2017年9月网络区域边界安全整改报告

一、项目概 、环境描 、需求描 、实施原 二、实施之前的规 、物理端口划 、互联IP地址划 、合并规 、路由规 、省公司ANYdeletesecuritypoliciesfrom-zonetrustto-zoneuntrustt-u-86matchapplicationanydeletesecuritypoliciesfrom-zonetrustto-zoneuntrustt-u-87matchapplicationanydeletesecuritypoliciesfrom-zonetrustto-zoneuntrustt-u-88matchapplicationanydeletesecuritypoliciesfrom-zonetrustto-zoneuntrustt-u-89matchapplicationanydeletesecuritypoliciesfrom-zonetrustto-zoneuntrustt-u-90matchapplicationanydeletesecuritypoliciesfrom-zonetrustto-zoneuntrustt-u-91matchapplicationanydeletesecuritypoliciesfrom-zonetrustto-zoneuntrustt-u-100matchapplicationsetsecuritypoliciesfrom-zonetrustto-zoneuntrustt-u-86matchapplicationjunos-icmp-allsetsecuritypoliciesfrom-zonetrustto-zoneuntrustt-u-87matchapplicationjunos-icmp-allsetsecuritypoliciesfrom-zonetrustto-zoneuntrustt-u-88matchapplicationjunos-icmp-allsetsecuritypoliciesfrom-zonetrustto-zoneuntrustt-u-89matchapplicationjunos-icmp-allsetsecuritypoliciesfrom-zonetrustto-zoneuntrustt-u-90matchapplicationjunos-icmp-allsetsecuritypoliciesfrom-zonetrustto-zoneuntrustt-u-91matchapplicationjunos-icmp-allsetsecuritypoliciesfrom-zonetrustto-zoneuntrustt-u-100matchapplicationjunos-icmp-allsetsecuritypoliciesfrom-zonetrustto-zoneuntrustt-u-86matchapplicationtcp-80setsecuritypoliciesfrom-zonetrustto-zoneuntrustt-u-86matchapplicationtcp-22setsecuritypoliciesfrom-zonetrustto-zoneuntrustt-u-86matchapplicationtcp-8080setsecuritypoliciesfrom-zonetrustto-zoneuntrustt-u-87matchapplicationtcp-setsecuritypoliciesfrom-zonetrustto-zoneuntrustt-u-88matchapplicationtcp-7001-7006setsecuritypoliciesfrom-zonetrustto-zoneuntrustt-u-88matchapplicationtcp-7003-、运行管理区ANY元素的策略（执行动作为deny的一个都没动。因为动了更不安全deletesecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-104matchapplicationanydeletesecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-236matchapplicationanydeletesecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-239matchapplicationanydeletesecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-241matchapplicationanydeletesecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-244matchapplicationanydeletesecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-251matchapplicationanydeletesecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-252matchapplicationanydeletesecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-255matchapplicationsetsecuritypoliciesfrom-zoneuntrustto-zone u-t-213matchdestination-addresssetsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-213matchdestination-address10.115.143.4/32setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-213matchapplicationtcp-80setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-213matchapplicationtcp-8443setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-213matchapplicationtcp-5414setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-213matchapplicationtcp-3389setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-213matchapplicationtcp-443setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-213thenpermitsetsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-214matchsource-address10.164.252.58/32setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-214matchsource-address10.114.213.22/32setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-214matchdestination-address10.115.143.9/32setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-214matchdestination-address10.115.143.10/32setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-214matchapplicationtcp-80setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-214matchapplicationtcp-443setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-214thenpermitsetsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-215matchsource-address10.164.252.58/32setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-215matchsource-address10.114.213.22/32setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-215matchsource-address10.114.213.11/32setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-215matchdestination-address10.115.143.22/32setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-215matchapplicationtcp-22setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-215then注：JuniperSRX650不支持snmp、DMZ区deletesecuritypoliciesfrom-zoneZYCto-zoneuntrustZYC-u-100matchapplicationanydeletesecuritypoliciesfrom-zoneZYCto-zoneuntrustZYC-u-101matchapplicationanydeletesecuritypoliciesfrom-zoneZYCto-zoneuntrustZYC-u-105matchapplicationsetsecuritypoliciesfrom-zoneZYCto-zoneuntrustZYC-u-100matchapplicationtcp-21setsecuritypoliciesfrom-zoneZYCto-zoneuntrustZYC-u-100matchapplicationtcp-setsecuritypoliciesfrom-zoneZYCto-zoneuntrustZYC-u-101matchapplicationtcp-1520-1521setsecuritypoliciesfrom-zoneZYCto-zoneuntrustZYC-u-105matchapplicationtcp-22setsecuritypoliciesfrom-zoneZYCto-zoneuntrustZYC-u-100matchapplicationudp-161setsecuritypoliciesfrom-zoneZYCto-zoneuntrustZYC-u-101matchapplicationtcp-22setsecuritypoliciesfrom-zoneZYCto-zoneuntrustZYC-u-105matchapplicationtcp-8080setsecuritypoliciesfrom-zoneZYCto-zoneuntrustZYC-u-100matchapplicationjunos-icmp-allsetsecuritypoliciesfrom-zoneZYCto-zoneuntrustZYC-u-101matchapplicationjunos-icmp-allsetsecuritypoliciesfrom-zoneZYCto-zoneuntrustZYC-u-105matchapplicationjunos-icmp-all注：JuniperSRX系列不支持snmp、第ANYdeletesecuritypoliciesfrom-zonetrustto-zoneuntrustt-u-100matchsource-addressanydeletesecuritypoliciesfrom-zonetrustto-zoneuntrustu-t-122matchapplicationanydeletesecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-102matchapplicationanydeletesecuritypoliciesfrom-zoneuntrustto-zonetrust u-t-105matchapplicationanydeletesecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-108matchsource-addresssetsecuritypoliciesfrom-zonetrustto-zoneuntrustt-u-100matchsource-address10.0.0.0/8setsecuritypoliciesfrom-zonetrustto-zoneuntrustu-t-122matchapplicationjunos-icmp-allsetsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-102matchapplicationjunos-icmp-allsetsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-105matchapplicationjunos-icmp-allsetsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-108matchsource-address10.0.0.0/8setsecuritypoliciesfrom-zonetrustto-zoneuntrustu-t-122matchapplicationtcp-22setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-102matchapplicationtcp-80setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-105matchapplicationtcp-1433setsecurityzonessecurity-zoneuntrustaddress-bookaddress10.0.0.0/810.0.0.0/8setsecurityzonessecurity-zonetrustaddress-bookaddress10.0.0.0/810.0.0.0/8注：JuniperSRX系列不支持snmpv3、第接运营商因为该上有对外业务，所以Internet区域内的ANY元素暂时不deletesecuritypoliciesfrom-zonetrustto-zoneZYCt-ZYC-105matchapplicationsetsecuritypoliciesfrom-zonetrustto-zoneZYCt-ZYC-105matchapplicationtcp-8001-8010setsecuritypoliciesfrom-zonetrustto-zoneZYCt-ZYC-105matchapplicationudp-8001-8010setsecuritypoliciesfrom-zonetrustto-zoneZYCt-ZYC-105matchapplicationjunos-icmp-all注：JuniperSRX系列不支持snmp、综合业务区deletesecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-100matchsource-addressanydeletesecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-200matchapplicationanydeletesecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-112matchapplicationanydeletesecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-113matchapplicationanydeletesecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-120matchapplicationanydeletesecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-148matchapplicationanydeletesecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-160matchapplicationanysetsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-100matchsource-addresssetsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-200matchapplicationjunos-icmp-allsetsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-112matchapplicationjunos-icmp-allsetsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-120matchapplicationjunos-icmp-allsetsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-148matchapplicationjunos-icmp-allsetsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-160matchapplicationjunos-icmp-setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-200matchapplicationtcp-8001-8006setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-112matchapplicationtcp-22setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-112matchapplicationtcp-1520setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-120matchapplicationtcp-setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-148matchapplicationtcp-7001-7010setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-160matchapplicationtcp-80setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-160matchapplicationtcp-443setsecurityzonessecurity-zoneuntrustaddress-bookaddress10.0.0.0/810.0.0.0/8setsecurityzonessecurity-zonetrustaddress-bookaddress10.0.0.0/8注：JuniperSRX系列不支持snmp、资产管理区deletesecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-135matchapplicationdeletesecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-160matchdestination-addressanydeletesecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-160matchapplicationanydeletesecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-162matchapplicationdeletesecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-200matchdestination-addressanydeletesecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-69matchapplicationanysetsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-200matchdestination-address10.0.0.0/8setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-160matchdestination-address10.0.0.0/8setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-160matchapplicationjunos-icmp-allsetsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-162matchapplicationjunos-icmp-allsetsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-135matchapplicationjunos-icmp-allsetsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-69matchapplicationjunos-icmp-allsetsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-160matchapplicationtcp-80setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-162matchapplicationtcp-443setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-135matchapplicationtcp-2121setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-69matchapplicationtcp-15210注：JuniperSRX系列不支持snmpv3、协同办公区deletesecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-87matchapplicationsetsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-87matchsource-address10.164.145.101/32setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-87matchsource-address10.164.145.102/32setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-87matchsource-address10.164.145.103/32setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-87matchsource-address10.164.145.104/32setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-87matchsource-address10.164.145.105/32setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-87matchsource-address10.164.145.106/32setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-87matchsource-address10.164.145.107/32setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-87matchsource-address10.164.145.108/32setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-87matchsource-address10.164.145.109/32setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-87matchsource-address10.164.145.110/32setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-87matchsource-address10.164.145.111/32setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-87matchsource-address10.164.145.112/32setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-87matchdestination-address10.115.160.1/32setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-87matchdestination-address10.115.160.2/32setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-87matchdestination-address10.115.160.3/32setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-87matchdestination-address10.115.160.4/32setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-87matchdestination-address10.115.161.205/32setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-87matchapplicationtcp-1521setsecuritypoliciesfrom-zoneuntrustto-zonetrustu-t-143then注：JuniperSRX系列不支持snmp、信通公司局域网setsecurityzonessecurity-zoneDJBaddress-bookaddress10.0.0.0/810.0.0.0/8setsecurityzonessecurity-zoneDSGJaddress-bookaddress10.0.0.0/810.0.0.0/8setsecurityzonessecurity-zoneIP-PHONEaddress-bookaddress10.0.0.0/8 setsecuritypoliciesfrom-zonetrustto-zoneZHXXtrust-zhxx-103matchapplicationjunos-icmp-allsetsecuritypoliciesfrom-zonetrustto-zoneZHXXtrust-zhxx-102matchapplicationjunos-icmp-allsetsecuritypoliciesfrom-zonetrustto-zoneZHXXtrust-zhxx-101matchapplicationjunos-icmp-allsetsecuritypoliciesfrom-zonetrustto-zoneZHXXtrust-zhxx-98matchapplicationjunos-icmp-allsetsecuritypoliciesfrom-zonetrustto-zoneZHXXtrust-zhxx-100matchapplicationjunos-icmp-all------设setsecuritypoliciesfrom-zonetrustto-zoneZHXXtrust-zhxx-101matchdestination-address10.0.setsecuritypoliciesfrom-zonetrustto-zoneZHXXtrust-zhxx-98matchdestination-address10.0setsecuritypoliciesfrom-zonetrustto-zoneZHXXtrust-zhxx-100matchdestination-address10.0.注意该的管理地址10.112.240.128就是业务口的地址因为该的管理地 、管理区修改存在any修改初始账号（admin）的为、在Juniper上设置最大连接setsecurityscreenids-optionscreen-1icmpip-sweepsetsecurityscreenids-optionscreen-1icmpfragmentsetsecurityscreenids-optionscreen-1icmplargesetsecurityscreenids-optionscreen-1icmpsetsecurityscreenids-optionscreen-1icmp-deathsetsecurityscreenids-optionscreen-1ipspoofingsetsecurityscreenids-optionscreen-1ipblock-setsecurityscreenids-optionscreen-1iptear-dropsetsecurityscreenids-optionscreen-1tcpport-scansetsecurityscreenids-optionscreen-1tcpsyn-floodsetsecurityscreenids-optionscreen-1tcplandsetsecurityscreenids-optionscreen-1udpsetsecurityscreenids-optionscreen-1limit-sessionsource-ip-basedsetsecurityscreenids-optionscreen-1limit-sessiondestination-ip-based关于最大连接数的设置已经刷到上述所有Juniper中，如果将来对业务有影响，应该加大limit-session阈值。、Junipersnmpv3