用于 PCAP 的 IDP 实用程序
了解数据包捕获
在 SRX300、SRX320、SRX340、SRX345、SRX550 SRX550HM设备上，为了改进 IDP 验证过程，引入了 CLI 命令，以仅显示和清除数据包捕获 （PCAP） 流量的上下文和关联数据。
您可以在 inet 模式或透明模式下运行数据包捕获实用程序以生成协议上下文。您应该从 UNIX 外壳提示符 （%） 运行命令行 PCAP 馈送器实用程序工具。
PCAP 馈送程序实用程序使用流量中可用的一对源和目标 IPv4 地址、数据包馈送的接口以及为注入这些 PCAP 的接口配置的 IPV4 地址。 将 PCAP 馈送到这些接口后，将与 PCAP 关联的上下文列表以及上下文的数据进行匹配。上下文、命中和关联数据将仅针对 PCAP 馈送方生成的流量显示。不会捕获实时流量统计信息。馈送数据包时，请确保将数据包馈送到接口的子网 IP。如果将数据包馈送到接口 IP，IDP 安全处理可能无法检测到上下文。除接口 IP 外，可以使用所有其他子网 IP。
在通过 PCAP 馈送器实用工具运行新的 PCAP 之前，请使用以下清除上下文命令清除现有上下文和数据：
[edit security] user@host> clear security idp attack context user@host> clear security flow session interface <intf1> user@host> clear security flow session interface <intf2> user@host> clear security flow session idp user@host> clear security idp attack table
用于 Inet 模式 PCAP 馈送器的示例命令：
% pcapfeed –verbose --interface-ip1 5.0.0.13 --interface-ip2 15.0.0.14 --pcap-ip1 6.0.0.1 --pcap-ip2 7.0.0.1 --interface1 ge-0/0/6 --interface2 ge-0/0/7 --pcap /var/tmp/http.pcap
或
% pcapfeed –quiet --interface-ip1 5.0.0.13 --interface-ip2 15.0.0.14 --pcap-ip1 6.0.0.1 --pcap-ip2 7.0.0.1 --interface1 ge-0/0/6 --interface2 ge-0/0/7 --pcap /var/tmp/http.pcap
用于透明模式 PCAP 馈送器的示例命令：
% pcapfeed –verbose –transparent --pcap-ip1 6.0.0.1 --pcap-ip2 7.0.0.1 --interface1 ge-0/0/6 --interface2 ge-0/0/7 --pcap /var/tmp/http.pcap
或
% pcapfeed –quiet –transparent --pcap-ip1 6.0.0.1 --pcap-ip2 7.0.0.1 --interface1 ge-0/0/6 --interface2 ge-0/0/7 --pcap /var/tmp/http.pcap
表 1 定义了上面提供的示例输出中的 PCAP 馈线工具字段。
Fields |
Description |
pcap --安静 |
禁止日志显示在控制台中 |
pcap --详细 |
使日志显示在控制台中 |
接口-IP1 |
用于馈送 PCAP 数据包的第一个接口的 IP 地址 |
接口-IP2 |
用于馈送 PCAP 数据包的其他接口的 IP 地址 |
pcap-IP1 |
在 PCAP 中看到的 IP 地址 |
pcap-IP2 |
在 PCAP 中看到的另一个 IP 地址 |
接口1 |
SRX 设备中的接口 1 |
接口2 |
SRX 设备中的接口 1 |
PCAP 进纸器不支持：
IPv6
多通道协议，如 FTP
示例：在 inet 模式下配置数据包捕获馈送器
此示例说明如何在 inet 模式下运行数据包捕获 （PCAP） 馈送器以生成协议上下文。
要求
准备工作：
配置网络接口。
概述
使用相关 IDP 策略运行 PCAP 馈送器以获取关联的协议上下文。在此示例中，PCAP 在安静模式下使用 pcap-ip1 6.0.0.1 和 pcap-ip2 7.0.0.1 馈送。
配置
程序
CLI 快速配置
要快速配置此示例，请复制以下命令，将其粘贴到文本文件中，删除所有换行符，更改与您的网络配置匹配所需的任何详细信息，然后将命令复制并粘贴到层次结构级别的 CLI [edit] 中，然后从配置模式进入 commit 。
set security idp idp-policy idppolicy rulebase-ips rule 1 match from-zone any set security idp idp-policy idppolicy rulebase-ips rule 1 match source-address any set security idp idp-policy idppolicy rulebase-ips rule 1 match to-zone any set security idp idp-policy idppolicy rulebase-ips rule 1 match destination-address any set security idp idp-policy idppolicy rulebase-ips rule 1 match application default set security idp idp-policy idppolicy rulebase-ips rule 1 match attacks predefined-attack-groups “HTTP - All” set security idp idp-policy idppolicy rulebase-ips rule 1 then action close-client-and-server set security idp idp-policy idppolicy rulebase-ips rule 1 then notification log-attacks set security forwarding-options family inet6 mode flow-based set security policies from-zone trust to-zone untrust policy 1 match source-address any set security policies from-zone trust to-zone untrust policy 1 match destination-address any set security policies from-zone trust to-zone untrust policy 1 match application any set security policies from-zone trust to-zone untrust policy 1 then permit application-services idp-policy idppolicy set security policies from-zone untrust to-zone trust policy 1 match source-address any set security policies from-zone untrust to-zone trust policy 1 match destination-address any set security policies from-zone untrust to-zone trust policy 1 match application any set security policies from-zone untrust to-zone trust policy 1 then permit application-services idp-policy idppolicy set security zones security-zone untrust host-inbound-traffic system-services all set security zones security-zone untrust host-inbound-traffic protocols all set security zones security-zone untrust interfaces ge-0/0/0.0 set security zones security-zone untrust application-tracking set security zones security-zone trust host-inbound-traffic system-services all set security zones security-zone trust host-inbound-traffic protocols all set security zones security-zone trust interfaces ge-0/0/2.0 set interfaces ge-0/0/0 unit 0 family inet address 5.0.0.15/24 set interfaces ge-0/0/2 unit 0 family inet address 15.0.0.16/24
分步过程
以下示例要求您在配置层次结构中导航各个级别。有关如何执行此操作的说明，请参阅 CLI 用户指南中的在配置模式下使用 CLI 编辑器。
要创建应用程序并将其与 IDP 策略关联，请执行以下操作：
通过为其分配有意义的名称来创建策略，将规则库与策略关联，向规则库添加规则，并定义规则的匹配标准。
[edit security] user@host#set idp idp-policy idppolicy rulebase-ips rule 1 match from-zone any user@host#set idp idp-policy idppolicy rulebase-ips rule 1 match source-address any user@host#set idp idp-policy idppolicy rulebase-ips rule 1 match to-zone any user@host#set idp idp-policy idppolicy rulebase-ips rule 1 match destination-address any user@host#set idp idp-policy idppolicy rulebase-ips rule 1 match application default user@host#set idp idp-policy idppolicy rulebase-ips rule 1 match attacks predefined-attack-groups “HTTP - All” user@host#set idp idp-policy idppolicy rulebase-ips rule 1 then action close-client-and-server user@host#set idp idp-policy idppolicy rulebase-ips rule 1 then notification log-attacks user@host#set forwarding-options family inet6 mode flow-based
配置策略。
[edit security] user@host#set policies from-zone trust to-zone untrust policy 1 match source-address any user@host#set policies from-zone trust to-zone untrust policy 1 match destination-address any user@host#set policies from-zone trust to-zone untrust policy 1 match application any user@host#set policies from-zone trust to-zone untrust policy 1 then permit application-services idp-policy idppolicy user@host#set policies from-zone untrust to-zone trust policy 1 match source-address any user@host#set policies from-zone untrust to-zone trust policy 1 match destination-address any user@host#set policies from-zone untrust to-zone trust policy 1 match application any user@host#set policies from-zone untrust to-zone trust policy 1 then permit application-services idp-policy idppolicy
配置区域并分配接口。
[edit security] user@host# set zones security-zone untrust host-inbound-traffic system-services all user@host# set zones security-zone untrust host-inbound-traffic protocols all user@host# set zones security-zone untrust interfaces ge-0/0/0.0 user@host# set zones security-zone untrust application-tracking user@host# set zones security-zone trust host-inbound-traffic system-services all user@host# set zones security-zone trust host-inbound-traffic protocols all user@host# set zones security-zone trust interfaces ge-0/0/2.0
配置转发接口。
[edit] user@host# set interfaces ge-0/0/0 unit 0 family inet address 5.0.0.15/24 user@host# set interfaces ge-0/0/2 unit 0 family inet address 15.0.0.16/24
结果
在配置模式下，输入 show security idp 和 show applications 命令确认您的配置。如果输出未显示预期的配置，请重复此示例中的配置说明以进行更正。
[edit]
user@host# show security idp
idp-policy idppolicy {
rulebase-ips {
rule 1 {
match {
from-zone any;
source-address any;
to-zone any;
destination-address any;
application default;
}
then {
action {
close-client-and-server;
}
notification {
log-attacks;
}
}
}
}
}
[edit]
user@host# show security policies
from-zone trust to-zone untrust {
policy 1 {
match {
source-address any;
destination-address any;
application any;
}
then {
permit {
application-services {
idp-policy idppolicy;
}
}
}
}
[edit]
user@host# show security zones
security-zone untrust {
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
interfaces {
ge-0/0/0.0;
}
application-tracking;
}
[edit]
user@host# show interfaces
ge-0/0/0 {
unit 0 {
family inet {
address 5.0.0.15/24;
}
}
}
ge-0/0/2 {
unit 0 {
family inet {
address 15.0.0.16/24;
}
}
}
如果完成设备配置，请从配置模式输入 commit 。
验证
要确认配置工作正常，请执行以下任务：
验证配置
目的
使用 PCAP 馈送程序工具运行 PCAP 后，验证 IDP 攻击上下文。
行动
在操作模式下，输入 show security idp attack context 命令。
示例输出
命令名称
user@host> show security idp attack context IDP context statistics: Context name #Hits #Data http-url 1 / http-get-url 1 / http-header-host 1 7.0.0.1 http-header-user-agent 1 lwp-request/5.827 libwww-perl/5.833 http-header 2 te: deflate,gzip;q=0.3 && connection: TE, close http-request 1 GET / HTTP/1.1 http-request-method 1 GET / HTTP/1.1
示例：在透明模式下配置数据包捕获馈送器
此示例说明如何在透明模式下运行数据包捕获 （PCAP） 馈送器以生成协议上下文。
要求
准备工作：
配置网络接口。
概述
使用相关 IDP 策略运行某些 PCAP 馈送器，以从数据包捕获运行的数据包中获取关联的协议上下文。在此示例中，PCAP 馈送器 pcap-ip 2 7.0.0.1 在安静模式下用于馈送数据包。
配置
程序
CLI 快速配置
要快速配置此示例，请复制以下命令，将其粘贴到文本文件中，删除所有换行符，更改与您的网络配置匹配所需的任何详细信息，然后将命令复制并粘贴到层次结构级别的 CLI [edit] 中，然后从配置模式进入 commit 。
set groups global protocols l2-learning global-mode transparent-bridge set security idp idp-policy idppolicy rulebase-ips rule 1 match from-zone any set security idp idp-policy idppolicy rulebase-ips rule 1 match source-address any set security idp idp-policy idppolicy rulebase-ips rule 1 match to-zone any set security idp idp-policy idppolicy rulebase-ips rule 1 match destination-address any set security idp idp-policy idppolicy rulebase-ips rule 1 match application default set security idp idp-policy idppolicy rulebase-ips rule 1 match attacks predefined-attack-groups “HTTP - All” set security idp idp-policy idppolicy rulebase-ips rule 1 then action close-client-and-server set security idp idp-policy idppolicy rulebase-ips rule 1 then notification log-attacks set security policies from-zone trust to-zone untrust policy 1 match source-address any set security policies from-zone trust to-zone untrust policy 1 match destination-address any set security policies from-zone trust to-zone untrust policy 1 match application any set security policies from-zone trust to-zone untrust policy 1 then permit application-services idp-policy idppolicy set security policies from-zone untrust to-zone trust policy 1 match source-address any set security policies from-zone untrust to-zone trust policy 1 match destination-address any set security policies from-zone untrust to-zone trust policy 1 match application any set security policies from-zone untrust to-zone trust policy 1 then permit application-services idp-policy idppolicy set security zones security-zone untrust host-inbound-traffic system-services all set security zones security-zone untrust host-inbound-traffic protocols all set security zones security-zone untrust interfaces ge-0/0/0.0 set security zones security-zone untrust application-tracking set security zones security-zone trust host-inbound-traffic system-services all set security zones security-zone trust host-inbound-traffic protocols all set security zones security-zone trust interfaces ge-0/0/2.0 set interfaces ge-0/0/0 unit 0 family ethernet-switching interface-mode access set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members 301 set interfaces ge-0/0/2 unit 0 family ethernet-switching interface-mode access set interfaces ge-0/0/2 unit 0 family ethernet-switching vlan members 301 set interfaces irb unit 301 family inet address 1.1.1.11/8 set vlans bd-vlan-301 vlan-id 301 set vlans bd-vlan-301 l3-interface irb.301
分步过程
以下示例要求您在配置层次结构中导航各个级别。有关如何执行此操作的说明，请参阅 CLI 用户指南中的在配置模式下使用 CLI 编辑器。
要创建应用程序并将其与 IDP 策略关联，请执行以下操作：
设置配置群组。
[edit] user@host#set groups global protocols l2-learning global-mode transparent-bridge
通过为其分配有意义的名称来创建策略，将规则库与策略关联，向规则库添加规则，并定义规则的匹配标准。
[edit security] user@host# set idp idp-policy idppolicy rulebase-ips rule 1 match from-zone any user@host# set idp idp-policy idppolicy rulebase-ips rule 1 match source-address any user@host# set idp idp-policy idppolicy rulebase-ips rule 1 match to-zone any user@host# set idp idp-policy idppolicy rulebase-ips rule 1 match destination-address any user@host# set idp idp-policy idppolicy rulebase-ips rule 1 match application default user@host# set idp idp-policy idppolicy rulebase-ips rule 1 match attacks predefined-attack-groups “HTTP - All” user@host# set idp idp-policy idppolicy rulebase-ips rule 1 then action close-client-and-server user@host# set idp idp-policy idppolicy rulebase-ips rule 1 then notification log-attacks user@host# set forwarding-options family inet6 mode flow-based
配置策略。
[edit security] user@host# set policies from-zone trust to-zone untrust policy 1 match source-address any user@host# set policies from-zone trust to-zone untrust policy 1 match destination-address any user@host# set policies from-zone trust to-zone untrust policy 1 match application any user@host# set policies from-zone trust to-zone untrust policy 1 then permit application-services idp-policy idppolicy user@host# set policies from-zone untrust to-zone trust policy 1 match source-address any user@host# set policies from-zone untrust to-zone trust policy 1 match destination-address any user@host# set policies from-zone untrust to-zone trust policy 1 match application any user@host# set policies from-zone untrust to-zone trust policy 1 then permit application-services idp-policy idppolicy
配置区域并分配接口。
[edit security] user@host# set zones security-zone untrust host-inbound-traffic system-services all user@host# set zones security-zone untrust host-inbound-traffic protocols all user@host# set zones security-zone untrust interfaces ge-0/0/0.0 user@host# set zones security-zone untrust application-tracking user@host# set zones security-zone trust host-inbound-traffic system-services all user@host# set zones security-zone trust host-inbound-traffic protocols all user@host# set zones security-zone trust interfaces ge-0/0/2.0
配置转发接口。
[edit] user@host# set interfaces ge-0/0/0 unit 0 family ethernet-switching interface-mode access user@host# set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members 301 user@host# set interfaces ge-0/0/2 unit 0 family ethernet-switching interface-mode access user@host# set interfaces ge-0/0/2 unit 0 family ethernet-switching vlan members 301 user@host# set interfaces irb unit 301 family inet address 1.1.1.11/8
配置 VLAN-ID。
[edit] user@host# set vlans bd-vlan-301 vlan-id 301 user@host# set vlans bd-vlan-301 l3-interface irb.301
结果
在配置模式下，输入 show security idp 和 show applications 命令确认您的配置。如果输出未显示预期的配置，请重复此示例中的配置说明以进行更正。
[edit]
user@host# show security idp
idp-policy idppolicy {
rulebase-ips {
rule 1 {
match {
from-zone any;
source-address any;
to-zone any;
destination-address any;
application default;
}
then {
action {
close-client-and-server;
}
notification {
log-attacks;
}
}
}
}
}
[edit]
user@host# show security policies
from-zone untrust to-zone trust {
policy 1 {
match {
source-address any;
destination-address any;
application any;
}
then {
permit {
application-services {
idp-policy idppolicy;
}
}
}
}
}
default-policy {
permit-all;
}
[edit]
user@host# show security zones
security-zone trust {
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
interfaces {
ge-0/0/0.0;
ge-0/0/2.0;
}
advance-policy-based-routing-profile {
p1;
}
}
security-zone untrust {
host-inbound-traffic {
system-services {
all;
}
protocols {
all;
}
}
interfaces {
ge-0/0/1.0;
ge-0/0/2.0;
ge-0/0/3.0;
ge-0/0/0.0;
}
application-tracking;
}
[edit]
user@host# show interfaces
ge-0/0/0 {
unit 0 {
family inet {
address 4.0.0.1/24;
}
family ethernet-switching {
interface-mode access;
vlan {
members 301;
}
}
}
}
ge-0/0/2 {
unit 0 {
family inet {
address 192.0.3.1/24;
}
family ethernet-switching {
interface-mode access;
vlan {
members 301;
}
}
}
}
如果完成设备配置，请从配置模式输入 commit 。
验证
要确认配置工作正常，请执行以下任务：
验证配置
目的
使用 PCAP 馈送程序工具运行 PCAP 后，验证 IDP 攻击上下文。
行动
在操作模式下，输入 show security idp attack context 命令。
示例输出
命令名称
user@host> show security idp attack context IDP context statistics: Context name #Hits #Data http-url 1 / http-get-url 1 / http-header-host 1 7.0.0.1 http-header-user-agent 1 lwp-request/5.827 libwww-perl/5.833 http-header 2 te: deflate,gzip;q=0.3 && connection: TE, close http-request 1 GET / HTTP/1.1 http-request-method 1 GET / HTTP/1.1