WEB应用安全解决方案测试验证

WEB应用安全解决方案测试报告

--- By jiang.jx at 2017-08-11

WEB应用安全解决方案.docx

链接：https://share.weiyun.com/068b05467040d4d2a479f46e7a23c614 密码：sa4bwk

拓扑环境：

测试步骤：

启动测试环境的虚拟机实例

LLB负载均衡功能测试
步骤	操作
	验证NSVPX-91上LLB负载均衡配置是否正确 =================================================== > show lb vserver lb_vsrv_llb lb_vsrv_llb (0.0.0.0:0) - ANY Type: ADDRESS State: UP Last state change was at Wed Feb 28 13:53:13 2018 Time since last state change: 0 days, 00:21:39.620 Effective State: UP Client Idle Timeout: 120 sec Down state flush: ENABLED Disable Primary Vserver On Down : DISABLED Appflow logging: ENABLED No. of Bound Services :  3 (Total)      2 (Active) Configured Method: ROUNDROBIN  BackupMethod: NONE Mode: IP Persistence: DESTIP      Persistence Mask: 255.255.255.255    Persistence v6MaskLength: 128     Persistence Timeout: 2 min Connection Failover: DISABLED L2Conn: OFF Skip Persistency: None Listen Policy: NONE IcmpResponse: PASSIVE RHIstate: PASSIVE New Service Startup Request Rate: 0 PER_SECOND, Increment Interval: 0 Mac mode Retain Vlan: DISABLED DBS_LB: DISABLED Process Local: DISABLED Traffic Domain: 0 TROFS Persistence honored: ENABLED Retain Connections on Cluster: NO 1) svc_isp_outside_vmnat_one (192.168.195.2: 0) - ANY State: UP Weight: 1 2) svc_isp_outside_vmbridge_one (192.168.1.1: 0) - ANY State: DOWN Weight: 1 3) svc_isp_outside_vmbridge_two (10.0.100.1: 0) - ANY State: UP  Weight: 1 Done > show lb route Network          Netmask          Traffic Domain  VIP                  Flags -------          -------          --------------  ---                  ----- 1)    0.0.0.0          0.0.0.0          0               lb_vsrv_llb          UP Done ===================================================
	在Win2008R2AD这台机器上，对www.bing.com域名对应的主机进行tracert.exe操作，查看链路走向： =================================================== PS C:\Users\adpadmin> TRACERT.EXE www.bing.com 通过最多 30 个跃点跟踪 到 cn-0001.cn-msedge.net [202.89.233.101] 的路由: 1    <1 毫秒   <1 毫秒   <1 毫秒 192.168.185.91 2     1 ms    <1 毫秒    1 ms  OPENWRT [10.0.100.1] 3     4 ms     5 ms     6 ms  163.125.48.1 4     7 ms     6 ms     8 ms  120.80.165.233 5     7 ms     *        *     221.4.0.125 6     *        *        *     请求超时。 7     *        *        *     请求超时。 8    40 ms    40 ms    39 ms  123.126.8.250 9     *        *        *     请求超时。 10    41 ms    42 ms    43 ms  61.148.60.134 11     *        *        *     请求超时。 12     *        *        *     请求超时。 13     *        *        *     请求超时。 14     *        *        *     请求超时。 15    40 ms    40 ms    41 ms  202.89.233.101 跟踪完成。 =================================================== 在NSVPX-91上禁用10.0.100.1/24这条链路： =================================================== > disable service svc_isp_outside_vmbridge_two Done > show lb vserver lb_vsrv_llb lb_vsrv_llb (0.0.0.0:0) - ANY Type: ADDRESS State: UP Last state change was at Wed Feb 28 13:53:39 2018 Time since last state change: 0 days, 00:43:44.400 Effective State: UP Client Idle Timeout: 120 sec Down state flush: ENABLED Disable Primary Vserver On Down : DISABLED Appflow logging: ENABLED No. of Bound Services :  3 (Total)      1 (Active) Configured Method: ROUNDROBIN  BackupMethod: NONE Mode: IP Persistence: DESTIP      Persistence Mask: 255.255.255.255    Persistence v6MaskLength: 128     Persistence Timeout: 2 min Connection Failover: DISABLED L2Conn: OFF Skip Persistency: None Listen Policy: NONE IcmpResponse: PASSIVE RHIstate: PASSIVE New Service Startup Request Rate: 0 PER_SECOND, Increment Interval: 0 Mac mode Retain Vlan: DISABLED DBS_LB: DISABLED Process Local: DISABLED Traffic Domain: 0 TROFS Persistence honored: ENABLED Retain Connections on Cluster: NO 1) svc_isp_outside_vmnat_one (192.168.195.2: 0) - ANY State: UP Weight: 1 2) svc_isp_outside_vmbridge_one (192.168.1.1: 0) - ANY State: DOWN Weight: 1 3) svc_isp_outside_vmbridge_two (10.0.100.1: 0) - ANY State: OUT OF SERVICE       Weight: 1 Done =================================================== 在Win2008R2AD这台机器上，对www.bing.com域名对应的主机进行tracert.exe操作，查看链路走向： =================================================== PS C:\Users\adpadmin> TRACERT.EXE www.bing.com 通过最多 30 个跃点跟踪 到 cn-0001.cn-msedge.net [202.89.233.100] 的路由: 1    <1 毫秒   <1 毫秒   <1 毫秒 192.168.185.91 2    <1 毫秒   <1 毫秒   <1 毫秒 192.168.195.2 3     *        *        *     请求超时。 4     *        *        *     请求超时。 5     *        *        *     请求超时。 6     *        *        *     请求超时。 7     *        *        *     请求超时。 8     *        *        *     请求超时。 9     *        *        *     请求超时。 10     *        *        *     请求超时。 11     *        *        *     请求超时。 12     *        *        *     请求超时。 13     *        *        *     请求超时。 14     *        *        *     请求超时。 15     *        *        *     请求超时。 16    42 ms   153 ms    42 ms  202.89.233.100 跟踪完成。 =================================================== 在NSVPX-91上恢复10.0.100.1/24这条链路： =================================================== > enable service svc_isp_outside_vmbridge_two Done > show lb vserver lb_vsrv_llb lb_vsrv_llb (0.0.0.0:0) - ANY Type: ADDRESS State: UP Last state change was at Wed Feb 28 13:54:09 2018 Time since last state change: 0 days, 00:51:41.140 Effective State: UP Client Idle Timeout: 120 sec Down state flush: ENABLED Disable Primary Vserver On Down : DISABLED Appflow logging: ENABLED No. of Bound Services :  3 (Total)      2 (Active) Configured Method: ROUNDROBIN  BackupMethod: NONE Mode: IP Persistence: DESTIP      Persistence Mask: 255.255.255.255    Persistence v6MaskLength: 128     Persistence Timeout: 2 min Connection Failover: DISABLED L2Conn: OFF Skip Persistency: None Listen Policy: NONE IcmpResponse: PASSIVE RHIstate: PASSIVE New Service Startup Request Rate: 0 PER_SECOND, Increment Interval: 0 Mac mode Retain Vlan: DISABLED DBS_LB: DISABLED Process Local: DISABLED Traffic Domain: 0 TROFS Persistence honored: ENABLED Retain Connections on Cluster: NO 1) svc_isp_outside_vmnat_one (192.168.195.2: 0) - ANY State: UP Weight: 1 2) svc_isp_outside_vmbridge_one (192.168.1.1: 0) - ANY State: DOWN Weight: 1 3) svc_isp_outside_vmbridge_two (10.0.100.1: 0) - ANY State: UP  Weight: 1 Done =================================================== 在Win2008R2AD这台机器上，对www.bing.com域名对应的主机进行tracert.exe操作，查看链路走向： =================================================== PS C:\Users\adpadmin> TRACERT.EXE www.bing.com 通过最多 30 个跃点跟踪 到 cn-0001.cn-msedge.net [202.89.233.101] 的路由: 1    <1 毫秒   <1 毫秒   <1 毫秒 192.168.185.91 2     1 ms     1 ms     1 ms  OPENWRT [10.0.100.1] 3    22 ms    47 ms     3 ms  163.125.48.1 4     6 ms     7 ms     7 ms  120.80.165.233 5     *        9 ms     *     221.4.0.125 6    46 ms    42 ms    44 ms  219.158.15.37 7     *        *        *     请求超时。 8    41 ms    40 ms    40 ms  123.126.8.250 9     *        *        *     请求超时。 10    40 ms    40 ms    41 ms  61.148.60.134 11     *        *        *     请求超时。 12     *        *        *     请求超时。 13     *        *        *     请求超时。 14     *        *        *     请求超时。 15    40 ms    40 ms    42 ms  202.89.233.101 跟踪完成。 =================================================== 结论：可以NSVPX-91虚拟机实例的系统可以自动切换链路，始终保持数据包在正常链路上进行通信，避开失效的链路。
验证结束

统一网关功能测试
步骤	操作
	在NSVPX-91上验证UG是否配置正确： =================================================== > show cs vserver myUnifiedGateway myUnifiedGateway (10.0.100.111:443) - SSL     Type: CONTENT State: UP Last state change was at Wed Feb 28 13:54:36 2018 Time since last state change: 0 days, 01:31:49.120 Client Idle Timeout: 180 sec Down state flush: ENABLED Disable Primary Vserver On Down : DISABLED Appflow logging: ENABLED State Update: DISABLED Default: Content Precedence: RULE Vserver IP and Port insertion: OFF L2Conn: OFF Case Sensitivity: ON Authentication: OFF 401 Based Authentication: OFF Push: DISABLED    Push VServer: Push Label Rule: none Listen Policy: NONE IcmpResponse: PASSIVE RHIstate:  PASSIVE Traffic Domain: 0 1)    AppFlow Policy Name: _vpn_myUnifiedGateway_Transparent_apfw_pol       Priority: 255 GotoPriority Expression: END 1)    Content-Switching Policy: UG_CSPOL_myUnifiedGateway     Priority: 63000       Hits: 24 Done > show vpn vserver UG_VPN_myUnifiedGateway UG_VPN_myUnifiedGateway (0.0.0.0:0) - SSL   Type: CONTENT State: UP  ARP:DISABLED Down state flush: ENABLED Loginonce: ON Disable Primary Vserver On Down : DISABLED HTTP profile name: nshttp_default_strict_validation Appflow logging: ENABLED Authentication : ON Device Certificate Check: OFF CGInfra Homepage Redirect : ENABLED Current AAA Sessions: 0 Total Connected Users: 0 Icaonlylicense : OFF     IcaProxySessionMigration : OFF DoubleHop : DISABLED       Dtls : ON L2Conn: OFF Max Login Attempts: 0 Failed Login Timeout 0 Fully qualified domain name: UG_VPN_myUnifiedGateway Listen Policy: NONE IcmpResponse: PASSIVE RHIstate:  PASSIVE Traffic Domain: 0 1)    AppFlow Policy Name: _UG_VPN_myUnifiedGateway_Transparent_apfw_pol       Priority: 255 GotoPriority Expression: END Flowtype: REQUEST 1)    Cache Policy Name: _cacheTCVPNStaticObjects      Priority: 10 GotoPriority Expression: END Flowtype: REQUEST 2)    Cache Policy Name: _cacheOCVPNStaticObjects     Priority: 20 GotoPriority Expression: END Flowtype: REQUEST 3)    Cache Policy Name: _cacheVPNStaticObjects  Priority: 30 GotoPriority Expression: END Flowtype: REQUEST 4)    Cache Policy Name: _mayNoCacheReq     Priority: 40 GotoPriority Expression: END Flowtype: REQUEST 5)    Cache Policy Name: _cacheWFStaticObjects    Priority: 10 GotoPriority Expression: END Flowtype: RESPONSE 6)    Cache Policy Name: _noCacheRest    Priority: 20 GotoPriority Expression: END Flowtype: RESPONSE 1)           VPN Session Policy Name: UG_VPN_SPol_10.0.100.111  Type: Advanced        Priority: 58000      GotoPriorityExpression: NEXT 1)    Url: bing 2)    Url: baidu 3)    Url: webgoat 1)    VPN Application: Intranet 1)           Primary ldap authentication policy name: 192.168.185.191_LDAP_pol       Priority: 60 1)           Primary local authentication policy name: NS_GATEWAY_DEFAULT_LOCAL_POL      Priority: 64000 1)    Intranet IP: 192.168.185.161 netmask: 255.255.255.224 1)    VPN PortalTheme: X1 1)    Eula : Security Message Done ===================================================
	在Win7MSP上访问统一网关站点： 输入用户名和密码以及接受许可，登录网站，选择无客户端访问： 使用无客户访问的方式浏览内网站点： 在移动设备IPhone上使用Citrix VPN软件，进行UG的连接： UG可以使用两种方式进行连接 一种是基于SSL VPN的网络访问，另外一种是基于浏览器的无客户访问。 在MPSVPX-95中，可以看见统计的UG数据：
验证结束

安全WEB网关功能测试
步骤	操作
	在NSVPX-91上验证SWG是否配置正确： =================================================== > show cs vserver mySWG_Transparent mySWG_Transparent (*:*) - PROXY    Type: CONTENT State: UP[Certkey not bound] Last state change was at Wed Feb 28 13:54:29 2018 Time since last state change: 0 days, 01:30:06.330  ARP:DISABLED Client Idle Timeout: 180 sec Down state flush: ENABLED Disable Primary Vserver On Down : DISABLED Appflow logging: ENABLED State Update: DISABLED Default: Content Precedence: RULE L2Conn: OFF Case Sensitivity: ON Authentication: OFF 401 Based Authentication: OFF Listen Policy: NONE IcmpResponse: PASSIVE RHIstate:  PASSIVE Traffic Domain: 0 1)    AppFlow Policy Name: _swg_mySWG_Transparent_apfw_pol Priority: 11 GotoPriority Expression: END Done ===================================================
	在Win2008R2AD这台机器上，访问外网，产生流量数据： 在MPSVPX-95上验证通过安全网关审计的流量：
验证结束

无缝集成文件流杀毒网关功能测试
步骤	操作
	验证NSVPX-91上无缝集成文件流杀毒网关配置是否正确 =================================================== > show cs vserver cs_vsrv_uploadfile cs_vsrv_uploadfile (192.168.195.112:80) - HTTP      Type: CONTENT State: UP Last state change was at Wed Feb 28 13:57:11 2018 Time since last state change: 0 days, 02:38:10.190 Client Idle Timeout: 180 sec Down state flush: ENABLED Disable Primary Vserver On Down : DISABLED Appflow logging: ENABLED Port Rewrite : DISABLED State Update: DISABLED Default: Content Precedence: RULE Vserver IP and Port insertion: OFF L2Conn: OFF Case Sensitivity: ON Authentication: OFF 401 Based Authentication: OFF Push: DISABLED    Push VServer: Push Label Rule: none Listen Policy: NONE IcmpResponse: PASSIVE RHIstate:  PASSIVE Traffic Domain: 0 1)    Responder Policy Name: ICAPRequest      Priority: 100 GotoPriority Expression: END 1)    Content-Switching Policy: cs_pol_uploadfile    Target LB: lb_vsrv_test       Priority: 100   Hits: 0 Done > show responder policy ICAPRequest Name: ICAPRequest Rule: HTTP.REQ.HEADER("Content-Type").CONTAINS("multipart/form-data") && sys.HTTP_CALLOUT(http_callout_squid) Responder Action: ICAPError UndefAction: Use Global LogAction: Use Global Hits: 0 Undef Hits: 0 Policy is bound to following CS VSERVERS 1)    Bound to: REQ VSERVER cs_vsrv_uploadfile Priority: 100 GotoPriorityExpression: END Done ===================================================
	上传正常文件： 上传病毒文件： 查看策略是否命中 查看文件流杀毒服务器的日志：
验证结束

应用防火墙功能测试
步骤	操作
	验证NSVPX-91上应用防火墙配置是否正确 =================================================== > show lb vserver lb_vsrv_webgoat lb_vsrv_webgoat (192.168.195.101:443) - SSL   Type: ADDRESS State: UP Last state change was at Wed Feb 28 15:51:14 2018 Time since last state change: 0 days, 01:00:34.860 Effective State: UP Client Idle Timeout: 180 sec Down state flush: ENABLED Disable Primary Vserver On Down : DISABLED Appflow logging: ENABLED No. of Bound Services :  1 (Total)      1 (Active) Configured Method: SOURCEIPHASH BackupMethod: ROUNDROBIN Network mask: 255.255.255.255 Mode: IP Persistence: SOURCEIP Persistence Mask: 255.255.255.255    Persistence Timeout: 2 min Vserver IP and Port insertion: OFF Push: DISABLED    Push VServer: Push Multi Clients: NO Push Label Rule: none L2Conn: OFF Skip Persistency: None Listen Policy: NONE IcmpResponse: PASSIVE RHIstate: PASSIVE New Service Startup Request Rate: 0 PER_SECOND, Increment Interval: 0 Mac mode Retain Vlan: DISABLED DBS_LB: DISABLED Process Local: DISABLED Traffic Domain: 0 TROFS Persistence honored: ENABLED Retain Connections on Cluster: NO 1) svc_webgoat (192.168.185.73: 8080) - HTTP State: UP       Weight: 1 1)    Rewrite Policy Name: rw_pol_sendtowebgoat  Priority: 101 GotoPriority Expression: NEXT Flowtype: REQUEST 1)    AppFlow Policy Name: lb_vsrv_webgoat_Transparent_apfw_pol    Priority: 255 GotoPriority Expression: END 1)    Policy : appfw_pf_webgoat Priority:100     GotoPriority Expression: NEXT Done ===================================================
验证结束