![D-Link DFL-1600 Инструкция по эксплуатации онлайн [360/552] 17576](/icons/site-icon-64.png){kind=icon}
D-Link DFL-1600 Инструкция по эксплуатации онлайн [360/552] 17576
Превью страниц
Страница 360 /
552
![D-Link DFL-210 Инструкция по эксплуатации онлайн [360/552] 17511](/views2/1018576/page360/bg168.png)
Содержание
2089- Network security firewall
- User manual
- Security
- Dfl 210 260 260e 800 860 860e dfl 1600 1660 2500 2560 2560g
- User manual
- Netdefendos version 2 7 3
- Dfl 210 260 260e 800 860 860e dfl 1600 1660 2500 2560 2560g
- User manual
- Netdefendos version 2 7 3
- Limitations of liability
- Disclaimer
- Copyright notice
- Table of contents
- List of figures
- List of examples
- Examples
- Text structure and conventions
- Screenshots
- Preface
- Intended audience
- Warning
- Trademarks
- Important
- Highlighted content
- Caution
- Netdefendos objects
- Netdefendos as a network security operating system
- Key features
- Features
- Chapter 1 netdefendos overview
- Netdefendos documentation
- Interfaces
- Netdefendos building blocks
- Netdefendos architecture
- Logical objects
- Interface symmetry
- Stateful inspection
- State based architecture
- Netdefendos rule sets
- Basic packet flow
- Note additional actions
- Netdefendos state engine packet flow
- Figure 1 packet flow schematic part i
- Figure 1 packet flow schematic part ii
- Figure 1 packet flow schematic part iii
- Figure 1 expanded apply rules logic
- Apply rules
- Overview
- Managing netdefendos
- Management interfaces
- Chapter 2 management and maintenance
- Creating additional accounts
- The default administrator account
- Remote management policies
- Note recommended browsers
- Multiple administration logins
- Important
- Logging on to the web interface
- The web interface
- Setting the management workstation ip
- Assignment of a default ip address
- The web browser interface
- Multi language support
- Important switch off popup blocking
- First time web interface logon and the setup wizard
- Note remote management access
- Interface layout
- Controlling access to the web interface
- Tip correctly routing management traffic
- The cli
- Logging out from the web interface
- Caution don t expose the management interface
- Tip getting help about help
- The cli command history
- Tab completion
- Optional parameters are tab completed last
- Note category and context
- Cli command structure
- Tab completion of parameter values
- Note rule names are recommended
- Selecting object categories
- Object categories
- Referencing by name
- Using hostnames in the cli
- Inserting into rule lists
- Using unique names
- Specifying multiple property values
- Ssh secure shell cli access
- Serial console cli access
- Note the console password is separate
- Logging on to the cli
- Changing the cli prompt
- Changing the admin user password
- Tip the cli prompt is the webui device name
- Logging off from the cli
- Configuring remote management access on an interface
- Checking configuration integrity
- Activating and committing changes
- Managing management sessions with sessionmanager
- Cli scripts
- Script variables
- Only four commands are allowed in scripts
- Executing scripts
- Script validation and command ordering
- Script output
- Saving scripts
- Note the symbol 0 is reserved
- Error handling
- Removing scripts
- Listing scripts
- Creating scripts automatically
- Tip listing commands at the console
- Secure copy
- Scripts running other scripts
- Commenting script files
- Netdefendos file organization
- Scp command format
- Note scp examples do not show the password prompt
- The console boot menu
- Examples of uploading and downloading
- Activating uploads
- Initial boot menu options without a password set
- Accessing the console boot menu
- Webui before rules
- Validation timeout
- The console password is only for the console
- Ssh before rules
- Removing the console password
- Management advanced settings
- Local console timeout
- Initial options with a console password set
- Webui http port
- Https certificate
- Configuration objects
- Working with configurations
- Webui https port
- Object types
- Object organization
- Working with configurations chapter 2 management and maintenance
- When accessing object via the cli you can omit the category name and just use the type name the cli command in the above example for instance could be simplified to
- Show servicetcpudp telnet
- Example 2 displaying a configuration object
- Working with configurations chapter 2 management and maintenance
- Important configuration changes must be activated
- Example 2 editing a configuration object
- Example 2 adding a configuration object
- Changes to a configuration object will not be applied to a running system until the new netdefendos configuration is activated
- After modifying several configuration objects you might want to see a list of the objects that were changed added and removed since the last commit
- Working with configurations chapter 2 management and maintenance
- Listing modified objects
- Example 2 undeleting a configuration object
- Example 2 deleting a configuration object
- Working with configurations chapter 2 management and maintenance
- The administrator should be aware that if any changes that affect the configurations of live ipsec tunnels are committed then those live tunnels connections will be terminated and must be re established
- Important committing ipsec changes
- If the new configuration is validated netdefendos will wait for a short period 30 seconds by default during which a connection to the administrator must be re established as described previously if the configuration was activated via the cli with the activate command then a commit command must be issued within that period if a lost connection could not be re established or if the commit command was not issued then netdefendos will revert to using the previous configuration this is a fail safe mechanism and amongst others things can help prevent a remote administrator from locking themselves out
- Example 2 listing modified configuration objects
- Example 2 0 activating and committing a configuration
- After changes to a configuration have been made the configuration has to be activated for those changes to have an impact on the running system during the activation process the new proposed configuration is validated and netdefendos will attempt to initialize affected subsystems with the new configuration data
- Activating and committing a configuration
- Note changes must be committed
- Events and logging
- Event types
- Event severity
- Overview
- Message format
- Log messages
- Log message generation
- Overview
- Memory for logging is limited
- Logging to syslog hosts
- Logging to memorylogreceiver
- Disabling memory logging
- Creating log receivers
- The prio and severity fields
- Note syslog server configuration
- Message format
- Snmp traps
- Snmp traps in netdefendos
- Note snmp trap standards
- The snmp protocol
- This setting specifies the maximum log messages that netdefendos will send per second this value should never be set too low as this may result in important events not being logged nor should it be set too high when the maximum is exceeded the excess messages are dropped and are not buffered
- The following advanced settings for netdefendos event logging are available to the administrator
- The delay in seconds between alarms when a continuous alarm is used minimum 0 maximum 10 000
- The administrator must make a case by case judgement about the message load that log servers can deal with this can often depend on the server hardware platform being used and if the resources of the platform are being shared with other tasks
- Send limit
- Default 60 one minute
- Default 2000
- Alarm repetition interval
- Advanced log settings chapter 2 management and maintenance
- Advanced log settings
- Start message parameters
- Radius architecture
- Radius accounting messages
- Radius accounting
- Overview
- Stop message parameters
- Tip the meaning of the asterisk after a list entry
- Radius accounting security
- Radius accounting and high availability
- Interim accounting messages
- Activating radius accounting
- Radius advanced settings
- Limitations with nat
- Handling unresponsive servers
- Allow on error
- Accounting and system shutdowns
- Example 2 3 radius accounting server setup
- Disabling the setting will mean that the user will be logged out if the radius accounting server cannot be reached even though the user has been previously authenticated
- Default enabled
- Default 1024
- Continue to be logged in
- The maximum number of contexts allowed with radius this applies to radius use with both accounting and authentication
- Radius advanced settings chapter 2 management and maintenance
- Maximum radius contexts
- Logout at shutdown
- If this option is not enabled netdefendos will shutdown even though there may be radius accounting sessions that have not been correctly terminated this could lead to the situation that the radius server will assume users are still logged in even though their sessions have been terminated
- If there is an orderly shutdown of the netdefend firewall by the administrator then netdefendos will delay the shutdown until it has sent radius accounting stop messages to any configured radius server
- Using the hwm cli command
- Note the meaning of x
- Hardware monitoring
- Enabling hardware monitoring
- Availability
- Setting the minimum and maximum range
- Note different hardware has different sensors and ranges
- Overview
- Enabling an ip rule for snmp
- Defining snmp access
- The netdefendos mib
- The community string
- Snmp monitoring
- The following snmp advanced settings can be found under the remote management section in the webui
- The advanced setting snmp request limit restricts the number of snmp requests allowed per second this can help prevent attacks through snmp overload
- Snmp before ruleslimit
- Snmp advanced settings chapter 2 management and maintenance
- Snmp advanced settings
- Snmp access port 161 is usually used for snmp and netdefendos always expects snmp traffic on that port
- Remote access encryption
- Preventing snmp overload
- It should be noted that snmp version 1 or 2c access means that the community string will be sent as plain text over a network this is clearly insecure if a remote client is communicating over the public internet it is therefore advisable to have remote access take place over an encrypted vpn tunnel or similarly secure means of communication
- Example 2 4 enabling snmp monitoring
- Enable snmp traffic to the firewall regardless of configured ip rules
- Interface description snmp
- Interface alias
- System name
- System location
- System contact
- Snmp request limit
- The pcapdump command
- Running on multiple interfaces
- Re using capture files
- A simple example
- Output file naming restrictions
- Note netdefendos keeps track of saved files
- Filter expressions
- Downloading the output file
- Compatibility with wireshark
- Combining filters
- Backing up configurations
- Auto update mechanism
- Warning do not upload a system backup to dissimilar hardware
- Version compatability
- Maintenance
- The management interfaces used
- Operation interruption
- Backup and restore using scp
- Restore to factory defaults chapter 2 management and maintenance
- Restore to factory defaults
- Reset procedure for the netdefend dfl 210 260 260e 800 860 and 860e
- Note backups do not contain everything
- It should be understood that a reset to factory defaults is exactly that any netdefendos upgrades performed since the unit left the factory will be lost
- Important any upgrades will be lost after a factory reset
- Backups include only static information from the netdefendos configuration dynamic information such as the dhcp server lease database or anti virus idp databases will not be backed up
- Backup and restore using the webui
- As an alternative to using scp the administrator can initiate a backup or restore of the configuration or complete system directly through the webui the example below illustrates how this is done
- A restore to factory defaults can be applied so that it is possible to return to the original hardware state that existed when the netdefend firewall was shipped by d link when a restore is applied all data such as the idp and anti virus databases are lost and must be reloaded
- Warning do not abort a reset to defaults
- Reset procedure for the netdefend dfl 1600 1660 2500 2560 and 2560g
- End of life procedures
- The address book
- Overview
- Ip addresses
- Chapter 3 fundamentals
- The numbers 0 32 correspond to the number of binary ones in the netmask for example 192 68 24
- Note that ranges are not limited to netmask boundaries they may include any span of ip addresses for example 192 68 0 192 68 5 represents six hosts in consecutive order
- Ip range a range of ip addresses is represented with the form a b c d e f g h
- Ip network an ip network is represented using classless inter domain routing cidr form cidr uses a forward slash and a digit 0 32 to denote the size of the network as a postfix this is also known as the netmask
- Ip addresses chapter 3 fundamentals
- Example 3 adding an ip range
- Example 3 adding an ip network
- Example 3 adding an ip host
- 24 corresponds to a class c net with 256 addresses netmask 255 55 55 27 corresponds to a 32 address net netmask 255 55 55 24 and so on
- When specifying an ethernet address the format aa bb cc dd ee ff should be used ethernet addresses are also displayed using this format
- If an ip object is deleted that is in use by another object then netdefendos will not allow the configuration to be deployed and will produce a warning message in other words it will appear that the object has been successfully deleted but netdefendos will not allow the configuration to be saved to the netdefend firewall
- Example 3 deleting an address object
- Example 3 adding an ethernet address
- Ethernet addresses chapter 3 fundamentals
- Ethernet addresses
- Ethernet address objects are used to define symbolic names for ethernet addresses also known as mac addresses this is useful for example when populating the arp table with static arp entries or for other parts of the configuration where symbolic names are preferred over numerical ethernet addresses
- Deleting in use ip objects
- Ip addresses can be excluded
- Groups simplify configuration
- Groups can contain different subtypes
- Address groups
- Auto generated address objects
- Address book folders
- Overview
- A service is passive
- Services
- Predefined services
- The type of service created can be one of the following
- Tcp udp service a service based on the udp or tcp protocol or both this type of service is discussed further in this section
- Service group a service group consisting of a number of services this is discussed further in section 3 service groups
- Ip protocol service a service based on a user defined protocol this is discussed further in section 3 custom ip protocol services
- If the list of predefined netdefendos service objects does not meet the requirements for certain traffic then a new service can be created reading this section will explain not only how new services are created but also provides an understanding of the properties of predefined services
- Icmp service a service based on the icmp protocol this is discussed further in section 3 icmp services
- Example 3 viewing a specific service
- Creating custom services chapter 3 fundamentals
- Creating custom services
- Udp orientated applications
- Tcp and udp service definition
- Tcp and udp based services
- Specifying port numbers
- Other service properties
- Tip specifying source ports
- Specifying all services
- Tip the http all service does not include dns
- Restrict services to the minimum necessary
- Icmp types and codes
- Icmp services
- Specifying codes
- Icmp message types
- The advantage of groups
- Service groups
- Ip protocol numbers
- Groups can contain other groups
- Custom ip protocol services
- Custom service timeouts
- Interfaces
- Interface types
- Source and destination interfaces
- Overview
- Warning
- The any and core interfaces
- Interfaces have unique names
- Disabling an interface
- All interfaces are logically equivalent
- Physical ethernet interfaces
- Note usage of the terms interface and port
- Note interface sockets connected via a switch fabric
- Ethernet interfaces
- Ethernet interface parameters
- Ethernet frames
- Tip specifying multiple ip addresses on an interface
- Note interface enumeration
- Note a gateway ip cannot be deleted with dhcp enabled
- The difference between logical and physical ethernet interfaces
- Changing the ip address of an ethernet interface
- Useful cli commands for ethernet interfaces
- Showing assigned interfaces
- Setting interface addresses
- Ethernet device commands
- Enabling dhcp
- Overview
- Vlan processing
- Physical vlan connection with vlan
- Note 802 ad is not supported
- Figure 3 vlan connections
- Vlan advanced settings
- Unknown vlan tags
- Summary of vlan setup
- License limitations
- The ppp protocol
- Pppoe client configuration
- Ppp authentication
- User authentication
- Unnumbered pppoe
- Note pppoe has a discovery protocol
- Ip address information
- Dial on demand
- The generic router encapsulation gre protocol is a simple encapsulating protocol that can be used whenever there is a need to tunnel traffic across networks and or through network devices gre does not provide any security features but this means that its use has extremely low overhead
- Pppoe cannot be used with ha
- Overview
- Gre tunnels chapter 3 fundamentals
- Gre tunnels
- Gre is typically used to provide a method of connecting two networks together across a third network such as the internet the two networks being connected together communicate with a common protocol which is tunneled using gre through the intervening network examples of gre usage are
- For reasons connected with the way ip addresses are shared in a netdefendos high availability cluster pppoe will not operate correctly it should there not be configured with ha
- Example 3 1 configuring a pppoe client
- Using gre
- Traversing network equipment that blocks a particular protocol
- Setting up gre
- Gre security and performance
- Setup for netdefend firewall a
- Gre and the ip rule set
- An example gre scenario
- Setup for netdefend firewall b
- Checking gre tunnel status
- The security transport equivalent option
- Interface groups
- Tip osi layers
- The netdefendos arp cache
- The expires column
- Overview
- Ip addressing over ethernet
- The size of the arp cache
- Flushing the arp cache
- Static mode arp objects
- Creating arp objects
- Publishing modes
- Published arp objects
- Using arp advanced settings
- Unsolicited arp replies
- Publishing entire networks
- Multicast and broadcast
- Figure 3 an arp publish ethernet frame
- Matching ethernet addresses
- Changes to the arp cache
- Arp requests
- Arp match ethernet sender
- Arp advanced settings summary
- Sender ip 0
- Unsolicited arp replies
- Static arp changes
- Log arp resolve failure
- Arp sender ip
- Arp requests
- Arp query no sender
- Arp changes
- Arp multicast
- Arp hash size vlan
- Arp hash size
- Arp expire unknown
- Arp expire
- Arp cache size
- Arp broadcast
- Arp ip collision
- The netdefendos security policy rule sets
- Security policy characteristics
- Security policies
- Ip rule sets
- Specifying any interface or network
- Ip rules and the default main ip rule set
- Traffic flow needs an ip rule and a route
- Tip include the rule set name in the drop all name
- Figure 3 simplified netdefendos traffic flow
- Creating a drop all rule
- Tip rules in the wrong order sometimes cause problems
- The first matching principle
- Stateful inspection
- Non matching traffic
- Ip rule evaluation
- Bi directional connections
- Ip rule actions
- Using reject
- Ip rule set folders
- Editing ip rule set entries
- Tip object groups help to document configurations
- This can be very useful for someone seeing a configuration for the first time such as technical support staff in an ip rule set that contains hundreds of rules it can often prove difficult to quickly identify those rules associated with a specific aspect of netdefendos operation
- The display function of object groups means they do not have relevance to the command line interface cli it is not possible to define or otherwise modify object groups with the cli and they will not be displayed in cli output any group editing must be done through the web interface and this is described next
- The concept of folders can be used to organise groups of netdefendos objects into related collections these work much like the folders concept found in a computer s file system folders are described in relation to the address book in section 3 address book folders and can also be used when organizing ip rules
- Object groups are a recommended way to document the contents of netdefendos configurations
- Object groups and the cli
- Groups can be used in most cases where netdefendos objects are displayed as tables where each line in the table is an instance of an object the most common usage will be for the netdefendos address book to arrange ip addresses and in particular for organizing rules in ip rule sets which is why they are introduced in this section
- Configuration object groups chapter 3 fundamentals
- Configuration object groups
- A compliment or alternative to folders for organizing different type of netdefendos object lists is the configuration object groups feature object groups gather together configuration objects under a specified title text for the purpose of organizing their display in graphical user interfaces unlike folders they do not require the folder to be opened for the individual objects to become visible instead all objects are already visible and they are displayed in a way that indicates how they are grouped together
- Editing group properties
- A simple example
- Adding preceding objects
- Adding additional objects
- Removing a group
- Moving groups
- Moving group objects
- Leaving a group
- Groups and folders
- Schedules
- Schedule parameters
- Schedule objects
- Multiple time ranges
- Important set the system date and time
- Schedules chapter 3 fundamentals
- Example 3 7 setting up a time scheduled policy
- Certificate components
- Certificate authorities
- Overview
- Certificates with vpn tunnels
- Certificates
- Validity time
- Trusting certificates
- Reusing root certificates
- Important
- Identification lists
- Certificates in netdefendos
- Certificate revocation lists
- Example 3 9 associating certificates with ipsec tunnels
- Example 3 8 uploading a certificate
- Create a gateway certificate on the windows ca server and export it as a file in the pfx format
- Convert the pfx file into the pem format
- Ca certificate requests chapter 3 fundamentals
- Ca certificate requests
- To request certificates from a ca server or ca company the best method is to send a ca certificate request which is a file that contains a request for a certificate in a well known predefined format
- There are two types of certificates that can be uploaded self signed certificates and remote certificates belonging to a remote peer or ca server self signed certificates can be generated by using one of a number of freely available utilities for doing this
- The netdefendos web interface webui does not currently include the ability to generate certificate requests that can be sent to a ca server for generation of the cer and key files required by netdefendos
- Manually creating windows ca server requests
- It is possible however to manually create the required files for a windows ca server using the following stages
- Time zones
- Time synchronization protocols
- Setting date and time
- Overview
- Note a reconfigure is not required
- Date and time
- Current date and time
- Many regions follow daylight saving time dst or summer time as it is called in some countries and this means clocks are advanced for the summer period unfortunately the principles regulating dst vary from country to country and in some cases there can be variations within the same country for this reason netdefendos does not automatically know when to adjust for dst instead this information has to be manually provided if daylight saving time is to be used
- Example 3 2 enabling dst
- Example 3 1 setting the time zone
- Daylight saving time
- Time servers chapter 3 fundamentals
- Time servers
- There are two parameters governing daylight saving time the dst period and the dst offset the dst period specifies on what dates daylight saving time starts and ends the dst offset indicates the number of minutes to advance the clock during the daylight saving time period
- The world is divided up into a number of time zones with greenwich mean time gmt in london at zero longitude being taken as the base time zone all other time zones going east and west from zero longitude are taken as being gmt plus or minus a given integer number of hours all locations counted as being inside a given time zone will then have the same local time and this will be one of the integer offsets from gmt
- The netdefendos time zone setting reflects the time zone where the netdefend firewall is physically located
- Time synchronization protocols
- Important dns servers need to be configured in netdefendos
- Configuring time servers
- To avoid situations where a faulty time server causes the clock to be updated with a extremely inaccurate time a maximum adjustment value in seconds can be set if the difference between the current netdefendos time and the time received from a time server is greater than this maximum adjustment value then the time server response will be discarded for example assume that the maximum adjustment value is set to 60 seconds and the current netdefendos time is 16 42 35 if a time server responds with a time of 16 43 38 then the difference is 63 seconds this is greater than the maximum adjustment value so no update occurs for this response
- Time servers chapter 3 fundamentals
- Maximum time adjustment
- If the timesyncinterval parameter is not specified when using the cli to set the synchronization interval the default of 86400 seconds equivalent to one day is used
- Example 3 5 modifying the maximum adjustment value
- Example 3 4 manually triggering a time synchronization
- Settings summary for date and time
- D link time servers
- Time zone
- Synchronization intervals
- Time sync server type
- Teriary time server
- Secondary time server
- Primary time server
- Max time drift
- Interval between synchronization
- Dst start date
- Dst offset
- Dst end date
- Group interval
- Overview
- Features requiring dns resolution
- Dns with netdefendos
- Dynamic dns
- Note a high rate of server queries can cause problems
- Overview
- Chapter 4 routing
- The principles of routing
- The components of a route
- Static routing
- Figure 4 a typical routing scenario
- A typical routing scenario
- The narrowest routing table match is selected
- The local ip address parameter
- Figure 4 using local ip address with an unbound network
- The route lookup mechanism
- Static routing
- Netdefendos route notation
- All traffic must have two associated routes
- Composite subnets can be specified
- Netdefendos route definition advantages
- When the netdefend firewall is started for the first time netdefendos will automatically add a
- Tip the cli cc command may be needed first
- These routing table changes can take place for different reasons for example if dynamic routing with ospf has been enabled then routing tables will become populated with new routes learned from communicating with other ospf routers in an ospf network other events such as route fail over can also cause routing table contents to change over time
- Static routing chapter 4 routing
- It is important to note that routing tables that are initially configured by the administrator can have routes added deleted and changed automatically during live operation and these changes will appear when the routing table contents are displayed
- In the cli example above it was necessary to first select the name of a specific routing table with the cc command meaning change category or change context before manipulating individual routes this is necessary for any category that could contain more than one named group of objects
- Example 4 displaying the main routing table
- Displaying routing tables
- Default static routes are added automatically for each interface
- The all nets route
- Note the metric for default routes is 100
- Core routes
- Netdefend firewalls are often deployed in mission critical locations where availability and connectivity is crucial for example an enterprise relying heavily on access to the internet could have operations severely disrupted if a single connection to the external internet via a single internet service provider isp fails
- It is therefore not unusual to have backup internet connectivity using a secondary isp the connections to the two service providers often use different routes to avoid a single point of failure
- For detailed information about the output of the cli routes command please see the cli reference guide
- To allow for a situation with multiple isps netdefendos provides a route failover capability so that should one route fail traffic can automatically failover to another alternate route netdefendos implements route failover through the use of route monitoring in which netdefendos monitors the availability of routes and then switches traffic to an alternate route should the primary preferred route fail
- Tip understanding output from the routes command
- Route failover chapter 4 routing
- Route failover
- Overview
- Setting up route failover
- Setting the route metric
- Figure 4 a route failover scenario for isp access
- Automatically added routes need redefining
- Route interface grouping
- Re enabling routes
- Multiple failover routes
- Failover processing
- Host monitoring for route failover
- Gratuitous arp generation
- Enabling host monitoring
- Overview
- Specifying hosts
- The reachability required option
- Iface poll interval
- Http parameters
- Arp poll interval
- Advanced settings for route failover
- A known issue when no external route is specified
- Proxy arp
- Ping poll interval
- Overview
- Gratuitous arp on fail
- Grace time
- Consecutive success
- Consecutive fails
- A typical scenario
- Transparent mode as an alternative
- Setting up proxy arp
- Figure 4 a proxy arp example
- Proxy arp and high availability clusters
- Not all interfaces can make use of proxy arp
- Automatically added routes
- Policy based routing tables
- Policy based routing rules
- Policy based routing
- Overview
- The ordering parameter
- Routing table selection
- If there is no route that is an exact match then the absence of a default all nets route will mean that the connection will be dropped
- Example 4 creating the route
- Example 4 creating a policy based routing table
- A common mistake with policy based routing is the absence of the default route with a destination interface of all nets in the default main routing table
- The ordering parameter chapter 4 routing
- Important ensure all nets appears in the main table
- The ordering parameter chapter 4 routing
- Example 4 policy based routing configuration
- Route load balancing
- Rlb operation
- Overview
- Enabling rlb
- Disabling rlb
- Figure 4 the rlb round robin algorithm
- Using route metrics with spillover
- Using route metrics with round robin
- Figure 4 the rlb spillover algorithm
- Rlb resets
- Rlb limitations
- An rlb scenario
- The requirement for matching ip ranges
- We will not use the spillover algorithm in this example so the routing metric for both routes should be the same in this case a value of 100 is selected
- We first need to define two routes to these two isps in the main routing table as shown below
- The service all is used in the above ip rules but this should be further refined to a service or service group that covers all the traffic that will be allowed to flow
- Route load balancing chapter 4 routing
- In order to flow any traffic requires both a route and an allowing ip rule the following rules will allow traffic to flow to either isp and will nat the traffic using the external ip addresses of interfaces wan1 and wan2
- Figure 4 a route load balancing scenario
- Example 4 setting up rlb
- By using the destination rlb algorithm we can ensure that clients communicate with a particular server using the same route and therefore the same source ip address if nat was being used for the client communication the ip address seen by the server would be wan1 or wan2
- Use two isps with one tunnel connecting through one isp and the other tunnel connecting through the other isp rlb can then be applied as normal with the two tunnels
- This solution has the advantage of providing redundancy should one isp link fail
- Route load balancing chapter 4 routing
- Rlb with vpn
- In order to get the second tunnel to function in this case it is necessary to add a single host route in the main routing table that points to the secondary isps interface and with the secondary isps gateway
- If we were to try and use rlb to balance traffic between two ipsec tunnels the problem that arises is that the remote endpoint for any two ipsec tunnels in netdefendos must be different the solutions to this issue are as follows
- If both tunnels must be for example ipsec connects it is possible to wrap ipsec in a gre tunnel in other words the ipsec tunnel is carried by a gre tunnel gre is a simple tunneling protocol without encryption and therefore involves a minimum of extra overhead see section 3 gre tunnels for more about this topic
- When using rlb with vpn a number of issues need to be overcome
- Use vpn with one tunnel that is ipsec based and another tunnel that is uses a different protocol
- Link state algorithms
- Dynamic routing
- Distance vector algorithms
- Differences to static routing
- The ospf solution
- Ospf is not available on all d link netdefend models
- Figure 4 a simple ospf scenario
- Advantages of link state algorithms
- A simple ospf scenario
- Tip ring topologies always provide alternate routes
- Ospf provides route redundancy
- Figure 4 ospf providing route redundancy
- A look at routing metrics
- Link state routing
- The autonomous system
- Overview
- Ospf is not available on all d link netdefend models
- Ospf concepts
- The designated router
- Ospf areas
- Ospf area components
- Authentication
- Virtual links
- Neighbors
- Aggregates
- A linking areas without direct connection to the backbone
- Figure 4 0 virtual links connecting areas
- B linking a partitioned backbone
- Ospf high availability support
- Figure 4 1 virtual links with partitioned backbone
- Using ospf with netdefendos
- Ospf router process
- Ospf components
- General parameters
- Figure 4 2 netdefendos ospf objects
- Authentication
- Ospf area
- Note authentication must be the same on all routers
- General parameters
- Advanced
- Ospf interface
- Note different interface types can be used with ospf interfaces
- Import filter
- Ospf vlinks
- Ospf neighbors
- Ospf aggregates
- Usage with ospf
- The reasons for dynamic routing rules
- The final ospf setup step is creating dynamic routing rules
- Overview
- Note linking partitioned backbones
- Dynamic routing rules
- When to use export rules
- Specifying a filter
- Ospf requires at least an import rule
- General parameters
- Figure 4 3 dynamic routing rule objects
- Dynamic routing rule objects
- Dynamic routing rule
- More parameters
- General parameters
- Destination network
- Routing action
- Ospf action
- Setting up ospf
- Sending ospf traffic through a vpn tunnel
- Ospf routing information exchange begins automatically
- Confirming ospf deployment
- Tip non ospf traffic can also use the tunnel
- An ospf example
- Example 4 creating an ospf router process
- Example 4 add ospf interface objects
- Example 4 add an ospf area
- Example 4 0 import routes from an ospf as into the main routing table
- An ospf example chapter 4 routing
- Example 4 1 exporting the default route into an ospf as
- An ospf example chapter 4 routing
- Reverse path forwarding
- Multicast routing
- Underlying principles
- The multicast routing solution
- The multicast problem
- Routing to the correct interface
- Overview
- Note interface multicast handling must be on or auto
- Note an allow or nat rule is also needed
- Multicast forwarding with sat multiplex rules
- Multicast forwarding no address translation
- The matching rule could also be a nat rule for source address translation see below but cannot be a fwdfast or sat rule
- Remember to add an allow rule that matches the sat multiplex rule
- Note sat multiplex rules must have a matching allow rule
- Multicast forwarding with sat multiplex rules chapter 4 routing
- Figure 4 4 multicast forwarding no address translation
- Example 4 2 forwarding of multicast traffic using the sat multiplex rule
- The two values outif ip represent a combination of output interface and if address translation of a group is needed an ip address
- The destination interface is core since 239 92 00 0 is a multicast group no address translation of 239 92 00 0 was added but if it is required for say if2 then the final argument would be
- The cli command to create the multiplex rule is then
- Multiplexargument outif1 ip1 outif2 ip2 outif3 ip3
- Multiplexargument if2 if3
- Multicast forwarding with sat multiplex rules chapter 4 routing
- Multicast forwarding address translation scenario
- If for example multiplexing of the multicast group 239 92 00 0 is required to the output interfaces if2 and if3 then the command to create the rule would be
- First the ipruleset in this example main needs to be selected as the current category
- Creating multiplex rules with the cli
- Creating multiplex rules through the cli requires some additional explanation
- Cc ipruleset main
- Multicast forwarding with sat multiplex rules chapter 4 routing
- Figure 4 5 multicast forwarding address translation
- Example 4 3 multicast forwarding address translation
- As previously noted remember to add an allow rule matching the sat multiplex rule
- This scenario is based on the previous scenario but this time the multicast group is translated when the multicast streams 239 92 0 24 are forwarded through the if2 interface the multicast groups should be translated into 237 92 0 24
- No address translation should be made when forwarding through interface if1 the configuration of the corresponding igmp rules can be found below in section 4 igmp rules configuration address translation
- Reports are sent from hosts towards the router when a host wants to subscribe to new multicast groups or change current multicast subscriptions
- Queries are igmp messages sent from the router towards the hosts in order to make sure that it will not close any stream that some host still wants to receive
- Proxy mode
- Note replace allow with nat for source ip translation
- Normally both types of rule have to be specified for igmp to function but there are two exceptions
- Netdefendos supports two igmp modes of operation
- Igmp signalling between hosts and routers can be divided into two categories
- Igmp reports
- Igmp queries
- Igmp configuration chapter 4 routing
- Igmp configuration
- If the multicast source is located on a network directly connected to the router no query rule is needed
- If address translation of the source address is required the allow rule following the sat multiplex rule should be replaced with a nat rule
- If a neighboring router is statically configured to deliver a multicast stream to the netdefend firewall an igmp query would also not have to be specified
- The operation of these two modes are shown in the following illustrations
- Snoop mode
- Igmp rules configuration no address translation
- Figure 4 7 multicast proxy mode
- Figure 4 6 multicast snoop mode
- Igmp configuration chapter 4 routing
- Example 4 4 igmp no address translation
- Two examples are provided one for each pair of report and query rule the upstream multicast router uses ip upstreamrouterip
- The following examples illustrates the igmp rules needed to configure igmp according to the address translation scenario described above in section 4 multicast forwarding address translation scenario we need two igmp report rules one for each client interface the interface if1 uses no address translation and if2 translates the multicast group to 237 92 0 24 we also need two query rules one for the translated address and interface and one for the original address towards if1
- Igmp rules configuration address translation
- Igmp configuration chapter 4 routing
- Example 4 5 if1 configuration
- Igmp configuration chapter 4 routing
- Example 4 6 if2 configuration group translation
- Auto add multicast core route
- Advanced igmp settings
- Igmp router version
- Igmp react to own queries
- Igmp lowest compatible version
- Igmp last member query interval
- Igmp before rules
- Igmp unsolicated report interval
- Igmp startup query interval
- Igmp startup query count
- Igmp robustness variable
- Igmp query response interval
- Igmp query interval
- Igmp max total requests
- Igmp max interface requests
- Switch routes
- Overview
- Comparison with routing mode
- Usage scenarios
- Transparent mode usage
- Transparent mode
- Note transparent and routing mode can be combined
- How transparent mode works
- Restricting the network parameter
- Multiple switch routes are connected together
- Enabling transparent mode
- Transparent mode with vlans
- Creating separate transparent mode networks
- Transparent mode with dhcp
- High availability and transparent mode
- Enabling transparent mode directly on interfaces
- Figure 4 9 transparent mode internet access
- Figure 4 8 non transparent mode internet access
- Enabling internet access
- Using nat
- Transparent mode scenarios
- Scenario 1
- Netdefendos may also need internet access
- Grouping ip addresses
- Transparent mode scenarios chapter 4 routing
- Figure 4 0 transparent mode scenario 1
- Example 4 7 setting up transparent mode for scenario 1
- Transparent mode scenarios chapter 4 routing
- Scenario 2
- Here the netdefend firewall in transparent mode separates server resources from an internal network by connecting them to a separate interface without the need for different address ranges
- Figure 4 1 transparent mode scenario 2
- Example 4 8 setting up transparent mode for scenario 2
- All hosts connected to lan and dmz the lan and dmz interfaces share the 10 24 address space as this is configured using transparent mode any ip address can be used for the servers and there is no need for the hosts on the internal network to know if a resource is on the same network or placed on the dmz the hosts on the internal network are allowed to communicate with an http server on dmz while the http server on the dmz can be reached from the internet the netdefend firewall is transparent between the dmz and lan but traffic is still controlled by the ip rule set
- Transparent mode scenarios chapter 4 routing
- Netdefendos includes support for relaying the bridge protocol data units bpdus across the netdefend firewall bpdu frames carry spanning tree protocol stp messages between layer 2 switches in a network stp allows the switches to understand the network topology and avoid the occurrences of loops in the switching of packets
- The diagram below illustrates a situation where bpdu messages would occur if the administrator enables the switches to run the stp protocol two netdefend firewalls are deployed in transparent mode between the two sides of the network the switches on either side of the firewall need to communicate and require netdefendos to relay switch bpdu messages in order that packets do not loop between the firewalls
- Spanning tree bpdu support chapter 4 routing
- Spanning tree bpdu support
- Implementing bpdu relaying
- Figure 4 2 an example bpdu relaying scenario
- Enabling disabling bpdu relaying
- Cam to l3 cache dest learning
- Advanced settings for transparent mode
- Transparency ats size
- Transparency ats expire
- Note optimal ats handling
- L3 cache size
- Dynamic l3c size
- Dynamic cam size
- Decrement ttl
- Cam size
- Relay spanning tree bpdus
- Null enet sender
- Multicast enet sender
- Broadcast enet sender
- Relay mpls
- Overview
- Lease expiration
- Ip address assignment
- Dhcp leases
- Chapter 5 dhcp services
- Using relayer ip address filtering
- Searching the server list
- Multiple dhcp servers
- Dhcp servers
- Dhcp options
- Dhcp server advanced settings
- Displaying ip to mac address mappings
- Tip lease database saving
- Static host parameters
- Static dhcp hosts
- Figure 5 dhcp server objects
- Additional server settings
- Example 5 static dhcp host assignment
- Custom options chapter 5 dhcp services
- Custom options
- Can be specified as this parameter the option exists to also specify if the identifier will be sent as an ascii or hexadecimal value
- An example of this is certain switches that require the ip address of a tftp server from which they can get certain extra information
- Adding a custom option to the dhcp server definition allows the administrator to send specific pieces of information to dhcp clients in the dhcp leases that are sent out
- Custom option parameters
- Dhcp relaying
- Although all netdefendos interfaces are core routed that is to say a route exists by default that routes interface ip addresses to core for relayed dhcp requests this core routing does not apply instead the interface is the source interface and not core
- A dhcp relayer takes the place of the dhcp server in the local network and acts as the link between the client and a remote dhcp server it intercepts requests coming from clients and relays them to the dhcp server the dhcp server then responds to the relayer which forwards the response back to the client dhcp relayers use the tcp ip bootstrap protocol bootp to implement this relay functionality for this reason dhcp relayers are sometimes referred to as bootp relay agents
- With dhcp clients send requests to locate the dhcp server s using broadcast messages however broadcasts are normally only propagated across the local network this means that the dhcp server and client always need to be on the same physical network in a large internet like network topology this means there would have to be a different dhcp server on every network this problem is solved by the use of a dhcp relayer
- The source ip of relayed dhcp traffic
- The dhcp relayer solution
- The dhcp problem
- For relayed dhcp traffic the option exists in netdefendos to use the interface on which it listens as the source interface for forwarded traffic or alternatively the interface on which it sends out the forwarded request
- Example 5 setting up a dhcp relayer
- Dhcp relaying chapter 5 dhcp services
- How many hops the dhcp request can take between the client and the dhcp server
- How many dhcp packets a client can send to through netdefendos to the dhcp server during one minute
- For how long a dhcp transaction can take place
- Dhcp relay advanced settings chapter 5 dhcp services
- Dhcp relay advanced settings
- Default 500 packets
- Default 5
- Default 32
- Transaction timeout
- Default 10 seconds
- The maximum lease time allowed by netdefendos if the dhcp server has a higher lease time it
- The following advanced settings are available with dhcp relaying
- Maximum number of transactions at the same time
- Max transactions
- Max ppm
- Max lease time
- Max hops
- Max auto routes
- Auto save policy
- Auto save interval
- Overview
- Ip pools with config mode
- Ip pools
- Basic ip pool options
- Advanced ip pool options
- Memory allocation for prefetched leases
- Listing ip pool status
- Other options in the ippool command allow the administrator to change the pool size and to free up ip addresses the complete list of command options can be found in the cli reference guide
- Ip pools chapter 5 dhcp services
- Example 5 creating an ip pool
- The default access rule
- Overview
- Custom access rules are optional
- Chapter 6 security mechanisms
- Access rules
- Turning off default access rule messages
- Note enabling logging
- Ip spoofing
- Access rule settings
- Access rule filtering fields
- Access rule actions
- If for some reason the default access rule log message is continuously being generated by some source and needs to be turned off then the way to do this is to specify an access rule for that source with an action of drop
- Troubleshooting access rule related problems
- It should be noted that access rules are a first filter of traffic before any other netdefendos modules can see it sometimes problems can appear such as setting up vpn tunnels precisely because of this it is always advisable to check access rules when troubleshooting puzzling problems in case a rule is preventing some other function such as vpn tunnel establishment from working properly
- Example 6 setting up an access rule
- Access rule settings chapter 6 security mechanisms
- Overview
- Figure 6 deploying an alg
- Deploying an alg
- Tip maximum sessions for http can sometimes be too low
- The http alg
- Maximum connection sessions
- Http alg features
- Using wildcards in white and blacklists
- The ordering for http filtering
- Note similarities with other netdefendos features
- Figure 6 http alg processing order
- The ftp alg
- Ftp connections
- Ftp connection modes
- Deploying an http alg
- A discussion of ftp security issues
- The netdefendos alg solution
- Hybrid mode
- Predefined ftp algs
- Note hybrid conversion is automatic
- Ftp alg command restrictions
- Figure 6 ftp alg hybrid mode
- Connection restriction options
- Note some commands are never allowed
- Filetype checking
- Control channel restrictions
- Anti virus scanning
- Note zonedefense won t block infected servers
- Ftp alg with zonedefense
- The ftp alg chapter 6 security mechanisms
- The ftp alg chapter 6 security mechanisms
- The ftp alg chapter 6 security mechanisms
- Example 6 protecting ftp clients
- The ftp alg chapter 6 security mechanisms
- The tftp alg
- Setting up ftp servers with passive mode
- General tftp options
- The smtp alg
- Tftp request options
- Smtp alg options
- Allowing request timeouts
- The ordering for smtp filtering
- Enhanced smtp and extensions
- Using wildcards in white and blacklists
- Figure 6 smtp alg processing order
- Tip exclusion can be manually configured
- Smtp alg with zonedefense
- Anti spam filtering
- The netdefendos anti spam implementation
- Figure 6 anti spam filtering
- Dnsbl server queries
- Dnsbl databases
- Creating a dnsbl consesus
- Tagging spam
- Alternative actions for dropped spam
- A threshold calculation example
- Verifying the sender email
- Allowing for failed dnsbl servers
- Adding x spam information
- Setup summary
- Logging
- Caching addresses for performance
- The dnsbl cli command
- Tip dnsbl servers
- The pop3 alg
- Pop3 alg options
- Why the pptp alg is needed
- The pptp alg
- Pptp alg setup
- Figure 6 pptp alg usage
- The sip alg
- Pptp alg settings
- Sip alg options
- Note traffic shaping will not work with the sip alg
- Netdefendos sip setup
- Sip media related protocols
- Sip components
- The sip proxy record route option
- Ip rules for media data
- Sip usage scenarios
- Scenario 1 protecting local clients proxy located on the internet
- Note nat traversal should not be configured
- The service object for ip rules
- Scenario 2 protecting proxy and local clients proxy on the same network as clients
- Note nat traversal should not be configured
- Scenario 3 protecting proxy and local clients proxy on the dmz interface
- The h 23 alg
- H 23 components
- H 23 protocols
- H 23 alg features
- H 23 alg configuration
- The h 23 alg chapter 6 security mechanisms
- The h 23 alg chapter 6 security mechanisms
- Example 6 h 23 with private ip addresses
- To place a call to the phone behind the netdefend firewall place a call to the external ip address on the firewall if multiple h 23 phones are placed behind the firewall one sat rule has to be configured for each phone this means that multiple external addresses have to be used however it is preferred to use a h 23 gatekeeper as in the h 23 with gatekeeper scenario as this only requires one external address
- The h 23 alg chapter 6 security mechanisms
- Example 6 two phones behind different netdefend firewalls
- The h 23 alg chapter 6 security mechanisms
- Example 6 using private ip addresses
- To place a call to the phone behind the netdefend firewall place a call to the external ip address on the firewall if multiple h 23 phones are placed behind the firewall one sat rule has to be configured for each phone this means that multiple external addresses have to be used however it is preferable to use an h 23 gatekeeper as this only requires one external address
- The h 23 alg chapter 6 security mechanisms
- Example 6 h 23 with gatekeeper
- The h 23 alg chapter 6 security mechanisms
- There is no need to specify a specific rule for outgoing calls netdefendos monitors the communication between external phones and the gatekeeper to make sure that it is possible for internal phones to call the external phones that are registered with the gatekeeper
- The h 23 alg chapter 6 security mechanisms
- Note outgoing calls do not need a specific rule
- Example 6 h 23 with gatekeeper and two netdefend firewalls
- There is no need to specify a specific rule for outgoing calls netdefendos monitors the communication between external phones and the gatekeeper to make sure that it is possible for internal phones to call the external phones that are registered with the gatekeeper
- The h 23 alg chapter 6 security mechanisms
- Note outgoing calls do not need a specific rule
- Example 6 0 using the h 23 alg in a corporate environment
- The h 23 alg chapter 6 security mechanisms
- The h 23 alg chapter 6 security mechanisms
- There is no need to specify a specific rule for outgoing calls netdefendos monitors
- The h 23 alg chapter 6 security mechanisms
- Note outgoing calls do not need a specific rule
- Example 6 2 allowing the h 23 gateway to register with the gatekeeper
- Example 6 1 configuring remote offices for h 23
- Tls is certificate based
- The tls alg
- The relationship with ssl
- Overview
- Advantages of using netdefendos for tls termination
- Figure 6 tls termination
- Enabling tls
- Urls delivered by servers
- Netdefendos tls limitations
- Cipher suites supported by netdefendos tls
- Web content filtering
- Overview
- Note enabling wcf
- Filtering mechanisms
- Caution consider the consequences of removing objects
- Active content handling
- Wildcarding
- Static content filtering
- Static and dynamic filter ordering
- Example com bad this will also cause www myexample com to be blocked since it blocks all sites ending with example com
- Example 6 4 setting up a white and blacklist
- Www example com bad this will only block the first request to the web site surfing to www example com index html for example will not be blocked
- Web content filtering url blacklisting is a separate concept from section 6 blacklisting hosts and networks
- Static content filtering chapter 6 security mechanisms
- Note the hosts and networks blacklist is separate
- Gif good this will block all files with gif as the file name extension
- Wcf processing flow
- Overview
- Dynamic web content filtering
- Dynamic wcf is only available on certain netdefend models
- Dynamic wcf databases
- Wcf and whitelisting
- Setting up wcf
- Note new url submissions are done anonymously
- Figure 6 dynamic content filtering flow
- Categorizing pages and not sites
- Activation
- Tip using a schedule
- The option exists to set the http alg fail mode in the same way that it can be set for some other algs and it applies to wcf just as it does to functions such as anti virus scanning the fail mode setting determines what happens when dynamic content filtering cannot function and typically this is because netdefendos is unable to reach the external databases to perform url lookup fail mode can have one of two settings
- Setting fail mode
- Once a subscription is taken out an http application layer gateway alg object should be defined with dynamic content filtering enabled this object is then associated with a service object and the service object is then associated with a rule in the ip rule set to determine which traffic should be subject to the filtering this makes possible the setting up of a detailed filtering policy based on the filtering parameters that are used for rules in the ip rule set
- If the administrator would like the content filtering policy to vary depending on the time of the day they can make use of a schedule object associated with the corresponding ip rule for more information please see section 3 schedules
- Example 6 5 enabling dynamic web content filtering
- Dynamic web content filtering chapter 6 security mechanisms
- Dynamic content filtering is a feature that is enabled by taking out a separate subscription to the service this is an addition to the normal netdefendos license
- Deny if wcf is unable to function then urls are denied if external database access to verify them is not possible the user will see an access denied web page
- Allow if the external wcf database is not accessible urls are allowed even though they might be disallowed if the wcf databases were accessible
- Introducing blocking gradually
- In audit mode the system will classify and log all surfing according to the content filtering policy but restricted web sites will still be accessible to the users this means the content filtering feature of netdefendos can then be used as an analysis tool to analysis what categories of websites are being accessed by a user community and how often
- Dynamic web content filtering chapter 6 security mechanisms
- Blocking websites can disturb users if it is introduced suddenly it is therefore recommended that the administrator gradually introduces the blocking of particular categories one at a time this allows individual users time to get used to the notion that blocking exists and could avoid any adverse reaction that might occur if too much is blocked at once gradual introduction also makes it
- Audit mode
- After running in audit mode for some period of time it is easier to then have a better understanding of the surfing behavior of different user groups and also to better understand the potential impact of turning on the wcf feature
- Reclassification of blocked sites
- On some occasions active content filtering may prevent users carrying out legitimate tasks consider a stock analyst who deals with on line gaming companies in his daily work he might need to browse gambling web sites to conduct company assessments if the corporate policy blocks gambling web sites he will not be able to do his job
- If a user overrides the restricted site notice page they are allowed to surf to all pages without any new restricted site message appearing again the user is however still being logged when the user has become inactive for 5 minutes the restricted site page will reappear if they then try to access a restricted site
- For this reason netdefendos supports a feature called allow override with this feature enabled the content filtering component will present a warning to the user that he is about to enter a web site that is restricted according to the corporate policy and that his visit to the web site will be logged this page is known as the restricted site notice the user is then free to continue to the url or abort the request to prevent being logged
- Example 6 6 enabling audit mode
- Easier to evaluate if the goals of site blocking are being met
- Dynamic web content filtering chapter 6 security mechanisms
- Caution overriding the restriction of a site
- By enabling this functionality only users that have a valid reason to visit inappropriate sites will normally do so other will avoid those sites due to the obvious risk of exposing their surfing habits
- As the process of classifying unknown web sites is automated there is always a small risk that some sites are given an incorrect classification netdefendos provides a mechanism for allowing users to
- Allowing override
- Manually propose a new classification of sites
- If reclassification is enabled and a user requests a web site which is disallowed the block web page will include a dropdown list containing all available categories if the user believes the requested web site is wrongly classified he can select a more appropriate category from the dropdown list and submit that as a proposal
- Example 6 7 reclassifying a blocked site
- Dynamic web content filtering chapter 6 security mechanisms
- Content filtering categories
- This section lists all the categories used with dynamic content filtering and describes the purpose
- This mechanism can be enabled on a per http alg level which means that the administrator can choose to enable this functionality for regular users or for a selected user group only
- The url to the requested web site as well as the proposed category will then be sent to d link s central data warehouse for manual inspection that inspection may result in the web site being reclassified either according to the category proposed or to a category which is felt to be correct
- Category 5 travel tourism
- Category 4 gambling
- Category 3 job search
- Category 2 news
- Category 1 adult content
- Category 9 dating sites
- Category 8 chatrooms
- Category 7 entertainment
- Category 6 shopping
- Category 10 game sites
- Category 13 crime terrorism
- Category 12 e banking
- Category 11 investment sites
- Category 15 politics
- Category 14 personal beliefs cults
- Category 20 search sites
- Category 19 malicious
- Category 18 violence undesirable
- Category 17 www email sites
- Category 16 sports
- Category 26 educational
- Category 25 government blocking list
- Category 24 business oriented
- Category 23 music downloads
- Category 22 clubs and societies
- Category 21 health sites
- Category 29 computing it
- Category 28 drugs alcohol
- Category 27 advertising
- Category 31 spam
- Category 30 swimsuit lingerie models
- Unclassified sites and sites that do not fit one of the other categories will be placed in this category it is unusual to block this category since this could result in most harmless urls being blocked
- To perform customization it is necessary to first create a new named alg banner files object this new object automatically contains a copy of all the files in the default alg banner files object these new files can then be edited and uploaded back to netdefendos the original default object cannot be edited the following example goes through the necessary steps
- Example 6 8 editing content filtering http banner files
- Dynamic web content filtering make use of a set of html files to present information to the user when certain conditions occur such as trying to access a blocked site these web pages sometimes referred to as http banner files are stored within netdefendos but can be customized to suit a particular installation s needs the webui provides a simple way to download edit and upload these files the available files are
- Dynamic web content filtering chapter 6 security mechanisms
- Customizing html pages
- Compressionforbidden contentforbidden urlforbidden restrictedsitenotice reclassifyurl
- Category 32 non managed
- Uploading with scp
- Tip saving changes
- Html page parameters
- Enabling through algs
- Combining with client anti virus scanning
- Anti virus scanning
- Streaming
- Pattern matching
- Overview
- Note anti virus is not available on all netdefend models
- Implementation
- Types of file downloads scanned
- Simultaneous scans
- Relationship with idp
- Protocol specific behavior
- Creating anti virus policies
- Association with an alg
- Activating anti virus scanning
- Safestream
- General options
- Database updates
- Anti virus options
- The signature database
- Subscribing to the d link anti virus service
- Scan exclude option
- Verifying the mime type
- Updating in high availability clusters
- Setting the correct system time
- Compression ratio limit
- Anti virus with zonedefense
- Anti virus options chapter 6 security mechanisms
- Netdefendos idp components
- Maintenance and advanced idp
- Intrusion detection and prevention
- Intrusion detection
- Intrusion definition
- Idp issues
- Idp availability for d link models
- Overview
- Subscribing to the d link advanced idp service
- Figure 6 idp database updating
- Updating in high availability clusters
- The terms idp ips and ids
- Setting the correct system time
- Rule components
- Idp rules
- Idp signature selection
- Http normalization
- Figure 6 0 idp signature selection
- Insertion evasion attack prevention
- Insertion attacks
- Initial packet processing
- Evasion attacks
- Checking dropped packets
- Overview
- Signatures
- Signature advisories
- Recommended configuration
- Recognizing unknown threats
- Insertion evasion log events
- Idp pattern matching
- Detection action
- Using groups
- Specifying signature groups
- Idp signature types
- Idp signature groups
- Idp signature wildcarding
- Idp actions
- Caution use the minimum idp signatures necessary
- Action options
- Processing multiple actions
- Listing of idp groups
- The ip address of smtp log receivers is required
- Smtp log receiver for idp events
- Idp zonedefense
- Idp blacklisting
- Smtp log receiver for idp events chapter 6 security mechanisms
- Example 6 1 setting up idp for a mail server
- Using individual signatures
- The preceding example uses an entire idp group name when enabling idp however it is possible
- Smtp log receiver for idp events chapter 6 security mechanisms
- Ping of death and jolt attacks
- Overview
- Dos attack mechanisms
- Denial of service attack prevention
- Fragmentation overlap attacks teardrop bonk boink and nestea
- The winnuke attack
- The land and latierra attacks
- Protection on the victim s side
- Avoiding becoming an amplifier
- Amplification attacks smurf papasmurf fraggle
- The syn flood defence mechanism
- The jolt2 attack
- Tcp syn flood attacks
- Spotting syn floods
- Distributed dos attacks
- Algs automatically provide flood protection
- Blacklisting hosts and networks
- Tip important ip addresses should be whitelisted
- Overview
- Note restarts do not effect the blacklist
- Blacklisting options
- Whitelisting
- The cli blacklist command
- Note the content filtering blacklist is separate
- Types of translation
- Overview
- Chapter 7 address translation
- Nat provides many to one ip address translation
- Limitations on the number of connections
- Figure 7 nat ip address translation
- Tip use nat pools to get around the connection limit
- The source ip address used for translation
- Applying nat translation
- Figure 7 a nat example
- Example 7 adding a nat rule
- 68 1038
- 1 2 3 32789
- The sequence of these events is illustrated further in the diagram below
- The original sender now receives the response
- Netdefendos receives the packet and compares it to its list of open connections once it finds the connection in question it restores the original address and forwards the packet
- Nat chapter 7 address translation
- Several internal machines can not communicate with the same external server using the same ip protocol
- Several internal machines can communicate with the same server using different ip protocols
- Several internal machines can communicate with different external servers using the same ip protocol
- Protocols handled by nat
- Note restrictions only apply to ip level protocols
- Netdefendos can alter port number information in the tcp and udp headers to make each connection unique even though such connections have had their sender addresses translated to the same ip
- Nat chapter 7 address translation
- Dynamic address translation is able to deal with the tcp udp and icmp protocols with a good level of functionality since the algorithm knows which values can be adjusted to become unique in the three protocols for other ip level protocols unique connections are identified by their sender addresses destination addresses and protocol numbers
- Anonymizing internet traffic with nat
- An internal machine can communicate with several external servers using the same ip protocol
- An internal machine can communicate with several external servers using different ip protocols
- A useful application of the nat feature in netdefendos is for anonymizing service providers to
- This means that
- These restrictions apply only to ip level protocols other than tcp udp and icmp such as ospf and l2tp they do not apply to the protocols transported by tcp udp and icmp such as telnet ftp http and smtp
- Some protocols regardless of the method of transportation used can cause problems during address translation
- Figure 7 anonymizing with nat
- Types of nat pools
- Stateful nat pools
- Overview
- Nat pools
- Using nat pools
- Stateless nat pools
- Proxy arp usage
- Ip pool usage
- Fixed nat pools
- Nat pools chapter 7 address translation
- Sat requires multiple ip rules
- Note port forwarding
- Translation of a single ip address 1 1
- The second rule must trigger on the untranslated destination ip
- The role of the dmz
- Translation of a single ip address 1 1 chapter 7 address translation
- The illustration below shows a typical network arrangement with the netdefend firewall mediating communications between the public internet and servers in the dmz and between the dmz and local clients on a network called lan
- On all models of d link netdefend hardware there is a specific ethernet interface which is marked as being for the dmz network although this is the port s intended use it could be used for other purposes and any ethernet interface could also be used instead for a dmz
- Note the dmz port could be any port
- Figure 7 the role of the dmz
- Example 7 enabling traffic to a protected web server in a dmz
- Translation of a single ip address 1 1 chapter 7 address translation
- Translation of a single ip address 1 1 chapter 7 address translation
- Example 7 enabling traffic to a web server on an internal network
- Translation of a single ip address 1 1 chapter 7 address translation
- Attempts to communicate with 194 2 will result in a connection to 192 68 6
- An example of when this is useful is when having several protected servers in a dmz and where each server should be accessible using a unique public ip address
- A single sat rule can be used to translate an entire range of ip addresses in this case the result is a transposition where the first original ip address will be translated to the first ip address in the translation list and so on
- Translation of multiple ip addresses m n chapter 7 address translation
- Translation of multiple ip addresses m n
- In other words
- For instance a sat policy specifying that connections to the 194 6 29 network should be translated to 192 68 0 will result in transpositions which are described in the table below
- Example 7 translating traffic to multiple protected web servers
- Attempts to communicate with 194 6 will result in a connection to 192 68 0
- Translation of multiple ip addresses m n chapter 7 address translation
- When all nets is the destination all to one mapping is always done
- This rule produces a n 1 translation of all addresses in the group the range 194 6 194 0 plus 194 0 to the ip 192 68 0
- Port translation
- Netdefendos can be used to translate ranges and or groups into just one ip address
- Attempts to communicate with 194 6 port 80 will result in a connection to 192 68 0
- Attempts to communicate with 194 0 port 80 will result in a connection to 192 68 0
- All to one mappings n 1 chapter 7 address translation
- All to one mappings n 1
- Multiple sat rule matches
- Protocols handled by sat
- Note a custom service is needed for port translation
- What happens now is as follows
- We will now try moving the nat rule between the sat and fwdfast rules
- We now add a nat rule to allow connections from the internal network to the internet
- The two above rules may both be carried out concurrently on the same connection in this instance internal sender addresses will be translated to addresses in pubnet in a 1 1 relationship in addition if anyone tries to connect to the public address of the web server the destination address will be changed to its private address
- The following rules make up a working example of static address translation using fwdfast rules to a web server located on an internal network
- Sat and fwdfast rules chapter 7 address translation
- Sat and fwdfast rules
- Return traffic from wwwsrv 80 will match rules 2 and 4 and will appear to be sent from wan_ip 80 correct
- Return traffic from wwwsrv 80 to internal machines will be sent directly to the machines themselves this will not work as the packets will be interpreted as coming from the wrong address
- It is possible to employ static address translation in conjunction with fwdfast rules although return traffic must be explicitly granted and translated
- Internal traffic to wan_ip 80 will match rules 1 and 3 and will be sent to wwwsrv this is almost correct the packets will arrive at wwwsrv but
- In this instance both rules are set to translate the destination address meaning that only one of them will be carried out if an attempt is made internally to communicate with the web servers public address it will instead be redirected to an intranet server if any other attempt is made to communicate with the web servers public address it will be redirected to the private address of the publicly accessible web server
- External traffic to wan_ip 80 will match rules 1 and 3 and will be sent to wwwsrv correct
- Again note that the above rules require a matching allow rule at a later point in the rule set in order to work
- What happens now
- The problem can be solved using the following rule set
- Sat and fwdfast rules chapter 7 address translation
- Return traffic will automatically be handled by the netdefend firewall s stateful inspection mechanism
- Return traffic from wwwsrv 80 will match rules 2 and 3 the replies will therefore be dynamically address translated this changes the source port to a completely different port which will not work
- Return traffic from wwwsrv 80 will match rules 2 and 3
- Internal traffic to wan_ip 80 will match rules 1 and 4 and will be sent to wwwsrv the sender address will be the netdefend firewall s internal ip address guaranteeing that return traffic passes through the netdefend firewall
- External traffic to wan_ip 80 will match rules 1 and 5 and will be sent to wwwsrv
- External traffic to wan_ip 80 will match rules 1 and 4 and will be sent to wwwsrv correct
- Proving identity
- Overview
- Making use of username password combinations
- Chapter 8 user authentication
- Setup summary
- Group membership
- Authentication setup
- Using groups with ip rules
- The local database
- Specifying an ssh public key
- Pptp l2tp configuration
- Note other authentication sources do not have the pptp l2tp option
- Granting administration privileges
- Caution use the network option with care
- Support for groups
- Setting up ldap authentication
- Reasons for using external servers
- Radius usage with netdefendos
- Radius security
- External radius servers
- External ldap servers
- General settings
- Defining an ldap server
- Microsoft active directory as the ldap server
- Ldap issues
- Ldap attributes
- Note the ldap server database determines the correct value
- Important the base object must be specified correctly
- Database settings
- Usernames may need the domain
- Optional settings
- Ldap server responses
- Bind request authentication
- Real time monitoring statistics
- Ldap authentication cli commands
- Ldap authentication and ppp
- Figure 8 normal ldap authentication
- Authentication rules
- Authentication rule parameters
- Important the link to the ldap server must be protected
- Figure 8 ldap for ppp with chap ms chapv1 or ms chapv2
- Connection timeouts
- Multiple logins
- Authentication processing
- Http authentication
- Changing the management webui port
- Agent options
- A group usage example
- Setting up ip rules
- If the agent is set to https then the host certificate and root certificate have to be chosen from a list of certificates already loaded into netdefendos
- Http authentication chapter 8 user authentication
- Http authentication cannot operate unless a rule is added to the ip rule set to explicitly allow authentication to take place if we consider the example of a number of clients on the local network lannet who would like access to the public internet through the wan interface then the ip rule set would contain the following rules
- Form is recommended over basicauth because in some cases the browser might hold the login data in its cache
- Forcing users to a login page
- Combination a realm string can optionally be specified which will appear in the browser s dialog
- With this setup when users that are not authenticated try to surf to any ip except lan_ip they will fall through the rules and their packets will be dropped to always have these users come to the authentication page we must add a sat rule and its associated allow rule the rule set will now look like this
- The third rule allows dns lookup of urls
- The second rule allows normal surfing activity but we cannot just use lannet as the source network since the rule would trigger for any unauthenticated client from that network instead the source network is an administrator defined ip object called trusted_users which is the same network as lannet but has additionally either the authentication option no defined credentials enabled or has an authentication group assigned to it which is the same group as that assigned to the users
- The sat rule catches all unauthenticated requests and must be set up with an all to one address mapping that directs them to the address 127 which corresponds to core netdefendos itself
- The first rule allows the authentication process to take place and assumes the client is trying to access the lan_ip ip address which is the ip address of the interface on the netdefend firewall where the local network connects
- Http authentication chapter 8 user authentication
- Example 8 user authentication setup for web access
- Example 8 creating an authentication user group
- Http authentication chapter 8 user authentication
- Example 8 configuring a radius server
- Http banner files
- Html page parameters
- Editing the banner files
- Customizing html pages
- Example 8 editing content filtering http banner files
- Customizing html pages chapter 8 user authentication
- Uploading with scp
- Tip html file changes need to be saved
- The web page url for redirects
- The redirurl parameter
- Since scp cannot be used to download the original default html the source code must be first copied from the webui and pasted into a local text file which is then edited using an appropriate editor
- Since redirurl only has this internal purpose it should not be removed from web pages and should appear in the formlogin page if that is used
- Reason the reason that access was denied
- It is possible to upload new http banner files using scp the steps to do this are
- Ipaddr the ip address which is being browsed from
- In the above example more than one html file can be edited in a session but the save button should be pressed to save any edits before beginning editing on another file
- In certain banner web pages the parameter redirurl appears this is a placeholder for the original url which was requested before the user login screen appeared for an unauthenticated user following successful authentication the user becomes redirected to the url held by this parameter
- Vpn usage
- Overview
- Chapter 9 vpn
- Vpn planning
- Vpn encryption
- The tls alternative for vpn
- Placement in a dmz
- Key distribution
- Endpoint security
- Vpn quick start
- Overview
- Common tunnel setup requirements
- Ipsec lan to lan with pre shared keys
- Note the system time and date should be correct
- Ipsec lan to lan with certificates
- Ipsec roaming clients with pre shared keys
- A ip addresses already allocated
- B ip addresses handed out by netdefendos
- Ipsec roaming clients with certificates
- Configuring ipsec clients
- L2tp roaming clients with pre shared keys
- Note the system time and date should be correct
- L2tp roaming clients with certificates
- Pptp roaming clients
- Set up the client for windows xp the procedure is exactly as described for l2tp above but without entering the pre shared key
- Pptp roaming clients chapter 9 vpn
- Now set up the ip rules in the ip rule set
- Enable proxy arp on the int interface
- Define a user authentication rule this is almost identical to l2tp
- As in l2tp enable the insertion of new routes automatically into the main routing table
- As described for l2tp the nat rule lets the clients access the public internet via the netdefend firewall
- Security associations sas
- Overview
- Ipsec components
- Internet key exchange ike
- Ike and ipsec lifetimes
- Ike algorithm proposals
- Ike phase 1 ike security negotiation
- Ike negotiation
- Ike phase 2 ipsec security negotiation
- Ike parameters
- Diffie hellman groups
- Psk advantages
- Manual keying disadvantages
- Manual keying advantages
- Manual keying
- Ike authentication
- Psk disadvantages
- Ipsec protocols esp ah
- Disadvantages of certificates
- Certificates
- Ah authentication header
- Advantages of certificates
- Nat traversal
- Figure 9 the esp protocol
- Figure 9 the ah protocol
- Esp encapsulating security payload
- Udp encapsulation
- Nat traversal configuration
- Changing ports
- Achieving nat detection
- Algorithm proposal lists
- Pre shared keys chapter 9 vpn
- Pre shared keys can be generated automatically through the webui but they can also be generated through the cli using the command pskgen this command is fully documented in the cli reference guide
- Pre shared keys are used to authenticate vpn tunnels the keys are secrets that are shared by the communicating parties before communication takes place to communicate both parties prove that they know the secret the security of a shared secret depends on how good a passphrase is passphrases that are common words are extremely vulnerable to dictionary attacks
- Pre shared keys
- If a psk is specified as a passphrase and not a hexadecimal value the different encodings on different platforms can cause a problem with non ascii characters windows for example encodes pre shared keys containing non ascii characters in utf 16 while netdefendos uses utf 8 even though they can seem the same at either end of the tunnel there will be a mismatch and this can sometimes cause problems when setting up a windows l2tp client that connects to netdefendos
- Example 9 using a pre shared key
- Beware of non ascii characters in a psk on different platforms
- When certificates are used as authentication method for ipsec tunnels the netdefend firewall will accept all remote devices or vpn clients that are capable of presenting a certificate signed by any of the trusted certificate authorities this can be a potential problem especially when using roaming clients
- The problem
- The id list solution
- The concept of identification lists presents a solution to this problem an identification list contains one or more identities ids where each identity corresponds to the subject field in a certificate identification lists can thus be used to regulate what certificates that are given access to what ipsec tunnels
- Since the ip addresses of the travelling employees vpn clients cannot be known beforehand the incoming vpn connections from the clients cannot be differentiated this means that the firewall is unable to control the access to various parts of the internal networks
- Identification lists chapter 9 vpn
- Identification lists
- Example 9 using an identity list
- Consider the scenario of travelling employees being given access to the internal corporate networks using vpn clients the organization administers their own certificate authority and certificates have been issued to the employees different groups of employees are likely to have access to different parts of the internal networks for example members of the sales force need access to servers running the order system while technical engineers need access to technical databases
- A typical scenario
- Identification lists chapter 9 vpn
- Identification lists chapter 9 vpn
- No ip rules are needed for the enclosing ipsec traffic
- Local initiation of tunnel establishment
- Ipsec tunnels
- Ip rules control decrypted traffic
- Returning traffic
- Remote initiation of tunnel establishment
- Overview
- Keep alive
- Ipsec tunnel quick start
- Dead peer detection
- Comparing dpd and keep alive
- Roaming clients
- Psk based client tunnels
- Lan to lan tunnels with pre shared keys
- Dealing with unknown ip addresses
- The following example shows how a certificate based tunnel can be set up
- Self signed certificate based client tunnels
- Roaming clients chapter 9 vpn
- Example 9 setting up a self signed certificate based vpn tunnel for roaming clients
- Example 9 setting up a psk based vpn tunnel for roaming clients
- Roaming clients chapter 9 vpn
- Tunnels based on ca server certificates
- Setting up client tunnels using a ca issued certificate is largely the same as using self signed certificates with the exception of a couple of steps
- Roaming clients chapter 9 vpn
- It is the responsibility of the administrator to acquire the appropriate certificate from an issuing authority for client tunnels with some systems such as windows 2000 server there is built in access to a ca server in windows 2000 server this is found in certificate services for more information on ca server issued certificates see section 3 certificates
- Example 9 setting up ca server certificate based vpn tunnels for roaming clients
- Using config mode
- Defining the config mode object
- Ip validation
- However in some scenarios this information is missing or the administrator wishes to use another ldap server the ldap configuration section can then be used to manually specify alternate ldap servers
- Fetching crls from an alternate ldap server chapter 9 vpn
- Fetching crls from an alternate ldap server
- Example 9 using config mode with ipsec tunnels
- Example 9 setting up an ldap server
- After defining the config mode object the only remaining action is to enable config mode to be used with the ipsec tunnel
- A root certificate usually includes the ip address or hostname of the certificate authority to contact when certificates or crls need to be downloaded to the netdefend firewall lightweight directory access protocol ldap is used for these downloads
- Optionally the affected sa can be automatically deleted if validation fails by enabling the advanced setting ipsecdeletesaonipvalidationfailure the default value for this setting is disabled
- Netdefendos always checks if the source ip address of each packet inside an ipsec tunnel is the same as the ip address assigned to the ipsec client with ike config mode if a mismatch is detected the packet is always dropped and a log message generated with a severity level of warning this message includes the two ip addresses as well as the client identity
- Vpn tunnel negotiation
- Using ikesnoop
- Troubleshooting with ikesnoop
- The client and the server
- Step 1 client initiates exchange by sending a supported algorithm list
- Step 2 server responds to client
- Explanation of values
- Step 3 clients begins key exchange
- Step 5 client sends identification
- Step 4 server sends key exchange data
- Explanation of above values
- Step 7 client sends a list of supported ipsec algorithms
- Step 6 server id response
- Explanation of above values
- Step 8 client sends a list of supported algorithms
- Step 9 client confirms tunnel setup
- Ipsec max tunnels
- Ipsec max rules
- Ipsec advanced settings
- Ipsec before rules
- Ike send initial contact
- Ike send crls
- Ike max ca path
- Ike crl validity time
- Ipsec gateway name cache time
- Ipsec cert cache max certs
- Dpd metric
- Dpd keep time
- Dpd expire time
- Deployment
- Troubleshooting pptp
- Pptp servers
- Pptp l2tp quick start
- Pptp l2tp
- Overview
- Implementation
- The client communicates with a local access concentrator lac and the lac communicates across the internet with a l2tp network server lns the netdefend firewall acts as the lns the lac tunnels data such as a ppp session using ipsec to the lns across the internet in most cases the client will itself act as the lac
- Tcp port 1723 and or ip protocol 47 before the pptp connection can be made to the netdefend firewall examining the log can indicate if this problem occurred with a log message of the following form appearing
- Layer 2 tunneling protocol l2tp is an ietf open standard that overcomes many of the problems of pptp its design is a combination of layer 2 forwarding l2f protocol and pptp making use of the best features of both since the l2tp standard does not implement encryption it is usually implemented with an ietf standard known as l2tp ipsec in which l2tp packets are encapsulated by ipsec
- L2tp servers chapter 9 vpn
- L2tp servers
- L2tp is certificate based and therefore is simpler to administer with a large number of clients and arguably offers better security than pptp unlike pptp it is possible to set up multiple virtual networks across a single tunnel because it is ipsec based l2tp requires nat traversal nat t to be implemented on the lns side of the tunnel
- Example 9 0 setting up a pptp server
- Error ppp lcp_negotiation_stalled ppp_terminated
- Example 9 2 setting up an l2tp tunnel over ipsec
- Example 9 1 setting up an l2tp server
- L2tp servers chapter 9 vpn
- L2tp servers chapter 9 vpn
- L2tp servers chapter 9 vpn
- The following l2tp pptp server advanced settings are available to the administrator
- L2tp pptp server advanced settings chapter 9 vpn
- L2tp pptp server advanced settings
- Pptp l2tp clients
- Pptp before rules
- Max ppp resends
- L2tp before rules
- Client setup
- Using the pptp client feature
- Note the default pptp l2tp route
- Figure 9 pptp client usage
- Ca server access
- Access considerations
- Overview
- Ca server types
- Placement of private ca servers
- Figure 9 certificate validation components
- Ca server access by clients
- Turning off fqdn resolution
- Vpn troubleshooting
- Troubleshooting certificates
- General troubleshooting
- Warning be careful using the num all option
- The ipsecstat console command
- Ipsec troubleshooting commands
- The ikesnoop console command
- Specific error messages
- Management interface failure with vpn
- Could not find acceptable proposal no proposal chosen
- Incorrect pre shared key
- Payload_malformed
- No public key found
- Ike_invalid_payload ike_invalid_cookie
- Unable to set up with config mode and getting a spurious xauth message
- The tunnel can only be initiated from one side
- Specific symptoms
- Note l2tp with microsoft vista
- Traffic shaping
- The traffic shaping solution
- Qos with tcp ip
- Overview
- Netdefendos diffserv support
- Chapter 10 traffic management
- Traffic shaping in netdefendos
- Note traffic shaping will not work with the sip alg
- Traffic shaping objectives
- Pipe rules
- Pipe rule chains
- Note no pipe rules are defined by default
- Figure 10 pipe rules determine pipe usage
- Simple bandwidth limiting
- Pipes will not work with fwdfast ip rules
- Figure 10 fwdfast rules bypass traffic shaping
- Explicitly excluding traffic from shaping
- Using a single pipe for both directions
- Limiting bandwidth in both directions chapter 10 traffic management
- Limiting bandwidth in both directions
- Just inserting std in in the forward chain will not work since we probably want the 2 mbps limit for outbound traffic to be separate from the 2 mbps limit for inbound traffic if 2 mbps of outbound traffic attempts to flow through the pipe in addition to 2 mbps of inbound traffic the total
- In the previous example only bandwidth in the inbound direction is limited in most situations this is the direction that becomes full first but what if the outbound traffic must be limited in the same way
- A single pipe does not care in which direction the traffic through it is flowing when it calculates total throughout using the same pipe for both outbound and inbound traffic is allowed by netdefendos but this will not partition the pipe limit exactly in two between the two directions
- Attempting to flow is 4 mbps since the pipe limit is 2 mbps the actual flow will be close to 1 mbps in each direction
- Using two separate pipes instead
- Two surfing pipes for inbound and outbound traffic could be set up however it is not usually required to limit outbound traffic since most web surfing usually consists of short outbound server
- The recommended way to control bandwidth in both directions is to use two separate pipes one for inbound and one for outbound traffic in the scenario under discussion each pipe would have a 2 mbps limit to achieve the desired result the following example goes through the setup for this
- The incorrect solution
- Raising the total pipe limit to 4 mbps will not solve the problem since the single pipe will not know that 2 mbps of inbound and 2 mbps of outbound are the intended limits the result might be 3 mbps outbound and 1 mbps inbound since this also adds up to 4 mbps
- In the previous examples a static traffic limit for all outbound connections was applied what if the aim is to limit web surfing more than other traffic assume that the total bandwidth limit is 250 kbps and 125 kbps of that is to be allocated to web surfing inbound traffic
- Example 10 limiting bandwidth in both directions
- Creating differentiated limits using chains chapter 10 traffic management
- Creating differentiated limits using chains
- The default precedence is zero
- The correct solution
- Precedences
- Figure 10 differentiated limits using chains
- Precedence priority is relative
- Figure 10 the eight pipe precedences
- Allocating precedence to traffic
- There are 8 possible precedence levels
- Specifying precedences within pipes
- Tip specifying bandwidth
- The lowest best effort precedence
- Precedence limits are also guarantees
- Precedences only apply when a pipe is full
- Lowest precedence limits
- Figure 10 minimum and maximum pipe precedence
- Applying precedences
- Using precedences as guarantees
- The need for guarantees
- Note a limit on the lowest precedence has no meaning
- Differentiated guarantees
- Note the return chain ordering is important
- Grouping by networks requires the size
- A port grouping includes the ip address
- Pipe groups
- Specifying group limits
- Combining the group total and precedences
- Figure 10 traffic grouped by ip address
- Dynamic balancing
- Combining pipe and group limit precedence values
- Another simple groups example
- Vpn pipe limits
- Traffic shaping recommendations
- The importance of a pipe limit
- Relying on the group limit
- Precedences and dynamic balancing
- Limits should not be more than the available bandwidth
- Limits should be less than available bandwidth
- Attacks on bandwidth
- A summary of traffic shaping
- Watching for leaks
- Troubleshooting
- A basic scenario
- 0 more pipe examples
- Priority 6 500
- Priority 4 citrix 250 kpbs
- Priority 4 250
- Priority 2 other traffic 1000 kpbs
- Priority 2 1000
- Priority 0 web plus remaining from other levels
- Now create the pipe rules
- Lets assume we have a symmetric 2 2 mbps link to the internet we will allocate descending priorities and traffic requirements to the following users
- First two pipes called in pipe and out pipe need to be created with the following parameters
- We now extend the above example by allocating priorities to different kinds of traffic accessing the internet from a headquarters office
- Figure 10 a basic traffic shaping scenario
- Using several precedences
- Dynamic balancing should be enabled for both pipes instead of perdestip and persrcip we could have used perdestnet and persrcnet if there were several networks on the inside
- To implement this scheme we can use the in pipe and out pipe we first enter the pipe limits for each pipe these limits correspond to the list above and are
- 0 more pipe examples chapter 10 traffic management
- The rule will force all traffic to the default precedence level and the pipes will limit total traffic to their 1 mbps limit having dynamic balancing enabled on the pipes means that all users will be allocated a fair share of this capacity
- The reason for using 2 different pipes in this case is that these are easier to match to the physical link capacity this is especially true with asynchronous links such as adsl
- The next step is to create the following pipe rule which will force traffic to flow through the pipes
- Priority 6 voip 500 kpbs
- Priority 6 voip 500 kpbs
- Priority 0 best effort
- Pipe chaining
- Note that in other and out other are first in the pipe chain in both directions this is because we want to limit the traffic immediately before it enters the in pipe and out pipe and competes with voip citrix and web surfing traffic
- It is also important to remember to insert into the pipe all non vpn traffic using the same physical link
- In the cases discussed so far all traffic shaping is occurring inside a single netdefend firewall vpn is typically used for communication between a headquarters and branch offices in which case pipes can control traffic flow in both directions with vpn it is the tunnel which is the source and destination interface for the pipe rules
- An important consideration which has been discussed previously is allowance in the pipe total values for the overhead used by vpn protocols as a rule of thumb a pipe total of 1700 bps is reasonable for a vpn tunnel where the underlying physical connection capacity is 2 mbps
- A vpn scenario
- 0 more pipe examples chapter 10 traffic management
- Vpn in
- To do this we first create separate pipes for the outgoing traffic and the incoming traffic voip traffic will be sent over a vpn tunnel that will have a high priority all other traffic will be sent at the best effort priority see above for an explanation of this term again we will assume a 2 2 mbps symmetric link
- These rules are processed from top to bottom and force different kinds of traffic into precedences based on the service customized service objects may need to be first created in order to identify particular types of traffic the all service at the end catches anything that falls through from earlier rules since it is important that no traffic bypasses the pipe rule set otherwise using pipes will not work
- The pipes required will be
- The pipe chaining can be used as a solution to the problem of vpn overhead a limit which allows for this overhead is placed on the vpn tunnel traffic and non vpn traffic is inserted into a pipe that matches the speed of the physical link
- Suppose the requirement now is to limit the precedence 2 capacity other traffic to 1000 kbps so that it does not spill over into precedence 0 this is done with pipe chaining where we create new pipes called in other and out other both with a pipe limit of 1000 the other pipe rule is then modified to use these
- Total 1700
- The following pipe rules are then needed to force traffic into the correct pipes and precedence levels
- Sat with pipes
- Priority 6 voip 500 kpbs
- Priority 0 best effort
- Out pipe
- In pipe
- If sat is being used for example with a web server or ftp server that traffic also needs to be forced into pipes or it will escape traffic shaping and ruin the planned quality of service in addition server traffic is initiated from the outside so the order of pipes needs to be reversed the forward pipe is the in pipe and the return pipe is the out pipe
- A simple solution is to put a catch all inbound rule at the bottom of the pipe rule however the external interface wan should be the source interface to avoid putting into pipes traffic that is coming from the inside and going to the external ip address this last rule will therefore be
- 0 more pipe examples chapter 10 traffic management
- With this setup all vpn traffic is limited to 1700 kbps the total traffic is limited to 2000 kbps and voip to the remote site is guaranteed 500 kbps of capacity before it is forced to best effort
- Vpn out
- Total 2000
- Note sat and arped ip addresses
- Setting up idp traffic shaping
- Overview
- Idp traffic shaping
- Combining idp and traffic shaping
- Application related bandwidth usage
- Unintended consequences
- The importance of specifying a network
- Processing flow
- Either side can trigger idp
- Figure 10 idp traffic shaping p2p scenario
- Excluding hosts
- A p2p scenario
- Viewing traffic shaping objects
- Viewing pipes
- Viewing hosts
- Pipes are shared
- Pipe naming
- Logging
- Guaranteeing instead of limiting bandwidth
- Threshold rules
- Threshold policies
- Overview
- Note threshold rules are not available on all netdefend models
- Limiting the total connections
- Limiting the connection rate total connections
- Limiting the connection rate
- Grouping
- Exempted connections
- Threshold rules and zonedefense
- Threshold rule blacklisting
- Rule actions
- Multiple triggered actions
- Server load balancing
- Overview
- Note slb is not available on all d link netdefend models
- Slb distribution algorithms
- Slb deployment considerations
- Identifying the servers
- Figure 10 a server load balancing configuration
- Additional benefits of slb
- Stickiness parameters
- Selecting stickiness
- Slb algorithms and stickiness
- Figure 10 0 connections from three clients
- Server health monitoring
- Figure 10 2 stickiness and connection rate
- Figure 10 1 stickiness and round robin
- The table below shows the rules that would be defined for a typical scenario of a set of webservers behind the netdefend firewall for which the load is being balanced the allow rule allows external clients to access the webservers
- The key component in setting up slb are ip rules that have slb_sat as the action the steps that should be followed for setting up such rules are
- Setting up slb_sat rules chapter 10 traffic management
- Setting up slb_sat rules
- Note that the destination interface is specified as core meaning netdefendos itself deals with this the key advantage of having a separate allow rule is that the webservers can log the exact ip address that is generating external requests using only a nat rule which is possible means that webservers would see only the ip address of the netdefend firewall
- Note fwdfast rules should not be used with slb
- In order to function slb requires that the netdefendos state engine keeps track of connections fwdfast ip rules should not be used with slb since packets that are forwarded by these rules are under state engine control
- If there are clients on the same network as the webservers that also need access to those webservers then an nat rule would also be used
- Example 10 setting up slb
- Define an slb_sat rule in the ip rule set which refers to this ip address group and where all other slb parameters are defined
- Define an ip address object for each server for which slb is to enabled
- Define an ip address group object which includes all these individual objects
- Define a further rule that duplicates the source destination interface network of the slb_sat rule that permits the traffic through this could be one rule or a combination of rules using the actions
- Setting up slb_sat rules chapter 10 traffic management
- Setting up slb_sat rules chapter 10 traffic management
- The master and active units
- Overview
- Note high availability is only available on some netdefend models
- Interconnection of cluster units
- Ha clusters
- Chapter 11 high availability
- Load sharing
- Hardware duplication
- Extending redundancy
- Cluster management
- Heartbeat characteristics
- Ha mechanisms
- Disabling heartbeat sending on interfaces
- Basic principles
- Heartbeat frequency
- Shared ip addresses and arp
- Ha with anti virus and idp
- Failover time
- Dealing with sync failure
- Note an inactive unit restart is required for resynchronization
- Typical ha cluster network connections
- Setting up ha
- Note management cannot be done through the shared ip
- Ha hardware setup
- Note the illustration shows a crossover cable sync connection
- Netdefendos manual ha setup
- Verifying the cluster functions
- Note ip addresses could be public addresses
- Making cluster configuration changes
- Enabling a unique shared mac address
- With dissimilar hardware units
- Unique shared mac addresses
- Problem diagnosis
- Using individual ip addresses
- The shared ip must not be 0
- Making ospf work
- Invalid checksums in heartbeat packets
- Ha issues
- Failed interfaces
- Changing the cluster id
- All cluster interfaces need ip addresses
- Pppoe tunnels and dhcp clients
- Upgrading an ha cluster
- Important make sure the inactive unit is alive
- Ha advanced settings
- Deactivate before reconf
- Use unique shared mac
- Sync packet max burst
- Sync buffer size
- Reconf failover time
- Initial silence
- Zonedefense controls switches
- Using thresholds
- Overview
- Note zonedefense is not available on all netdefend models
- Chapter 12 zonedefense
- Acl upload
- Zonedefense switches
- Tip switch firmware versions should be the latest
- Snmp managers
- Manual blocking and exclude lists
- Managed devices
- Zonedefense operation
- Threshold rules
- Manual blocking and exclude lists chapter 12 zonedefense
- Exclude lists can be created and used to exclude hosts from being blocked when a threshold rule limit is reached good practice includes adding to the list the firewall s interface ip or mac address connecting towards the zonedefense switch this prevents the firewall from being accidentally blocked out
- Example 12 a simple zonedefense scenario
- As a complement to threshold rules it is also possible to manually define hosts and networks that are to be statically blocked or excluded manually blocked hosts and networks can be blocked by default or based on a schedule it is also possible to specify which protocols and protocol port numbers are to be blocked
- Zonedefense with anti virus scanning chapter 12 zonedefense
- Zonedefense with anti virus scanning
- Zonedefense can be used in conjuction with the netdefendos anti virus scanning feature netdefendos can first identify a virus source through antivirus scanning and then block the source by communicating with switches configured to work with zonedefense this feature is activated through the following algs
- This feature is described further in section 6 anti virus scanning and in the sections covering the individual algs
- There are some differences in zonedefense operation depending on switch model the first difference is the latency between the triggering of a blocking rule to the moment when switch es actually starts blocking out the traffic matched by the rule all switch models require a short period
- Smtp zonedefense can block a local smtp client that is sending viruses with emails
- Limitations
- Http zonedefense can block an http server that is a virus source
- Ftp zonedefense can block a local ftp client that is uploading viruses
- Important clearing the acl rule set on the switch
- Note activating setting changes
- Log received ttl 0
- Log non ip4
- Log checksum errors
- Ip level settings
- Chapter 13 advanced settings
- Ttl on low
- Ttl min
- Multicast ttl on low
- Layer size consistency
- Default ttl
- Block multicast src
- Block 127 net
- Block 0000 src
- Block 0 net
- Directed broadcasts
- Securemoteudp compatibility
- Ip router alert option
- Ip options timestamps
- Ip options other
- Ip option source return
- Ip option sizes
- Strip dontfragment
- Multicast mismatch option
- Min broadcast ttl option
- Low broadcast ttl action option
- Ip reserved flag
- Tcp mss on high
- Tcp mss min
- Tcp mss max
- Tcp mss log level
- Tcp level settings
- Tcp option sizes
- Tcp mss vpn max
- Tcp mss on low
- Tcp zero unused urg
- Tcp zero unused ack
- Tcp option wsopt
- Tcp option tsopt
- Tcp option sack
- Tcp option altchkreq
- Tcp auto clamping
- Tcp syn urg
- Tcp syn rst
- Tcp syn psh
- Tcp option other
- Tcp option con timeout
- Tcp option altchkdata
- Tcpe ecn
- Tcp urg
- Tcp syn fin
- Tcp sequence numbers
- Tcp reserved field
- Tcp null
- Tcp fin urg
- Allow tcp reopen
- Silently drop state icmperrors
- Icmp sends per sec limit
- Icmp level settings
- Log state violations
- Log reverse opens
- Log open fails
- Log connections
- Connection replace
- State settings
- Max connections
- Log connection usage
- Dynamic max connections
- Udp idle lifetime
- Udp bidirectional keep alive
- Tcp syn idle lifetime
- Tcp idle lifetime
- Tcp fin idle lifetime
- Ping idle lifetime
- Igmp idle lifetime
- Connection timeout settings
- Other idle lifetime
- Max esp length
- Max ah length
- Length limit settings
- Max udp length
- Max tcp length
- Max icmp length
- Max gre length
- Max skip length
- Max other length
- Max ospf length
- Max l2tp length
- Max ipsec ipcomp length
- Max ipip fwz length
- Log oversized packets
- Pseudo reass max concurrent
- Illegal fragments
- Fragmentation settings
- Duplicated fragment data
- Dropped fragments
- Failed fragment reassembly
- Duplicate fragments
- Reassembly timeout
- Reassembly done limit
- Minimum fragment length
- Max reassembly time limit
- Fragmented icmp
- Reassembly illegal limit
- Max size
- Max concurrent
- Local fragment reassembly settings
- Large buffers
- Max pipe users
- Max memory
- Max connections
- Flood reboot time
- Watchdog time
- Udp source port 0
- Port 0
- Miscellaneous settings
- Tip a registration guide can be downloaded
- Subscription renewal
- Pre empting database updates
- Overview
- Monitoring database updates
- Important renew in good time
- Database console commands
- Appendix a subscribing to updates
- Querying update status
- Querying server status
- Note updating the database causes a pause in processing
- Deleting local databases
- For idp scanning the following signature groups are available for selection these groups are only available for the d link advanced idp service there is a version of each group under the three types of ids ips and policy for further information see section 6 intrusion detection and prevention
- Appendix b idp signature groups
- Appendix b idp signature groups
- Appendix b idp signature groups
- Appendix b idp signature groups
- The smtp alg
- The pop3 alg
- The http alg
- The ftp alg
- The algs listed above also offer the option to explicitly allow or block certain filetypes as downloads from a list of types that list is the same one found in this appendix
- Some netdefendos application layer gateways algs have the optional ability to verify that the contents of a downloaded file matches the type that the filetype in the filename indicates the filetypes for which mime verification can be done are listed in this appendix and the algs to which this applies are
- For a more detailed description of mime verification and the filetype block allow feature see section 6 the http alg
- Appendix c verified mime filetypes
- Appendix c verified mime filetypes
- Appendix c verified mime filetypes
- Appendix c verified mime filetypes
- Overview
- Layer functions
- Figure d the 7 layers of the osi model
- Appendix d the osi framework
- Alphabetical index
Похожие устройства
-
D-Link DFL-2500Инструкция по применению -
D-Link DFL-860EИнструкция пользователя
-
D-Link DFL-260EИнструкция пользователя
-
D-Link DI-1750Инструкция 13 -
D-Link DI-1750Инструкция 12 -
D-Link DI-1750Инструкция 11 -
D-Link DI-1750Инструкция 10 -
D-Link DI-1750Инструкция 9 -
D-Link DI-1750Инструкция 8 -
D-Link DI-1750Инструкция 7 -
D-Link DI-1750Инструкция 6 -
D-Link DI-1750Инструкция 5