1 / 21

DFL-1500 安裝規範 網路安全原理

DFL-1500 安裝規範 網路安全原理. Application. Application. Presentation. Presentation. Session. Session. Transport. Transport. Internal Subnet Protocol. Network. Network. Network. Network. Data Link. Data Link. Data Link. Data Link. Physical. Physical. Physical. Physical. Router.

lacey-conley
Download Presentation

DFL-1500 安裝規範 網路安全原理

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. DFL-1500安裝規範 網路安全原理

  2. Application Application Presentation Presentation Session Session Transport Transport Internal Subnet Protocol Network Network Network Network Data Link Data Link Data Link Data Link Physical Physical Physical Physical Router Router The OSI Reference Model Application Protocol APDU 7 6 5 4 3 2 1 Presentation Protocol PPDU Session Protocol SPDU Transport Protocol TPDU Packet Frame Bit Layer Host A Host B

  3. 封包的組成 Data Link Network Transport Application Ethernet Header IP Header TCP Header Application Payload

  4. Ethernet Frame Format

  5. IP Header Format

  6. TCP header format

  7. Ethernet header IP header TCP header 完整的封包內容

  8. NAT (Network Address Translation) 利用private address轉換為public address的一種技術。 為了解決IP數量不足的問題。 要讓本地端的所有電腦使用較少的IP個數連上網路。 增加內部網路的安全性。 Why NAT

  9. Private IP Address RFC 1597 Sectin 3: Private Address Space Internet 10.0.0.0 10.255.255.255 172.16.0.0 172.31.255.255 192.168.0.0 192.168.255.255 ? Private IP

  10. Internet Local Net Internet Local Net IP Packet 可透過IP Router 傳送出去 10.1.2.3 140.115.17.125 外部的 IP Packet 無法透過傳統IP Router 送回 ? 10.1.2.3 140.115.17.125 Private IP Packet 傳送的問題

  11. Internet Local Net Proxy Server 可解決部份問題 10.1.2.3 Proxy Server 140.115.17.125 Proxy Server 1. Local net 與 Internet 以Proxy Server 連接 2. Local net 可透過 Proxy Server 使用Internet 資源 使用 Proxy Server 的問題 1. 使用的Clinet 程式需提供透通 Proxy 的存取方式 2. 不能以 Proxy 沒有支援的方式與 Internet 相連，如 telnet, NFS 等 3. 內部不能有 Server 開放給外部使用，除非外部設定正確的 Proxy Server (Transparent Proxy)

  12. 140.115.17.125 10.0.0.1 10.0.0.254 140.115.1.254 140.115.17.125 23 10.0.0.1 2745 140.115.17.125 23 140.115.1.254 3548 140.115.1.254 3548 140.115.1.125 23 10.0.0.1 2745 140.115.17.125 23 NAT的原理 • NAT 是Network Address Translation的縮寫 • NAT 伺服器可能是PC 工作站、具 NAT 功能的 Router 或 Dedicate NAT Server • NAT 的動作 • NAT 可解決大部份 Private IP Transparently 連接Internet的問題

  13. n m NAT 10.1.0.0/32 140.115.1.0/24 Dynamic NAT m,n > 0 m > n Static NAT m,n > 0 m = n Masquerading m > 0 n = 1 NAT的分類

  14. NAT (Masquerading) Table NAT Table Internal IP / Port local NAT-Port 10.1.1.3 1257 10.1.1.5 4192 .... .... 63451 63452 .... .... NAT的工作原理 NAT src 10.1.1.3:1257 dst 140.115.17.108:23 src 140.115.1.1:63451 dst 140.115.17.108:23 10.1.1.254 140.115.1.1 src 10.1.1.5:4192 dst 163.28.1.22:80 src 140.115.1.1:63452 dst 163.28.1.22:80

  15. 140.115.17.125 10.0.0.1 10.0.0.254 140.115.1.254 140.115.1.254 80 140.115.17.125 3146 10.0.0.1 80 140.115.17.125 2853 140.115.17.125 2853 10.0.0.1 80 140.115.17.125 3146 140.115.1.254 80 NAT Port Redirection • NAT Server 的Port Redirection 功能可讓外部連接到特定 Port Number 的Packet Redirection 到特定主機 • Port Redirection 使內部網路的 Service 可給外部使用(適用於大部分的service)。 • 每種形式(port)的內部主機，於內部中最多只能有一台。 Redirect Port 80 到10.0.0.1 內部的WWW 伺服器

  16. WAN  LAN 防止不合法的使用者進入系統 只開放允許的服務(ex.web, ftp...)進入系統 LAN  WAN 只允許已設定的電腦(IP)存取internet服務 只開放已設定的應用軟體對外服務 為什麼需要 Firewall

  17. 防火牆概念

  18. FTP active mode

  19. FTP passive mode

  20. CuteFTP Pro 2.0

  21. Setup FTP mode • CuteFTP Pro 2.0 • 選取該ftp site， /Edit /Site Properties /Type /Data Connection Type

More Related