Cisco PIX 525 Specifikace stáhnout pdf (Strana 35)

1-9

Cisco PIX Firewall and VPN Configuration Guide

78-15033-01

Chapter 1 Getting Started

Protecting Your Network from Attack

For more information about the PIX Firewall features used to protect your network against specific

attacks, refer to

Chapter 5, “Configuring Application Inspection (Fixup).” For information about

configuring ActiveX Blocking, Java Filtering, and URL Filtering, refer to the “Filtering Outbound

Connections” section on page 3-31 in Chapter 3, “Controlling Network Access and Use.”

For information about features that allow using specific protocols and applications across the firewall,

refer to “

Supporting Specific Protocols and Applications."

Unicast Reverse Path Forwarding

Unicast Reverse Path Forwarding (Unicast RPF), also known as “reverse route lookup,” provides

inbound and outbound filtering to help prevent IP spoofing. This feature checks inbound packets for IP

source address integrity, and verifies that packets destined for hosts outside the managed domain have

IP source addresses verifiable by routes in the enforcing entities local routing table.

Unicast RPF is limited to addresses for networks in the enforcing entities local routing table. If the

incoming packet does not have a source address represented by a route, it is impossible to know whether

the packet arrived on the best possible path back to its origin.

Mail Guard

The Mail Guard feature provides safe access for Simple Mail Transfer Protocol (SMTP) connections

from the outside to an inside messaging server. This feature allows a single mail server to be deployed

within the internal network without it being exposed to known security problems with some SMTP

server implementations. This eliminates the need for an external mail relay (or bastion host) system.

Mail Guard enforces a safe minimal set of SMTP commands to avoid an SMTP server system from being

compromised. This feature also logs all SMTP connections.

Flood Guard

The Flood Guard feature controls the AAA service's tolerance for unanswered login attempts. This helps

to prevent a denial of service (DoS) attack on AAA services in particular. This feature optimizes AAA

system use. It is enabled by default and can be controlled with the floodguard 1 command.

FragGuard and Virtual Reassembly

FragGuard and virtual reassembly is a feature that provides IP fragment protection. This feature

performs full reassembly of all ICMP error messages and virtual reassembly of the remaining IP

fragments that are routed through the PIX

Firewall. Virtual reassembly is currently enabled by default.

This feature uses syslog to log any fragment overlapping and small fragment offset anomalies, especially

those caused by a teardrop attack.

DNS Control

The PIX Firewall identifies each outbound DNS (Domain Name System) resolve request, and only

allows a single DNS response. A host may query several servers for a response (in the case that the first

server is slow in responding), but only the first answer to the request is allowed. All additional responses

to the request are dropped by the firewall. The DNS fixup is configurable and enabled by default.

1 2 ... 30 31 32 33 34 35 36 37 38 39 40 ... 465 466

Komentáře k této Příručce

Žádné komentáře

Cisco PIX 525 Specifikace Strana 35

Komentáře k této Příručce

Související produkty a manuály pro Bezpečnostní systémy pro řízení přístupu Cisco PIX 525