|
|
发表于 2004-12-2 00:58:14
|
显示全部楼层
22.试比较"网络地址转换"和"代理服务器"的优
找了些资料，摘下来读读。
Application Level Gateway (Proxy)
An application level gateway is often referred to as a proxy. Actually, an
application level gateway provides higher level control on the traffic between two
networks in that the contents of a particular service can be monitored and filtered
according to the network security policy. Therefore, for any desired application,
corresponding proxy code must be installed on the gateway in order to manage that
specific service passing through the gateway。
A proxy acts as a server to the client and as a client to the destination server. A
virtual connection is established between the client and the destination server.
Though the proxy seems to be transparent from the point of view of the client and
the server, the proxy is capable of monitoring and filtering any specific type of data,
such as commands, before sending it to the destination. For example, an FTP
server is permitted to be accessed from outside. In order to protect the server from
any possible attacks the FTP proxy in the firewall can be configured to deny PUT
and MPUT commands.
A proxy server is an application-specific relay server that runs on the host that
connects a secure and a non-secure network. The purpose of a proxy server is to
control exchange of data between the two networks at an application level instead
of an IP level. By using a proxy server, it is possible to disable IP routing between
the secure and the non-secure network for the application protocol the proxy server
is able to handle, but still be able to exchange data between the networks by
relaying it in the proxy server.
Compared with IP filtering, application level gateways provide much more
comprehensive logging based on the application data of the connections. For
example, an HTTP proxy can log the URLs visited by users. Another feature of
application level gateways is that they use strong user authentication. For
example, when using FTP and TELNET services from the unsecure network, users
have to authenticate themselves to the proxy.
A disadvantage of application level gateways is that in order to achieve a
connection via a proxy server, the client software should be changed to support
that proxy service. This can sometimes be achieved by some modifications in user
behavior rather than software modification. For example, to connect to a TELNET
server over a proxy, the user first has to be authenticated by the proxy server then
by the destination TELNET server. This requires two user steps to make a
connection rather than one. However, a modified TELNET client can make the
proxy server transparent to the user by specifying the destination host rather than
proxy server in the TELNET command. |
|
IP卡
狗仔卡
显身卡