1
sangfor_sdp:
2
  # 部署模式
3
  deployment:
4
    mode: gateway_aware # 网关感知模式
5
    tunnel_type: ipsec # IPSec 隧道
6

7
  # 认证流程
8
  authentication:
9
    primary_idp: LDAP/AD
10
    mfa:
11
      - totp
12
      - sms_code
13
      - dingtalk_push
14
    device_trust:
15
      - certificate
16
      - endpoint_posture
17

18
  # 资源发布
19
  resource_publish:
20
    - name: "内部 CRM"
21
      app_type: web
22
      url: https://crm.internal
23
    - name: "数据库"
24
      app_type: tcp
25
      port: 3306

1
# RBAC + ABAC 权限模型
2
authorization:
3
  # 角色定义
4
  roles:
5
    - name: developer
6
      permissions:
7
        - resource: "code-repo"
8
          actions: [read, write]
9
        - resource: "production-db"
10
          actions: []
11

12
    - name: dba
13
      permissions:
14
        - resource: "db-*"
15
          actions: [read, write]
16
          conditions:
17
            - type: ip_range
18
              value: ["10.0.0.0/8"]
19

20
  # 属性条件
21
  conditions:
22
    - type: time_range
23
      value: "work_hours"
24
    - type: location
25
      value: ["office_network"]
26
    - type: device_posture
27
      value: ["encrypted", "antivirus_enabled"]

1
# 授权流程
2
oauth2_flow:
3
  authorization_code:
4
    - response_type: code
5
      scope: openid profile email
6
      nonce: required
7

8
  token_exchange:
9
    refresh_token: true
10
    token_lifetime: 1h
11
    refresh_lifetime: 7d
12

13
  # OIDC ID Token 声明
14
  id_token_claims:
15
    - sub
16
    - email
17
    - groups
18
    - device_id
19
    - trust_score

1
# 深信服微隔离配置
2
microsegmentation:
3
  # 默认拒绝
4
  default_policy: deny
5

6
  # 策略模板
7
  templates:
8
    - name: web_db
9
      from_tier: web
10
      to_tier: db
11
      allow:
12
        - port: 3306
13
          protocol: tcp
14
        - port: 5432
15
          protocol: tcp
16

17
  # 身份标签
18
  identity_tags:
19
    tier: ["web", "app", "db"]
20
    environment: ["prod", "dev"]
21
    compliance: ["pci", "sox"]

1
// 流量分析引擎
2
struct flow_analyzer {
3
    // 全流量采集
4
    struct flow_cache *flows;  // 流表
5

6
    // 画像构建
7
    struct traffic_profile {
8
        char src_identity[64];
9
        char dst_identity[64];
10
        int port;
11
        int bytes_in;
12
        int bytes_out;
13
        int connections;
14

15
        // 行为评分
16
        float risk_score;
17
    } profiles[MAX_IDENTITIES];
18
};
19

20
// 异常检测
21
int detect_lateral_movement(struct flow_analyzer *analyzer) {
22
    for each flow in analyzer->flows {
23
        // 检测扫描行为
24
        if (flow.dst_ports.size > THRESHOLD_SCAN) {
25
            alert(ALERT_RECONNAISSANCE);
26
        }
27

28
        // 检测权限升级
29
        if (flow.tier_escalation) {
30
            alert(ALERT_PRIVILEGE_ESCALATION);
31
        }
32
    }
33
}

1
# 东西向流量策略
2
east_west:
3
  # 租户隔离
4
  tenant_isolation: true
5

6
  # 服务网格集成
7
  service_mesh:
8
    istio_enabled: true
9
    auto_policy_generation: true
10

11
  # 数据库防护
12
  database_shielding:
13
    - db_type: mysql
14
      allowed_apps:
15
        - app_name: "web-backend"
16
          priority: 1
17
        - app_name: "batch-job"
18
          priority: 2

1
sangfor_zero_trust:
2
  components:
3
    # 核心组件
4
    - name: vSSL VPN
5
      function: 远程接入
6
    - name: IAM
7
      function: 身份管理
8
    - name: MSG
9
      function: 微隔离
10
    - name: SDP
11
      function: 应用网关
12

13
  # 联动能力
14
  integrations:
15
    - edr: true
16
    - firewall: true
17
    - threat_intel: true

1
anheng_zta:
2
  # 零信任核心
3
  core:
4
    - name: AiTrust 零信任解决方案
5
      function: 策略管理
6
    - name: 动态信任评估
7
      function: 风险评分
8
    - name: 身份管控平台
9
      function: IDM
10

11
  # 场景方案
12
  scenarios:
13
    - name: 远程办公
14
      components:
15
        - vpn_replacement
16
        - mfa
17
        - device_posture

1
maturity_assessment:
2
  level1_initial:
3
    - 分散的身份系统
4
    - 手工策略管理
5

6
  level2_repeatable:
7
    - 统一 IdP
8
    - 基于角色访问控制
9

10
  level3_defined:
11
    - 自动策略生成
12
    - 持续风险评估
13

14
  level4_managed:
15
    - 实时监控告警
16
    - 微隔离实施
17

18
  level5_optimizing:
19
    - AI 风险预测
20
    - 自动响应闭环

1
migration_checklist:
2
  identity:
3
    - [ ] 统一身份目录（AD/LDAP）
4
    - [ ] MFA 全员覆盖
5
    - [ ] 设备合规检查
6
    - [ ] 特权账号管理
7
    - [ ] 会话审计
8

9
  network:
10
    - [ ] 网络分段优化
11
    - [ ] 微隔离规划
12
    - [ ] 东西向流量可视
13
    - [ ] 出口控制
14

15
  application:
16
    - [ ] 应用统一入口
17
    - [ ] OAuth/OIDC 集成
18
    - [ ] API 安全网关