D-Link NetDefend SOHO DFL-160 Скачать руководство пользователя

Страница: 1 / 130

background image

User Manual

DFL-160

Ver 2.27.00

Network Security Solution

http://www.dlink.com.tw

Security

Security

SOHO

UTM Firewall

1
2
3
...
»

Содержание NetDefend SOHO DFL-160

Страница 1: ...User Manual DFL 160 Ver 2 27 00 Network Security Solution http www dlink com tw Security Security SOHO UTM Firewall...

Страница 2: ...ser Manual D Link DFL 160 Firewall NetDefendOS Version 2 27 00 D Link Corporation No 289 Sinhu 3rd Rd Neihu District Taipei City 114 Taiwan R O C http www DLink com Published 2010 05 24 Copyright 2009...

Страница 3: ...r purpose The manufacturer reserves the right to revise this publication and to make changes from time to time in the content hereof without obligation of the manufacturer to notify any person of such...

Страница 4: ...sec 48 4 4 2 L2TP PPTP Client 52 4 4 3 L2TP PPTP Server 53 4 5 VPN Users 55 4 6 Web Content Filtering 56 4 6 1 Options 56 4 6 2 The Content Categories 58 4 7 Anti Virus 65 4 8 IDP Options 68 4 9 Traff...

Страница 5: ...B Windows XP IP Setup 121 C Windows Vista IP Setup 123 D Windows 7 IP Setup 125 E Apple Mac IP Setup 127 Alphabetical Index 129 User Manual 5...

Страница 6: ...em is also found in D Link DFL firewall products designed for larger enterprises The NetDefendOS Management Interface The principle management interface for the DFL 160 is through a web browser runnin...

Страница 7: ...the Internet Extensive Firewalling Capabilities NetDefendOS can block traffic which does not comply with security policies defined by the user These policies can target traffic according to which prot...

Страница 8: ...ces at the back of the hardware unit Interface Network Connections The illustration below shows the typical usage of network connections to the DFL 160 interfaces Intended Interface Usage The interfac...

Страница 9: ...from and send data to the public internet An example might be a mail server The intent with the DMZ interface is to provide a stage of security between the well protected internal LAN networks and th...

Страница 10: ...Ports On the right hand side of the front of the DFL 160 there is a line of LED lights that show the status of the different Ethernet interfaces by showing a flashing or solid light in orange or gree...

Страница 11: ...1 3 The LED Indicators Chapter 1 Product Overview 11...

Страница 12: ...Quick Installation Guide A plug in 12 Volt 1 2 Amp power supply with connecting cable One Category 5e Ethernet cable One RS232 cable for connecting a console to the DFL 160 serial COM port A CD ROM c...

Страница 13: ...d with the DFL 160 to connect it to the power source Ensure that the DFL 160 does not overload the power circuits wiring and over current protection To determine the possibility of overloading the sup...

Страница 14: ...L 160 LAN interface because they are on the same IP network If DHCP is enabled on the workstation and this is usually the default or DHCP is enabled on the device such as a router via which the connec...

Страница 15: ...instead enter https 192 168 10 1 in the browser When responding to an https request NetDefendOS sends a self signed certificate which will not be initially recognized so it will be necessary to tell t...

Страница 16: ...erent menus shown in the top menu bar to a get a feel where different options are located This menu structure is duplicated in the layout of later chapters that describe the options During initial set...

Страница 17: ...Traffic Options By default everything is allowed for outbound connections on the LAN interface but it is recommended to restrict this to the minimum necessary For instance allowing the HTTP and HTTPS...

Страница 18: ...tions and exploring the individual options available with each The later part of this manual has a structure which reflects the naming and order of these menu options In most instances the web interfa...

Страница 19: ...blem further connect a console to the RS232 port on the DFL 160 after NetDefendOS starts The details of making this connection are described below in Section 2 4 Console Port Connection When you press...

Страница 20: ...n included RS232 null modem cable is used to connect the console to the console port This port is marked COM as shown in the image above The connected console must have the following communication set...

Страница 21: ...60 USB Port Next to the RS232 port is a USB port This port is not used with the current version of NetDefendOS The port is intended for use with features planned for future NetDefendOS versions and is...

Страница 22: ...2 4 Console Port Connection Chapter 2 Initial Setup 22...

Страница 23: ...hat follow describe the options in this menu in the order they appear 3 1 Administration The options on this page deal with administrator access to the DFL 160 through one of the Ethernet interfaces T...

Страница 24: ...efore not recommended to expose the DFL 160s public IP address to this probing For troubleshooting purposes however it may be desirable to temporarily enable ping responses on the WAN interface B Admi...

Страница 25: ...ne if there is a clash of port numbers after enabling inbound traffic Management Through the Serial Console Some administration tasks can be carried out through a console device attached directly to t...

Страница 26: ...sses will automatically be retrieved and no further configuration is normally required for this option The only option is the MTU value that will be used for this connection but this normally doesn t...

Страница 27: ...the ISP then this should be selected otherwise Static should be selected and the static IP addresses supplied by the ISP should be entered If the Dial on Demand option is enabled the PPTP connection w...

Страница 28: ...Transparent mode does not require an IP address to be allocated instead the LAN interface automatically gets the same IP address as the WAN interface The presentation of the LAN interface options in...

Страница 29: ...e exposed through the WAN interface In some scenarios the WAN interface may be connected to another internal network and in this case NAT usage may also not be appropriate because there is no need to...

Страница 30: ...pears in the web interface Combinations of IP address and MAC address can be added to the list The red icon on the right of each entry can be clicked to delete the entry This feature allows the same I...

Страница 31: ...re URL resolution is required will also need to find a DNS server These DNS servers should be manually configured if this hasn t already been done automatically through DHCP when connecting to an ISP...

Страница 32: ...affic itself which networks can be found on the interfaces and creates the necessary entries in its routing table If both the LAN and DMZ interfaces have transparent mode enabled traffic will flow tra...

Страница 33: ...dress as the WAN interface If DHCP is enabled on the WAN interface and the IP address on WAN cannot be refreshed within its DHCP lease time then it will receive the IP address 0 0 0 0 and the DMZ inte...

Страница 34: ...ning of severity levels and the various attributes available The severity of each event is predefined and it can be in order of severity one of 1 Emergency the most severe 2 Alert 3 Critical 4 Error 5...

Страница 35: ...0 seconds Hold Time 120 Log Threshold 2 Medium Min Repeat Delay 600 seconds Hold Time 120 Log Threshold 3 Low Min Repeat Delay 1800 seconds Hold Time 120 Log Threshold 5 Very Low Min Repeat Delay 3600...

Страница 36: ...d applicable daylight saving time settings can be set in this part of the web page C Automatic time synchronization A number of publicly available time servers exist on the Internet which any host can...

Страница 37: ...ll poll them on a regular basis and then adjust the DFL 160 system clock with the exact time If the time server and the current time differ by more than one hour 60 minutes then the time server is ign...

Страница 38: ...DNS lookup All CLI commands are documented in Appendix A CLI Reference Usage in VPN Scenarios Dynamic DNS can also be useful in VPN scenarios where both ends of the tunnel have dynamic IP addresses I...

Страница 39: ...3 7 Dynamic DNS Settings Chapter 3 The System Menu 39...

Страница 40: ...t provides a protective barrier against a range of potential threats that can be transported by the public Internet towards sensitive internal networks Using the DFL 160 as a Firewall The firewalling...

Страница 41: ...ork Allowing Services A Service refers to a higher level protocol such as the HTTP protocol used for web surfing and is a convenient way of identifying different types of data traffic The presentation...

Страница 42: ...hedule A named Schedule can be defined through the Firewall Schedules menu option and this can then be used with any individual protocol allowed for outgoing traffic from the LAN interface Schedules s...

Страница 43: ...ocked It is recommended however to try and impose restrictions that match the expected needs of the clients and hosts on the DMZ network Connections from the DMZ to the LAN Connections initiated from...

Страница 44: ...interface Schedules specify a period of time when a particular selection is valid For example the administrator might decide to not allow web surfing during working hours The HTTP and HTTPS protocols...

Страница 45: ...public IP address if it is not If there are two IP addresses for a particular service for instance 2 web servers then the inbound traffic to one could be allowed by ticking the box here and the inbou...

Страница 46: ...on a specified port As explained above the custom rule must have a destination IP address specified which either an internal IP address if NAT is being used of a public IP if NAT is not being used Th...

Страница 47: ...l is then secure The mechanism that provides tunnel security is encryption There are two common scenarios where VPNs are used 1 LAN to LAN connection Where two internal networks need to be connected t...

Страница 48: ...options are grouped together into the same pages This is because of their similarity L2TP is a protocol that has superseded PPTP but PPTP is still used in some scenarios 4 4 1 IPsec This section expla...

Страница 49: ...the tunnel The key should be the same for both end points of the tunnel for communication to succeed A PSK can be any alphanumeric character string Security using digital certificates is not possible...

Страница 50: ...parameters used by IPsec This may be necessary in certain scenarios where the DFL 160 must communicate with an IPsec peer that expects certain conventions to be used The advanced options are as follo...

Страница 51: ...to work out the key The DH group value selects the strength of the DH algorithm being used The options are 1 2 and 5 C Perfect Forward Secrecy Perfect Forward Secrecy PFS ensures that the session key...

Страница 52: ...tunnels can be listed and their usage examined through the IPsec option in the Status menu see Section 6 8 IPsec Status 4 4 2 L2TP PPTP Client This option allows a tunnel to be set up where the DFL 16...

Страница 53: ...re the DFL 160 acts as a L2TP or PPTP server receiving connection requests from external clients Such clients are sometimes called roaming clients since they might not have a fixed IP address and migh...

Страница 54: ...least one DNS server defined C Authentication This section specifies how authentication is done with connecting clients D MPPE Microsoft Point to Point Encryption MPPE is an optional encryption method...

Страница 55: ...ssible For a description of how to set up VPN connections with the DFL 160 see Section 4 4 VPN Options VPN Types That Use VPN Authentication The exact types of VPN actions that rely on this user datab...

Страница 56: ...itted or denied for web surfing A company s internal surfing policy might be for example to only allow access to news and e banking sites but not to any other type of site The sections of the WCF page...

Страница 57: ...fied URLs Allow Override With this option a web page is displayed to the user to indicate that they are trying to access a URL which has been flagged by the WCF database There is a link on the page ho...

Страница 58: ...cribed in Section 6 4 Web Content Filtering Status A graphical summary of WCF activity shown below can be found in the initial display screen which is described in Section 6 1 System Status 4 6 2 The...

Страница 59: ...odds and lottery web sites This does not include traditional or computer based games refer to the Games Sites category 10 Examples might be www blackjackspot com www pickapony net Category 5 Travel To...

Страница 60: ...ncludes facilities to submit and review personal advertisements arrange romantic meetings with other people mail order bride foreign spouse introductions and escort services Examples might be adultmat...

Страница 61: ...systems of religious beliefs and practice Examples might be www paganfed demon co uk www cultdeadcrow com Category 15 Politics A web site may be classified under the Politics category if its content...

Страница 62: ...baby nu Category 20 Search Sites A web site may be classified under the Search Sites category if its main focus is providing online Internet search facilities Refer to the section on unique categories...

Страница 63: ...easantvids com Category 26 Educational A web site classified under the Educational category may belong to other categories but has content that relates to educational services or has been deemed of ed...

Страница 64: ...r general fashion models Examples might be www vickys secret com sportspictured cnn com features 2002 swimsuit Category 31 Spam A web site may be classified under the Spam category if it is found to b...

Страница 65: ...imal effect on overall throughput The inspection process is based on pattern matching against a database of known virus patterns and can determine with a high degree of certainty if a virus is in the...

Страница 66: ...the web interface for Anti Virus scanning is divided into 3 sections A Anti Virus Database B Anti Virus Scanning C Scan Exclusion Control A Anti Virus Database This section of the user interface shows...

Страница 67: ...ion NetDefendOS always performs MIME checking where it looks inside the file to determine what the true filetype of the data is Only if the filetype determined by MIME checking is on the exclude list...

Страница 68: ...sions by isolating any server infection away from the most sensitive inside network which is usually connected to the LAN interface However it is much better to take steps to prevent these infections...

Страница 69: ...It is recommended to scan the minimum number of protocols required For example if there is only an SMTP server in the DMZ network then enabling the SMTP checkbox only is recommended IDP scanning can c...

Страница 70: ...ol With both Worms and Malware and Scanners it is important to use them with caution since they will use more processing resources by increasing the scanning load Both can be particularly useful when...

Страница 71: ...help to resolve competing guarantees Setting Up traffic Shaping After selecting the Traffic Shaping menu option in the Firewall menu we must first click the box that enables the option Specifying WAN...

Страница 72: ...Tip Specifying all services It is not possible to explcitly specify all services However it is possible to specify a custom service with a port range that is zero to a very large number A port range c...

Страница 73: ...shaping rule can apply to a specific local network on LAN or DMZ and or a specific remote network on the Internet If specified the source and or destination networks provide an alternate condition fo...

Страница 74: ...owed and this is described further in Section 4 1 Outbound LAN Traffic Options Section 4 2 Outbound DMZ Traffic Options Section 4 3 Inbound Traffic Options Predefined Schedules By default a number of...

Страница 75: ...comments field allows some text explanation to be added to the schedule It serves only as a reminder to the administrator what the schedule was intended for 4 10 Schedules Chapter 4 The Firewall Menu...

Страница 76: ...4 10 Schedules Chapter 4 The Firewall Menu 76...

Страница 77: ...face provides a simple way to issue a ping command to any IP address and also to repeat the ping request a certain number of times with a certain size of packet The image below shows the ping dialog w...

Страница 78: ...5 1 Ping Chapter 5 The Tools Menu 78...

Страница 79: ...output could consist of a large number of lines of output the web interface provides the ability to impose a filter on the output so only those lines that are of interest are displayed Where a large...

Страница 80: ...60 system and how its resources are being used B UTM Statistics Unified Threat Management UTM consists of the 3 components Anti Virus IDP and Web Content Filtering If any of these features are enabled...

Страница 81: ...take you to the Logging option in the System menu for a more complete list of recent events and the filters to analyze them The details of NetDefendOS logging can be found in Section 3 5 Logging 6 1...

Страница 82: ...the NetDefendOS MemLog Along with these 500 the last 500 from each of the Anti Virus Web Content Filtering and IDP subsystems are also kept in memory and these can be viewed separately The MemLog Dis...

Страница 83: ...escribed in Section 6 2 Logging Status Log messages are visible in 100 message blocks on the page and tools are also provided for filtering out messages of interest based on various criteria These mes...

Страница 84: ...Section 6 2 Logging Status Log messages are visible in 100 message blocks on the page and tools are also provided for filtering out messages of interest based on various criteria These messages can p...

Страница 85: ...tatus menu described in Section 6 2 Logging Status Log messages are visible in 100 message blocks on the page and tools are also provided for filtering out messages of interest based on various criter...

Страница 86: ...e currently established connections The list shows the protocol TCP or UDP the source IP address and the destination IP address of the connection A example of the information displayed is shown below...

Страница 87: ...cs A Interface Status The general information for the chosen interface is displayed The example below is for the DMZ interface B Driver Information Hardware Statistics This section of the display show...

Страница 88: ...dly the statistics for received incoming traffic are shown over the last 24 hours An example is shown below the image is also truncated on the right side 6 7 Interfaces Status Chapter 6 The Status Men...

Страница 89: ...e encryption methods and other parameters that will be used for data flowing from one end of an IPsec tunnel to the other SAs are set up after the two ends of a VPN tunnel use the Internet Exchange Pr...

Страница 90: ...el An example of the user authentication display is shown below The Forcibly Logout Option For each user the administrator has the option to force a logout of a user with this option This can be usefu...

Страница 91: ...utes in the NetDefendOS routing table are created automatically without intervention from the administrator The image below shows a typical example of the status display for the NetDefendOS routing ta...

Страница 92: ...fined IP range to any users or hosts that require them This option in the Status menu allows the administrator to see which DHCP servers are configured and the status of these servers Each line is the...

Страница 93: ...6 11 DHCP Server Status Chapter 6 The Status Menu 93...

Страница 94: ...and IDP databases This portion of the web interface is divided into 3 tabs A General B Update Interval C History A General This section of the user interface allows the administrator to enable or dis...

Страница 95: ...the latest releases It is not often that the databases are updated more than once in a day C History This tab shows the history of recent database updates and can also indicate if there were problems...

Страница 96: ...s received which can then be entered into the license page to activate the service License Properties Each DFL 160 comes pre installed with a standard NetDefendOS license This page of the web interfac...

Страница 97: ...ber of PPP tunnels which terminate at the WAN interface that can be created To expand the capabilities of the standard product license consult with your local D Link representative 7 2 Licenses Chapte...

Страница 98: ...really matter since NetDefendOS will read a header in the file to determine what it is Backups Do Not Contain Everything Backups include only static information from the NetDefendOS configuration Dyna...

Страница 99: ...en could be used to hold the reset button in Warning Do not abort a reset to factory defaults DO NOT STOP THE RESET TO FACTORY DEFAULTS PROCESS PREMATURELY If the factory default reset process is inte...

Страница 100: ...s are available as a single file which can be uploaded to the DFL 160 through this page in the web interface NetDefendOS upgrades can be downloaded for free from your local D Link site or from the D L...

Страница 101: ...el After clicking on the button Download support file a file is automatically generated by the NetDefendOS and downloaded to the web interface and can be saved to the local disk The techsupport CLI Co...

Страница 102: ...7 6 Technical Support Chapter 7 The Maintenance Menu 102...

Страница 103: ...ey is pressed during these 3 seconds then NetDefendOS startup pauses and the console boot menu is displayed Initial Boot Menu Options without a Password Set When NetDefendOS is started for the first t...

Страница 104: ...w The Start firewall option re continues the interrupted NetDefendOS startup process If the Login option is chosen the console password must be entered and the full boot menu described above is entere...

Страница 105: ...llowing Showing diagnose entries since 2008 05 22 2008 06 21 11 54 58 Start 2 27 00 0 131 2008 06 21 11 56 16 Stop RECONFIGURE 2008 06 21 11 56 21 Start 2 27 00 0 131 2008 06 21 11 57 29 Stop RECONFIG...

Страница 106: ...tional frozen state then system restart can offer a simple way to clear all error conditions This can take a few minutes and while restart occurs no traffic can flow through the unit All connections w...

Страница 107: ...tly running on the DFL 160 Syntax about ARP Displays ARP entries for the specified interface s Published static as well as dynamic items are shown Syntax arp options interface pattern Options ip patte...

Страница 108: ...an 419 142 UDP 192 168 123 137 192 168 3 183 wan 543 322 UDP 194 2 1 50 192 168 123 182 lan 962 60 UDP 192 168 123 182 194 2 1 50 lan 687 60 ARP 0080 ad87 e592 ffff ffff ffff wan 268 88 UDP 192 168 3...

Страница 109: ...c permitted to pass under FwdFast is not included in this list Each connection has two timeout values one in each direction These are updated when the firewall receives packets from each end of the co...

Страница 110: ...r options Options rules Shows dhcp server rules leases Shows dhcp server leases mappings Shows dhcp server IP MAC mappings release Releases an active or blacklisted IP Example DFL 160 dhcpserver Conte...

Страница 111: ...ongoing and completed attempts Syntax frags Example DFL 160 frags RecvIf Num State Source Destination Proto Next Timeout lan 2 Done 10 5 3 2 26 23 5 4 ICMP 2000 58 wan 8 Accept 23 3 8 4 10 5 3 2 ICMP...

Страница 112: ...ce lan Builtin e1000 Intel R PRO 1000 T Server Adapter Slot 2 1 IRQ 5 Media 1000BaseTx Speed 1000 Mbps Full Duplex MTU 1500 Link Partner 10BASE T 10BASE T FD 100BASE TX 100BASE TX FD 1000BASE TX F Bus...

Страница 113: ...n IKE snooping on if an IP is specified then only IKE traffic from that IP will be shown Syntax ikesnoop verbose ipaddr Enable verbose output if an IP is specified then only IKE traffic from that IP w...

Страница 114: ...re memory consumption Also displays detailed memory use of some components and lists Syntax memory Ping Sends a specified number of ICMP Echo Request packets to a given destination All packets are sen...

Страница 115: ...single host routes Note that core routes for interface IP addresses are not normally shown use the all switch to show core routes also In the Flags field of the routing tables the following letters ar...

Страница 116: ...ttings TCP TCP Transmission Control Protocol Settings ICMP ICMP Internet Control Message Protocol Settings ARP ARP Address Resolution Protocol Settings State Stateful Inspection Settings ConnTimeouts...

Страница 117: ...Shutdown NORMAL Active in 5 seconds Shutdown reason Shutdown due to console command Stats Shows various vital stats and counters Syntax stats Example DFL 160 stats Uptime 10 days 23 11 59 Last shutdow...

Страница 118: ...x time options Options set arg Set system local time YYYY MM DD HH MM SS sync Synchronize time with timeserver s specified in settings force Force synchronization regardless of the MaxAdjust setting U...

Страница 119: ...ay to explicitly disconnect Userauth Display information about authenticated users known privileges Syntax userauth options Options l Displays a list of all authenticated users p Displays a list of al...

Страница 120: ...ntents of user database LocalUsers Username Groups Static IP Remote Networks bob sales alice tech DFL 160 userdb LocalUsers bob Information for bob in database LocalUsers Username bob Groups sales Net...

Страница 121: ...ic must be able to flow between the designated PC Ethernet interface and the DFL 160 LAN interface so they must be on the same IP network This means the PC s interface should be assigned the following...

Страница 122: ...e assigned IP address 192 168 10 30 could in fact be another address from the 192 168 10 0 24 network However 192 168 10 30 is normally used by D Link as a convention Appendix B Windows XP IP Setup 12...

Страница 123: ...DHCP cannot be used the workstation IP address should be configured manually The steps to do this with Windows Vista are as follows 1 Press the Windows Start button 2 Select the Control Panel from th...

Страница 124: ...e following IP address and enter the following values IP Address 192 168 10 30 Subnet mask 255 255 255 0 Default gateway 192 168 10 1 DNS addresses can be entered later once Internet access is establi...

Страница 125: ...nnot be used the workstation IP address should be configured manually The steps to do this with Windows 7 are as follows 1 Press the Windows Start button 2 Select the Control Panel from the start menu...

Страница 126: ...the following IP address and enter the following values IP Address 192 168 10 30 Subnet mask 255 255 255 0 Default gateway 192 168 10 1 DNS addresses can be entered later once Internet access is estab...

Страница 127: ...e should not be needed since the DFL 160 automatically assigns the address using DHCP If DHCP cannot be used the workstation IP address should be configured manually The steps to do this with MacOS X...

Страница 128: ...ask 255 255 255 0 Router 192 168 10 1 6 Click Apply to complete the static IP setup Note Different MacOS versions Some versions of MacOS may differ slightly from the screenshots shown above but the se...

Страница 129: ...ommand 110 dynamic DNS settings 38 E end of life procedures 99 environmental parameters 13 Ethernet port LEDs 10 F FireFox usage 15 firewall menu 17 40 frags CLI command 111 H heat flow considerations...

Страница 130: ...tatic URL filters 57 stats CLI command 117 status LED 10 14 status menu 79 sysmsgs CLI command 117 system menu 23 system status 80 T technical support 101 techsupport CLI command 118 time CLI command...

Отзывы:

Нет отзывов

Похожие инструкции для NetDefend SOHO DFL-160

NetDefend DFL-CP310

Бренд: D-Link Страницы: 485

NetDefend DFL-260E

Бренд: D-Link Страницы: 652

NetDefend DFL-260E

Бренд: D-Link Страницы: 6

Бренд: D-Link Страницы: 8

DFL-800 - Security Appliance

Бренд: D-Link Страницы: 20

DFL-300 - Security Appliance

Бренд: D-Link Страницы: 12

DFL-1600 - Security Appliance

Бренд: D-Link Страницы: 22

DFL-700 - Security Appliance

Бренд: D-Link Страницы: 141

NetDefend DFL-260E

Бренд: D-Link Страницы: 198

DFL-210 - NetDefend - Security Appliance

Бренд: D-Link Страницы: 213

DFL-210 - NetDefend - Security Appliance

Бренд: D-Link Страницы: 469

Бренд: D-Link Страницы: 6

Бренд: Barracuda Страницы: 4

3C16792 - OfficeConnect Dual Speed Switch 16

Бренд: 3Com Страницы: 2

3C16772 - OfficeConnect Web Site Filter

Бренд: 3Com Страницы: 4

Бренд: Abocom Страницы: 3

Бренд: Watchguard Страницы: 2

H3C SecPath F1800-A

Бренд: H3C Страницы: 13

Бренды по названию

0 1 2 3 4 5 6 7 8 9 A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

Популярные бренды

Загрузить еще бренды