home

หน้าแรก
 Computer >> บทช่วยสอนคอมพิวเตอร์ >  >> ระบบเครือข่าย >> ความปลอดภัยเครือข่าย

วิธีเข้าถึง Network Security Appliance ใหม่: การตั้งค่า WAN, Firewall, VPN

เข้าถึงและตั้งค่า Network Security Appliance ใหม่ (Firewall, UTM, NGFW)

🔧 Initial Access (First Time Setup)

1. Physical Connection

  • Console Cable: RJ45-to-DB9 หรือ USB-to-Serial (Baud: 9600/115200, 8-N-1)
  • Management Port: Dedicated MGMT Port (Out-of-band)
  • LAN Port: Connect Laptop → Static IP ใน Subnet เดียว (เช่น 192.168.1.10/24)

2. Default Credentials (ตัวอย่างยอดนิยม)

VendorDefault IPUsernamePassword
Cisco ASA/Firepower192.168.1.1adminadmin / (blank)
FortiGate192.168.1.99admin(blank)
Palo Alto192.168.1.1adminadmin
Check Point192.168.1.1adminadmin
Sophos XG192.168.1.1adminadmin
SonicWall192.168.168.168adminpassword
WatchGuard10.0.1.1adminpassphrase
Juniper SRX192.168.1.1root(blank)

🌐 WAN Configuration (การตั้งค่า WAN)

Connection Types

  • DHCP Client: ISP มอบ IP อัตโนมัติ (Common: Cable, Fiber)
  • Static IP: ISP ให้ IP קבוע, Subnet Mask, Gateway, DNS
  • PPPoE: Username/Password จาก ISP (Common: DSL, GPON บางแห่ง)
  • PPTP/L2TP: น้อยกว่า พบในบาง ISP

CLI Examples

# Cisco ASA
interface GigabitEthernet0/0
 nameif outside
 security-level 0
 ip address dhcp setroute
 no shutdown

# FortiGate
config system interface
 edit "wan1"
  set mode dhcp
  set allowaccess ping https ssh
 next
end

# Palo Alto (Web GUI: Network → Interfaces → Ethernet → Add → Type: Layer3 → Virtual Router: default → IPv4: DHCP Client)

🔥 Firewall Policy Basics

  • Default Deny: Block All → Allow Specific (Zero Trust)
  • Zone-based: Trust (LAN) → Untrust (WAN) Rules
  • Rule Order: Specific → General (Top-down Processing)
  • Logging: Log at Session End (Start/End/Both)

Essential Policies

  1. Allow Management Access (SSH/HTTPS) from Trusted Subnets Only
  2. Allow DNS (UDP/TCP 53) to Internal DNS / Public DNS
  3. Allow NTP (UDP 123) for Time Sync
  4. Allow Outbound Internet (App-ID based) from Trust → Untrust
  5. Block Known Bad: Geo-IP, Reputation, Threat Intelligence Feeds
  6. SSL Decryption (Outbound) for Visibility

🔐 VPN Setup (Site-to-Site / Remote Access)

IPsec Site-to-Site

  • Phase 1 (IKE): Encryption (AES-256), Hash (SHA-256), DH Group (14/19/20), Auth (PSK/Cert), Lifetime
  • Phase 2 (IPsec): Protocol (ESP), Encryption (AES-256), Hash (SHA-256), PFS (Group 14), Lifetime
  • Proxy IDs / Traffic Selectors: Local/Remote Subnets

Remote Access (SSL VPN / IPsec VPN)

  • Portal/Gateway Config
  • Authentication: RADIUS/LDAP/SAML + MFA (Duo, Azure MFA, Okta)
  • Client: AnyConnect, GlobalProtect, FortiClient, SecuExtender
  • Split Tunnel vs Full Tunnel

⚙️ Initial Hardening Checklist

  1. 🔒 Change Default Admin Password (Complex, 15+ chars)
  2. 🔒 Disable HTTP/Telnet → Enable HTTPS/SSH Only
  3. 🔒 Restrict Management Access (Trusted IPs/Subnets Only)
  4. 🔒 Enable MFA for Admin Access
  5. 🔒 Update Firmware/Threat Signatures to Latest
  6. 🔒 Configure NTP (Trusted Time Source)
  7. 🔒 Enable Logging → Syslog/SIEM
  8. 🔒 Backup Config (Encrypted, Offsite)
  9. 🔒 License Registration & Subscription Activation

☁️ Cloud/VM Firewall (AWS, Azure, GCP)

  • AWS: Network Firewall, Security Groups, NACLs, Transit Gateway
  • Azure: Azure Firewall, NSG, Firewall Manager
  • GCP: Cloud Firewall, Cloud Armor, Network Security Policies
  • Management: Terraform, Ansible, Vendor APIs, Panorama/Prisma/FortiManager