Firewall security policy configuration method and management unit

Abstract

The invention provides a firewall security policy configuration method and a management unit. The method comprises the following steps of: obtaining attack prevention configuration information which includes maximum message rate, message size or an on-and-off parameter and is sent from the firewall; obtaining first filter rule information which includes an IP address, a port number, a network protocol and action attribute and is sent from the firewall; generating a policy package including security policy configuration information according to the attack prevention configuration information and the first filter rule information; and sending the security policy configuration information to the association firewall according to association firewall information corresponding to the security policy configuration information in the policy package. In the embodiment of the invention, the security policy of a single firewall is reversely reduced to the policy package, thus providing convenience for a user to conduct security policy configuration on the firewall.

Description

technical field [0001] The invention relates to network security technology, in particular to a firewall security policy configuration method and management device. Background technique [0002] The modern firewall system is not only an "entrance barrier", but also an access control point for several networks. All data flows passing through the network protected by the firewall should first pass through the firewall, making the firewall a gateway for information to enter, so the firewall can Protect the security of the entire internal network on the Internet. In each network separated by a firewall, all computers are considered "trusted", and the communication between them can not be interfered by the firewall. Between the various networks separated by the firewall, mutual access must be carried out in accordance with the "security policy" stipulated by the firewall. Therefore, it is necessary to configure the security policy of the firewall to realize the protection of th...

AI Technical Summary

Problems solved by technology

[0005] In the process of realizing the present invention, the inventor found that the prior art has at least the following problems: when the user configures the security policy of a single firewall, the user will need to configure and issue each firewall. When the number of management network elements When it is larger, it will cause great trouble

The work of manually creating and editing policy packages is tedious and error-prone, and if a firewall has already configured security policy information, the management device cannot effectively use this information

Images