D-Link DFL-1000 [36/168] Arrange policies in the policy list so that they have the results that you expect arranging policies in a policy list is described in configuring policy lists

In v2 6 you configure alert email from logging reporting you can configure the dfl 1000 npg to send alert email to report firewall or vpn events or violations see configuring alert email 14

Load balancing to balance the amount of traffic routed to each wan port for more information see configuring the dfl 1000 npg for multiple internet connections 14

Local dfl 1000 user database 14

Logging 14

Messages can be cleared from event log saved to memory 14

Multiple wan support 14

New cli commands 14

Redundancy using link detection if one wan connection fails the dfl 1000 npg re routes all traffic to and from the other wan connection 14

The command line interface has been extensively changed for v2 6 command syntax has been changed to be easier to use and more effective many command names and keywords have changed and cli help has been improved 14

The following logging features are new in v2 6 see logging and reporting 14

You can add user names to the local dfl 1000 user database when you add a user name you can specify a password or that the user can be authenticated using a radius server you can then add user names to user groups and make these user groups available for authenticating with firewall policies dialup vpn pptp vpn and l2tp vpn see users and authentication 14

You can configure the dfl 1000 npg to have multiple connections to the internet using routing and policies the dfl 1000 multiple wan feature supports 14

About this document 15

Customer service and technical support 15

For more information 15

Getting started 17

Package contents 17

Mounting 18

Powering on 18

A computer with an ethernet connection 19

A crossover cable or an ethernet hub and two ethernet cables to connect to the web based manager 19

Connecting to the web based manager 19

Initial configuration 19

Internet explorer version 4 or higher 19

Set the ip address of the computer with an ethernet connection to the static ip address 192 68 and a netmask of 255 55 55 19

The web based manager is the primary tool for installing and configuring your dfl 1000 npg configuration changes made with the web based manager are effective immediately without the need to reset the firewall or interrupt service to connect to the web based manager you need 19

When the dfl 1000 npg is first powered on it is running in nat route mode and has the basic configuration listed in dfl 1000 npg initial power on settings 19

Connecting to the command line interface cli 20

Next steps 21

Advanced nat route mode settings 22

Completing the configuration 22

Configuring your networks 22

Connecting to your networks 22

Nat route mode installation 22

Preparing to configure nat route mode 22

This chapter describes how to install your dfl 1000 npg in nat route mode if you want to install the dfl 1000 npg in transparent mode see transparent mode installation this chapter includes 22

Use advanced dfl 1000 nat route mode settings to gather the information that you need to customize advanced dfl 1000 nat route mode settings 22

Use nat route mode settings to gather the information that you need to customize nat route mode settings 22

Using the command line interface 22

Using the setup wizard 22

Confirm your configuration settings and then select finish and close 23

Dmz interface 23

From the web based manager you can use the setup wizard to create the initial configuration of your dfl 1000 npg to connect to the web based manager see connecting to the web based manager 23

If you changed the ip address of the internal interface using the setup wizard you must reconnect to the web based manager using a new ip address browse to https followed by the new ip address of the internal interface otherwise you can reconnect to the web based manager by browsing to https 192 68 9 you have now completed the initial configuration of your dfl 1000 npg and you can proceed to connect the dfl 1000 npg to your network using the information in connecting to your networks 23

Reconnecting to the web based manager 23

Select easy setup wizard the middle button in upper right corner of the web based manager 23

Starting the setup wizard 23

Use dmz interface optional to record the ip address and netmask of the dfl 1000 dmz interface if you are configuring it during installation 23

Use the information that you gathered in nat route mode settings to fill in the wizard fields select the next button to step through the wizard pages 23

Using the setup wizard 23

Configuring nat route mode ip addresses 24

Configuring the dfl 1000 npg to run in nat route mode 24

Using the command line interface 24

Configuring your networks 25

Connecting to your networks 25

Completing the configuration 26

Configuring the dmz interface 26

Setting the date and time 26

Changing to transparent mode 27

Preparing to configure transparent mode 27

Transparent mode installation 27

Using the setup wizard 27

Changing to transparent mode 28

Configuring the transparent mode management ip address 28

Reconnecting to the web based manager 28

Starting the setup wizard 28

Using the command line interface 28

Configure the transparent mode default gateway 29

Connecting to your networks 29

Setting the date and time 29

Firewall configuration 31

Adding nat route mode policies 32

Changing to nat route mode 32

Changing to transparent mode 32

Nat route mode 32

Nat route mode and transparent mode 32

Transparent mode 32

Configure the policy 33

On a policy in the list to add the new policy above a specific policy 33

You can also select insert policy before 33

Arrange policies in the policy list so that they have the results that you expect arranging policies in a policy list is described in configuring policy lists 34

Select ok to add the policy 34

Add transparent mode policies to control the network traffic that is allowed to pass through the dfl 1000 npg when you are running the firewall in transparent mode 35

Adding transparent mode policies 35

Configure the policy 35

On a policy in the list to add the new policy above a specific policy 35

Policy 35

Select a policy list tab 35

Select new to add a new policy you can also select insert policy before 35

Arrange policies in the policy list so that they have the results that you expect arranging policies in a policy list is described in configuring policy lists 36

Select ok to add the policy the policy is added to the policy list 36

Configuring policy lists 37

Policy matching in detail 37

Addresses 38

Changing the order of policies in a policy list 38

Disabling a policy 38

Enabling a policy 38

Enabling and disabling policies 38

Adding addresses 39

Deleting addresses 40

Editing addresses 40

Organizing addresses into address groups 40

Grouping services 41

Predefined services 41

Providing access to custom services 41

Services 41

The dfl 1000 predefined firewall services are listed in dfl 1000 predefined services you can add these services to any policy 41

Use services to control the types of communication accepted or denied by the firewall you can add any of the predefined services to a policy you can also create your own custom services and add services to service groups this section describes 41

Add a custom service if you need to create a policy for a service that is not in the predefined service list 43

Custom 43

Enter a group name to identify the group this name appears in the service list when you add a policy and cannot be the same as a predefined service name the name can contain numbers 0 9 uppercase and lowercase letters a z a z and the special characters and _ other special characters and spaces are not allowed 43

Enter a name for the service this name appears in the service list used when you add a policy the name can contain numbers 0 9 uppercase and lowercase letters a z a z and the special characters and _ other special characters and spaces are not allowed 43

Grouping services 43

If the service has more than one port range select add to specify additional protocols and port ranges if you mistakenly add too many port range rows select delete 43

Providing access to custom services 43

Select new 43

Select ok to add the custom service you can now add this custom service to a policy 43

Select the protocol either tcp or udp used by the service 43

Specify a source and destination port number range for the service by entering the low and high port numbers if the service uses one port number enter this number in both the low and high fields 43

To make it easier to add policies you can create groups of services and then add one policy to provide access to or block access for all the services in the group a service group can contain predefined services and custom services in any combination you cannot add service groups to another service group 43

To remove each extra row 43

Creating one time schedules 44

Schedules 44

Creating recurring schedules 45

Adding a schedule to a policy 46

Adding static nat virtual ips 47

Adding static nat virtual ipssee adding policies with virtual ips 47

Adding static nat virtual ipssee adding port forwarding virtual ips 47

Adding static nat virtual ipssee adding static nat virtual ips 47

Dmz firewall policy and set destination to the virtual ip you can create two types of virtual ips 47

This section describes 47

Virtual ip 47

Virtual ips 47

Adding port forwarding virtual ips 49

Adding policies with virtual ips 50

Ip pools 51

Configuring ip mac binding for packets going through the firewall 52

Ip mac binding 52

Adding ip mac addresses 53

Configuring ip mac binding for packets going to the firewall 53

Viewing the dynamic ip mac list 53

Enabling ip mac binding 54

Example policies 55

Nat policy for public access to a server 55

Routing policy for access to a server from the internal network 55

Transparent mode policy for public access to a server 56

Denying connections from the internet 57

Denying connections to the internet 57

Using a schedule to deny access 57

Adding policies that accept connections 58

Requiring authentication to connect to the internet 59

Adding user names and configuring authentication 61

Setting authentication timeout 61

Users and authentication 61

Adding user names and configuring authentication 62

Deleting user names from the internal database 62

Adding radius servers 63

Configuring radius support 63

Deleting radius servers 63

Adding user groups 64

Configuring user groups 64

Deleting user groups 65

Ipsec vpns 66

Configuring autoike key ipsec vpn 67

Interoperability with ipsec vpn products 67

Configuring dialup vpn 68

Configuring manual key ipsec vpn 68

Configuring a vpn concentrator for hub and spoke vpn 69

Configuring the vpn concentrator 69

Add a remote gateway if you are adding autoike key tunnels see adding a remote gateway 70

Add additional encrypt policies between the member vpns use the following configuration 70

Add an autoike key vpn tunnel and include the remote gateway added in step 1 see adding an autoike key vpn tunnel or add a manual key vpn tunnel see adding a manual key vpn tunnel 70

Add one encrypt policy between the member vpn and the vpn concentrator use the following configuration 70

Configuring the member vpns 70

For each member vpn you must create a vpn tunnel to the vpn concentrator network this tunnel can be an autoike key or manual key tunnel you must create an encrypt policy that allows inbound and outbound vpn connections between the member vpn and the concentrator you must create additional encrypt policies that allow inbound and outbound vpn connections between each of the member vpns the policy between the member vpn and the concentrator must be arranged in the policy list above the policies between member vpns each encrypt policy must include the same tunnel name to configure each member vpn 70

See adding an encrypt policy 70

Adding a remote gateway 71

Configuring ipsec redundancy 71

Select ok to save the remote gateway 72

About dialup vpn authentication 73

A username and password in the user group added to the dialup server remote gateway in this configuration the clients pre shared key must be formatted with a between the user name and password username password 74

Aggressive mode with no user group 74

In this configuration the server and the clients use aggressive mode for key exchange a user group has not been selected in the server dialup remote gateway clients authenticate with the server using their authentication keys 74

In this configuration the server and the clients use main mode for key exchange a user group has been selected in the server dialup remote gateway clients authenticate with the server using their authentication keys the client authentication key can be one of the following 74

In this configuration the server and the clients use main mode for key exchange a user group has not been added to the server dialup remote gateway clients authenticate with the server using their authentication keys 74

Main mode with a user group selected 74

Main mode with no user group selected 74

The same as the server authentication key 74

About dh groups 75

About nat traversal 75

About the p1 proposal 75

Aggressive mode with a user group selected 75

Autoike key ipsec vpns use a two phase process for creating a vpn tunnel during the first phase p1 the vpn gateways at each end of the tunnel negotiate to select a common algorithm for encryption and another one for authentication when you configure the remote gateway p1 proposal you are selecting the algorithms that the dfl 1000 npg proposes during phase 1 negotiation you can select up to three different encryption and authentication algorithm combinations choosing more combinations might make it easier for p1 negotiation but you can restrict the choice to one if required for negotiation to be successful both ends of the vpn tunnel must have at least one encryption algorithm and one authentication algorithm in common 75

In this configuration the server and the clients use aggressive mode for key exchange a user group is selected in the server dialup remote gateway the format of the authentication key depends on the information in the local id field 75

Nat network address translation converts private ip addresses into routable public ip addresses the dfl 1000 npg uses napt network address port translation in which both ip addresses and ports are mapped mapping both components allows multiple private ip addresses to use a single public ip address because a nat device modifies the original ip address of an ipsec packet the packet fails an integrity check this failure means that ipsec vpn does not work with nat devices nat traversal solves this problem by encapsulating the ipsec packet within a udp packet encapsulating the ipsec packet allows nat to process the packet without changing the original ipsec packet 75

Select 3des to propose to encrypt packets using triple des encryption 75

Select des to propose to encrypt packets using des encryption 75

Select md5 to propose to use md5 authentication 75

Select sha1 to propose to use sha1 authentication 75

The diffie hellman dh algorithm creates a shared secret key that can be created at both ends of the vpn tunnel without communicating the key across the internet you can select from dh group 1 2 and 5 dh group 5 produces the most secure shared secret key and dh group 1 produces the least secure key however dh group 1 is faster that dh group 5 75

Add an autoike key tunnel to specify the parameters used to create and maintain a vpn tunnel that has been started by a remote gateway configuration to add an autoike key vpn tunnel 76

Adding an autoike key vpn tunnel 76

Autoike key 76

Configure the autoike key vpn tunnel 76

Select new to add a new autoike key vpn tunnel 76

Select ok to save the autoike key vpn tunnel 76

About perfect forward secrecy pfs 77

About replay detection 77

About the p2 proposal 77

Adding a manual key vpn tunnel 78

Configure a manual key tunnel to create an ipsec vpn tunnel between the dfl 1000 npg and a remote ipsec vpn client or gateway that is also using manual key a manual key vpn tunnel consists of a name for the tunnel the ip address of the vpn gateway or client at the opposite end of the tunnel and the encryption algorithm to use for the tunnel depending on the encryption algorithm you must also specify the encryption keys and optionally the authentication keys used by the tunnel because the keys are created when you configure the tunnel no negotiation is required for the vpn tunnel to start however the vpn gateway or client that connects to this tunnel must use the same encryption algorithm and must have the same encryption and authentication keys to create a manual key vpn tunnel 78

Configure the vpn tunnel 78

If you do not enable pfs the vpn tunnel creates all phase 2 keys from a key created during phase 1 this method of creating keys is less processor intensive but also less secure if an unauthorized party gains access to the key created during phase 1 all the phase 2 encryption keys can be compromised 78

Manual key 78

Select new to add a new manual key vpn tunnel 78

Select ok to save the manual key vpn tunnel 78

Adding a vpn concentrator 79

Adding an encrypt policy 80

Viewing vpn tunnel status 82

Testing a vpn 83

Viewing dialup vpn connection status 83

Autoike key vpn between two networks 84

Ipsec vpn configuration examples 84

Configuring the remote gateway for a remote network 85

Use the following procedure to configure the remote gateway for the example vpn in example vpn between two internal networks example remote gateway configuration shows the information required to configure the remote gateway 85

Autoike key 86

Configuring the autoike key tunnel for a remote network 86

On the branch office dfl 1000 configure the autoike key tunnel using the branch office information in example autoike key tunnel configuration 86

On the branch office dfl 1000 npg configure the remote gateway using the branch office information in example remote gateway configuration 86

On the main office dfl 1000 configure the autoike key tunnel using the main office information in example autoike key tunnel configuration 86

On the main office dfl 1000 npg configure the remote gateway using the main office information in example remote gateway configuration 86

Remote gateway 86

Select new to add a remote gateway 86

Select new to add an autoike key tunnel 86

Select ok to save the autoike key tunnel 86

Select ok to save the remote gateway 86

To configure the autoike key tunnel for the main office and branch office vpn gateways 86

To configure the remote gateways for the main office and branch office 86

Use the following procedure to configure the autoike key tunnel for the example vpn in example vpn between two internal networks example autoike key tunnel configuration shows the information required to configure the tunnel 86

Adding an encrypt policy for a network to network vpn 87

Adding source and destination addresses for a network to network vpn 87

Internal 87

On the branch office dfl 1000 npg enter the address name ip address and netmask using the branch office source address information in ipsec vpn source and destination addresses 87

On the main office dfl 1000 npg enter the address name ip address and netmask using the main office source address information in ipsec vpn source and destination addresses 87

Repeat these steps this time selecting the external address list to add the main office and branch office destination addresses 87

Select new to add an address 87

Select ok to save the source address 87

To add the main office and branch office source addresses 87

Use the following procedure to add an encrypt policy that allows ipsec vpn traffic through the firewall the encrypt policy associates the tunnel with the source and destination address example encrypt policies show main office and branch office encrypt policies for the vpn in example vpn between two internal networks 87

Use the following procedures to add the network addresses to the autoike key tunnel shown in example vpn between two internal networks you must add a source and a destination address to both gateways ipsec vpn source and destination addresses shows the information required to add the source and destination addresses to the autoike key tunnel 87

Autoike key vpn for remote clients 88

Adding an encrypt policy for a remote client 89

Adding source and destination addresses for a remote client vpn 89

Configure the remote gateway using the information in example remote gateway configuration 89

Configuring the autoike key tunnel for a remote client 89

Configuring the ipsec vpn client 89

Configuring the remote gateway for remote clients 89

Example autoike key tunnel configuration shows the information required to configure the autoike key tunnel for the example vpn in example vpn between a main office internal network and a remote client 89

Example remote gateway configuration shows the information required to configure the remote gateway for the example vpn in example vpn between a main office internal network and a remote client 89

Remote gateway 89

Select new to add a remote gateway 89

Select ok to save the remote gateway 89

To configure the remote gateway 89

Adding a source address for the internal network 90

Adding source and destination addresses for a remote client vpn 90

Autoike key 90

Configure the tunnel using the information in example autoike key tunnel configuration 90

Enter the address name ip address and netmask using the source address information in example source and destination addresses for a client with a static ip address 90

Internal 90

Repeat these steps this time selecting the external address list to add destination address 90

Select new to add an address 90

Select new to add an autoike key tunnel 90

Select ok to save the autoike key tunnel 90

Select ok to save the source address 90

To configure the vpn tunnel 90

Use the following procedures to add the example source and destination addresses 90

Use the following procedures to add the network and client addresses to the autoike key tunnel the source address is the ip address of the network behind the local vpn gateway and the destination address is the ip address of the remote vpn client 90

Adding an encrypt policy for a remote client 91

Configuring the ipsec vpn client 91

Dialup vpn 92

Adding a dialup remote gateway 93

Adding autoike key tunnels for dialup vpn 93

Adding source and destination addresses for dialup vpn 93

Adding encrypt policies for dialup vpn 94

Configuring remote ipsec vpn clients for dialup vpn 94

Configuring remote ipsec vpn gateways for dialup vpn 94

Manual key vpn between two networks 94

Adding an encrypt policy 95

Adding source and destination addresses 95

Configure the manual key tunnel using the main office information in example manual key tunnel configuration 95

Configuring the manual key vpn tunnel 95

Example manual key tunnel configuration shows the information required to configure the manual key tunnel for the vpn in example vpn between two internal networks 95

Manual key 95

Repeat steps select new to add a manual key tunnel to select ok to save the manual key tunnel on the appropriate dfl 1000 npg using the branch office information in example manual key tunnel configuration 95

Select new to add a manual key tunnel 95

Select ok to save the manual key tunnel 95

To configure the manual key tunnel on both vpn gateways 95

Use the procedure adding an encrypt policy for a network to network vpn 95

Use the procedure adding source and destination addresses for a network to network vpn 95

Adding an encrypt policy 96

Adding internal and external addresses 96

Configure the manual key tunnel using the dfl 1000 vpn gateway information in example dfl 1000 vpn gateway and client manual key tunnels 96

Configuring the ipsec vpn client 96

Configuring the manual key tunnel 96

Example dfl 1000 vpn gateway and client manual key tunnels shows the information required to configure the manual key tunnel for the example vpn in example vpn between a main office internal network and a remote client 96

In this example you configure a manual key vpn between an internal network and a remote vpn client example vpn between a main office internal network and a remote client shows this configuration use the following procedures to configure the manual key vpn 96

Manual key 96

Manual key vpn for remote clients 96

Select new to add a manual key tunnel 96

To configure the manual key tunnel on the dfl 1000 vpn gateway 96

Adding an encrypt policy 97

Adding internal and external addresses 97

Configuring the ipsec vpn client 97

Hub and spoke vpn vpn concentrator 97

Configuring the hub 98

Configuring the spokes 98

Adding encrypt policies 99

Adding source and destination addresses 99

Configure a separate autoike key tunnel for the hub and for each spoke these tunnels will use the remote gateways that you created in the procedure configuring the remote gateways use the procedure configuring the autoike key tunnel for a remote client use the information in example autoike key tunnel configuration to configure the autoike key tunnels 99

Configuring the autoike key tunnels 99

Configuring the remote gateways 99

Use the following procedures to create branch 1 and branch 2 99

Use the procedure configuring the remote gateway for remote clients use the information in example remote gateway configuration to configure remote gateways for the main office branch 1 and branch 2 99

Add source and destination addresses for the main office branch 1 and branch 2 use the procedure adding source and destination addresses for a remote client vpn use the information in example ipsec source and destination address information to add the source and destination addresses you need to add the addresses for each location individually 100

Adding source and destination addresses 100

Concentrator 100

Configuring the vpn concentrator 100

Enter the name of the new vpn concentrator in the concentrator name field 100

For the main office the hub create the vpn concentrator and add the appropriate members to it add all the tunnels that are part of the same hub and spoke configuration to the same vpn concentrator if you add a spoke to the configuration after you create the vpn concentrator you can add the new vpn tunnel to the vpn concentrator by selecting the concentrator name while you are configuring the tunnel example vpn concentrator configuration shows the information required to configure the vpn concentrator 100

Select branch1_vpn in the available tunnels list and select the right arrow the tunnel moves to the members list 100

Select branch2_vpn in the available tunnels list and select the right arrow the tunnel moves to the members list 100

Select new to add a vpn concentrator 100

Select ok to add the vpn concentrator 100

To add a vpn concentrator 100

Adding encrypt policies 101

Use the information in tables below to add the encrypt policies use the procedure adding an encrypt policy for a remote client the main office requires one policy to each branch office each branch office requires two policies on the same tunnel at the branch offices the policy for the hub must be arranged in the policy list above the policies for the spokes 101

Pptp and l2tp vpns 103

Pptp vpn configuration 103

Configuring the dfl 1000 npg as a pptp gateway 104

Configuring a windows 98 client for pptp 105

Installing pptp support 105

Configuring a pptp dialup connection 106

Configuring a windows 2000 client for pptp 106

Connecting to the pptp vpn 106

Configuring a pptp dialup connection 107

Configuring a windows xp client for pptp 107

Configuring the vpn connection 107

Connecting to the pptp vpn 107

Connecting to the pptp vpn 108

L2tp vpn configuration 108

Configuring the dfl 1000 npg as an l2tp gateway 109

Configuring a windows 2000 client for l2tp 110

Configuring an l2tp dialup connection 110

Disabling ipsec 110

Configuring a windows xp client for l2tp 111

Configuring an l2tp vpn dialup connection 111

Configuring the vpn connection 111

Connecting to the l2tp vpn 111

Connecting to the l2tp vpn 112

Disabling ipsec 112

Blocking web pages that contain unwanted content 113

Enabling web content filtering 113

Web content filtering 113

Adding words and phrases to the banned word list 114

Changing the content block message 114

Enabling the banned word list 114

Backing up the banned word list 115

Clearing the banned word list 115

Temporarily disabling individual words in the banned word list 115

Temporarily disabling the banned word list 115

Blocking access to urls 116

Changing the url block message 116

Enabling the url block list 116

Restoring the banned word list 116

Adding urls to the url block list 117

Clearing the url block list 118

Downloading the url block list 118

Temporarily disabling individual url blocking 118

Temporarily disabling the url block list 118

Uploading a url block list 118

Exempting urls from content or url blocking 119

Removing scripts from web pages 119

Adding urls to the exempt url list 120

Clearing the exempt url list 121

Downloading the exempt url list 121

Temporarily disabling entries in the exempt url list 121

Uploading an exempt url list 121

Configuring logging 123

Logging and reporting 123

Recording logs on a netiq webtrends server 123

Recording logs on a remote computer 123

Recording logs on the dfl 1000 hard disk 124

Logging event log to memory 125

Selecting what to log 125

Searching event log 126

Viewing event log 126

Viewing event log saved to memory 126

Clearing event log messages 127

Viewing and maintaining logs saved to the hard disk 127

Viewing logs 127

Downloading a log file to the management computer 128

Searching logs 128

Configuring alert email 129

Deleting a saved log file 129

Deleting all messages in an active log 129

Enabling alert emails 130

Log message formats 130

Testing alert emails 130

Traffic log message format 130

Content filtering messages 131

Event log message format 131

Management messages 131

Traffic log example messages 131

Vpn tunnel monitor messages 131

Administration 132

System status 132

Upgrading the dfl 1000 firmware 133

Upgrading the firmware 133

Upgrading the firmware from a tftp server using the cli 133

Upgrading the firmware using the web based manager 133

Backing up system settings 135

Displaying the dfl 1000 npg serial number 135

Restoring system settings 135

Restoring system settings to factory defaults 135

Changing to nat route mode 136

Changing to transparent mode 136

Restarting the dfl 1000 npg 136

Shutting down the dfl 1000 npg 136

System status monitor 137

Configuring the internal interface 138

Network configuration 138

Configuring the external interface 139

Configuring the external interface with a static ip address 139

Configuring the external interface for dhcp 140

Configuring the external interface for pppoe 140

Changing the external interface mtu size to improve network performance 141

Controlling management access to the external interface 141

Configuring the dmz interface 142

Configuring the management interface transparent mode 142

Adding routing gateways 143

Configuring routing 143

Setting dns server addresses 143

Adding a default route 144

Adding routes to the routing table 145

Configuring the routing table 145

Adding routes transparent mode 146

Configuring the dfl 1000 npg for multiple internet connections 146

Enabling rip server support 146

Example configuration 147

For example your main connection to the internet could be a t1 or broadband connection to the external interface to make sure that problems with this internet connection do not affect your access to the internet you could add a second t1 or broadband connection perhaps with a different isp you can connect this second internet connection to the dmz interface you can then configure routing so that incoming and outgoing traffic is automatically routed to the wan connection that is running you can also configure routing to balance the traffic between both connections if both are running 147

This example configuration consists of a t1 wan connection to the external interface and a broadband wan connection to the dmz interface the wan networks have the following ip addresses 147

Adding a route for redundancy 148

Adding routes for load balancing 148

Configuring routing for multiple internet connections 148

Providing dhcp services to your internal network 148

Viewing the dynamic ip list 149

Setting system date and time 150

System configuration 150

Changing web based manager options 151

Adding and editing administrator accounts 152

Adding new administrator accounts 152

Editing administrator accounts 152

Configuring snmp 153

Configuring the dfl 1000 npg for snmp connections 153

Dfl 1000 mibs 154

Select apply 154

The dfl 1000 agent supports the standard internet mib ii system group rfc 1213 for reporting basic system information the agent also supports a dfl 1000 mib that reports firewall and vpn information example dfl 1000 mib fields shows the system and dfl 1000 mib fields you must compile the following mibs in your snmp manager to communicate with the dfl 1000 agent 154

Dfl 1000 traps 155

The dfl 1000 agent can send traps to up to three snmp trap receivers on your network that are configured to receive traps from the dfl 1000 npg the dfl 1000 agent sends traps in response to the events listed in snmp traps 155

You can download copies of these mib files from d link 155

Glossary 156

Firewall policies 159

General administration 159

Network configuration 159

Troubleshooting faqs 159

Schedules 160

Web content filtering 160

Logging 161

Dfl 1000 user manual 162 162

Offices 162

Technical support 162

Dfl 1000 user manual 163 163

Registration card 163

Limited warranty 165

Register the d link dfl 500 office firewall online at http www dlink com sales reg 168

Registration 168

D-Link DFL-1000 [36/168] Arrange policies in the policy list so that they have the results that you expect arranging policies in a policy list is described in configuring policy lists

Содержание

Похожие устройства