完美中文字幕国外技术飞塔防火墙视频31集案例中英文地址

W

简介W

（Web

CacheCommunication

Protocol

）是一种高速缓存技术协议，是路由器与缓存引擎Cache

Engine之间的通信协议，当用户访问的请求经过路由器时，路由器进行

，并重定向到Cache服务器，这样可以提供

速度，减轻广域网带宽负担。.

v

l

a

n

5

.

c

o

m #

^

_

^

#W

的功能W

的版本有V1和V2，目前.归原作者所有的版本是V2，新版本具有以下功能支持多路由器、负载均衡连接多个路由器，构成冗余和分布式的结构。支持两种重定向方式支持L2重写和GRE封装两种方式，GRE封装使得Cache可以与路由器不在同一网段支持多种服务通过服务组的方式（0为HTTP），可以支持非HTTP的服务。安全增强支持认证，路由器和Cache之间的协议包支持认证支持组播路由器和Cache之间可以通过组播通信。支持透明重定向用户浏览器不需要做任何修改。支持报文退还当缓存引擎把不能处理的报文退还给路由器时，该路由器将不再把该报文重定向。攻城狮本资料

试读攻城狮(技术+生活)群2

2

5

8

0

9

7Squid

CacheSquid是目前应用最广的免费Cache服务器，它运行在Linux平台上，与Cisco路由器配合，应用W

协议，构成最常见的透明Cache方案。流程：1，用户 的http请求，被路由器重定向到Cache服务器2，在Cache

，80端口又重定向到3128端口（Squid的

端口）3，由Cache去

站点攻城狮.

v

l

a

n

5

.

c

o

m#

^

_

^

#.归原作者所有本资料

试读攻城狮(技术+生活)群2

2

5

8

0

9

7步骤FortiGate配置在相应的接口上启用w在相应的 策略上启用wLinux

Squid服务器配置修改系统配置，在服务器上启用IP转发修改Squid的配置（/etc/squid/squid.conf)启用GRE通道。（或者使用ip_wcp)使用Iptables将80端口的请求转发到3128端口启动Squid测试和攻城狮.

v

l

a

n

5

.

c

o

m#

^

_

^

#.归原作者所有本资料

试读攻城狮(技术+生活)群2

2

5

8

0

9

7拓扑从PC发出的在wan1上启用W

，LinuxCache服务器。，转到GRE通道配置config

systemwedit

"0"setrouter-id

6set

group-address

set

server-list

41

55set

authentication

disableset

forward-method

GREsetreturn-methodGREset

assignment-method

HASHnextend地址做为IDCache服务器地址列表，可以是网段也可以是主机地址Serice-id

0

代表httpGRE封装方式配置（续）FG100C3G08600069

#

config

system

interfaceFG100C3G08600069

(interface)

#

edit

wan1FG100C3G08600069

(wan1)

#

set

w

enableFG100C3G08600069

(wan1)

#

end在wan1接口启用wconfig

firewall

policyedit

1set

srcintf

"switch"set

dstintf"wan1"set

srcaddr

"all"set

dstaddr

"all"set

action

acceptset

schedule

"always"set

service

"ANY"set

w

enableset

nat

enablenextend在 策略中启用wLinux配置修改Squid配置，主要修改几项设置透明Cachehttp_port

3128

transparent指定路由器IP地址w 2_router

6定义W

服务w

2_service

standard

0定义重定向方式及分配算法w

2_forwarding_method

1w

2_return_method

1w

2_assignment_method

1原文件在此0代表是http服务1代表GRE,

2表示L21是Hash,2MaskE:\labdemo\lab\w

\squid.confLinux配置（续）文件，它完成建立GRE通道，IP转发的工作以下是一个

#!/bin/bashmodprobe

ip_greip

tunnel

add

w1

mode

gre

remote

6local

41ttl255ip

link

set

w 1

upip

addr

add

dev

w

1echo

1

>/proc/sys/net/ipv4/ip_forwardecho

0

>/proc/sys/net/ipv4/conf/eth0/rp_filterecho

0

>/proc/sys/net/ipv4/conf/w

1/rp_filteriptables-t

nat

-A

PREROUTING

-p

tcp--dport

80-j

REDIRECT

--to-port

3128先运行以上

，再运行Squid,至此启动完毕，以上的脚步也可以添加到相应的系统配置文件和启动文件中，在系统启动时就运行。建立GRE通道，w 1为通道名确保激活IP转发用Iptables实现转发启动GRE模块攻城狮.

v

l

a

n

5

.

c

o

m#

^

_

^

#.归原作者所有本资料

试读攻城狮(技术+生活)群2

2

5

8

0

9

7测试从PC浏览网页Squid服务器access.log中实时显示

的攻城狮.

v

l

a

n

5

.

c

o

m#

^

_

^

#.归原作者所有本资料

试读攻城狮(技术+生活)群2

2

5

8

0

9

7W

协议抓包从服务器发出的包,“我在这里”服务器和路由器地址攻城狮.

v

l

a

n

5

.

c

o

m#

^

_

^

#.归原作者所有本资料

试读攻城狮(技术+生活)群2

2

5

8

0

9

7W

协议抓包（续）从路由器返回的包，“我看见了”服务器和路由器地址攻城狮.

v

l

a

n

5

.

c

o

m#

^

_

^

#.归原作者所有本资料

试读攻城狮(技术+生活)群2

2

5

8

0

9

7从FortiGate经过

GRE发出的包，0X2f是GRE的协议号15:14:08.370440

IP

6

>

41:

GREv0,

length

60:gre-proto-0x883e15:14:08.392056

IP

6

>

41:

GREv0,

length

48:gre-proto-0x883e15:14:08.403229

IP

6

>

41:

GREv0,

length

822:

gre-proto-0x883e15:14:08.432133

IP

6

>

41:

GREv0,

length

48:gre-proto-0x883e15:14:08.509219

IP

6

>

41:

GREv0,

length

48:gre-proto-0x883e15:14:08.509249

IP

6

>

41:

GREv0,

length

48:gre-proto-0x883e15:14:08.509253

IP

6

>

41:

GREv0,

length

48:gre-proto-0x883e15:14:08.575923

IP

6

>

41:

GREv0,

length

48:gre-proto-0x883e从linux端的GRE通道接收的包。.

v

l

a

n

5

.

c

o

m #

^

_

^

#

.GRE封装FG100C3G08600069

#

diagnose

sniffer

packet

wan1

'ip

proto

0x2f'

4interfaces=[wan1]filters=[ip

proto

0x2f]6.603097

wan1

--6

->

41:

ip-proto-47

606.608653

wan1

--6

->

41:

ip-proto-47

486.665869

wan1

--6

->

41:

ip-proto-47

12386.685523

wan1

--6

->

41:

ip-proto-47

486.685565

wan1

--6

->

41:

ip-proto-47

486.687701

wan1

--6

->

41:

ip-proto-47

486.687712

wan1

--6

->

41:

ip-proto-47

486.687723

wan1

--6

->

41:

ip-proto-47

48[root@localhost

squid]#

tcpdump

-i

eth0

ip

proto

gretcpdump:

verbose

output

suppressed,

use

-v

or

-vv

for

full

protocol

decodelistening

on

eth0,

link-type

EN10MB

(Ethernet),

capture

size

96

bytes攻城狮归原作者所有本资料

试读攻城狮(技术+生活)群2

2

5

8

0

9

7常用

命令除了前面讲的在端口抓包外，还有以下实时的debugdiag

debug

application

w <debug

level>命令应用的Debugdiag

test

application

w d

<1-5>1.

Dump

w2.

Dump

w3.

Dump

w4.

Dump

w5.

Dump

wstatsconfig2

cache

servers2

services2

assignment攻城狮.

v

l

a

n

5

.

c

o

m#

^

_

^

#.归原作者所有本资料

试读攻城狮(技术+生活)群2

2

5

8

0

9

7W

debugDiag

debug

app

w

-1FG100C3G08600069#diag

debug

app

w

-1_send_pkt()-128:

vdom-roo d:

len=472,

6->

41,

ttl=1_on_recv()-98:

vdom-root

recv:

num=152,

dev=3(3),

41->62_receive_pkt()-1124:

len=152,

type=10,

ver=0200,length=1442_receive_pkt()-1150:

foundcomponent:t=0,

len=42_receive_pkt()-1150:

foundcomponent:t=1,

len=242_receive_pkt()-1150:

foundcomponent:t=3,

len=442_receive_pkt()-1150:

foundcomponent:t=5,

len=282_receive_pkt()-1150:

foundcomponent:t=8,

len=24w

_on_recv()-98:

vdom-root

recv:

num=152,

dev=3(3),

41->6w

2_receive_pkt()-1124:

len=152,

type=10,

ver=0200,length=144w

2_receive_pkt()-1150:

foundcomponent:t=0,

len=4w

2_receive_pkt()-1150:

foundcomponent:t=1,

len=24w

2_receive_pkt()-1150:

foundcomponent:t=3,

len=44w

2_receive_pkt()-1150:

foundcomponent:t=5,

len=28w

2_receive_pkt()-1150:

foundcomponent:t=8,

len=24wwwwwwwww_send_pkt()-128:

vdom-roo d:

len=472,

6->

41,

ttl=1常用命令（续）FG100C3G08600069

#

diagnose

testapplication

w d1vdoms=1pkts=0FG100C3G08600069

#

diagnose

testapplication

w d2vdom-root:

working

NAT

_phy_id=3interface

list:intf=wan1,

gid=3

phy_id=3service

list:service:

0,

router_id=6,

group=,auth(no)access:41/55

forward=1return=1,

assign=1.erouter_id=6FG100C3G08600069

#

diagnose

testapplication

w d3service-0

invdom-root:

num=1,usable=1cache

server

ID:len=44,

addr=41,

weight=4135,

status=0rcv_id=29,

usable=1,

fm=1,

nq=0,

dev=3(k3),to=6ch_no=0,

num_router=1:6FG100C3G08600069

#

diagnose

testapplication

w d4service-0

in

vdom-root:total_servers=1,

usable_servers=1,

assign_m=1,

rtun_m=1,wcid_len=48,

rcv_id=30,

ch_no=1ID=0,

type=0,

pri=0,

pro=0

f=00000000Port:

0

0

0

00

00

0

num-routers=1:6statsconfigserversservicesservice-0

in

vdom-root:FG100C3G08600069

#

diagnose

testapplication

w d5assignementkey:

ip=41,

change-number=1cache_list:

10.

41pri

ssignment:key=41

change-number=1num_routers=1router

element[0]:

router_id=6,

receive_id=4,ch_no=1cache-server-num=1:41buckets:00

00

00

00

00

00

00

00

00

00

00

00

00

00

00

0000

00

00

00

00

00

00

00

00

00

00

00

00

00

00

00Debug

Flow

and

GREFG100C3G08600069

#

diagnose

debug

flow

trace

start1000id=20085trace_id=48419

func=resolve_ip_tuple_fast

line=3196

msg="vd-root

receiveda

packet(proto=6,10:2862->25:80)

from

switch."id=20085

trace_id=48419

func=resolve_ip_tuple

line=3308

msg="allocatea

new

session-00004b93"id=20085

trace_id=48419

func=vf_ip4_route_input

line=1607

msg="find

a

route:

gw-via

wan1"id=20085

trace_id=48419

func=get_new_addr

line=1481

msg="find

SNAT:

IP-6,

port-44966"id=20085

trace_id=48419

func=fw_forward_handlerline=366

msg="Allowed

by

Policy-1:

SNAT"id=20085

trace_id=48419

func=

ip_session_run_tuple

line=1663

msg="SNAT10->6:44966"id=20085

trace_id=48419func=wid=20085

trace_id=48419func=w_output

line=222

msg="gre_forward"_output

line=264

msg="send

packet

via

dev-wan1“id=20085trace_id=48420

func=resolve_ip_tuple_fast

line=3196

msg="vd-root

receiveda

packet(proto=6,25:80->6:44966)

from

wan1."id=20085

trace_id=48420

func=resolve_ip_tuple_fastline=3224

msg="Find

an

existingsession,

id-00004b93,

replydirection"id=20085

trace_id=48420

func=wid=20085

trace_id=48420

func=w_prerou_prerouine=427

msg="regular

packet"ine=435

msg="feed

to

dev=wan1"id=20085

trace_id=48420

func=

ip_session_run_tupleline=1677

msg="DNAT

6:44966->10:2862"id=20085

trace_id=48420

func=vf_ip4_route_input

line=1607

msg="find

a

route:

gw-10via

switch“id=20085trace_id=48421

func=resolve_ip_tuple_fast

line=3196

msg="vd-root

receiveda

packet(proto=6,10:2862->25:80)

from

switch."id=20085

trace_id=48421

func=resolve_ip_tuple_fastline=3224

msg="Find

an

existingsession,

id-00004b93,

originaldirection"id=20085

trace_id=48421

func=

ip_session_run_tuple

line=1663

msg="SNAT10->6:44966"id=20085

trace_id=48421func=wid=20085

trace_id=48421func=w_output

line=222

msg="gre_forward"_output

line=264

msg="send

packet

via

dev-wan1Session

listFG100C3G08600069

#

diagnose

sys

session

filter

dport

80FG100C3G08600069

#

diagnose

sys

session

listsession

info:proto=6

proto_state=05

expire=51

timeout=3600

flags=00000000

sockflag=00000000sockport=0av_idx=0

use=4origin-sh

r=reply-sh

r=ha_id=0

hakey=47595policy_dir=0

tunnel=/state=w

may_dirty

nlb

remstatistic(bytes/packets/allow_err):=2313/7/1

reply=1488/5/1

tuples=2in->sink:hook=post

dir=pre->post,

reply

pre->post

dev=8->3/3->8

gwy=/10act=snat

10:4623->25:80(6:48263)hook=pre

dir=reply

act=dnat

25:80->6:48263(10:4623)pos/(before,after)

0/(0,0),

0/(0,0)misc=0

policy_id=1auth_info=0

chk_client_info=0vd=0serial=00001f4c

tos=ff/ff

app=0dd_type=0

dd_rule_id=0w :

server=41,

rid=192168.116.46,

dev=3,

pri=180,alt=0

GRE-F

L2-Rstdtotal

session

1F:

Tunneling

Forward

GRER:

Tunneling

Reverse

L2AcceleratorFGT

ipfacingAcceleratortcpdump

-i

eth0

port

2048

可以抓到w

协议的通信tcpdump

-i

<gre接口>

可以实时查看用户

的流量tcpdump-i

eth0

ip

protogre

通过eth0接口的gre流量检查Squid的日志，一般日志缺省存放在/var/log/squid

下Tail

–f

access.log

查看

日志，当从pc

web站点时，会记录在access.log文件中。检查Squid的Cache文件，一般cache存放在/var/spool/squid

下当用户通过PC

web站点时，会存放在cache

下文件中。用户浏览

后cache中的文件会增加。.

v

l

a

n

5

.

c

o

m#

^

_

^

#(Linux)在linux可以使用tcpdump抓包：攻城狮.归原作者所有本资料

试读攻城狮(技术+生活)群2

2

5

8

0

9

7举例（1）FG100C3G08600069

#

diagnose

debug

application

w d

-12_receive_pkt()-1150:

found

component:t=1,

len=242_receive_pkt()-1150:

found

component:t=3,

len=442_receive_pkt()-1150:

found

component:t=5,

len=202_receive_pkt()-1150:

found

component:t=8,

len=24w

_on_recv()-98:

vdom-rootrecv:

num=144,

dev=3(3),

41->6w

2_receive_pkt()-1124:

len=144,type=10,

ver=0200,length=136w

2_receive_pkt()-1150:

found

component:t=0,

len=4wwwww2_receive_pkt()-1214:sender-41

is

not

in

acl(40/55)FG100C3G08600069

#

diagnose

test

applicationw d

3service-0

invdom-root:

num=0,

usable=0FG100C3G08600069

#Cache没有在的地址列表中，不能建立正常的通信显示没有可用的Cache举例（1）FG100C3G08600069

#

diagnose

debug

application

w d

-1FG100C3G08600069

#

w

_on_recv()-98:

vdom-root

recv:

num=144,

dev=3(3),

41->62_receive_pkt()-1150:

found

component:t=0,

len=42_receive_pkt()-1150:

found

component:t=1,

len=242_receive_pkt()-1150:

found

component:t=3,

len=442_receive_pkt()-1150:

found

component:t=5,

len=202_receive_pkt()-1150:

found

component:t=8,

len=24w

2_receive_pkt()-1124:

len=144,

type=10,ver=0200,

length=136wwwwww_send_pkt()-128:

vdom-roo d:

len=92,

6

->

41,

ttl=15FG100C3G08600069

#

diagnose

test

applicationw d

3service-0

in

vdom-root:

num=1,

usable=1cache

server

ID:len=44,

addr=41,

weight=4135,status=0rcv_id=85,

usable=1,

fm=1,

nq=0,

dev=3(k3),

to=6ch_no=0,

num_router=1:6显示Cache的地址，并显示目前是可用的修改服务器列表后，Cache与之间

o正常举例（2）FG100C3G08600069

#

diagnose

debug

application

w d

-12_receive_pkt()-1124:

len=144,

type=10,

ver=0200,

length=1362_receive_pkt()-1150:

found

component:t=0,

len=42_receive_pkt()-1150:

found

component:t=1,

len=242_receive_pkt()-1150:

found

component:t=3,

len=442_receive_pkt()-1150:

found

component:t=5,

len=202_receive_pkt()-1150:

found

component:t=8,

len=24d:len=112,

6

->41,

ttl=1d:len=64,

6

->

41,

ttl=15d:len=64,

6

->

41,

ttl=15d:len=64,

6

->

41,

ttl=15w

_on_recv()-98:

vdom-root

recv:

num=1