{"id":253,"date":"2008-08-27T14:15:34","date_gmt":"2008-08-27T10:15:34","guid":{"rendered":"http:\/\/mudji.net\/press\/?p=253"},"modified":"2021-06-11T21:56:58","modified_gmt":"2021-06-11T17:56:58","slug":"konfigurasi-cisco-secure-pix-firewall-2-cisco-router","status":"publish","type":"post","link":"https:\/\/mudji.net\/press\/?p=253","title":{"rendered":"Konfigurasi Cisco Secure PIX Firewall & 2 Cisco Router"},"content":{"rendered":"

Network Diagram<\/strong><\/p>\n

\"Pix_Network_Diagram.gif\"<\/p>\n


\nKONFIGURASI:<\/strong>
\nKonfigurasi yang ditampilkan pertama kali disini adalah PIX Firewall karena konfigurasi router harus sudah mengerti sebelumnya dalam hubungannya dengan Firewall.<\/p>\n

<\/a> <\/p>\n\n\n\n\n
PIX Firewall<\/th>\n<\/tr>\n
\n
\n!--- Sets the outside address of the PIX Firewall:<\/span>\n<\/em>\nip address outside 131.1.23.2\n\n!--- Sets the inside address of the PIX Firewall:<\/span>\n<\/em>\nip address inside 10.10.254.1\n\n!--- Sets the global pool for hosts inside the firewall:<\/span>\n<\/em>\nglobal (outside) 1 131.1.23.12-131.1.23.254\n\n!--- Allows hosts in the 10.0.0.0 network to be\n!--- translated through the PIX:<\/span>\n<\/em>\nnat (inside) 1 10.0.0.0\n\n!--- Configures a static translation for an admin workstation\n!--- with local address 10.14.8.50:<\/span>\n<\/em>\nstatic (inside,outside) 131.1.23.11 10.14.8.50\n\n!--- Allows syslog packets to pass through the PIX from RTRA.\n!--- You can use conduits OR access-lists to permit traffic.\n!--- Conduits has been added to show the use of the command,\n!--- however they are commented in the document, since the\n!--- recommendation is to use access-list.\n!--- To the admin workstation (syslog server):\n!--- Using conduit:\n!--- conduit permit udp host 131.1.23.11 eq 514 host 131.1.23.1 <\/span>\n<\/em>\n\n\n!--- Using access-list:<\/span>\n<\/em>\nAccess-list 101 permit udp host 131.1.23.1 host 131.1.23.11 255.255.255.0 eq 514\nAccess-group 101 in interface outside\n\n!--- Permits incoming mail connections to 131.1.23.10:<\/span>\n<\/em>\nstatic (inside, outside) 131.1.23.10 10.10.254.3\n\n!--- Using conduits\n!--- conduit permit TCP host 131.1.23.10 eq smtp any\n!--- Using Access-lists, we use access-list 101\n!--- which is already applied to interface outside.<\/span>\n<\/em>\nAccess-list 101 permit tcp any host 131.1.23.10 eq smtp\n\n!--- PIX needs static routes or the use of routing protocols\n!--- to know about networks not directly connected.\n!--- Add a route to network 10.14.8.x\/24.<\/span>\n<\/em>\nroute inside 10.14.8.0 255.255.255.0 10.10.254.2\n\n!--- Add a default route to the rest of the traffic\n!--- that goes to the internet.<\/span>\n<\/em>\nRoute outside 0.0.0.0 0.0.0.0 131.1.23.1\n\n!--- Enables the Mail Guard feature\n!--- to accept only seven SMTP commands\n!--- HELO, MAIL, RCPT, DATA, RSET, NOOP, and QUIT:\n!--- (This can be turned off to permit ESMTP by negating with\n!--- the no fixup protocol smtp 25<\/strong> command):<\/span>\n<\/em>\nfixup protocol smtp 25\n\n!--- Allows Telnet from the inside workstation at 10.14.8.50\n!--- into the inside interface of the PIX:<\/span>\n<\/em>\ntelnet 10.14.8.50\n\n!--- Turns on logging:<\/span>\n<\/em>\nlogging on\n\n!--- Turns on the logging facility 20:<\/span>\n<\/em>\nlogging facility 20\n\n!--- Turns on logging level 7:<\/span>\n<\/em>\nlogging history 7\n\n!--- Turns on the logging on the inside interface:<\/span>\n<\/em>\nlogging host inside 10.14.8.50<\/pre>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
Catatan:<\/strong> RTRA adalah router pertahanan luar. RTRA harus melindungi PIX Firewall dari serangan secara langsung, melindungi server FTP\/HTTP, dan berfungsi sebagai sebuah alarm system. Jika seseorang masuk ke RTRA, system administrator akan tahu seketika.<\/p>\n\n\n\n\n
RTRA<\/th>\n<\/tr>\n
\n
no service tcp small-servers\n\n!--- Prevents some attacks against the router itself.<\/span>\n<\/em>\nlogging trap debugging\n\n!--- Forces the router to send a message\n!--- to the syslog server for each and every\n!--- event on the router. This includes packets denied\n!--- access through access lists and\n!--- configuration changes. This acts as an early warning system to the system\n!--- administrator that someone is trying to break in, or has broken in and is\n!--- trying to create a \"hole\" in their firewall.<\/span>\n<\/em>\nlogging 131.1.23.11\n\n!--- The router logs all events to this\n!--- host, which in this case is the\n!--- \"outside\" or \"translated\" address of the system\n!--- administrator's workstation.<\/span>\n<\/em>\nenable secret xxxxxxxxxxx\n!\ninterface Ethernet 0\nip address 131.1.23.1 255.255.255.0\n!\ninterface Serial 0\nip unnumbered ethernet 0\nip access-group 110 in\n\n!--- Shields the PIX Firewall and the HTTP\/FTP\n!--- server from attacks and guards\n!--- against spoofing attacks.<\/span>\n<\/em>\n!\naccess-list 110 deny ip 131.1.23.0 0.0.0.255 any log\n\n!--- RTRA and the PIX Firewall.\n!--- This is to prevent spoofing attacks.<\/span>\n<\/em>\naccess-list 110 deny ip any host 131.1.23.2 log\n\n!--- Prevents direct attacks against the\n!--- outside interface of the PIX Firewall and\n!--- logs any attempts to connect to the\n!--- outside interface of the PIX to the syslog server.<\/span>\n<\/em>\naccess-list 110 permit tcp any 131.1.23.0 0.0.0.255 established\n\n!--- Permits packets which are part\n!--- of an established TCP session.<\/span>\n<\/em>\naccess-list 110 permit tcp any host 131.1.23.3 eq ftp\n\n!--- Allows FTP connections into the FTP\/HTTP server.<\/span>\n<\/em>\naccess-list 110 permit tcp any host 131.1.23.3 eq ftp-data\n\n!--- Allows ftp-data connections into the FTP\/HTTP server.<\/span>\n<\/em>\naccess-list 110 permit tcp any host 131.1.23.3 eq www\n\n!--- Allows HTTP connections into the FTP\/HTTP server.<\/span>\n<\/em>\naccess-list 110 deny ip any host 131.1.23.3 log\n\n!--- Disallows all other connections to\n!--- the FTP\/HTTP server, and logs any attempt\n!--- to connect this server to the syslog server.<\/span>\n<\/em>\naccess-list 110 permit ip any 131.1.23.0 0.0.0.255\n\n!--- Permits other traffic destined to the\n!--- network between the PIX Firewall and RTRA.<\/span>\n<\/em>\n!\nline vty 0 4\nlogin\npassword xxxxxxxxxx\naccess-class 10 in\n\n!--- Restricts Telnet access to the router\n!--- to those IP addresses listed in\n!--- access list 10.<\/span>\n<\/em>\n!\naccess-list 10 permit ip 131.1.23.11\n\n!--- Permits only the workstation of the administrator\n!--- to Telnet into the router. This\n!--- access list may need to be changed to permit\n!--- access from the Internet for\n!--- maintenance, but should contain as few\n!--- entries as possible.<\/span>\n<\/em><\/pre>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
Catatan:<\/strong> RTRB adalah router pertahanan bagian dalam. RTRB adalah garis pertahanan terakhir dalam firewall anda, dan merupakan pintu masuk ke dalam jaringan internal anda.<\/p>\n
<\/a><\/p>\n\n\n\n\n
RTRB<\/th>\n<\/tr>\n
\n
logging trap debugging\nlogging 10.14.8.50\n\n!--- Log all activity on this router to the\n!--- syslog server on the administrator's\n!--- workstation, including configuration changes.<\/span>\n<\/em>\n!\ninterface Ethernet 0\nip address 10.10.254.2 255.255.255.0\nno ip proxy-arp\nip access-group 110 in\n\n!--- Prevents inside and outside addresses\n!--- from mingling; guards against attacks\n!--- launched from the PIX Firewall or the\n!--- SMTP server as much as possible.<\/span>\n<\/em>\n!\naccess-list 110 permit udp host 10.10.250.5 0.0.0.255\n\n!--- Permits syslog messages destined\n!--- to the administrator's workstation.<\/span>\n<\/em>\naccess-list 110 deny ip host 10.10.254.1 any log\n\n!--- Denies any other packets sourced\n!--- from the PIX Firewall.<\/span>\n<\/em>\naccess-list 110 permit tcp host 10.10.254.3 10.0.0.0 0.255.255.255 eq smtp\n\n!--- Permits SMTP mail connections from the\n!--- mail host to internal mail servers.<\/span>\n<\/em>\naccess-list 110 deny ip host 10.10.254.3 10.0.0.0 0.255.255.255\n\n!--- Denies all other traffic sourced\n!--- from the mail server.<\/span>\n<\/em>\naccess-list 110 deny ip 10.10.250.0 0.0.0.255 any\n\n!--- Prevents spoofing of trusted addresses\n!--- on the internal network.<\/span>\n<\/em>\naccess-list 110 permit ip 10.10.254.0 0.0.0.255 10.10.250.0 0.255.255.255\n\n!--- Permits all other traffic sourced from\n!--- the network between the PIX Firewall and RTRB.<\/span>\n<\/em>\n!\nline vty 0 4\nlogin\npassword xxxxxxxxxx\naccess-class 10 in\n\n!--- Restricts Telnet access to the router\n!--- to those IP addresses listed in\n!--- access list 10.<\/span>\n<\/em>\n!\naccess-list 10 permit ip 10.14.8.50\n\n!--- Permits only the workstation of the administrator\n!--- to Telnet into the router. This\n!--- access list may need to be changed to permit\n!--- access from the Internet for\n!--- maintenance, but should contain as few entries as possible.\n\n!--- A static route or routing protocol must be utilized\n!--- to make the router aware of network 10.14.8.x (which is\n!--- inside the corporate network). This is because\n!--- it is not a directly connected network.\n\n<\/span>\n<\/em><\/pre>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n
======<\/p>\n
KONSEP<\/strong><\/p>\n
Tujuan dari Firewall adalah untuk mencegah masuknya trafik yang tidak diinginkan (unauthorized\/illegal) ke dalam jaringan anda bersamaan dengan trafik yang anda inginkan (authorized\/legal). Hal ini akan menjadi lebih mudah dimulai dengan menganalisa dan membreakdown objek objek yang penting kemudian mempertimbangkan bagaimana membuat pertahanan dari kriminal\/hacker yang selalu mengintai untuk memasuki jaringan anda. Misal seorang kriminal mengincar server anda yang berisi informasi penting dan bisa dijual ke kompetitor anda. Dia mulai mempelajari server anda, misal alamat server anda 10.10.250.100<\/p>\n
Sang kriminal menemukan beberapa masalah serius: alamat IP server anda tidak bisa dicapai melalui Internet, jadi tidak ada satupun organisasi yang mengirimkan paket ke alamat network 10. Hal ini menyebabkan sang kriminal mencari tahu alamat ip berapa yang digunakan untuk mentranslate ip ini ke internet. Asumsikan bahwa sang kriminal tidak dapat menemukan cara untuk memasuki\/menyerang server anda secara langsung dari internet, kemudian mencari akal dengan jalan masuk ke jaringan dan menyerang server dari dalam jaringan anda.<\/p>\n
Rintangan pertama yang ditemuinya adalah “demilitarized zone” (DMZ), pada diagram diatas adalah antara RTRA dan PIX Firewall. Sang kriminal mencoba melewati\/memasuki RTRA, tetapi router telah dikonfigurasi hanya menerima koneksi dari workstation sang admin, dan memblock paket yang berasal dari DMZ itu sendiri. Jika sang kriminal bisa masuk ke RTRA, dia hanya menemukan bahwa dirinya sedang berhadapan dengan PIX Firewal itu sendiri – dia tidak akan bisa masuk ke jaringan anda, dan dia tetap tidak bisa menyerang\/masuk ke host\/server anda.<\/p>\n
Sang kriminal bisa mencoba dengan mematahkan FTP\/HTTP server, yang memiliki satu kemungkinan untuk dicoba. Host ini harus benar-benar aman dari jenis serangan seperti ini. Jika sang kriminal bisa mematahkan FTP\/HTTP dan masuk ke server, dia masih belum berada pada posisi untuk menyerang server secara langsung yang meiliki data-data sensitive, tapi dia berada pada posisi bisa menyerang PIX Firewall secara langsung. Dalam kasus ini, segala aktivitas kriminal seharusnya di LOG (menyimpan syslog pada server) oleh sang admin, sehingga bisa memberikan peringatan\/alert akan keberadaan seorang penyusup\/kriminal.<\/p>\n
Jika attacker (sang kriminal) sukses mematahkan outer DMZ, kurang lebih dia sudah berada pada posisi untuk menyerang PIX Firewall, jadi target selanjutnya adalah inner DMZ. Dia bisa mencapai inner DMZ dengan menyerang PIX Firewall atau menyerang RTRB, yang telah diprogram hanya menerima Telnet session dari PC sang admin saja. Sekali lagi, usaha attacker tsb utk mematahkan inner DMZ telah di LOG baik di PIX Firewall maupun di RTRB, jadi system administrator seharusnya menerima beberapa pesan peringatan “Warning” dan bisa menghentikan serangan sebelum attacker bisa masuk ke titik rawan \/ server yang berisi data-data sensitive.<\/p>\n
Konsepnya adalah buatlah pertahanan berlapis lapis bukan satu “super strong” firewall. Masing-masing bagian saling terhubung satu sama lain menjadi sebuah struktur Firewall yang sangat kuat, cukup flexible untuk melewatkan trafik yang anda inginkan, dan juga memiliki system alert\/peringatan (alarms & early warning systems)<\/p>\n","protected":false},"excerpt":{"rendered":"
Network Diagram KONFIGURASI: Konfigurasi yang ditampilkan pertama kali disini adalah PIX Firewall karena konfigurasi router harus sudah mengerti sebelumnya dalam hubungannya dengan Firewall.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[8],"tags":[],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/mudji.net\/press\/index.php?rest_route=\/wp\/v2\/posts\/253"}],"collection":[{"href":"https:\/\/mudji.net\/press\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mudji.net\/press\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mudji.net\/press\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mudji.net\/press\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=253"}],"version-history":[{"count":1,"href":"https:\/\/mudji.net\/press\/index.php?rest_route=\/wp\/v2\/posts\/253\/revisions"}],"predecessor-version":[{"id":392,"href":"https:\/\/mudji.net\/press\/index.php?rest_route=\/wp\/v2\/posts\/253\/revisions\/392"}],"wp:attachment":[{"href":"https:\/\/mudji.net\/press\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=253"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mudji.net\/press\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=253"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mudji.net\/press\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=253"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}