Johnson Lai. Technical Consultant E: Copyright Fortinet Inc. All rights reserved.

Transcription

1 IPv6 防護管理及控管機制 Johnson Lai Technical Consultant E: Copyright Fortinet Inc. All rights reserved.

2 IPV6 Now! 2

3 Internet and TCP/IP 1969 ARPANET begins 1981 IPv4 definition (RFC 791) 1983 ARPANET adopts TCP/IP 1990 First research about IP exhaustion 1993 Begins the commercial internet 2011 No more /8 IPv4 available in Asia (APINIC) 3

4 4

5 安全報告分析趨勢 95% 的惡意軟體存在少於一個月, 其中 4/5 的種類不到一週的時間就消失 70 90% 的惡意軟體樣本都具有獨一性 針對特定企業或組織所設計開發的 50% 近 50% 的釣魚電子郵件收到後, 相關的連結會在第一個小時被點擊 23% 的收件人除了點選釣魚網站連結外, 另外有 11% 的人員也會同時開啟附件檔案 60% 六成的資安事件裡, 攻擊者可以在幾分鐘之內發動攻擊, 並快速癱瘓企業或組織 5

6 Lets Talk Security 6

7 Security issues related to IPv6 IPv4 security devices cannot inspect IPv6 traffic Some legacy security devices will never support IPv6 and will need to be replaced Many security vendors have limited support for IPv6 today, leading to potential gaps in protection Address Translation Potential Vulnerabilities IPv6 support is often at much slower performance 7

8 IPv6 Security Concerns ICMPv6 handling» ICMPv6 has more relevance» Give you control over ICMPv6 despite what RFCs suggest Firewalls to protect Routers and Network IPv6 specific Features» Neighbor Discovery» Router Advertisment» Multicast handling 8

9 IPv6 Extenstion Header Security 40 Byte FIXED 9

10 IPv6 Extenstion Header Security IPv6 Extension Header and Options» Give you full control over IPv6 Extension» Validation to conformity» Lengths Control» RFC6564 (A Uniform Format for IPv6 Extension Headers) Application Security» DNS Domain Name Services» All other Applications Old App-Attacks remain the same 10

11 IPv6 All Features Static / Dynamic routing (RIPng, OSPFv3 and BGP4+) DNS Network interface addressing Routing access lists and prefix lists IPv6 tunnel over IPv4, IPv4 tunnel over IPv6 Security policies Authentication IPv6 over SCTP Packet and network sniffing IPsec VPN SSL VPNs UTM protection NAT/Route and Transparent mode Logging and reporting SNMP Virtual IPs and groups Ping6 IPv6 NAT: NAT66, NAT64, DNS64 IPv6 explicit proxy IPv6 MIBs IPv6 Per-IP shaper IPv6 policy routing IPv6 session pickup in HA mode NAT64 acceleration (XLR/XLP) IPv6 SSL proxy IPS inspection DHCP Client / DHCP Relay NAT64 High Availability (HA) 11

12 Transition of IPv6 Ebony and Ivory 12

13 Transition and Co-Existence Tunnelling / Encapsulation» DSLite» 6over4 (SIXXS, Hurricane Electric) Translation» NAT64» NAT46» NAT444 / NAT446 Dual-Stack (Co-existence) 13

14 Tunneling/Encapsulation De-Capsulation + CGN IPv4 IPv6[IPv4] IPv4 IPv6 IPv4 IPv6 IPv6 Access and Transport 14

15 Tunneling/Encapsulation IPv6[IPv4] IPv4 IPv6 IPv6 IPv4 IPv6 15

16 Dual-Stack/Co-existence IPv4 IPv6 IPv4 IPv6 IPv6 and IPv4 Access and Transport 16

17 Dual-Stack/Co-existence IPv4 IPv6 IPv4 IPv6 IPv4 IPv6 17

18 Translation IPv4 NAT46 IPv6 IPv6 Server IPv4 IPv4 Access and Transport IPv6 NAT64 IPv4 IPv4 Server IPv6 IPv6 Access and Transport 18

19 Translation IPv4 IPv4 IPv4 IPv6 IPv6 IPv6 IPv6 IPv6 IPv4 IPv4 19

20 Options, Options, Options Logging 4in6 NAT46+6in6 6in4 NAT64 NAT46 NAT446 SIXXS CGN DNS64 20

21 Lets Talk Wire & Wireless 21

22 Access everywhere Unified Access Layer Remote Access Wired Access DIGITAL ASSET User Identification Access Control Content Inspection Attack Mitigation Wireless Access 22

23 Threat Landscape & Evolving IT Infrastructure Internal Segmentation Firewall (ISFW) ISFW Private Cloud ISFW Data Center ISFW Internet Edge Gateway Cloud External ISFW Internal Network (100 Gbps+) ISFW Interna l ISFW Branch Office WAN Home Office 23

24 ISFW Requirement NO. 1 - PERFORMANCE Internal Segmentation Firewall (ISFW) Border Firewall (NGFW) Internet Interfaces 10G, 40G & 100G No. of Ports 8 to 48 Ge/10Ge Throughput 10Gps to 1Tbps Ports Speeds 1G, 10G No. of Ports 2 to 12 Throughput Mbps to 1Gbps 24

25 High Performance Scalable Enterprise Firewall with Optimum Path Processing (OPP) Engine CPU CPU CPU UTM (Distributed Enterprise) UTM (SMB) Internal Segmentation Firewall (ISFW) Next Generation Firewall (NGFW) Data Center Firewall (DCFW) Virtual Firewall SDN Firewall Cloud Firewall Mbps Tbps 26

26 ISFW Requirement No. 2 - PROTECTION Firewall VPN Application Control IPS Web Filtering Anti-malware WAN Acceleration Data Leakage Protection WiFi Controller Advanced Threat Protection SaaS Gateway Software Enabled Security Module Management 27

27 A Global Threat Security Service that Updates the Platform in Real time - FortiGuard Application Control Service Antivirus Service Anti-spam Service Intrusion Prevention Service Web Security Service Web Filtering Service Database Security Service Vulnerability Management Service IP Reputation Service Mobile Security Global Fortinet Device Footprint 28

28 Platform Security Operations The Core of the Platform FortiOS Automated Orchestration Scalable Central Management Granular Segmentation Visibility w/ Context & one-click to action Time to Resolution Policy & Control Firewall NGFW ATP UTM Protection & Intelligence Virtual Machine Cloud Appliance End to End Platform 29

29 Internal Segmentation Firewall How is it different? Deployment Mode ISFW NGFW DCFW UTM Purpose Visibility & protection for internal segments Visibility & protection against external threats and internet activities High performance, low latency network protection Visibility & protection against external threats and user activities Location Access Layer Internet Gateway Core Layer/DC gateway Internet Gateway Network Operation Mode Transparent Mode NAT/Route Mode NAT/Route Mode NAT/Route Mode Hardware requirements Higher Port Density to protection multiple assets GbE and 10GbE ports High speed (GbE/10 GbE/40 GbE/100) & high port density, hardware acceleration High GbE port density, integrated wireless connectivity and POE Security Components Firewall, IPS, ATP, Application Control (User-based) Firewall, VPN, IPS, Application Control, Firewall, DDoS protection Comprehensive and extensible, client and device integration Other Characteristics Rapid Deployment near zero configuration Integration with Advanced Threat Protection (Sandbox) High Availability Different WAN Connectivity Options such as 3G4G 30

30 Some Thoughts Though Translation (NAT)» Increasing network complexity» Increasing Costs Law enforcement / Logging requirements» Service crippling» Service Points where NAT happen on central Devices» Fragmentation issues Thou shalt not trust your Network to translate your Applications Tunneling» Fragmentation» Unbalanced Networkcore Traffic / centralised TEP» Multicast handling 31

31 Lets Talk Solution 32

32 IPv6 Fortinet Solution Stateful Inspection Core Backbone Virtualisation Transition Techniques Unified Threat Management Performance RFC CATCH UP Management 4G/LTE GTP Diameter sigtran 33

33 FortiGate does it all! FortiGate does it fast! FortiGate does it secure! 34

34