D-Link DFL- 860 User manual

Network Security Solution http://www.dlink.com

NetDefendOS

Ver. 2.40.00

Network Security Firewall

User Manual

Security

User Manual

DFL-260E/860E/1660/2560/2560G

NetDefendOS Version 2.40.00

D-Link Corporation

No. 289, Sinhu 3rd Rd, Neihu District, Taipei City 114, Taiwan R.O.C.

http://www.DLink.com

Published 2011-09-06

User Manual

DFL-260E/860E/1660/2560/2560G

NetDefendOS Version 2.40.00

Published 2011-09-06

Copyright Notice

This publication, including all photographs, illustrations and software, is protected under

contained herein, may be reproduced without the written consent of D-Link.

Disclaimer

The information in this document is subject to change without notice. D-Link makes no

representations or warranties with respect to the contents hereof and specifically disclaims any

implied warranties of merchantability or fitness for a particular purpose. D-Link reserves the right to

revise this publication and to make changes from time to time in the content hereof without any

obligation to notify any person or parties of such revision or changes.

Limitations of Liability

UNDER NO CIRCUMSTANCES SHALL D-LINK OR ITS SUPPLIERS BE LIABLE FOR

DAMAGES OF ANY CHARACTER (E.G. DAMAGES FOR LOSS OF PROFIT, SOFTWARE

RESTORATION, WORK STOPPAGE, LOSS OF SAVED DATA OR ANY OTHER

COMMERCIAL DAMAGES OR LOSSES) RESULTING FROM THE APPLICATION OR

IMPROPER USE OF THE D-LINK PRODUCT OR FAILURE OF THE PRODUCT, EVEN IF

D-LINK IS INFORMED OF THE POSSIBILITY OF SUCH DAMAGES. FURTHERMORE,

D-LINK WILL NOT BE LIABLE FOR THIRD-PARTY CLAIMS AGAINST CUSTOMER FOR

LOSSES OR DAMAGES. D-LINK WILL IN NO EVENT BE LIABLE FOR ANY DAMAGES IN

EXCESS OF THE AMOUNT D-LINK RECEIVED FROM THE END-USER FOR THE

PRODUCT.

Table of Contents

Preface ...............................................................................................................15

1. NetDefendOS Overview ....................................................................................17

1.1. Features ................................................................................................17

1.2. NetDefendOS Architecture ......................................................................20

1.2.1. State-based Architecture ...............................................................20

1.2.2. NetDefendOS Building Blocks .......................................................20

1.2.3. Basic Packet Flow ........................................................................21

1.3. NetDefendOS State Engine Packet Flow .....................................................24

2. Management and Maintenance ............................................................................29

2.1. Managing NetDefendOS ..........................................................................29

2.1.1. Overview ...................................................................................29

2.1.2. The Default Administrator Account .................................................30

2.1.3. The Web Interface .......................................................................30

2.1.4. The CLI .....................................................................................36

2.1.5. CLI Scripts .................................................................................44

2.1.6. Secure Copy ...............................................................................48

2.1.7. The Console Boot Menu ...............................................................50

2.1.8. Management Advanced Settings .....................................................52

2.1.9. Working with Configurations .........................................................53

2.2. Events and Logging ................................................................................59

2.2.1. Overview ...................................................................................59

2.2.2. Log Messages .............................................................................59

2.2.3. Creating Log Receivers .................................................................60

2.2.4. Logging to MemoryLogReceiver ....................................................60

2.2.5. Logging to Syslog Hosts ...............................................................60

2.2.6. Severity Filter and Message Exceptions ...........................................62

2.2.7. SNMP Traps ...............................................................................62

2.2.8. Advanced Log Settings .................................................................64

2.3. RADIUS Accounting ..............................................................................65

2.3.1. Overview ...................................................................................65

2.3.2. RADIUS Accounting Messages ......................................................65

2.3.3. Interim Accounting Messages ........................................................67

2.3.4. Activating RADIUS Accounting .....................................................67

2.3.5. RADIUS Accounting Security ........................................................68

2.3.6. RADIUS Accounting and High Availability ......................................68

2.3.7. Handling Unresponsive RADIUS Servers .........................................68

2.3.8. Accounting and System Shutdowns .................................................69

2.3.9. Limitations with NAT ...................................................................69

2.3.10. RADIUS Advanced Settings ........................................................69

2.4. Monitoring ............................................................................................71

2.4.1. The Link Monitor ........................................................................71

2.4.2. SNMP Monitoring .......................................................................73

2.4.3. Hardware Monitoring ...................................................................76

2.4.4. Memory Monitoring Settings .........................................................78

2.5. The pcapdump Command ........................................................................80

2.6. Maintenance ..........................................................................................83

2.6.1. Auto-Update Mechanism ...............................................................83

2.6.2. Backing Up Configurations ...........................................................83

2.6.3. Restore to Factory Defaults ............................................................85

3. Fundamentals ...................................................................................................88

3.1. The Address Book ..................................................................................88

3.1.1. Overview ...................................................................................88

3.1.2. IP Addresses ...............................................................................88

3.1.3. Ethernet Addresses .......................................................................90

3.1.4. Address Groups ...........................................................................91

3.1.5. Auto-Generated Address Objects ....................................................92

3.1.6. Address Book Folders ...................................................................92

4

3.2. IPv6 Support .........................................................................................93

3.3. Services ................................................................................................98

3.3.1. Overview ...................................................................................98

3.3.2. Creating Custom Services ..............................................................99

3.3.3. ICMP Services .......................................................................... 102

3.3.4. Custom IP Protocol Services ........................................................104

3.3.5. Service Groups .......................................................................... 104

3.3.6. Custom Service Timeouts ............................................................ 105

3.4. Interfaces ............................................................................................ 106

3.4.1. Overview .................................................................................106

3.4.2. Ethernet Interfaces .....................................................................108

3.4.3. VLAN .....................................................................................115

3.4.4. PPPoE .....................................................................................118

3.4.5. GRE Tunnels ............................................................................120

3.4.6. Interface Groups ........................................................................ 124

3.5. ARP ..................................................................................................126

3.5.1. Overview .................................................................................126

3.5.2. The NetDefendOS ARP Cache .....................................................126

3.5.3. Creating ARP Objects .................................................................128

3.5.4. Using ARP Advanced Settings ..................................................... 130

3.5.5. ARP Advanced Settings Summary ................................................131

3.6. IP Rules .............................................................................................135

3.6.1. Security Policies ........................................................................ 135

3.6.2. IP Rule Evaluation .....................................................................138

3.6.3. IP Rule Actions .........................................................................139

3.6.4. Editing IP rule set Entries ............................................................140

3.6.5. IP Rule Set Folders .................................................................... 141

3.6.6. Configuration Object Groups ....................................................... 142

3.7. Schedules ...........................................................................................146

3.8. Certificates ......................................................................................... 148

3.8.1. Overview .................................................................................148

3.8.2. Certificates in NetDefendOS ........................................................ 150

3.8.3. CA Certificate Requests .............................................................. 151

3.9. Date and Time .....................................................................................153

3.9.1. Overview .................................................................................153

3.9.2. Setting Date and Time ................................................................153

3.9.3. Time Servers ............................................................................154

3.9.4. Settings Summary for Date and Time ............................................157

3.10. DNS .................................................................................................160

4. Routing .........................................................................................................164

4.1. Overview ............................................................................................ 164

4.2. Static Routing ......................................................................................165

4.2.1. The Principles of Routing ............................................................165

4.2.2. Static Routing ...........................................................................169

4.2.3. Route Failover ..........................................................................174

4.2.4. Host Monitoring for Route Failover ............................................... 177

4.2.5. Advanced Settings for Route Failover ............................................179

4.2.6. Proxy ARP ...............................................................................180

4.3. Policy-based Routing ............................................................................183

4.4. Route Load Balancing ...........................................................................190

4.5. OSPF .................................................................................................196

4.5.1. Dynamic Routing ....................................................................... 196

4.5.2. OSPF Concepts ......................................................................... 199

4.5.3. OSPF Components ..................................................................... 204

4.5.4. Dynamic Routing Rules ..............................................................210

4.5.5. Setting Up OSPF .......................................................................213

4.5.6. An OSPF Example ..................................................................... 217

4.6. Multicast Routing ................................................................................. 220

4.6.1. Overview .................................................................................220

4.6.2. Multicast Forwarding with SAT Multiplex Rules .............................221

4.6.3. IGMP Configuration ..................................................................225

4.6.4. Advanced IGMP Settings ............................................................ 230

User Manual

5

4.7. Transparent Mode ................................................................................ 233

4.7.1. Overview .................................................................................233

4.7.2. Enabling Internet Access .............................................................238

4.7.3. Transparent Mode Scenarios ........................................................239

4.7.4. Spanning Tree BPDU Support ...................................................... 243

4.7.5. Advanced Settings for Transparent Mode .......................................244

5. DHCP Services .............................................................................................. 249

5.1. Overview ............................................................................................ 249

5.2. DHCP Servers ..................................................................................... 250

5.2.1. Static DHCP Hosts .....................................................................253

5.2.2. Custom Options ......................................................................... 255

5.3. DHCP Relaying ...................................................................................256

5.3.1. DHCP Relay Advanced Settings ................................................... 257

5.4. IP Pools ..............................................................................................259

6. Security Mechanisms ....................................................................................... 263

6.1. Access Rules .......................................................................................263

6.1.1. Overview .................................................................................263

6.1.2. IP Spoofing .............................................................................. 264

6.1.3. Access Rule Settings .................................................................. 264

6.2. ALGs .................................................................................................266

6.2.1. Overview .................................................................................266

6.2.2. The HTTP ALG ........................................................................ 267

6.2.3. The FTP ALG ........................................................................... 270

6.2.4. The TFTP ALG .........................................................................279

6.2.5. The SMTP ALG ........................................................................ 280

6.2.6. The POP3 ALG .........................................................................289

6.2.7. The PPTP ALG .........................................................................290

6.2.8. The SIP ALG ............................................................................ 291

6.2.9. The H.323 ALG ........................................................................302

6.2.10. The TLS ALG .........................................................................316

6.3. Web Content Filtering ...........................................................................319

6.3.1. Overview .................................................................................319

6.3.2. Active Content Handling .............................................................319

6.3.3. Static Content Filtering ...............................................................320

6.3.4. Dynamic Web Content Filtering ...................................................322

6.4. Anti-Virus Scanning ............................................................................. 337

6.4.1. Overview .................................................................................337

6.4.2. Implementation .........................................................................337

6.4.3. Activating Anti-Virus Scanning ....................................................338

6.4.4. The Signature Database ..............................................................338

6.4.5. Subscribing to the D-Link Anti-Virus Service .................................339

6.4.6. Anti-Virus Options .....................................................................339

6.5. Intrusion Detection and Prevention .......................................................... 343

6.5.1. Overview .................................................................................343

6.5.2. IDP Availability for D-Link Models ..............................................343

6.5.3. IDP Rules ................................................................................. 345

6.5.4. Insertion/Evasion Attack Prevention .............................................. 347

6.5.5. IDP Pattern Matching .................................................................348

6.5.6. IDP Signature Groups .................................................................349

6.5.7. IDP Actions ..............................................................................350

6.5.8. SMTP Log Receiver for IDP Events ..............................................351

6.6. Denial-of-Service Attack Prevention ........................................................355

6.6.1. Overview .................................................................................355

6.6.2. DoS Attack Mechanisms ............................................................. 355

6.6.3. Ping of Death and Jolt Attacks ..................................................... 355

6.6.4. Fragmentation overlap attacks: Teardrop, Bonk, Boink and Nestea ......356

6.6.5. The Land and LaTierra attacks .....................................................356

6.6.6. The WinNuke attack ...................................................................356

6.6.7. Amplification attacks: Smurf, Papasmurf, Fraggle ........................... 357

6.6.8. TCP SYN Flood Attacks .............................................................358

6.6.9. The Jolt2 Attack ........................................................................ 358

6.6.10. Distributed DoS Attacks ............................................................358

User Manual

6

6.7. Blacklisting Hosts and Networks .............................................................360

7. Address Translation ........................................................................................363

7.1. Overview ............................................................................................ 363

7.2. NAT ..................................................................................................364

7.3. NAT Pools ..........................................................................................369

7.4. SAT ................................................................................................... 372

7.4.1. Translation of a Single IP Address (1:1) ......................................... 372

7.4.2. Translation of Multiple IP Addresses (M:N) ....................................377

7.4.3. All-to-One Mappings (N:1) ......................................................... 379

7.4.4. Port Translation ......................................................................... 381

7.4.5. Protocols Handled by SAT .......................................................... 381

7.4.6. Multiple SAT Rule Matches .........................................................381

7.4.7. SAT and FwdFast Rules ..............................................................382

8. User Authentication ........................................................................................385

8.1. Overview ............................................................................................ 385

8.2. Authentication Setup .............................................................................387

8.2.1. Setup Summary .........................................................................387

8.2.2. The Local Database ....................................................................387

8.2.3. External RADIUS Servers ...........................................................389

8.2.4. External LDAP Servers ............................................................... 389

8.2.5. Authentication Rules ..................................................................396

8.2.6. Authentication Processing ........................................................... 398

8.2.7. A Group Usage Example .............................................................399

8.2.8. HTTP Authentication ................................................................. 399

8.3. Customizing Authentication HTML Pages ................................................404

9. VPN ............................................................................................................. 409

9.1. Overview ............................................................................................ 409

9.1.1. VPN Usage ...............................................................................409

9.1.2. VPN Encryption ........................................................................410

9.1.3. VPN Planning ........................................................................... 411

9.1.4. Key Distribution ........................................................................ 411

9.1.5. The TLS Alternative for VPN ......................................................412

9.2. VPN Quick Start .................................................................................. 413

9.2.1. IPsec LAN to LAN with Pre-shared Keys ....................................... 414

9.2.2. IPsec LAN to LAN with Certificates ............................................. 415

9.2.3. IPsec Roaming Clients with Pre-shared Keys ..................................416

9.2.4. IPsec Roaming Clients with Certificates .........................................418

9.2.5. L2TP Roaming Clients with Pre-Shared Keys .................................419

9.2.6. L2TP Roaming Clients with Certificates ........................................421

9.2.7. PPTP Roaming Clients ...............................................................421

9.3. IPsec Components ................................................................................ 423

9.3.1. Overview .................................................................................423

9.3.2. Internet Key Exchange (IKE) ....................................................... 423

9.3.3. IKE Authentication ....................................................................429

9.3.4. IPsec Protocols (ESP/AH) ........................................................... 430

9.3.5. NAT Traversal .......................................................................... 431

9.3.6. Algorithm Proposal Lists .............................................................433

9.3.7. Pre-shared Keys ........................................................................434

9.3.8. Identification Lists .....................................................................435

9.4. IPsec Tunnels ...................................................................................... 438

9.4.1. Overview .................................................................................438

9.4.2. LAN to LAN Tunnels with Pre-shared Keys ................................... 440

9.4.3. Roaming Clients ........................................................................ 440

9.4.4. Fetching CRLs from an alternate LDAP server ................................ 445

9.4.5. Troubleshooting with ikesnoop .....................................................446

9.4.6. IPsec Advanced Settings .............................................................453

9.5. PPTP/L2TP .........................................................................................457

9.5.1. PPTP Servers ............................................................................457

9.5.2. L2TP Servers ............................................................................458

9.5.3. L2TP/PPTP Server advanced settings ............................................463

9.5.4. PPTP/L2TP Clients .................................................................... 463

9.6. SSL VPN ............................................................................................ 466

User Manual

7

9.6.1. Overview .................................................................................466

9.6.2. Configuring SSL VPN in NetDefendOS .........................................467

9.6.3. Installing the SSL VPN Client ......................................................469

9.6.4. Setup Example .......................................................................... 472

9.7. CA Server Access ................................................................................474

9.8. VPN Troubleshooting ...........................................................................477

9.8.1. General Troubleshooting ............................................................. 477

9.8.2. Troubleshooting Certificates ........................................................478

9.8.3. IPsec Troubleshooting Commands ................................................478

9.8.4. Management Interface Failure with VPN ........................................ 479

9.8.5. Specific Error Messages ..............................................................479

9.8.6. Specific Symptoms .................................................................... 482

10. Traffic Management ...................................................................................... 485

10.1. Traffic Shaping ..................................................................................485

10.1.1. Overview ................................................................................485

10.1.2. Traffic Shaping in NetDefendOS .................................................486

10.1.3. Simple Bandwidth Limiting ....................................................... 488

10.1.4. Limiting Bandwidth in Both Directions ........................................ 489

10.1.5. Creating Differentiated Limits Using Chains .................................490

10.1.6. Precedences ............................................................................ 492

10.1.7. Pipe Groups ............................................................................496

10.1.8. Traffic Shaping Recommendations ..............................................499

10.1.9. A Summary of Traffic Shaping ................................................... 500

10.1.10. More Pipe Examples ...............................................................501

10.2. IDP Traffic Shaping ............................................................................ 506

10.2.1. Overview ................................................................................506

10.2.2. Setting Up IDP Traffic Shaping ..................................................506

10.2.3. Processing Flow ....................................................................... 507

10.2.4. The Importance of Specifying a Network ......................................507

10.2.5. A P2P Scenario ........................................................................508

10.2.6. Viewing Traffic Shaping Objects ................................................ 509

10.2.7. Guaranteeing Instead of Limiting Bandwidth ................................. 510

10.2.8. Logging ................................................................................. 510

10.3. Threshold Rules .................................................................................511

10.4. Server Load Balancing ........................................................................514

10.4.1. Overview ................................................................................514

10.4.2. SLB Distribution Algorithms ...................................................... 515

10.4.3. Selecting Stickiness ..................................................................516

10.4.4. SLB Algorithms and Stickiness ...................................................517

10.4.5. Server Health Monitoring ..........................................................518

10.4.6. Setting Up SLB_SAT Rules ........................................................519

11. High Availability ..........................................................................................523

11.1. Overview ..........................................................................................523

11.2. HA Mechanisms ................................................................................. 525

11.3. Setting Up HA ...................................................................................528

11.3.1. HA Hardware Setup ................................................................. 528

11.3.2. NetDefendOS Manual HA Setup .................................................529

11.3.3. Verifying the Cluster Functions ..................................................530

11.3.4. Unique Shared Mac Addresses ................................................... 531

11.4. HA Issues ......................................................................................... 532

11.5. Upgrading an HA Cluster .....................................................................534

11.6. Link Monitoring and HA ......................................................................536

11.7. HA Advanced Settings ........................................................................537

12. ZoneDefense ................................................................................................539

12.1. Overview ..........................................................................................539

12.2. ZoneDefense Switches .........................................................................540

12.3. ZoneDefense Operation ....................................................................... 541

12.3.1. SNMP .................................................................................... 541

12.3.2. Threshold Rules .......................................................................541

12.3.3. Manual Blocking and Exclude Lists .............................................541

12.3.4. ZoneDefense with Anti-Virus Scanning ........................................543

12.3.5. Limitations .............................................................................543

User Manual

8

13. Advanced Settings ......................................................................................... 546

13.1. IP Level Settings ................................................................................ 546

13.2. TCP Level Settings .............................................................................550

13.3. ICMP Level Settings ........................................................................... 555

13.4. State Settings .....................................................................................556

13.5. Connection Timeout Settings ................................................................558

13.6. Length Limit Settings ..........................................................................560

13.7. Fragmentation Settings ........................................................................562

13.8. Local Fragment Reassembly Settings .....................................................566

13.9. Miscellaneous Settings ........................................................................567

A. Subscribing to Updates ................................................................................... 570

B. IDP Signature Groups ..................................................................................... 572

C. Verified MIME filetypes ................................................................................. 576

D. The OSI Framework ....................................................................................... 580

Alphabetical Index .............................................................................................581

User Manual

9

List of Figures

1.1. Packet Flow Schematic Part I ...........................................................................24

1.2. Packet Flow Schematic Part II ..........................................................................25

1.3. Packet Flow Schematic Part III .........................................................................26

1.4. Expanded Apply Rules Logic ............................................................................27

3.1. VLAN Connections ...................................................................................... 116

3.2. An ARP Publish Ethernet Frame ..................................................................... 130

3.3. Simplified NetDefendOS Traffic Flow ............................................................. 138

4.1. A Typical Routing Scenario ...........................................................................166

4.2. Using Local IP Address with an Unbound Network ............................................ 168

4.3. A Route Failover Scenario for ISP Access ......................................................... 174

4.4. A Proxy ARP Example ..................................................................................181

4.5. The RLB Round Robin Algorithm ................................................................... 191

4.6. The RLB Spillover Algorithm ......................................................................... 192

4.7. A Route Load Balancing Scenario ...................................................................194

4.8. A Simple OSPF Scenario ...............................................................................197

4.9. OSPF Providing Route Redundancy .................................................................198

4.10. Virtual Links Connecting Areas ....................................................................202

4.11. Virtual Links with Partitioned Backbone ......................................................... 203

4.12. NetDefendOS OSPF Objects ........................................................................204

4.13. Dynamic Routing Rule Objects .....................................................................211

4.14. Multicast Forwarding - No Address Translation ................................................222

4.15. Multicast Forwarding - Address Translation ....................................................224

4.16. Multicast Snoop Mode .................................................................................226

4.17. Multicast Proxy Mode .................................................................................226

4.18. Non-transparent Mode Internet Access ...........................................................238

4.19. Transparent Mode Internet Access .................................................................238

4.20. Transparent Mode Scenario 1 ........................................................................240

4.21. Transparent Mode Scenario 2 ........................................................................241

4.22. An Example BPDU Relaying Scenario ...........................................................244

5.1. DHCP Server Objects ................................................................................... 253

6.1. Deploying an ALG .......................................................................................266

6.2. HTTP ALG Processing Order .........................................................................269

6.3. FTP ALG Hybrid Mode .................................................................................271

6.4. SMTP ALG Processing Order ......................................................................... 282

6.5. Anti-Spam Filtering ......................................................................................284

6.6. PPTP ALG Usage ........................................................................................290

6.7. TLS Termination .......................................................................................... 317

6.8. Dynamic Content Filtering Flow .....................................................................323

6.9. IDP Database Updating .................................................................................344

6.10. IDP Signature Selection ...............................................................................346

7.1. NAT IP Address Translation .......................................................................... 364

7.2. A NAT Example .......................................................................................... 366

7.3. Anonymizing with NAT ................................................................................ 368

7.4. The Role of the DMZ ....................................................................................373

8.1. Normal LDAP Authentication ........................................................................395

8.2. LDAP for PPP with CHAP, MS-CHAPv1 or MS-CHAPv2 ..................................396

9.1. The AH protocol .......................................................................................... 431

9.2. The ESP protocol ......................................................................................... 431

9.3. PPTP Client Usage .......................................................................................465

9.4. SSL VPN Browser Connection Choices ............................................................ 469

9.5. The SSL VPN Client Login ............................................................................470

9.6. The SSL VPN Client Statistics ........................................................................ 471

9.7. Certificate Validation Components .................................................................. 475

10.1. Pipe Rules Determine Pipe Usage ..................................................................487

10.2. FwdFast Rules Bypass Traffic Shaping ........................................................... 488

10.3. Differentiated Limits Using Chains ................................................................ 491

10.4. The Eight Pipe Precedences ..........................................................................492

10.5. Minimum and Maximum Pipe Precedence .......................................................494

10

10.6. Traffic Grouped By IP Address ..................................................................... 498

10.7. A Basic Traffic Shaping Scenario .................................................................. 502

10.8. IDP Traffic Shaping P2P Scenario ................................................................. 508

10.9. A Server Load Balancing Configuration ..........................................................514

10.10. Connections from Three Clients ...................................................................517

10.11. Stickiness and Round-Robin ....................................................................... 518

10.12. Stickiness and Connection-rate ....................................................................518

D.1. The 7 Layers of the OSI Model ......................................................................580

User Manual

11

List of Examples

1. Example Notation .............................................................................................15

2.1. Enabling remote management via HTTPS ...........................................................35

2.2. Enabling SSH Remote Access ..........................................................................41

2.3. Listing Configuration Objects ...........................................................................53

2.4. Displaying a Configuration Object .....................................................................54

2.5. Editing a Configuration Object .........................................................................55

2.6. Adding a Configuration Object .........................................................................55

2.7. Deleting a Configuration Object ........................................................................56

2.8. Undeleting a Configuration Object ....................................................................56

2.9. Listing Modified Configuration Objects ..............................................................57

2.10. Activating and Committing a Configuration .......................................................57

2.11. Enable Logging to a Syslog Host .....................................................................61

2.12. Sending SNMP Traps to an SNMP Trap Receiver ...............................................63

2.13. RADIUS Accounting Server Setup ..................................................................70

2.14. Enabling SNMP Monitoring ...........................................................................74

2.15. Performing a Complete System Backup ............................................................85

2.16. Complete Hardware Reset to Factory Defaults ...................................................85

3.1. Adding an IP Host Address ..............................................................................89

3.2. Adding an IP Network .....................................................................................89

3.3. Adding an IP Range ........................................................................................90

3.4. Deleting an Address Object ..............................................................................90

3.5. Adding an Ethernet Address .............................................................................91

3.6. Adding IPv6 Host Addresses ............................................................................93

3.7. Enabling IPv6 Globally ...................................................................................94

3.8. Enabling IPv6 on an Interface ...........................................................................94

3.9. Enabling IPv6 Advertisements ..........................................................................95

3.10. Listing the Available Services .........................................................................98

3.11. Viewing a Specific Service .............................................................................99

3.12. Creating a Custom TCP/UDP Service ............................................................. 102

3.13. Adding an IP Protocol Service ......................................................................104

3.14. Defining a VLAN ....................................................................................... 117

3.15. Configuring a PPPoE Client ......................................................................... 120

3.16. Creating an Interface Group ..........................................................................124

3.17. Displaying the ARP Cache ........................................................................... 127

3.18. Flushing the ARP Cache ..............................................................................127

3.19. Defining a Static ARP Entry ......................................................................... 128

3.20. Adding an Allow IP Rule ..............................................................................141

3.21. Setting up a Time-Scheduled Security Policy ...................................................147

3.22. Uploading a Certificate ................................................................................150

3.23. Associating Certificates with IPsec Tunnels .....................................................151

3.24. Setting the Current Date and Time ................................................................. 153

3.25. Setting the Time Zone ................................................................................. 154

3.26. Enabling DST ............................................................................................154

3.27. Enabling Time Synchronization using SNTP ....................................................155

3.28. Manually Triggering a Time Synchronization ..................................................156

3.29. Modifying the Maximum Adjustment Value ....................................................156

3.30. Forcing Time Synchronization ......................................................................157

3.31. Enabling the D-Link NTP Server ................................................................... 157

3.32. Configuring DNS Servers ............................................................................. 160

4.1. Displaying the main Routing Table ..................................................................171

4.2. Adding a Route to the main Table ................................................................... 172

4.3. Displaying the Core Routes ............................................................................173

4.4. Creating a Routing Table ...............................................................................184

4.5. Adding Routes .............................................................................................184

4.6. Creating a Routing Rule ................................................................................185

4.7. Policy-based Routing with Multiple ISPs ..........................................................188

4.8. Setting Up RLB ...........................................................................................194

4.9. Creating an OSPF Router Process ...................................................................217

12

4.10. Add an OSPF Area ..................................................................................... 217

4.11. Add OSPF Interface Objects ......................................................................... 217

4.12. Import Routes from an OSPF AS into the Main Routing Table ............................218

4.13. Exporting the Default Route into an OSPF AS .................................................218

4.14. Forwarding of Multicast Traffic using the SAT Multiplex Rule ...........................222

4.15. Multicast Forwarding - Address Translation ....................................................224

4.16. IGMP - No Address Translation ....................................................................227

4.17. if1 Configuration ........................................................................................228

4.18. if2 Configuration - Group Translation .............................................................229

4.19. Setting up Transparent Mode for Scenario 1 ....................................................240

4.20. Setting up Transparent Mode for Scenario 2 ....................................................241

5.1. Setting up a DHCP server .............................................................................. 251

5.2. Static DHCP Host Assignment ........................................................................254

5.3. Setting up a DHCP Relayer ............................................................................256

5.4. Creating an IP Pool .......................................................................................261

6.1. Setting up an Access Rule .............................................................................. 265

6.2. Protecting an FTP Server with an ALG .............................................................274

6.3. Protecting FTP Clients ..................................................................................277

6.4. Protecting Phones Behind NetDefend Firewalls .................................................. 305

6.5. H.323 with Private IPv4 Addresses ..................................................................306

6.6. Two Phones Behind Different NetDefend Firewalls ............................................ 307

6.7. Using Private IPv4 Addresses .........................................................................308

6.8. H.323 with Gatekeeper .................................................................................. 309

6.9. H.323 with Gatekeeper and two NetDefend Firewalls ..........................................311

6.10. Using the H.323 ALG in a Corporate Environment ...........................................312

6.11. Configuring remote offices for H.323 .............................................................315

6.12. Allowing the H.323 Gateway to register with the Gatekeeper ..............................315

6.13. Stripping ActiveX and Java applets ................................................................ 320

6.14. Setting up a white and blacklist .....................................................................321

6.15. Enabling Dynamic Web Content Filtering ....................................................... 324

6.16. Enabling Audit Mode ..................................................................................326

6.17. Reclassifying a blocked site ..........................................................................327

6.18. Editing Content Filtering HTTP Banner Files ...................................................334

6.19. Activating Anti-Virus Scanning ..................................................................... 341

6.20. Configuring an SMTP Log Receiver ..............................................................351

6.21. Setting up IDP for a Mail Server ....................................................................352

6.22. Adding a Host to the Whitelist ......................................................................361

7.1. Specifying a NAT Rule ..................................................................................366

7.2. Using NAT Pools .........................................................................................370

7.3. Enabling Traffic to a Protected Web Server in a DMZ ......................................... 373

7.4. Enabling Traffic to a Web Server on an Internal Network ....................................375

7.5. Translating Traffic to Multiple Protected Web Servers ........................................377

7.6. Translating Traffic to a Single Protected Web Server (N:1) ..................................380

8.1. Creating an Authentication User Group ............................................................402

8.2. User Authentication Setup for Web Access .......................................................402

8.3. Configuring a RADIUS Server ....................................................................... 403

8.4. Editing Content Filtering HTTP Banner Files ....................................................405

9.1. Using an Algorithm Proposal List ....................................................................433

9.2. Using a Pre-Shared key ................................................................................. 434

9.3. Using an Identity List ....................................................................................436

9.4. Setting up a PSK based VPN tunnel for roaming clients ....................................... 441

9.5. Setting up a Self-signed Certificate based VPN tunnel for roaming clients ...............441

9.6. Setting up CA Server Certificate based VPN tunnels for roaming clients .................443

9.7. Setting Up Config Mode ................................................................................445

9.8. Using Config Mode with IPsec Tunnels ............................................................445

9.9. Setting up an LDAP server .............................................................................446

9.10. Setting up a PPTP server .............................................................................. 458

9.11. Setting up an L2TP server ............................................................................ 459

9.12. Setting up an L2TP Tunnel Over IPsec ...........................................................459

9.13. Setting Up an SSL VPN Interface .................................................................. 472

10.1. Applying a Simple Bandwidth Limit ..............................................................488

10.2. Limiting Bandwidth in Both Directions ........................................................... 490

User Manual

13

10.3. Setting up SLB ...........................................................................................519

12.1. A simple ZoneDefense scenario ....................................................................542

User Manual

14

Preface

Intended Audience

The target audience for this reference guide is Administrators who are responsible for configuring

and managing NetDefend Firewalls which are running the NetDefendOS operating system. This

guide assumes that the reader has some basic knowledge of networks and network security.

Text Structure and Conventions

The text is broken down into chapters and sub-sections. Numbered sub-sections are shown in the

table of contents at the beginning. An index is included at the end of the document to aid with

alphabetical lookup of subjects.

Where a "See chapter/section" link (such as: see Chapter 9, VPN) is provided in the main text, this

can be clicked to take the reader directly to that reference.

Text that may appear in the user interface of the product is designated by being in bold case. Where

a term is being introduced for the first time or being stressed it may appear in italics.

Where console interaction is shown in the main text outside of an example, it will appear in a box

with a gray background.

Where a web address reference is shown in the text, clicking it will open the specified URL in a

browser in a new window (some systems may not allow this).

For example, http://www.dlink.com.

Screenshots

This guide contains a minimum of screenshots. This is deliberate and is done because the manual

deals specifically with NetDefendOS and administrators have a choice of management user

interfaces. It was decided that the manual would be less cluttered and easier to read if it concentrated

on describing how NetDefendOS functions rather than including large numbers of screenshots

showing how the various interfaces are used. Examples are given but these are largely textual

descriptions of management interface usage.

Examples

Examples in the text are denoted by the header Example and appear with a gray background as

shown below. They contain a CLI example and/or a Web Interface example as appropriate. (The

NetDefendOS CLI Reference Guide documents all CLI commands.)

Example 1. Example Notation

Information about what the example is trying to achieve is found here, sometimes with an explanatory image.

Command-Line Interface

The Command Line Interface example would appear here. It would start with the command prompt followed by

the command:

gw-world:/> somecommand someparameter=somevalue

Web Interface

15

The Web Interface actions for the example are shown here. They are also typically a numbered list showing what

items in the tree-view list at the left of the interface or in the menu bar or in a context menu need to be opened

followed by information about the data items that need to be entered:

1. Go to: Item X > Item Y > Item Z

2. Now enter:

• DataItem1: datavalue1

• DataItem2: datavalue2

Highlighted Content

Sections of text which the reader should pay special attention to are indicated by icons on the left

hand side of the page followed by a short paragraph in italicized text. Such sections are of the

following types with the following purposes:

Note

This indicates some piece of information that is an addition to the preceding text. It

may concern something that is being emphasized, or something that is not obvious or

explicitly stated in the preceding text.

Tip

This indicates a piece of non-critical information that is useful to know in certain

situations but is not essential reading.

Caution

This indicates where the reader should be careful with their actions as an undesirable

situation may result if care is not exercised.

Important

This is an essential point that the reader should read and understand.

Warning

This is essential reading for the user as they should be aware that a serious situation

may result if certain actions are taken or not taken.

Trademarks

Certain names in this publication are the trademarks of their respective owners.

Windows, Windows XP, Windows Vista and Windows 7 are either registered trademarks or

trademarks of Microsoft Corporation in the United States and/or other countries.

Preface

16

Chapter 1. NetDefendOS Overview

This chapter outlines the key features of NetDefendOS.

• Features, page 17

• NetDefendOS Architecture, page 20

• NetDefendOS State Engine Packet Flow, page 24

1.1. Features

D-Link NetDefendOS is the base software engine that drives and controls the range of NetDefend

Firewall hardware products.

NetDefendOS as a Network Security Operating System

Designed as a network security operating system, NetDefendOS features high throughput

performance with high reliability plus super-granular control. In contrast to products built on top of

standard operating systems such as Unix or Microsoft Windows, NetDefendOS offers seamless

integration of all its subsystems, in-depth administrative control of all functionality, as well as a

minimal attack surface which helps to negate the risk from security attacks.

NetDefendOS Objects

From the administrator's perspective the conceptual approach of NetDefendOS is to visualize

operations through a set of logical building blocks or objects. These objects allow the configuration

of NetDefendOS in an almost limitless number of different ways. This granular control allows the

administrator to meet the requirements of the most demanding network security scenarios.

Key Features

NetDefendOS has an extensive feature set. The list below presents the key features of the product:

IP Routing

NetDefendOS provides a variety of options for IP routing

including static routing, dynamic routing, as well as multicast

routing capabilities. In addition, NetDefendOS supports

features such as Virtual LANs, Route Monitoring, Proxy ARP

and Transparency. For more information, please see

Chapter 4, Routing.

Firewalling Policies

NetDefendOS provides stateful inspection-based firewalling

for a wide range of protocols such as TCP, UDP and ICMP.

The administrator can define detailed firewalling policies

based on source/destination network/interface, protocol,

ports, user credentials, time-of-day and more. Section 3.6, “IP

Rules”, describes how to set up these policies to determine

what traffic is allowed or rejected by NetDefendOS.

Address Translation

For functionality as well as security reasons, NetDefendOS

supports policy-based address translation. Dynamic Address

Translation (NAT) as well as Static Address Translation

(SAT) is supported, and resolves most types of address

translation needs. This feature is covered in Chapter 7,

Address Translation.

17

VPN

NetDefendOS supports a range of Virtual Private Network

(VPN) solutions. Support exists for IPsec, L2TP and PPTP as

well as SSL VPN with security policies definable for

individual VPN connections. This topic is covered in

Chapter 9, VPN.

TLS Termination

NetDefendOS supports TLS termination so that the

NetDefend Firewall can act as the end point for connections

by HTTP web-browser clients (this feature is sometimes

called SSL termination). For detailed information, see

Section 6.2.10, “The TLS ALG”.

Anti-Virus Scanning

NetDefendOS features integrated anti-virus functionality.

Traffic passing through the NetDefend Firewall can be

subjected to in-depth scanning for viruses, and virus sending

hosts can be black-listed and blocked. For details of this

feature, seeSection 6.4, “Anti-Virus Scanning”.

Intrusion Detection and

Prevention

To mitigate application-layer attacks towards vulnerabilities

in services and applications, NetDefendOS provides a

powerful Intrusion Detection and Prevention (IDP) engine.

The IDP engine is policy-based and is able to perform

high-performance scanning and detection of attacks and can

perform blocking and optional black-listing of attacking

hosts. More information about the IDP capabilities of

NetDefendOS can be found in Section 6.5, “Intrusion

Detection and Prevention”.

Note

Full IDP is available on all D-Link NetDefend

product models as a subscription service. On

some models, a simplified IDP subsystem is

provided as standard.

Web Content Filtering

NetDefendOS provides various mechanisms for filtering web

content that is deemed inappropriate according to a web usage

policy. With Web Content Filtering (WCF) web content can

be blocked based on category (Dynamic WCF), malicious

objects can be removed from web pages and web sites can be

whitelisted or blacklisted. More information about this topic

can be found in Section 6.3, “Web Content Filtering”.

Traffic Management

NetDefendOS provides broad traffic management capabilities

through Traffic Shaping, Threshold Rules (certain models

only) and Server Load Balancing.

Traffic Shaping enables limiting and balancing of bandwidth;

Threshold Rules allow specification of thresholds for sending

alarms and/or limiting network traffic; Server Load Balancing

enables a device running NetDefendOS to distribute network

load to multiple hosts. These features are discussed in detail

in Chapter 10, Traffic Management.

Note

Threshold Rules are only available on certain

D-Link NetDefend product models.

Operations and Maintenance

Administrator management of NetDefendOS is possible

through either a Web-based User Interface (the WebUI) or via

a Command Line Interface (the CLI). NetDefendOS also

1.1. Features Chapter 1. NetDefendOS Overview

18

provides detailed event and logging capabilities plus support

for monitoring through SNMP. More detailed information

about this topic can be found in Chapter 2, Management and

Maintenance.

ZoneDefense

NetDefendOS can be used to control D-Link switches using

the ZoneDefense feature. This allows NetDefendOS to isolate

portions of a network that contain hosts that are the source of

undesirable network traffic.

Note

NetDefendOS ZoneDefense is only available on

certain D-Link NetDefend product models.

IPv6

IPv6 addresses are supported on interfaces and within

rulesets. This feature is not enabled by default and must be

explicitly enables on an Ethernet interface. More information

about this topic can be found in Section 3.2, “IPv6 Support”.

NetDefendOS Documentation

Reading through the available documentation carefully will ensure getting the most out of the

NetDefendOS product. In addition to this document, the reader should also be aware of the

companion reference guides:

• The CLI Reference Guide which details all NetDefendOS CLI commands.

• The NetDefendOS Log Reference Guide which details all NetDefendOS log event messages.

Together, these documents form the essential reference material for NetDefendOS operation.

1.1. Features Chapter 1. NetDefendOS Overview

19

1.2. NetDefendOS Architecture

1.2.1. State-based Architecture

The NetDefendOS architecture is centered around the concept of state-based connections.

Traditional IP routers or switches commonly inspect all packets and then perform forwarding

decisions based on information found in the packet headers. With this approach, packets are

forwarded without any sense of context which eliminates any possibility to detect and analyze

complex protocols and enforce corresponding security policies.

Stateful Inspection

NetDefendOS employs a technique called stateful inspection which means that it inspects and

forwards traffic on a per-connection basis. NetDefendOS detects when a new connection is being

established, and keeps a small piece of information or state in its state table for the lifetime of that

connection. By doing this, NetDefendOS is able to understand the context of the network traffic

which enables it to perform in-depth traffic scanning, apply bandwidth management and a variety of

other functions.

The stateful inspection approach additionally provides high throughput performance with the added

advantage of a design that is highly scalable. The NetDefendOS subsystem that implements stateful

inspection will sometimes be referred to in documentation as the NetDefendOS state-engine.

1.2.2. NetDefendOS Building Blocks

The basic building blocks in NetDefendOS are interfaces, logical objects and various types of rules

(or rule sets).

Interfaces

Interfaces are the doorways through which network traffic enters or leaves the NetDefend Firewall.

Without interfaces, a NetDefendOS system has no means for receiving or sending traffic.

The following types of interface are supported in NetDefendOS:

• Physical interfaces - These correspond to the actual physical Ethernet interfaces.

• Sub-interfaces - These include VLAN and PPPoE interfaces.

• Tunnel interfaces - Used for receiving and sending traffic through VPN tunnels.

Interface Symmetry

The NetDefendOS interface design is symmetric, meaning that the interfaces of the device are not

fixed as being on the "insecure outside" or "secure inside" of a network topology. The notion of

what is inside and outside is totally for the administrator to define.

Logical Objects

Logical objects can be seen as predefined building blocks for use by the rule sets. The address book,

for instance, contains named objects representing host and network addresses.

Another example of logical objects are services which represent specific protocol and port

combinations. Also important are the Application Layer Gateway (ALG) objects which are used to

define additional parameters on specific protocols such as HTTP, FTP, SMTP and H.323.

1.2. NetDefendOS Architecture Chapter 1. NetDefendOS Overview

20

Page is loading ...

D-Link DFL- 860, DFL-1660, DFL-860E, NetDefend DFL-1660, NetDefend DFL-2560, NetDefend DFL-2560G, NetDefend DFL-260E, NetDefend DFL-860E User manual

Related papers

Other documents