Configuring Juniper Networks NetScreen & SSG Firewalls

Configuring Juniper ® Networks NetScreen & SSG Firewalls Rob Cameron Technical Editor Brad Woodberg Mohan Krishnamurthy Madwachar Mike Swarm Neil R. Wyler Matthew Albers Ralph Bonnell FOREWORD BY SCOTT KRIENS CEO, JUNIPER NETWORKS Syngress Publishing, Inc., the author(s), and any person or firm involved in the writing, editing, or production (collectively “Makers”) of this book (“the Work”) do not guarantee or warrant the results to be obtained from the Work. There is no guarantee of any kind, expressed or implied, regarding the Work or its contents.The Work is sold AS IS and WITHOUT WARRANTY.You may have other legal rights, which vary from state to state. In no event will Makers be liable to you for damages, including any loss of profits, lost savings, or other inci-dental or consequential damages arising out from the Work or its contents. Because some states do not allow the exclusion or limitation of liability for consequential or incidental damages, the above limitation may not apply to you. You should always use reasonable care, including backup and other appropriate precautions, when working with computers, networks, data, and files. Syngress Media®, Syngress®,“Career Advancement Through Skill Enhancement®,”“Ask the Author UPDATE®,” and “Hack Proofing®,” are registered trademarks of Syngress Publishing, Inc.“Syngress:The Definition of a Serious Security Library”™,“Mission Critical™,” and “The Only Way to Stop a Hacker is to Think Like One™” are trademarks of Syngress Publishing, Inc. Brands and product names mentioned in this book are trademarks or service marks of their respective companies. KEY SERIAL NUMBER 001 HJIRTCV764 002 PO9873D5FG 003 829KM8NJH2 004 5489IJJLPP 005 CVPLQ6WQ23 006 VBP965T5T5 007 HJJJ863WD3E 008 2987GVTWMK 009 629MP5SDJT 010 IMWQ295T6T PUBLISHED BY Syngress Publishing, Inc. 800 Hingham Street Rockland, MA 02370 Configuring Networks NetScreen & SSG Firewalls Copyright © 2007 by Syngress Publishing, Inc.All rights reserved. Except as permitted under the Copyright Act of 1976, no part of this publication may be reproduced or distributed in any form or by any means, or stored in a database or retrieval system, without the prior written permission of the publisher, with the exception that the program listings may be entered, stored, and executed in a computer system, but they may not be reproduced for publication. 1 2 3 4 5 6 7 8 9 0 ISBN-10: 1-59749-118-7 ISBN-13: 978-1-59749-118-1 Publisher:Andrew Williams Acquisitions Editor: Gary Byrne Technical Editor: Rob Cameron Cover Designer: Michael Kavish Page Layout and Art: Patricia Lupien Copy Editors: Mike McGee, Sandy Jolley Indexer: Nara Wood Distributed by O’Reilly Media, Inc. in the United States and Canada. For information on rights, translations, and bulk sales, contact Matt Pedersen, Director of Sales and Rights, at Syngress Publishing; email matt@syngress.com or fax to 781-681-3585. Lead Author and Technical Editor Rob Cameron (JNCIS-FWV, JNCIA-M, CCSP, CCSE+) is a Security Solutions Engineer for Juniper Networks. He currently works to design security solutions for Juniper Networks that are considered best practice designs. Rob specializes in network security architecture, firewall deployment, risk management, and high-avail-ability designs. His background includes five years of security con-sulting for more than 300 customers.This is Rob’s second book; the previous one being Configuring NetScreen Firewalls (ISBN: 1-932266-39-9) published by Syngress Publishing in 2004. Contributing Authors Matthew Albers (CCNP, CCDA, JNCIA-M, JNCIS-FWV, JNCIA-IDP) is a senior systems engineer for Juniper Networks. He currently serves his enterprise customers in the Northern Ohio marketplace. His specialties include routing platforms,WAN acceler-ation, firewall/VPNs, intrusion prevention, strategic network plan-ning, network architecture and design, and network troubleshooting and optimization. Matthew’s background includes positions as a senior engineer at First Virtual Communications, Lucent Technologies, and Bay Networks. Matthew wrote Chapter 1 and cowrote Chapter 11. iii Ralph Bonnell (CISSP, LPIC-2, CCSI, CCNA, MCSE: Security) is a senior information security consultant at Accuvant in Denver, CO. His primary responsibilities include the deployment of various net-work security products and product training. His specialties include NetScreen deployments, Linux client and server deployments, Check Point training, firewall clustering, and PHP Web program-ming. Ralph also runs a Linux consulting firm called Linux Friendly. Before moving to Colorado, Ralph was a senior security engineer and instructor at Mission Critical Systems, a Gold Check Point partner and training center in South Florida. Ralph cowrote Chapter 11. Mohan Krishnamurthy Madwachar (JNCIA-FWV, CWNA, and CCSA) is AVP-Infrastructure Services for ADG Infotek, Inc., Almoayed Group, Bahrain.Almoayed Group is a leading systems integration group that has branches in seven countries and executes projects in nearly 15 countries. Mohan is a key contributor to the company’s infrastructure services division and plays a key role in the organization’s network security and training initiatives. Mohan has a strong networking, security, and training background. His tenure with companies such as Schlumberger Omnes and Secure Network Solutions India adds to his experience and expertise in imple-menting large and complex network and security projects. Mohan holds leading IT industry certifications and is a member of the IEEE and PMI. Mohan would like to dedicate his contributions to this book to his sister, Geetha Prakash, and her husband, C.V. Prakash, and their son, Pragith Prakash. Mohan has coauthored the book Designing and Building Enterprise DMZs (ISBN: 1-597491004), published by Syngress Publishing. He also writes in newspaper columns on various subjects and has contributed to leading content companies as a technical writer and a subject matter expert. Mohan wrote Chapter 12. iv ... - tailieumienphi.vn