zones security-zone untrust application-tracking set security zones security-zone trust host-inbound-traffic system-services all set security zones security-zone trust host-inbound-traffic protocols all set security zones security-zone trust interfaces ge-0/0/2.0 set interfaces ge-0/0/0 unit 0 family ethernet-switching interface-mode access set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members 301 set interfaces ge-0/0/2 unit 0 family ethernet-switching interface-mode access set interfaces ge-0/0/2 unit 0 family ethernet-switching vlan members 301 set interfaces irb unit 301 family inet address 1.1.1.11/8 set vlans bd-vlan-301 vlan-id 301 set vlans bd-vlan-301 l3-interface irb.301
分步过程
下面的示例要求您在各个配置层级中进行导航。有关作说明，请参阅 CLI 用户指南中的在配置模式下使用 CLI 编辑器。
要创建应用程序并将其与 IDP 策略关联，请执行以下作：
设置配置组。
[edit] user@host#set groups global protocols l2-learning global-mode transparent-bridge
通过为其分配有意义的名称来创建策略，将规则库与策略相关联，向规则库添加规则，并为规则定义匹配条件。
[edit security] user@host# set idp idp-policy idppolicy rulebase-ips rule 1 match from-zone any user@host# set idp idp-policy idppolicy rulebase-ips rule 1 match source-address any user@host# set idp idp-policy idppolicy rulebase-ips rule 1 match to-zone any user@host# set idp idp-policy idppolicy rulebase-ips rule 1 match destination-address any user@host# set idp idp-policy idppolicy rulebase-ips rule 1 match application default user@host# set idp idp-policy idppolicy rulebase-ips rule 1 match attacks predefined-attack-groups “HTTP - All” user@host# set idp idp-policy idppolicy rulebase-ips rule 1 then action close-client-and-server user@host# set idp idp-policy idppolicy rulebase-ips rule 1 then notification log-attacks user@host# set forwarding-options family inet6 mode flow-based
配置策略。
[edit security] user@host# set policies from-zone trust to-zone untrust policy 1 match source-address any user@host# set policies from-zone trust to-zone untrust policy 1 match destination-address any user@host# set policies from-zone trust to-zone untrust policy 1 match application any user@host# set policies from-zone trust to-zone untrust policy 1 then permit application-services idp-policy idppolicy user@host# set policies from-zone untrust to-zone trust policy 1 match source-address any user@host# set policies from-zone untrust to-zone trust policy 1 match destination-address any user@host# set policies from-zone untrust to-zone trust policy 1 match application any user@host# set policies from-zone untrust to-zone trust policy 1 then permit application-services idp-policy idppolicy
配置区域并分配接口。
[edit security] user@host# set zones security-zone untrust host-inbound-traffic system-services all user@host# set zones security-zone untrust host-inbound-traffic protocols all user@host# set zones security-zone untrust interfaces ge-0/0/0.0 user@host# set zones security-zone untrust application-tracking user@host# set zones security-zone trust host-inbound-traffic system-services all user@host# set zones security-zone trust host-inbound-traffic protocols all user@host# set zones security-zone trust interfaces ge-0/0/2.0
配置转发接口。
[edit] user@host# set interfaces ge-0/0/0 unit 0 family ethernet-switching interface-mode access user@host# set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members 301 user@host# set interfaces ge-0/0/2 unit 0 family ethernet-switching interface-mode access user@host# set interfaces ge-0/0/2 unit 0 family ethernet-switching vlan members 301 user@host# set interfaces irb unit 301 family inet address 1.1.1.11/8
配置 VLAN-ID。
[edit] user@host# set vlans bd-vlan-301 vlan-id 301 user@host# set vlans bd-vlan-301 l3-interface irb.301
结果
在配置模式下，输入 show security idp 和 show applications 命令，以确认您的配置。如果输出未显示预期的配置，请重复此示例中的配置说明，以便进行更正。
[edit]
user@host# show security idp
idp-policy idppolicy {
rulebase-ips {
rule 1 {
match {
from-zone any;
source-address any;
to-zone any;
destination-address any;
application default;
}
then {
action {
close-client-and-server;
}
notification {
log-attacks;
}
}
}
}
}
[edit]
user@host# show security policies
from-zone untrust to-zone trust {
policy 1 {
match {
source-address any;
destination-address any;
application any;
}
then {
permit {
application-services {
idp-policy idppolicy;
}
}
}
}
}
default-policy {
permit-all;
}
[edit]
user@host# show security zones
security-zone trust {
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
interfaces {
ge-0/0/0.0;
ge-0/0/2.0;
}
advance-policy-based-routing-profile {
p1;
}
}
security-zone untrust {
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
interfaces {
ge-0/0/1.0;
ge-0/0/2.0;
ge-0/0/3.0;
ge-0/0/0.0;
}
application-tracking;
}
[edit]
user@host# show interfaces
ge-0/0/0 {
unit 0 {
family inet {
address 4.0.0.1/24;
}
family ethernet-switching {
interface-mode access;
vlan {
members 301;
}
}
}
}
ge-0/0/2 {
unit 0 {
family inet {
address 192.0.3.1/24;
}
family ethernet-switching {
interface-mode access;
vlan {
members 301;
}
}
}
}
如果完成设备配置，请从配置模式输入 commit 。
验证
要确认配置工作正常，请执行以下任务：
验证配置
目的
在使用 PCAP 馈线工具运行 PCAP 后，验证 IDP 攻击上下文。
行动
在作模式下，输入 show security idp attack context 命令。
示例输出
命令-名称
user@host> show security idp attack context IDP context statistics: Context name #Hits #Data http-url 1 / http-get-url 1 / http-header-host 1 7.0.0.1 http-header-user-agent 1 lwp-request/5.827 libwww-perl/5.833 http-header 2 te: deflate,gzip;q=0.3 && connection: TE, close http-request 1 GET / HTTP/1.1 http-request-method 1 GET / HTTP/1.1
特定于平台的数据包捕获行为
使用 功能浏览器 确认平台和版本对特定功能的支持。
使用下表查看您的平台特定于平台的行为。
| 平台 |
差异 |
|---|---|
| SRX 系列防火墙 |
支持数据包捕获的 SRX300、SRX320、SRX340 和 SRX345 防火墙支持命令 |