Juniper Net Screen防火墙.docx

研发服务中心网络文档Juniper网络安全设备适用应用文档（防火墙）2011-5-17发布文档修改记录序号操作文档版本文档更新日期文档撰写人文档审核人1CV 1.02011-5-17卜红素说明：创建:C 修改:M 删除D 重命名:RJuniper Net Screen 防火墙学习Juniper Net Screen防火墙介绍Juniper 安全产品线NetScreen-------------------------------------------------Firewall/VPNIDP--------------------------------------------------------------IPSSSLVPNUAC-------------------------------------------------------------NAC/CCAJuniper FirewallsStateful inspectionThe Netscreen firewalls themselves are based on a custom-built architecture consisting of application-specific integrated circuit(ASIC) technology。DIIPSEC VPNNetscreen-Remote,Netscreen-SecurityTrend Micro’s and Kaspersky Lab’s antivirus software.三种网管方式Command-line Interface (CLI)Web User Interface (WebUI)NetScreen Security Manager (NSM)Core TechnologiesZones三种类型的Zonesecurity zoneTunnel zoneFunction zoneVirtual Routers提供了多个路由表 （类似于VRF）Virtual routers are bound to zones , and the zones are bound to interfaces 。Interface ModesRoute ModeTransparent ModePolicies三种Policies类型Intrazone;Interzone;Global四种ActionAllow;Deny;Reject;TunnelVPNRoute-BasedPolicy-BasedDevice ArchitectureIntegrated Security ApplicationVPNFirewallDenial of Service ProtectionTraffic ManagementSecurity Specific Real Time OSDynamic RoutingHigh AvailabilityVirtualizationCentralized ManagementRISC CPUMemoryASICInterfacesPurpose-Built Hardware PlatformSSG 产品特点没有采用ASICUTM两种内存方案（128M,256M）NetScreen SSG产品特点each device is relatively similar 。However,the higher up the firewall product line,the more ports and options you will get to use 。（junos相同，提供相同的配置界面，高端的防火墙产品只是能够提供更多的接口和选项。）All of the devices use flash momory as the long-term storage option。None of the firewalls relies on a hard disk to run。（统一使用Flash架构，比硬盘架构更稳定。）Net Screen SSG Product Line (一)Product Max InterfacesNameProduct Class Ethernet /WanThroughputNetscreen-Remote Remote Client N/AN/AVPN Client SoftwareNetscreen-RemoteRemote Client N/AN/AClientSoftwareNetScreen-Hardware Small Office 5/050MbpsSecurity ClientHome Office Ne