YD-T 4633-2023 网络功能虚拟化 NFV 架构下防火墙集中管理技术要求

ICS 35.030 CCS M10 YD 中华人民共和国通信行业标准 YD/T XXXX —XXXX 网络功能虚拟化（ NFV）架构下防火墙集中管理技术要求 Technical requirement of centralized management for firewall in Network Function Virtualization (NFV) （报批稿） XXXX - XX - XX发布 XXXX - XX - XX实施中华人民共和国工业和信息化部发布YD/T XXXX—XXXX I前言 .................................................................................. IV 1 范围 ................................................................................. 1 2 规范性引用文件 ....................................................................... 1 3 术语和定义 ........................................................................... 1 4 缩略语 ............................................................................... 1 5 总体架构及功能概述 ................................................................... 2 6 集中管理技术要求 ..................................................................... 3 6.1 集中管理预配置 ................................................................... 3 6.2 物理防火墙屏蔽 ................................................................... 3 6.3 认证订阅 ......................................................................... 3 6.4 告警管理 ......................................................................... 4 6.5 心跳查询 ......................................................................... 4 6.6 一致性对账 ....................................................................... 4 7 编排控制技术要求 ..................................................................... 4 7.1 防火墙设备 ....................................................................... 4 7.2 防火墙租户 ....................................................................... 4 7.3 防火墙设备接口 ................................................................... 5 7.4 防火墙安全域 ..................................................................... 5 7.5 安全策略 ......................................................................... 5 7.6 网络地址转换 ..................................................................... 5 7.7 静态路由 ......................................................................... 6 7.8 动态路由 ......................................................................... 6 8 接口要求 ............................................................................. 6 8.1 接口通用 ......................................................................... 6 8.2 认证及订阅接口 .................................................................. 10 8.3 告警接口 ........................................................................ 14 8.4 防火墙租户接口 .................................................................. 17 8.5 防火墙设备接口 .................................................................. 21 8.6 安全域接口 ...................................................................... 27 8.7 防火墙接口管理接口 .............................................................. 31 8.8 地址集接口 ...................................................................... 38 8.9 服务集接口 ...................................................................... 43 8.10 安全策略接口 ................................................................... 48 8.11 源NAT地址池接口 ............................................................... 58 8.12 NAT策略接口 ................................................................... 64 8.13 NAT映射接口 ................................................................... 73 8.14 静态路由接口 ................................................................... 79 8.15 BGP接口 ....................................................................... 83 目次 YD/T XXXX—XXXX II8.16 路由策略接口 ................................................................... 94 附　录　A （资料性）防火墙集中管理接口样例 .......................................... 101 A.1 NFVO向安全控制器申请用户认证 Authentication 接口样例 ........................... 101 A.2 创建订阅 CreateSubscription 接口样例 ............................................ 101 A.3 查询订阅接口样例 ............................................................... 102 A.4 删除订阅接口样例 ..