D-Link DFL- 860 manuals

D link DFL- 860 User Manual (355 pages)

Brand: D-link | Category: Hardware firewalls | Size: 7.47 MB |

English

Table of contents

User Manual

1

NetDefendOS version 2.20

2

Copyright Notice

3

Disclaimer

3

Limitations of Liability

3

Table of Contents

4

List of Figures

9

List of Examples

10

Intended Audience

12

Examples

12

Important

13

Chapter 1. Product Overview

14

1.2. NetDefendOS Architecture

16

1.2.3. Basic Packet Flow

17

2.1.1. Overview

23

Management Interfaces

23

Creating New Accounts

24

2.1.3. The CLI

24

Serial Console CLI Access

24

SSH (Secure Shell) CLI Access

25

Logging on to the CLI

25

Changing the CLI Prompt

25

Logging off from the CLI

26

2.1.4. The WebUI

26

Multi-language Support

27

The Web Browser Interface

27

Interface Layout

27

Listing Modified Objects

32

Committing IPsec Changes

33

2.2.1. Overview

35

2.2.2. Event Messages

35

2.2.3.2. SNMP Traps

37

2.3.1. Overview

39

START Message Parameters

39

STOP Message Parameters

40

2.3.9. Limitations with NAT

42

2.4. Monitoring

43

Remote Access Encryption

44

Preventing SNMP Overload

44

2.5. Maintenance

45

Web Interface

46

Chapter 3. Fundamentals

48

3.1.3. Ethernet Addresses

50

3.1.4. Address Groups

51

3.2. Services

52

Max Sessions

54

Using All Services

54

3.2.3. ICMP Services

55

3.3.1. Overview

57

The any and core interfaces

58

3.3.2. Ethernet

58

Ethernet Interface Names

58

Ethernet IP Addresses

59

The Default Gateway

59

3.3.3. VLAN

60

3.3.4. PPPoE

61

The PPPoE interface

62

IP address information

62

User authentication

62

Dial-on-demand

62

3.3.5. GRE Tunnels

63

GRE and the IP Rule Set

64

An Example GRE Scenario

64

3.3.6. Interface Groups

66

3. Click OK

67

3.4. ARP

68

Flushing the ARP Cache

69

Size of the ARP Cache

69

Static ARP Entries

70

Published ARP Entries

70

3.4.5. Advanced ARP Settings

71

Sender IP 0.0.0.0

72

Matching Ethernet Addresses

72

3.5.1. Security Policies

73

Policy Characteristics

73

IP Rules

74

3.5.2. IP Rule Evaluation

74

Stateful Inspection

74

The First Matching Principle

74

Non-matching Traffic

74

3.5.3. IP Rule Actions

75

Bi-directional Connections

75

Using Reject

76

3.6. Schedules

77

3.7.1. Overview

79

Certificates with VPN Tunnels

79

Certificate Components

79

Certification Authorities

79

Validity Time

79

Certificate Revocation Lists

80

Trusting Certificates

80

Identification Lists

80

Reusing Root Certificates

80

3.7.2. X.509 Certificates in

81

NetDefendOS

81

3.8. Setting Date and Time

82

3.8.2. Time Servers

83

Maximum Time Adjustment

85

Synchronization Intervals

85

D-Link Time Servers

86

3.9. DNS Lookup

87

4.2. Static Routing

90

4.2.2. Static Routing

91

The Route Lookup Mechanism

91

NetDefendOS Route Notation

91

Displaying the Routing Table

92

Core Routes

93

4.2.3. Route Failover

94

Setting the Route Metric

95

Multiple Failover Routes

95

Failover Processing

95

Re-enabling Routes

95

4.2.4. Proxy ARP

96

4.3.1. Overview

98

4.3.5. The Ordering parameter

99

4.4. Dynamic Routing

103

4.4.2. OSPF

104

Overview

104

OSPF Areas

104

The Designated Router

105

Neighbors

105

Aggregates

105

Virtual Links

106

A Partitioned Backbone

106

4.4.3. Dynamic Routing Policy

107

4.5.1. Overview

110

SAT Multiplex Rule

112

Chapter 4. Routing

112

4.5.3. IGMP Configuration

114

Figure 4.7. Multicast Proxy

115

Advanced IGMP Settings

118

4.6. Transparent Mode

119

Scenario 1

120

Scenario 2

122

Chapter 5. DHCP Services

127

5.2. DHCP Servers

128

5.3. Static DHCP Assignment

130

5.4. DHCP Relaying

131

Basic IP Pool Options

132

Advanced IP Pool Options

132

Using Prefetched Leases

133

6.1.1. Introduction

135

The Default Access Rule

135

6.1.2. IP spoofing

135

6.1.3. Access Rule Settings

136

6.2.1. Overview

138

Deploying an ALG

138

Maximum Connection Sessions

138

ALGs and Syn Flood Protection

139

6.2.2. HTTP

139

Deploying an HTTP ALG

140

6.2.3. FTP

140

FTP Connections

140

Connection Modes

140

FTP Security Issues

140

The Solution

141

6.2.4. TFTP

145

General TFTP Options

146

TFTP Request Options

146

Allowing Request Timeouts

146

6.2.5. SMTP

146

SMTP ALG Options

146

6.2.5.1. DNSBL SPAM Filtering

147

Tagging SPAM Emails

148

Dropping SPAM Email

149

Verifying the Sender Email

149

Network Setup

150

Setup Summary

150

The dnsbl CLI Command

150

6.2.6. POP3

151

POP3 ALG Options

151

Anti-Virus Options

152

6.2.7. SIP

152

SIP Components

153

SIP Media-related Protocols

153

SIP Usage Scenarios

153

SIP Configuration Options

153

SIP Setup Summary

154

Handling Data Traffic

155

6.2.8. H.323

155

H.323 Components

155

H.323 Protocols

156

H.323 ALG features

156

H.323 ALG Configuration

157

6.3.1. Overview

169

Wildcarding

170

URL Processing Flow

172

Activation

173

Audit Mode

174

Allowing Override

175

Category 1: Adult Content

176

Category 2: News

177

Category 3: Job Search

177

Category 4: Gambling

177

Category 5: Travel / Tourism

177

Category 6: Shopping

177

Category 7: Entertainment

178

Category 8: Chatrooms

178

Category 9: Dating Sites

178

Category 10: Game Sites

178

Category 11: Investment Sites

178

Category 12: E-Banking

179

Category 15: Politics

179

Category 16: Sports

179

Category 32: Non-Managed

182

Category 29: Computing/IT

182

Category 31: Spam

182

6.4. Anti-Virus Scanning

183

6.4.4. The Signature Database

184

6.4.6. Anti-Virus Options

184

1. General options

185

3. Scan Exclude Option

185

4. Compression Ratio Limit

185

Verifying the MIME Type

185

6.5.1. Overview

188

IDP, IPS and IDS

189

6.5.3. IDP Rules

190

Rule Components

190

Initial Packet Processing

190

Checking Dropped Packets

190

6.5.5. IDP Pattern Matching

192

6.5.6. IDP Signature Groups

192

6.5.7. IDP Actions

194

6.6.1. Overview

198

6.6.2. DoS Attack Mechanisms

198

Boink and Nestea

199

6.6.6. The WinNuke attack

199

6.6.8. TCP SYN Flood Attacks

201

6.6.9. The Jolt2 Attack

201

Whitelisting

202

Protocols Handled by NAT

206

Types of NAT Pools

207

Stateful NAT Pools

207

Stateless NAT Pools

208

Fixed NAT Pools

208

IP Pool Usage

208

Proxy ARP Usage

208

Using NAT Pools

208

Address (1:1)

211

7.3.4. Port Translation

216

7.3.7. SAT and FwdFast Rules

217

Proving Identity

220

Using Username/Passwords

220

8.2. Authentication Setup

221

RADIUS Security

222

8.2.4. Authentication Rules

222

Connection Timeouts

222

Multiple Logins

222

8.2.6. HTTP Authentication

223

Agent Options

224

Setting Up IP Rules

224

Forcing Users to a Login Page

224

Chapter 9. VPN

229

9.1.4. Key Distribution

230

9.2. VPN Quickstart Guide

231

Interface Network Gateway

232

Configuring the IPsec Client

234

9.2.6. PPTP Roaming Clients

236

9.2.7. VPN Troubleshooting

237

The ipsecstat console command

238

The ikesnoop console command

239

9.3.1. Overview

240

IKE Negotiation

241

IKE and IPsec Lifetimes

241

IKE Proposals

241

IKE Parameters

242

9.3.3. IKE Authentication

245

Manual Keying

245

Certificate Disadvantages

247

AH (Authentication Header)

247

9.3.5. NAT Traversal

248

NAT Traversal Configuration

248

9.3.6. Proposal Lists

249

9.3.7. Pre-shared Keys

250

9.3.8. Identification Lists

251

9.4.1. Overview

253

9.4.3. Roaming Clients

253

9.4.3.4. Using Config Mode

257

IP Validation

258

9.5. PPTP/L2TP

260

9.5.2. L2TP

261

9.5.2. L2TP Chapter 9. VPN

262

10.1. Traffic Shaping

267

Pipe Rules

268

10.1.6. Precedences

272

Allocating Precedence

272

Pipe Precedences

272

The Best Effort Precedence

273

Applying Precedences

273

The Need for Guarantees

273

10.1.7. Guarantees

274

10.1.9. Groups

275

A Simple Groups Scenario

275

Group Limits and Guarantees

276

10.1.10. Recommendations

276

Pipe limits for VPN

276

Relying on the group limit

276

Attacks on Bandwidth

277

Watching for Leaks

277

Troubleshooting

277

10.2.1. Overview

279

10.2.3. Grouping

279

10.2.4. Rule Actions

279

10.2.6. Exempted Connections

280

10.3.1. Overview

281

10.3.6. SLB_SAT Rules

284

Example 10.3. Setting up SLB

285

Chapter 11. High Availability

289

Extending Redundancy

290

11.3.1. Hardware Setup

293

11.3.2. NetDefendOS Setup

294

Using Individual IPs

296

Failed Interfaces

296

Changing the Cluster ID

296

Chapter 12. ZoneDefense

298

12.2. ZoneDefense Switches

299

12.3.1. SNMP

300

SNMP Managers

300

Managed devices

300

12.3.2. Threshold Rules

300

12.3.4. Limitations

302

Chapter 13. Advanced Settings

304

13.2. TCP Level Settings

307

TCPSequenceNumbers

310

ICMPSendPerSecLimit

311

SilentlyDropStateICMPErrors

311

13.4. ARP Settings

312

13.6. Connection Timeouts

316

Default: False

317

13.7. Size Limits by Protocol

318

PseudoReass_MaxConcurrent

320

IllegalFrags

320

DuplicateFragData

320

FragReassemblyFail

321

DroppedFrags

321

DuplicateFrags

321

Default: 60 seconds

323

LocalReass_MaxConcurrent

324

LocalReass_MaxSize

324

LocalReass_NumLarge

324

DHCP_MinimumLeaseTime

325

DHCP_ValidateBcast

325

DHCP_AllowGlobalBcast

325

DHCP_UseLinkLocalIP

325

DHCP_DisableArpOnOffer

325

13.11. DHCPRelay Settings

326

DHCPServer_SaveLeasePolicy

327

13.13. IPsec Settings

328

Default: Disabled

329

LogSendPerSecLimit

330

Default: 0

331

TimeSync_DSTStartDate

332

TimeSync_DSTEndDate

332

PPP_L2TPBeforeRules

333

PPP_PPTPBeforeRules

333

Reassembly_MaxConnections

335

Reassembly_MaxProcessingMem

335

BufFloodRebootTime

336

MaxPipeUsers

336

Pre-empting Database Updates

338

Querying Update Status

339

Querying Server Status

339

Deleting Local Databases

339

Appendix D. The OSI Framework

348

Alphabetical Index

351

More products and manuals for Hardware firewalls D-Link

Models	Document Type
DFL-2560G Network Security UTM Firewall	User Manual D-Link DFL-2560G Network Security UTM Firewall, 483 pages
DFL-1660	User Manual D-Link DFL - 1660 Network Security UTM Firewall, 469 pages
DFL-80	Specifications D-Link DFL-80 Specifications, 147 pages
D DFL-500 DFL-500	User Manual D-Link D DFL-500 DFL-500 User`s manual [en] , 114 pages
DFL-2560-IPS-12	User Manual Untitled - D-Link, 38 pages
DFL-1100 - Security Appliance	User Manual CLI Manual(1004152444) - D-Link [en] , 19 pages
DFL-160	User Manual D-Link Corporation Firewall Specification Version 1.10, 7 pages
DFL-500	User Manual D-Link DFL-500 User's Manual, 122 pages
DFL-260E/ANB	Datasheet D-Link DFL-260E, 6 pages
DFL-160/A	Datasheet D-Link DFL-160, 4 pages
SSG-520M-SH-N-TAA	Datasheet Juniper SSG-520M, 12 pages
DFL-2560	Datasheet D-Link DFL-2560 firewall (hardware), 7 pages
DFL-1000	Datasheet D-Link WORKGROUP FIREWALL 1LAN, 3 pages

D-Link devices