目 录
第 1 章 概述..............................................................................................................................................1
1.1 目的.................................................................................................................................................1
1.2 适用范围.........................................................................................................................................1
1.3 适用版本.........................................................................................................................................1
第 2 章 帐号管理、认证授权安全要求 .................................................................................................1
2.1 帐号管理.........................................................................................................................................1
2.1.1
用户帐号分配
* .......................................................................................................................1
2.1.2
删除无关的帐号
* ...................................................................................................................2
2.1.3
帐户登录超时
* .......................................................................................................................3
2.1.4
帐户密码错误自动锁定
* .......................................................................................................4
2.2 口令.................................................................................................................................................4
2.2.1
口令复杂度要求
.....................................................................................................................4
2.3 授权.................................................................................................................................................5
2.3.1
远程维护的设备使用加密协议
.............................................................................................5
第 3 章 日志及配置安全要求 .................................................................................................................6
3.1 日志安全.........................................................................................................................................6
3.1.1
记录用户对设备的操作
.........................................................................................................6
3.1.2
开启记录
NAT
日志
................................................................................................................7
3.1.3
开启记录
VPN
日志
*..............................................................................................................8
3.1.4
配置记录流量日志
.................................................................................................................9
3.1.5
配置记录拒绝和丢弃报文规则的日志
...............................................................................10
3.2 告警配置要求...............................................................................................................................11
3.2.1
配置对防火墙本身的攻击或内部错误告警
.......................................................................11
3.2.2
配置
TCP/IP
协议网络层异常报文攻击告警
* ...................................................................12
3.2.3
配置
TCP/IP
协议应用层异常攻击告警
.............................................................................13
3.2.4
配置
DOS
和
DDOS
攻击告警
.............................................................................................14
3.2.5
配置关键字内容过滤功能告警
* .........................................................................................15
3.3 安全策略配置要求.......................................................................................................................16
3.3.1
访问规则列表最后一条必须是拒绝一切流量
...................................................................16
3.3.2
配置访问规则应尽可能缩小范围
.......................................................................................16
3.3.3 VPN
用户按照访问权限进行分组
*......................................................................................17
3.3.4
配置
NAT
地址转换
*............................................................................................................18
3.3.5
隐藏防火墙字符管理界面的
bannner
信息
........................................................................19
3.3.6
避免从内网主机直接访问外网的规则
* .............................................................................19
3.3.7
关闭非必要服务
...................................................................................................................20
3.4 攻击防护配置要求.......................................................................................................................21
3.4.1
拒绝常见漏洞所对应端口或者服务的访问
.......................................................................21
3.4.2
防火墙各逻辑接口配置开启防源地址欺骗功能
...............................................................22
第 4 章 IP 协议安全要求 ......................................................................................................................23
