TIDP and TMS 视频介绍

Threat Information Distribution Protocol (TIDP) and TMS

这是一个Cisco最新推出的安全设备联动技术，如下是我的视频介绍和配置备份。

视频介绍：

1.拓扑和术语介绍.exe

http://www.rayfile.com/files/797f69d1-0ed1-11df-8b67-0015c55db73d/

2.tidp psk.exe

http://www.rayfile.com/files/d211ac40-0ed1-11df-bc49-0015c55db73d/

3.tidp rsa.exe

http://www.rayfile.com/files/8cac703d-0ed0-11df-8df0-0015c55db73d/

4.tms Controller和Consumer配置.exe

http://www.rayfile.com/files/436e262b-0ed2-11df-8576-0015c55db73d/

5.介绍XML TDF文件编写方法 加载XML TDF并且测试.exe

http://www.rayfile.com/files/fed802f8-0ed2-11df-81f0-0015c55db73d/

6.Consumer tms local policy.exe

http://www.rayfile.com/files/5dc3c4b8-0ed3-11df-a2cf-0015c55db73d/

欢迎购买现任明教教主汇总视频DVD，附送NMAP视频（仅仅只收取工本费，68元包运费）

请复制粘贴链接到IE

http://item.taobao.com/auction/item_detail-0db2-e730ea190ec8fdff434540233ed6c76b.jhtml

配置备份：

tidp psk 配置备份：

****************Controller******************
enable
config t
hostname Controller
no ip domain lookup
ip domain name bjsec.net
ip host Consumer.bjsec.net 202.100.1.2
interface FastEthernet0/0
ip address 202.100.1.1 255.255.255.0
no shut
interface Loopback0
ip address 1.1.1.1 255.255.255.255
interface Loopback1
ip address 3.3.3.3 255.255.255.255
ip route 0.0.0.0 0.0.0.0 202.100.1.2

***************Consumer********************
enable
config t
hostname Consumer
no ip domain lookup
ip domain name bjsec.net
ip host Controller.bjsec.net 202.100.1.1
interface FastEthernet0/0
ip address 202.100.1.2 255.255.255.0
no shut
interface Loopback0
ip address 2.2.2.2 255.255.255.255
ip route 0.0.0.0 0.0.0.0 202.100.1.1

****************Controller.tidp配置************

config t
tidp key-set tidp.key
authentication-key send key-string 0 wolfccies.1
authentication-key receive key-string 0 wolfccies.2
encryption-key send key-string 0 cisco.1
encryption-key receive key-string 0 cisco.2
tidp group 10
peer 202.100.1.2
key-set tidp.key
registration retry-interval min 30 max 600
active

tidp source interface FastEthernet0/0
tidp source device-id Controller
tidp enable
end
debug tidp test

*******************Consumer.tidp配置********************
config t
tidp key-set tidp.key
authentication-key send key-string 0 wolfccies.2
authentication-key receive key-string 0 wolfccies.1
encryption-key send key-string 0 cisco.2
encryption-key receive key-string 0 cisco.1
tidp group 10
peer 202.100.1.1
key-set tidp.key
active

tidp source interface FastEthernet0/0
tidp source device-id Consumer
tidp enable
end
debug tidp test

*************************测试*******************************
双方都打开debug tidp test
test tidp send group 10 peer-ip 202.100.1.1 message bjsecwolftesttms

tidp rsa 配置备份：

****************Controller******************
enable
config t
hostname Controller
no ip domain lookup
ip domain name bjsec.net
ip host Consumer.bjsec.net 202.100.1.2
interface FastEthernet0/0
ip address 202.100.1.1 255.255.255.0
no shut
interface Loopback0
ip address 1.1.1.1 255.255.255.255
interface Loopback1
ip address 3.3.3.3 255.255.255.255
ip route 0.0.0.0 0.0.0.0 202.100.1.2

cry key generate rsa general-keys modulus 1024

***************Consumer********************
enable
config t
hostname Consumer
no ip domain lookup
ip domain name bjsec.net
ip host Controller.bjsec.net 202.100.1.1
interface FastEthernet0/0
ip address 202.100.1.2 255.255.255.0
no shut
interface Loopback0
ip address 2.2.2.2 255.255.255.255
ip route 0.0.0.0 0.0.0.0 202.100.1.1

cry key generate rsa general-keys modulus 1024

****************Controller.tidp配置************

config t
crypto key pubkey-chain rsa
named-key Consumer.bjsec.net signature
address 202.100.1.2
key-string
30819F30 0D06092A 864886F7 0D010101 05000381 8D003081 89028181 00954ED8
0031F7F7 BD71EA3C 64E7DB29 A407B51B D1B03570 A5F46620 B4AA2E32 94951D80
3E4A39E8 DB91C2DB 977FD89B 650B17E7 3E208E8A F7E39689 A02E6963 E74E23C5
0D5C601D 035AAA3A 7E91B998 13543E0A 9D81815C 524C3689 562A5555 0FF268F9
D4F12E44 D52589DA B66CC037 B0E454FC CA1F7F67 431E6302 E46A9BF3 0F020301 0001
quit
tidp key-set tidp.key
authentication-key send keypair-name Controller.bjsec.net
authentication-key receive pubkey-name Consumer.bjsec.net
encryption-key send key-string 0 wolfccies.1
encryption-key receive key-string 0 wolfccies.2
tidp group 10
peer 202.100.1.2
key-set tidp.key
registration retry-interval min 30 max 600
active

tidp source interface FastEthernet0/0
tidp source device-id Controller
tidp enable

*******************Consumer.tidp配置********************
config t
crypto key pubkey-chain rsa
named-key Controller.bjsec.net signature
address 202.100.1.1
key-string
30819F30 0D06092A 864886F7 0D010101 05000381 8D003081 89028181 00B7A1DA
3F48134B 0948A470 7AD02558 E1CB58E1 0DEE5695 EF089E0E EDB654EF 4DCAC9F7
98B278E5 2E7232FD E6A68E7A 57BA060D 95577138 5A45BD34 B3F9E062 B7064813
682DE3C2 8D67DAA2 C334A0A6 941B979F 8C940B77 00C435A5 62C204AC 9CDB3E33
B1B7B786 C1732BF1 FEAF5544 F615FAF3 63C04D93 EA4D8428 0CC15A8A F7020301 0001
quit
tidp key-set tidp.key
authentication-key send keypair-name Consumer.bjsec.net
authentication-key receive pubkey-name Controller.bjsec.net
encryption-key send key-string 0 wolfccies.2
encryption-key receive key-string 0 wolfccies.1
tidp group 10
peer 202.100.1.1
key-set tidp.key
active

tidp source interface FastEthernet0/0
tidp source device-id Consumer
tidp enable

*************************测试*******************************
双方都打开debug tidp test
test tidp send group 10 peer-ip 202.100.1.1 message sdfsdfsdf

tms 配置备份：

************Controller******************
config t

parameter-map type tms tms.para
logging tms events syslog
heartbeat retry interval 60
heartbeat retry count 3
message retry interval 15
message retry count 5

class-map type control tms match-any tms.class
match tidp-group 10

policy-map type control tms tms.policy
class type control tms tms.class
mitigation tms.para

tms controller
service-policy type control tms tms.policy
identifier 1000

察看状态命令
show tms controller
show tms controller stat

***********Consumer**********************
config t
ip access-list extended tms.acl
permit ip any any

interface FastEthernet0/0
ip access-group tms.acl in
tms-class

parameter-map type tms tms.para
controller ipv4 202.100.1.1
logging tms events syslog
registration retry interval 60

class-map type control tms match-any tms.class
match tidp-group 10
policy-map type control tms tms.policy
class type control tms tms.class
mitigation tms.para
tms consumer
service-policy type control tms tms.policy

察看状态命令
show tms consumer
show tms consumer stat

*********Consumer tms本地配置*************
config t
class-map type control mitigation match-all MIT.Ignore.class
match priority 3
match primitive block

policy-map type control mitigation MIT.Ignore.policy
class type control mitigation MIT.Ignore.class
ignore
policy-map type control tms tms.policy
class type control tms tms.class
service-policy type control mitigation MIT.Ignore.policy

tms操作：

加载TDF文件:
tms controller load threat ftp://202.100.1.254/XTDF

给consumer推送策略
tms controller send group 10 owner 1055 tid 1000 consumer all duration 3600
tms controller send group 10 owner 1055 tid 1001 consumer all duration 3600
删除策略
tms controller reset delete group 10 owner 1055 tid 1000 consumer all
tms controller reset delete group 10 owner 1055 tid 1001 consumer all

XmlNotepad.msi 下载路径：

http://www.rayfile.com/files/712f3359-0ed3-11df-af0d-0015c55db73d/

XTDF 实例下载路径：

http://www.rayfile.com/files/71dcf030-0ed3-11df-a220-0015c55db73d/