Firewall Kural Örnekleri

# Cisco ASA Firewall Kuralları
access-list OUTSIDE_IN extended permit tcp any host 192.168.1.10 eq 80
access-list OUTSIDE_IN extended permit tcp any host 192.168.1.10 eq 443
access-list OUTSIDE_IN extended permit tcp 192.168.1.0 255.255.255.0 any eq 22
access-list OUTSIDE_IN extended deny ip any any

# Fortinet FortiGate Kuralları
config firewall policy
    edit 1
        set srcintf "wan1"
        set dstintf "internal"
        set srcaddr "all"
        set dstaddr "web-server"
        set action accept
        set schedule "always"
        set service "HTTP" "HTTPS"
        set logtraffic all
    next
    edit 2
        set srcintf "internal"
        set dstintf "wan1"
        set srcaddr "internal-net"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set logtraffic all
    next
end
                    

# Web sunucusu için temel kural örneği
config firewall policy
    edit 1
        set srcintf "wan1"
        set dstintf "internal"
        set dstaddr "web-server"
        set action accept
        set service "HTTP" "HTTPS"
        set logtraffic all
    next
end

Cisco ASA IPsec VPN Yapılandırması

# Phase 1 (IKE) Yapılandırması
crypto isakmp policy 10
 encryption aes 256
 hash sha256
 authentication pre-share
 group 14
 lifetime 86400

crypto isakmp key secret123 address 203.0.113.1

# Phase 2 (IPsec) Yapılandırması
crypto ipsec transform-set ESP-AES256-SHA256 esp-aes 256 esp-sha256-hmac
crypto map VPN-MAP 10 ipsec-isakmp
 set peer 203.0.113.1
 set transform-set ESP-AES256-SHA256
 match address VPN-ACL

# Access List Tanımlama
access-list VPN-ACL extended permit ip 192.168.1.0 255.255.255.0 10.0.0.0 255.255.255.0

# Interface'e Crypto Map Uygulama
interface GigabitEthernet0/0
 crypto map VPN-MAP
                    

# IPsec Phase 1–2 özet
crypto isakmp policy 10
 encryption aes 256  hash sha256  authentication pre-share  group 14
crypto ipsec transform-set ESP-AES256-SHA256 esp-aes 256 esp-sha256-hmac
crypto map VPN-MAP 10 ipsec-isakmp
 set peer 203.0.113.1  set transform-set ESP-AES256-SHA256  match address VPN-ACL

SNMP Yapılandırma Örnekleri

# Cisco Router SNMP Yapılandırması
snmp-server community public RO
snmp-server community private RW
snmp-server location "Data Center - Floor 1"
snmp-server contact "admin@company.com"
snmp-server enable traps
snmp-server host 192.168.1.100 public

# Linux SNMP Agent Yapılandırması
# /etc/snmp/snmpd.conf
rocommunity public
rwcommunity private
syslocation "Server Room"
syscontact "admin@company.com"
trap2sink 192.168.1.100 public

# SNMP Walk Komutu Örnekleri
snmpwalk -v2c -c public 192.168.1.1 1.3.6.1.2.1.1.1.0  # System Description
snmpwalk -v2c -c public 192.168.1.1 1.3.6.1.2.1.2.2.1.10 # Interface In Octets
snmpwalk -v2c -c public 192.168.1.1 1.3.6.1.2.1.2.2.1.16 # Interface Out Octets
                    

# Wireshark filtresi örnekleri
http.request.method == "POST"
tcp.flags.syn == 1 and tcp.flags.ack == 0
tcp.len > 1000
dns.qry.name contains "suspicious"

Cisco Wireless Controller Yapılandırması

# WPA2 Enterprise Security Profile
wlan profile-name "Corporate-WiFi"
 security wpa2
  wpa2-psk key "StrongPassword123!"
  wpa2-psk key-format ascii
  wpa2-psk key-rotation 86400
  wpa2-psk key-rotation-interval 3600

# 802.1X Authentication
security wpa2
 authentication wpa2-enterprise
 encryption aes
 radius-server 192.168.1.10
 radius-key "RadiusSecret123"
 eap-method peap
 inner-authentication mschapv2

# Access Point Yapılandırması
ap profile "Office-AP"
 radio 1
  channel 6
  power 20
  mode 802.11n
 radio 2
  channel 36
  power 20
  mode 802.11ac
                    

Snort IDS/IPS Kural Örnekleri

# SQL Injection Tespiti
alert tcp any any -> any 80 (msg:"SQL Injection Attempt"; 
content:"union select"; nocase; sid:1001; rev:1;)

# ICMP Flood Tespiti
alert icmp any any -> any any (msg:"ICMP Flood Detected"; 
threshold:type both,track by_src,count 100,seconds 60; 
sid:1002; rev:1;)

# SSH Brute Force Tespiti
alert tcp any any -> any 22 (msg:"SSH Brute Force Attack"; 
threshold:type both,track by_src,count 5,seconds 60; 
sid:1003; rev:1;)

# Port Scan Tespiti
alert tcp any any -> any any (msg:"Port Scan Detected"; 
flags:S; threshold:type both,track by_dst,count 20,seconds 60; 
sid:1004; rev:1;)

# ARP Spoofing Tespiti
alert arp any any -> any any (msg:"ARP Spoofing Attempt"; 
content:"|00 00 00 00 00 00|"; sid:1005; rev:1;)