配置入侵防御示例
组网图形
图1 入侵防御组网图
- 组网需求
- 配置思路
- 操作步骤
- 中心AP的配置文件
组网需求
如图1所示，某企业部署了WLAN网络，内网用户可以访问Internet的Web服务器。现需要在中心AP上配置入侵防御功能，具体要求如下：
保护内网用户，避免内网用户访问Internet的Web服务器时受到攻击。例如，含有恶意代码的网站对内网用户发起攻击。
配置思路
- 配置WLAN基本业务。
- 配置入侵防御模板“profile_ips_pc”，保护内网用户。通过配置签名过滤器来满足安全需要。
- 创建攻击防御模板“defence_1”，并引用入侵防御模板“profile_ips_pc”，保护内网用户免受来自Internet的攻击。
- 配置WLAN业务VAP引用攻击防御模板，使入侵防御功能生效。
操作步骤
- 配置WLAN基本业务。
- 使能安全引擎。
[AP] defence engine enable
- 创建入侵防御模板“profile_ips_pc”，保护内网用户。
[AP] profile type ips name profile_ips_pc
[AP-profile-ips-profile_ips_pc] description profile for intranet users
[AP-profile-ips-profile_ips_pc] collect-attack-evidence enable
Warning: Succeeded in configuring attack evidence collection for the IPS functio
n. The function is used for fault locating. This function may deteriorate system
performance. Exercise caution before using the function.
Attack evidences can be collected only when a log storage device with sufficient
storage space is available.
After all required attack evidences are collected, disable the function.
Our company alone is unable to transfer or process the communication contents or
personal data. You are advised to enable the related functions based on the ap
plicable laws and regulations in terms of purpose and scope of usage. When the c
ommunication contents or personal data are being transferred or processed, you
are obliged to take considerable measures to ensure that these contents are full
y protected. Continue? [Y/N]: y
[AP-profile-ips-profile_ips_pc] signature-set name filter1
[AP-profile-ips-profile_ips_pc-sigset-filter1] target client
[AP-profile-ips-profile_ips_pc-sigset-filter1] severity high
[AP-profile-ips-profile_ips_pc-sigset-filter1] protocol HTTP
[AP-profile-ips-profile_ips_pc-sigset-filter1] quit
[AP-profile-ips-profile_ips_pc] quit
- 提交配置。
[AP] engine configuration commit
- 创建攻击防御模板“defence_1”，引用入侵防御模板“profile_ips_pc”。
[AP] defence-profile name defence_1
[AP-defence-profile-defence_1] profile type ips profile_ips_pc
[AP-defence-profile-defence_1] quit
- 在VAP模板上引用攻击防御模板“defence_1”。
[AP] wlan
[AP-wlan-view] vap-profile name wlan-vap
[AP-wlan-vap-prof-wlan-vap] defence-profile defence_1
[AP-wlan-vap-prof-wlan-vap] quit
- 验证配置结果。在中心AP上执行命令display profile type ips name profile_ips_pc，查看入侵防御配置文件的配置信息。
[AP-wlan-view] display profile type ips name profile_ips_pc
IPS Profile Configurations:
----------------------------------------------------------------------
Name : profile_ips_pc
Description : profile for intranet users
Referenced : 1
State : committed
AttackEvidenceCollection : enable
SignatureSet : filter1
Target : client
Severity : high
OS : N/A
Protocol : HTTP
Category : N/A
Action : default
Application : N/A
Exception:
ID Action Name
----------------------------------------------------------------------
DNS Protocol Check:
HTTP Protocol Check:
----------------------------------------------------------------------
中心AP的配置文件
#
defence engine enable
sysname AP
#
profile type ips name profile_ips_pc
description profile for intranet users
collect-attack-evidence enable
signature-set name filter1
target client
severity high
protocol HTTP
#
vlan batch 100 to 101
#
dhcp enable
#
defence-profile name defence_1
profile type ips profile_ips_pc
#
interface Vlanif100
ip address 10.23.100.1 255.255.255.0
dhcp select interface
#
interface Vlanif101
ip address 10.23.101.1 255.255.255.0
dhcp select interface
#
interface GigabitEthernet0/0/1
port link-type trunk
port trunk pvid vlan 100
port trunk allow-pass vlan 100 to 101
#
interface GigabitEthernet0/0/24
port link-type trunk
port trunk allow-pass vlan 101
#
management-vlan 100
#
wlan
security-profile name wlan-security
security wpa2 psk pass-phrase %^%#m"tz0f>~7.[`^6RWdzwCy16hJj/Mc!,}s`X*B]}A%^%# aes
ssid-profile name wlan-ssid
ssid wlan-net
vap-profile name wlan-vap
service-vlan vlan-id 101
ssid-profile wlan-ssid
security-profile wlan-security
defence-profile defence_1
regulatory-domain-profile name domain1
ap-group name ap-group1
regulatory-domain-profile domain1
radio 0
vap-profile wlan-vap wlan 1
radio 1
vap-profile wlan-vap wlan 1
ap-id 1 type-id 19 ap-mac 60de-4476-e360 ap-sn 210235554710CB000042
ap-name area_1
ap-group ap-group1
radio 0
channel 20mhz 6
eirp 127
radio 1
channel 20mhz 149
eirp 127
#
return
