陌生网络边界防火墙规则配置方法研究

摘要

This article summarizes the reason and damage of unacquainted network edge problem in ifrewall engineering conifguration, proposes three traditional solutions to this problem. Combining project experiences in large network, a demand analysis and log-exploring technical system is put forward as a new solution to conifgurate unacquainted network edge access rules. Based on many case studies and managerial psychology, demand analysis method is detailed design. Based on database and ifrewalls log analysis technology, log-exploring method is detailed design. The method in this article has been test and proven to be successful by using the mainstream ifrewall.%文章分析了防火墙工程部署中陌生网络边界问题的产生原因与危害，归纳了应对这一问题的3种传统方法。结合在大型网络中的工程实施经验，提出了解决陌生网络边界访问规则配置问题的“需求分析-日志挖掘”技术体系。基于调研案例分析和管理心理学，对体系中的需求分析法进行了具体设计；基于数据库技术和防火墙日志分析技术，对体系中的日志挖掘法进行了具体设计。使用市场主流防火墙产品，对文章提出的方法进行了测试与验证。