Rohde & Schwarz GP-S User manual

R&S

®

GP-E/GP-S

gateprotect Firewall

User Manual

v16.2.1 ─ 01

Cybersecurity

This document describes the following R&S

®

gateprotect Firewall models:

●

R&S

®

gateprotect Firewall GP-E

●

R&S

®

gateprotect Firewall GP-S

Augustusplatz 9, 04109 Leipzig, Germany

Phone: +49 (0) 341 392 993 43-0

Fax: +49 (0) 341 392 993 43-9

E-mail: [email protected]

Internet: https://cybersecurity.rohde-schwarz.com

Printed in Germany – Subject to change – Data without tolerance limits is not binding.

R&S

®

is a registered trademark of Rohde & Schwarz GmbH & Co. KG.

Trade names are trademarks of the owners.

The following abbreviations are used throughout this manual: R&S

®

gateprotect Firewall is indicated as gateprotect Firewall.

Contents

R&S

®

GP-E/GP-S

3User Manual v16.2.1 ─ 01

Contents

1 About This Manual.................................................................................9

1.1 Audience........................................................................................................................ 9

1.2 What’s in This Manual................................................................................................ 10

1.3 Conventions................................................................................................................ 10

1.4 Related Resources......................................................................................................11

1.5 About Rohde & Schwarz Cybersecurity................................................................... 11

2 Getting Started..................................................................................... 13

2.1 Logging On.................................................................................................................. 13

2.2 Resetting the Hardware.............................................................................................. 14

3 User Interface....................................................................................... 17

3.1 Web Interface Components........................................................................................17

3.1.1 Header Area..................................................................................................................18

3.1.2 Navigation Pane............................................................................................................19

3.1.3 Desktop......................................................................................................................... 19

3.2 Icons and Buttons.......................................................................................................21

3.3 Firewall Rule Settings.................................................................................................22

3.4 Menu Reference.......................................................................................................... 29

3.4.1 Firewall..........................................................................................................................29

3.4.1.1 Status............................................................................................................................ 29

3.4.1.2 Reports..........................................................................................................................30

3.4.1.3 Updates.........................................................................................................................33

3.4.1.4 Backup.......................................................................................................................... 34

3.4.1.5 Local Logs.....................................................................................................................38

3.4.1.6 Network Diagnostics..................................................................................................... 42

3.4.1.7 System.......................................................................................................................... 44

3.4.1.8 User Authentication.......................................................................................................47

3.4.1.9 License..........................................................................................................................53

3.4.1.10 Time Profiles................................................................................................................. 54

3.4.2 Network......................................................................................................................... 55

3.4.2.1 Firewall Rules................................................................................................................55

3.4.2.2 Static Routes.................................................................................................................56

Contents

R&S

®

GP-E/GP-S

4User Manual v16.2.1 ─ 01

3.4.2.3 Syslog Servers.............................................................................................................. 58

3.4.2.4 SSL Proxy..................................................................................................................... 59

3.4.2.5 High Availability.............................................................................................................60

3.4.2.6 Support Access............................................................................................................. 63

3.4.2.7 FTC (Forensic Traffic Capture)..................................................................................... 64

3.4.2.8 NAT Rules.....................................................................................................................66

3.4.3 LAN............................................................................................................................... 68

3.4.3.1 Ethernet Zones..............................................................................................................68

3.4.3.2 WLAN Zones.................................................................................................................72

3.4.3.3 VLAN Zones..................................................................................................................76

3.4.4 WAN..............................................................................................................................78

3.4.4.1 Connection Monitoring.................................................................................................. 78

3.4.4.2 DynDNS Accounts........................................................................................................ 80

3.4.4.3 Failover Settings........................................................................................................... 82

3.4.4.4 WAN Zone.....................................................................................................................84

3.4.4.5 Port Forwarding.............................................................................................................89

3.4.4.6 IP Forwardings.............................................................................................................. 90

3.4.4.7 Policy Based Routes..................................................................................................... 92

3.4.5 Nodes............................................................................................................................94

3.4.5.1 Custom Hosts................................................................................................................94

3.4.5.2 Network Groups............................................................................................................ 95

3.4.5.3 Custom Networks..........................................................................................................96

3.4.6 UTM.............................................................................................................................. 97

3.4.6.1 Invalid Protocols............................................................................................................97

3.4.6.2 IPS/IDS Profiles............................................................................................................ 98

3.4.6.3 Web Filter Profiles.......................................................................................................100

3.4.6.4 Antispam Settings....................................................................................................... 103

3.4.6.5 Antivirus Settings........................................................................................................ 104

3.4.6.6 Mail Filter Settings.......................................................................................................105

3.4.7 VPN.............................................................................................................................107

3.4.7.1 IPsec........................................................................................................................... 108

3.4.7.2 OpenVPN.................................................................................................................... 117

3.4.8 Certificate Management.............................................................................................. 121

Contents

R&S

®

GP-E/GP-S

5User Manual v16.2.1 ─ 01

3.4.8.1 Certificates.................................................................................................................. 122

3.4.8.2 Templates................................................................................................................... 125

3.4.8.3 OCSP/CRL Settings....................................................................................................126

3.4.8.4 Truststore.................................................................................................................... 126

4 Application Examples........................................................................129

4.1 Firewall Rule Examples............................................................................................ 129

4.1.1 Blocking Certain Websites Using Applications............................................................130

4.1.2 Blocking Certain Websites Using Web Filters.............................................................130

4.1.3 Allowing Certain Websites Using Web Filters............................................................. 132

4.1.4 Forcing Secure Communication..................................................................................134

4.1.5 Using Quality of Service..............................................................................................135

4.1.6 Using DHCP in Bridge Mode.......................................................................................136

4.2 Setting Up Single Sign-On....................................................................................... 137

4.2.1 Configuring the NTP Server........................................................................................ 137

4.2.2 Preparing the Domain Controller.................................................................................137

4.2.3 Configuring the Firewall.............................................................................................. 139

4.2.4 Configuring User-Specific Firewall Rules....................................................................142

4.2.5 Configuring the Windows Clients................................................................................ 143

4.3 Setting Up a Static Route......................................................................................... 145

4.4 Using NAT Rules....................................................................................................... 146

4.4.1 Destination NAT.......................................................................................................... 146

4.4.2 Source NETMAP.........................................................................................................146

4.5 Setting Up a Syslog Server...................................................................................... 146

4.6 Setting Up a VLAN.................................................................................................... 148

4.7 Setting Up Port Forwarding..................................................................................... 149

4.8 Sorting Policy-Based Routes...................................................................................150

4.8.1 Sorting IP Addresses.................................................................................................. 150

4.8.2 Sorting Ports and IP Addresses.................................................................................. 150

4.8.3 Overall Sorting............................................................................................................ 151

4.9 Setting Up the Mail Filter with SSL Inspection.......................................................152

4.10 Handling Certificates................................................................................................ 153

4.10.1 Creating a Certificate.................................................................................................. 153

4.10.2 Importing a Certificate................................................................................................. 153

Contents

R&S

®

GP-E/GP-S

6User Manual v16.2.1 ─ 01

4.10.3 Replacing a Certificate................................................................................................ 154

4.10.4 Exporting a Certificate.................................................................................................155

4.10.5 Exporting a Certificate Signing Request..................................................................... 155

4.10.6 Suspending a Certificate............................................................................................. 156

4.10.7 Resuming a Certificate................................................................................................156

4.10.8 Renewing a Certificate................................................................................................ 156

4.10.9 Revoking a Certificate................................................................................................. 157

4.11 Setting Up OCSP/CRL Services...............................................................................157

4.12 VPN Setup Examples................................................................................................ 158

4.12.1 Setting Up a Client-to-Site VPN via IPsec...................................................................159

4.12.1.1 Setting Up the VPN Connection..................................................................................160

4.12.1.2 Setting Up Authentication............................................................................................175

4.12.2 Setting Up a Site-to-Site VPN via IPsec......................................................................177

4.12.2.1 Creating VPN Certificates........................................................................................... 177

4.12.2.2 Setting Up the VPN Connection..................................................................................181

4.12.2.3 Setting Up IPsec Site-to-Site for Complex Networks.................................................. 185

4.12.3 Setting Up a Client-to-Site VPN via OpenVPN........................................................... 187

4.12.3.1 Creating a VPN Certificate.......................................................................................... 187

4.12.3.2 Configuring Authentication.......................................................................................... 188

4.12.3.3 Setting Up the VPN Connection..................................................................................190

4.12.4 Setting Up a Site-to-Site VPN via OpenVPN.............................................................. 192

4.12.4.1 Creating VPN Certificates........................................................................................... 193

4.12.4.2 Setting Up the Primary Box.........................................................................................196

4.12.4.3 Setting Up the Secondary Box.................................................................................... 199

4.12.4.4 Connecting the Remote Networks.............................................................................. 201

4.13 Decoder Examples.................................................................................................... 201

4.13.1 Blocking PDF Files......................................................................................................202

4.13.2 Blocking Microsoft Office Files.................................................................................... 202

4.13.3 Blocking Web Hosts.................................................................................................... 202

4.13.4 Blocking Keywords in Webmail................................................................................... 203

4.13.5 Blocking Keywords in Mail Clients.............................................................................. 203

4.13.6 Using Anchors in String Decoders.............................................................................. 204

4.13.7 Using IEC 104 Protocol Decoders.............................................................................. 205

Contents

R&S

®

GP-E/GP-S

7User Manual v16.2.1 ─ 01

Annex.................................................................................................. 209

A Decoder Reference............................................................................ 209

A.1 FTP Commands.........................................................................................................209

A.2 HTTP MIME Types..................................................................................................... 211

Index....................................................................................................231

Contents

R&S

®

GP-E/GP-S

8User Manual v16.2.1 ─ 01

About This Manual

R&S

®

GP-E/GP-S

9User Manual v16.2.1 ─ 01

1 About This Manual

The gateprotect Firewall User Manual describes the innovative next-generation firewall

solution from Rohde & Schwarz Cybersecurity. gateprotect Firewall integrates firewall,

intrusion prevention, application control, web filtering, malware protection and many

more functions in a single system.

Figure 1-1: Sample gateprotect Firewall GP-E-1200.

This document applies to two gateprotect Firewall product lines:

●

Extended Line - Easy to configure - the firewall solution for complex office networks

in medium-sized companies

●

Specialized Line - Easy to customize - the perfectly tailored solution that meets the

high demands of complex network structures in industry and enterprise environ-

ments

There are license-based features that distinguish individual product models within the

two product lines from one another. For more information about your specific gatepro-

tect Firewall, see the information on the relevant data sheet.

See the topics below for more information about this document.

1.1 Audience

This manual is for the networking or computer technician responsible for installing and

configuring gateprotect Firewall and employees that use the web interface to define

traffic filtering rules.

To use this document effectively, you have to have the following skills depending on

your responsibilities:

●

To install and configure the hardware, you have to be familiar with telecommunica-

tions equipment and installation procedures. You also have to have good experi-

ence as a network or system administrator.

●

To define filtering rules, you need to understand basic TCP/IP networking con-

cepts.

Audience

About This Manual

R&S

®

GP-E/GP-S

10User Manual v16.2.1 ─ 01

1.2 What’s in This Manual

The contents of this manual are designed to assist you in installing and configuring

gateprotect Firewall.

This document includes the following chapters and appendixes:

1. Chapter 2, "Getting Started", on page 13

Log on to gateprotect Firewall to set up the system for your network.

2. Chapter 3, "User Interface", on page 17

The sections in this chapter describe the components of the gateprotect Firewall

user interface.

3. Chapter 4, "Application Examples", on page 129

This chapter includes various examples that illustrate how to use firewall rules to

manage network traffic, set up specific features, services and VPN connections,

and configure decoders to block communication containing certain file types or

keywords.

4. Chapter A, "Decoder Reference", on page 209

The gateprotect Firewall protocol decoder can detect FTP commands and HTTP

MIME types in traffic flows.

1.3 Conventions

This topic explains the typographic conventions and other notations used to represent

information in this manual.

Elements of the web-based graphical user interface (GUI, or »web interface«) are indi-

cated as follows:

●

Buttons, checkboxes, list names and other controls appear in quotation marks. For

example: »Click "Save" to create the rule.«

●

A sequence of menu commands is indicated as follows: "Firewall > Status" . In this

case, select "Status" from the "Firewall" menu.

●

List options and literal text both appear in a fixed-width font. For example: »The

default filename is set to config.tar.gz.«

●

Terms that require extended definitions or explanations are indicated in italics. For

example, the term application is often used to refer to a software program. In this

manual, however, it usually means the Layer 7 protocol used by the program on

the Application Layer of the OSI reference model. With Skype traffic, for example,

the terms application and protocol are used interchangeably.

Notes

The following types of notes are used in this manual to indicate information which

expands on or calls attention to a particular point.

Conventions

About This Manual

R&S

®

GP-E/GP-S

11User Manual v16.2.1 ─ 01

This note is a little hint that can help make your work easier.

This note contains important additional information.

This note contains information that is important to consider. Non-observance can dam-

age your gateprotect Firewall or put your network security at risk.

1.4 Related Resources

This section describes additional documentation and other resources for information on

gateprotect Firewall.

Refer to these resources for more information on gateprotect Firewall:

●

A separate gateprotect Firewall Getting Started guide is provided with the gate-

protect Firewall hardware. The document describes the installation procedure and

first steps to start working.

●

Getting Started guides are also available for the virtual machines (VM) of gatepro-

tect Firewall. The platform-specific documents are provided for all types of suppor-

ted virtualization software.

●

How-tos describe specific configuration scenarios and solutions.

●

Data sheets summarize the technical characteristics of the different gateprotect

Firewall hardware models.

●

Release Notes provide the latest information on each release.

●

Our website at cybersecurity.rohde-schwarz.com provides a wealth of information

about our products and solutions and the latest company news and events.

For additional documents such as technical specifications, please visit the mygatepro-

tect portal at www.mygateprotect.com.

1.5 About Rohde & Schwarz Cybersecurity

Rohde & Schwarz Cybersecurity protects companies and public institutions worldwide

against espionage and cyber attacks.

The company develops and produces high-end encryption products, next-generation

firewalls, network traffic analytics and endpoint security software as leading-edge tech-

nical solutions for information and network security requirements.

About Rohde & Schwarz Cybersecurity

About This Manual

R&S

®

GP-E/GP-S

12User Manual v16.2.1 ─ 01

Rohde & Schwarz, active for over 20 years in the field of IT security, is now expanding

into this sector. The integration of enterprise security experts gateprotect, ipoque and

Sirrix has created the new brand »Rohde & Schwarz Cybersecurity« as the leading

European provider of cybersecurity solutions.

The trustworthy IT solutions are developed based on the »Security by Design« princi-

ple, which proactively prevents cyber attacks rather than reacting to a known threat.

This new approach even protects against complex attacks that use zero-day exploits to

expose the weakness of existing antivirus software or traditional firewalls.

For more information, visit our website at cybersecurity.rohde-schwarz.com.

About Rohde & Schwarz Cybersecurity

Getting Started

R&S

®

GP-E/GP-S

13User Manual v16.2.1 ─ 01

2 Getting Started

2.1 Logging On

Log on to gateprotect Firewall to set up the system for your network.

After having completed the installation and licensing procedure for gateprotect Firewall

as described in the gateprotect Firewall Getting Started guide, you can begin working

with the firewall:

1. On the gateprotect Firewall logon page, enter admin as the "User Name" and the

factory default "Password" gateprotect.

Figure 2-1: Logging on to gateprotect Firewall.

2. Click "Login" .

3. After your first login using the standard credentials, the system prompts you to

change your password. You cannot skip this step.

Note: If you forget the new password entered, the password can only be reset by

setting the system back to the factory default configuration as described under

Chapter 2.2, "Resetting the Hardware", on page 14.

Note: The admin password is included in a system backup.

The web interface appears.

After three unsuccessful login attempts, you will be blocked for an hour to prevent

unauthorized access. Every new attempt during that hour resets the waiting period.

After one hour without login attempts, you can log on to gateprotect Firewall again with

valid credentials.

You are automatically logged out after 10 minutes of inactivity.

Logging On

Getting Started

R&S

®

GP-E/GP-S

14User Manual v16.2.1 ─ 01

Set your browser configuration to clear all session data and cookies when the browser

is closed. Otherwise, your admin session will be restored after the computer is reboo-

ted and unauthorized persons can access the firewall.

2.2 Resetting the Hardware

If you cannot access the web interface, you can reset the system to the factory default

configuration.

Connect the ports labeled eth2 and eth3 with a patch cable, then power off and

power on.

Figure 2-2: Resetting the hardware of the gateprotect Firewall GP-S series.

With models GP-E-1000/GP-S-1800 or higher, connect the first two ports in the first

module (for example eth11 and eth12) with a patch cable, then power off and power

on.

Figure 2-3: Resetting the hardware of gateprotect Firewall models GP-E-1000/GP-S-1800 or higher.

The kind of power button (power off switch, push button or power off button) and its

location differ by hardware model.

Resetting the Hardware

Getting Started

R&S

®

GP-E/GP-S

15User Manual v16.2.1 ─ 01

The default settings are restored.

Booting to a factory reset can take up to 5 minutes.

Resetting the Hardware

Getting Started

R&S

®

GP-E/GP-S

16User Manual v16.2.1 ─ 01

Resetting the Hardware

User Interface

R&S

®

GP-E/GP-S

17User Manual v16.2.1 ─ 01

3 User Interface

The sections in this chapter describe the components of the gateprotect Firewall user

interface.

The gateprotect Firewall web interface requires a minimum display resolution of

1024 × 786 pixels (XGA).

The following browser versions (or newer) are supported, with JavaScript enabled:

●

Google Chrome 10

●

Firefox 12

The first sections provide an overview of the main components of the web interface.

The next topic explains the meaning of the icons and buttons commonly used on the

user interface and throughout this manual.

The following topic describes how a firewall rule for a connection between two desktop

nodes is set up.

The remaining topics correspond to the menu items in the navigation bar on the left

side of the user interface. For information on the available options, see the correspond-

ing section.

3.1 Web Interface Components

The gateprotect Firewall web interface uses a standard tri-pane page layout with a

common header area, a left navigation pane, and a main content pane on the right.

Web Interface Components

User Interface

R&S

®

GP-E/GP-S

18User Manual v16.2.1 ─ 01

Figure 3-1: gateprotect Firewall web interface.

The information displayed in each area is described in the following sections.

3.1.1 Header Area

The header area (1) contains the following elements (from left to right):

Figure 3-2: gateprotect Firewall web interface header area.

●

the button to hide or show the navigation bar (the navigation bar is displayed by

default, see Chapter 3.1.2, "Navigation Pane", on page 19),

●

the Rohde & Schwarz Cybersecurity logo,

●

the current system status information, expressing the system load and the memory

and disk usage as a percentage, so you can quickly spot system performance bot-

tlenecks,

●

a user menu that allows you to select the language to be used in the web interface,

●

a menu to change the current user's password (the new password has to be at

least eight characters long and cannot be identical with the current password) and

to end the current user session and return to the login dialog and

●

a link which provides access to a PDF version of the gateprotect Firewall User

Manual. Depending on your browser settings, the PDF file is either displayed in a

new tab or window, or downloaded.

In addition, the header area displays unsaved configuration changes if you close an

editor panel by pressing the Esc key on your computer keyboard (unsaved changes

Web Interface Components

User Interface

R&S

®

GP-E/GP-S

19User Manual v16.2.1 ─ 01

are not displayed if you close an editor panel by clicking the button in the upper right

corner of the panel, however).

The PDF version of the gateprotect Firewall User Manual is also available from the

logon page. Click on "User Manual" to access the file.

3.1.2 Navigation Pane

The navigation pane (2) is on the left side of the web interface and consists of two

parts. The links in the left navigation bar provide access to the gateprotect Firewall set-

tings. The item list bar on the right is used to display information on the current desktop

configuration.

Both bars contain a search field at the top which can filter the lists to help you quickly

find menus or items. Each search field works for the bar it is part of only. As you type in

the search field, gateprotect Firewall reduces the lists to show only those menus or

items that contain the characters you are typing.

The information displayed in the item list bar depends on, firstly, the menu item

selected in the navigation bar and, secondly, how much information you desire to be

displayed. You can unfold more detailed information by clicking

or reduce the

amount of information presented by clicking in the upper right corner of this pane.

To view the complete list of menus or items again, reset the search by clicking in the

search field.

See Chapter 3.4, "Menu Reference", on page 29 for details on the options available

in each view.

3.1.3 Desktop

The desktop (3) fills the main portion of the screen below the header area and to the

right of the navigation pane. The information displayed here depends on the item

selected in the navigation pane or on the desktop.

Web Interface Components

User Interface

R&S

®

GP-E/GP-S

20User Manual v16.2.1 ─ 01

Figure 3-3: gateprotect Firewall desktop.

On the desktop you always have a complete overview of your entire configured net-

work. You can edit various settings in this pane or view the details of a configuration.

A toolbar at the top of the desktop allows you to create and edit objects or connections.

To create an object on the desktop, click with the left mouse button on the desired but-

ton in the toolbar, keep the mouse button pressed and drag the object onto the desk-

top. Depending on the type of object you are creating, an editor panel automatically

opens where you can enter the required data for the object. To delete an object from

the desktop, click the object with the left mouse button and select

from the circular

menu.

If the system configuration changes, the "

Activate" button is highlighted, prompting

you to update your configuration. Click this button to save your current desktop config-

uration changes and to activate them on the firewall.

The buttons that appear in the circular menu when you click an object with the left

mouse button allow you to adjust the settings for an existing object, to create a connec-

tion between two existing objects, to hide or display objects attached to the object, to

unpin an object from a specific location on the desktop or to remove it from the desk-

top.

Web Interface Components

Page is loading ...

Rohde & Schwarz GP-S User manual

This manual is also suitable for

Rohde & Schwarz GP-S User manual

Related papers

Other documents