Asus Internet Security Router User manual

Internet Security
Router
User s Manual
Revision 1.1
Oct. 30, 2003

ii
Copyright Information
Nopartofthis manual,includingtheproductsand software describedinit, maybe reproduced,transmitted,
transcribed, storedina retrieval system,or translated into anylanguageinanyformorbyanymeans,except
documentation kept bythepurchaser for backup purposes,withouttheexpresswritten permission of
ASUSTeK COMPUTERINC. ( ASUS”).
ASUS PROVIDES THISMANUAL AS IS”WITHOUTWARRANTY OFANYKIND,EITHER EXPRESS OR
IMPLIED,INCLUDINGBUTNOTLIMITED TO THEIMPLIEDWARRANTIES ORCONDITIONSOF
MERCHANTABILITY OR FITNESS FORA PARTICULARPURPOSE.INNOEVENTSHALL ASUS,ITS
DIRECTORS, OFFICERS, EMPLOYEES OR AGENTS BELIABLEFOR ANYINDIRECT, SPECIAL,
INCIDENTAL, OR CONSEQUENTIALDAMAGES (INCLUDINGDAMAGESFOR LOSS OF PROFITS,LOSS
OF BUSINESS,LOSS OF USE ORDATA, INTERRUPTION OF BUSINESS AND THELIKE), EVEN IF
ASUS HAS BEEN ADVISED OFTHEPOSSIBILITY OFSUCHDAMAGESARISING FROM ANYDEFECT
OR ERRORINTHISMANUAL ORPRODUCT.
Productwarrantyor service will not be extended if: (1) theproduct is repaired,modified or altered,unlesssuch
repair, modificationof alteration is authorized inwriting byASUS;or(2)the serial number oftheproductis
defacedormissing.
Products and corporatenames appearinginthismanual mayor maynotbe registeredtrademarks or
copyrightsof theirrespective companies, andare used onlyforidentificationor explanation andtotheowners’
benefit, withoutintenttoinfringe.
SPECIFICATIONS ANDINFORMATIONCONTAINEDIN THIS MANUALAREFURNISHEDFOR
INFORMATIONALUSE ONLY, ANDARE SUBJECTTO CHANGE ATANY TIMEWITHOUTNOTICE, AND
SHOULDNOTBE CONSTRUED AS ACOMMITMENTBYASUS. ASUSASSUMES NORESPONSIBILITY
OR LIABILITYFOR ANYERRORS ORINACCURACIES THATMAYAPPEARIN THIS MANUAL,
INCLUDINGTHEPRODUCTSANDSOFTWARE DESCRIBEDINIT.
Copyright ©2003 ASUSTeK COMPUTERINC.AllRightsReserved.

iii
Table of Contents
1Introduction...............................................1
1.1 Features..................................................................................................................1
1.2 SystemRequirements............................................................................................1
1.3 Using thisDocument..............................................................................................1
1.3.1 Notational conventions................................................................................1
1.3.2 Typographical conventions.........................................................................1
1.3.3 Special messages........................................................................................1
2Getting toKnow theInternet Security
Router.......................................................3
2.1 PartsList.................................................................................................................3
2.2 Front Panel..............................................................................................................3
2.3 Rear Panel..............................................................................................................3
2.4 MajorFeatures........................................................................................................4
2.4.1 Firewall Features.........................................................................................4
2.4.1.1 AddressSharing andManagement...............................................4
2.4.1.1 ACL (AccessControlList)..............................................................5
2.4.1.2 Stateful PacketInspection..............................................................5
2.4.1.3 DefenseagainstDoSAttacks........................................................5
2.4.1.4 ApplicationCommand Filtering......................................................6
2.4.1.5 Application Level Gateway(ALG)..................................................6
2.4.1.6 URL Filtering....................................................................................6
2.4.1.7 Log andAlerts.................................................................................6
2.4.1.8 RemoteAccess...............................................................................7
2.4.2 VPN...............................................................................................................7
3Quick Start Guide.....................................9
3.1 Part1 —ConnectingtheHardware......................................................................9
3.1.1 Step1.ConnectanADSL oracable modem...........................................9
3.1.2 Step2.Connect computersor aLAN........................................................9
3.1.3 Step3. Attachthepower adapter...............................................................9

iv
3.1.4 Step 4. TurnontheInternetSecurityRouter,the ADSLor cablemodem
and powerup your computers..................................................................10
3.2 Part2 —ConfiguringYour Computers...............................................................11
3.2.1 Beforeyou begin........................................................................................11
3.2.2 Windows®XP PCs:...................................................................................11
3.2.3 Windows®2000 PCs:...............................................................................11
3.2.4 Windows®95, 98,and Me PCs...............................................................12
3.2.5 Windows®NT4.0workstations:...............................................................12
3.2.6 AssigningstaticIP addresses toyour PCs..............................................13
3.3 Part3 —QuickConfigurationoftheInternet SecurityRouter..........................14
3.3.1 Buttons Used in SetupWizard..................................................................14
3.3.2 SettingUp theInternetSecurityRouter....................................................14
3.3.3 TestingYourSetup....................................................................................20
3.3.4 DefaultRouterSettings.............................................................................20
4Getting Started with the Configuration
Manager.................................................21
4.1 Log into ConfigurationManager..........................................................................21
4.2 FunctionalLayout.................................................................................................22
4.2.1 Setup MenuNavigationTips.....................................................................22
4.2.2 CommonlyUsed Buttons andIcons.........................................................22
4.3 The HomePageof Configuration Manager.......................................................23
4.4 Overview of SystemConfiguration......................................................................23
5ConfiguringLAN Settings......................25
5.1 LANIP Address....................................................................................................25
5.1.1 LANIP ConfigurationParameters............................................................25
5.1.2 ConfiguringtheLAN IPAddress...............................................................25
5.2 DHCP (Dynamic HostControlProtocol).............................................................26
5.2.1 What isDHCP?..........................................................................................26
5.2.2 WhyuseDHCP?........................................................................................27
5.2.3 ConfiguringDHCPServer.........................................................................27
5.2.4 Viewing CurrentDHCPAddress Assignments........................................28
5.3 DNS.......................................................................................................................29
5.3.1 AboutDNS.................................................................................................29

v
5.3.2 AssigningDNSAddresses........................................................................29
5.3.3 ConfiguringDNS Relay.............................................................................29
5.4 Viewing LAN Statistics.........................................................................................30
6Configuring WAN Settings.....................31
6.1 WAN ConnectionMode.......................................................................................31
6.2 PPPoE...................................................................................................................31
6.2.1 WAN PPPoE ConfigurationParameters..................................................31
6.2.2 ConfiguringPPPoE forWAN....................................................................32
6.3 Dynamic IP............................................................................................................32
6.3.1 WAN DynamicIP Configuration Parameters...........................................32
6.3.2 ConfiguringDynamic IP for WAN.............................................................33
6.4 StaticIP.................................................................................................................34
6.4.1 WAN StaticIP ConfigurationParameters................................................34
6.4.2 ConfiguringStatic IP forWAN...................................................................34
6.5 Viewing WAN Statistics........................................................................................35
7ConfiguringRoutes................................37
7.1 Overview of IPRoutes.........................................................................................37
7.1.1 Do Ineedto defineIP routes?..................................................................37
7.2 Dynamic Routing usingRIP (RoutingInformationProtocol).............................38
7.2.1 Enabling/DisablingRIP..............................................................................38
7.3 StaticRouting........................................................................................................38
7.3.1 StaticRouteConfigurationParameters....................................................38
7.3.2 AddingStaticRoutes.................................................................................38
7.3.3 Deleting StaticRoutes...............................................................................38
7.3.4 Viewing theStaticRouting Table..............................................................39
8ConfiguringDDNS..................................41
8.1 DDNS Configuration Parameters........................................................................42
8.2 Access DDNSConfiguration Page.....................................................................43
8.3 ConfiguringRFC-2136 DDNSClient..................................................................43
8.4 ConfiguringHTTP DDNS Client..........................................................................44

vi
9ConfiguringFirewall/NATSettings.........45
9.1 Firewall Overview.................................................................................................45
9.1.1 Stateful PacketInspection.........................................................................45
9.1.2 DoS (Denialof Service)Protection...........................................................45
9.1.3 Firewalland AccessControlList (ACL)....................................................45
9.1.3.1 PriorityOrderof ACL Rule............................................................45
9.1.3.2 TrackingConnectionState...........................................................46
9.1.4 Default ACLRules.....................................................................................46
9.2 NATOverview.......................................................................................................46
9.2.1 Static(OnetoOne)NAT...........................................................................46
9.2.2 Dynamic NAT.............................................................................................47
9.2.3 NAPT(NetworkAddress andPortTranslation) orPAT(Port Address
Translation).................................................................................................48
9.2.4 ReverseStatic NAT...................................................................................49
9.2.5 ReverseNAPT/ VirtualServer.................................................................49
9.3 ConfiguringInboundACLRules..........................................................................49
9.3.1 InboundACL RuleConfigurationParameters.........................................49
9.3.2 Access InboundACL RuleConfigurationPage –(Firewall èInbound
ACL)............................................................................................................52
9.3.3 AddInbound ACLRules............................................................................52
9.3.4 ModifyInboundACL Rules.......................................................................53
9.3.5 DeleteInboundACLRules.......................................................................53
9.3.6 DisplayInboundACL Rules......................................................................53
9.4 ConfiguringOutbound ACLRules.......................................................................53
9.4.1 OutboundACL RuleConfiguration Parameters......................................54
9.4.2 Access OutboundACL RuleConfiguration Page –(Firewall è
Outbound ACL)..........................................................................................56
9.4.3 Addan Outbound ACLRule.....................................................................57
9.4.4 ModifyOutboundACL Rules....................................................................57
9.4.5 DeleteOutbound ACLRules....................................................................58
9.4.6 DisplayOutboundACL Rules...................................................................58
9.5 ConfiguringURL Filters........................................................................................58
9.5.1 URL FilterConfigurationParameters.......................................................58
9.5.2 Access URLFilter ConfigurationPage –(Firewall èURL Filter)..........58
9.5.3 Addan URL FilterRule..............................................................................59
9.5.4 Modifyan URL FilterRule.........................................................................59

vii
9.5.5 Delete an URLFilter Rule.........................................................................59
9.5.6 View ConfiguredURL FilterRules............................................................59
9.5.7 URL FilterRuleExample...........................................................................59
9.6 ConfiguringAdvanced Firewall Features –(Firewall èAdvanced).................60
9.6.1 ConfiguringSelf AccessRules.................................................................60
9.6.1.1 Self AccessConfigurationParameters........................................61
9.6.1.2 Access SelfAccessRuleConfigurationPage –(Firewall è
Advanced èSelf Access)............................................................61
9.6.1.3 Adda Self Access Rule................................................................61
9.6.1.4 Modifya SelfAccessRule............................................................62
9.6.1.5 Deletea Self Access Rule............................................................62
9.6.1.6 View ConfiguredSelf Access Rules............................................62
9.6.2 ConfiguringServiceList.............................................................................62
9.6.2.1 Service ListConfiguration Parameters........................................63
9.6.2.2 Access Service ListConfiguration Page –(Firewall èAdvanced
èService).....................................................................................63
9.6.2.3 Adda Service................................................................................63
9.6.2.4 Modifya Service............................................................................64
9.6.2.5 Deletea Service............................................................................64
9.6.2.6 View ConfiguredServices............................................................64
9.6.3 ConfiguringDoSSettings..........................................................................64
9.6.3.1 DoS Protection ConfigurationParameters..................................64
9.6.3.2 Access DoS ConfigurationPage –(Firewall èAdvanced è
DoS)...............................................................................................66
9.6.3.3 ConfiguringDoSSettings.............................................................66
9.7 FirewallPolicyList –(Firewall èPolicyList).....................................................66
9.7.1 ConfiguringApplication Filter....................................................................67
9.7.1.1 ApplicationFilterConfiguration Parameters................................67
9.7.1.2 Access ApplicationFilterConfigurationPage –(Firewall è
PolicyList èApplicationFilter)....................................................68
9.7.1.3 Addan ApplicationFilter...............................................................69
9.7.1.3.1 FTPExample:AddaFTPFilterRuleto BlockFTPDELETE
Command......................................................................................69
9.7.1.3.2 HTTP Example: AddaHTTPFilter Rule to BlockJAVAApplets
and JavaArchives.........................................................................71
9.7.1.4 Modifyan Application Filter..........................................................72
9.7.1.5 DeleteanApplication Filter...........................................................73
9.7.2 ConfiguringIPPool....................................................................................73
9.7.2.1 IP Pool ConfigurationParameters...............................................73

viii
9.7.2.2 Access IPPool ConfigurationPage –(Firewall èPolicyList è
IP Pool)..........................................................................................74
9.7.2.3 Addan IP Pool..............................................................................74
9.7.2.4 Modifyan IP Pool..........................................................................74
9.7.2.5 DeleteanIPPool..........................................................................75
9.7.2.6 IP Pool Example............................................................................75
9.7.3 ConfiguringNATPool................................................................................76
9.7.3.1 NATPool ConfigurationParameters...........................................76
9.7.3.2 Access NATPool Configuration Page –(Firewall èPolicyList
èNATPool).................................................................................77
9.7.3.3 AddaNATPool.............................................................................78
9.7.3.4 Modifya NATPool........................................................................78
9.7.3.5 Deletea NATPool........................................................................78
9.7.3.6 NATPool Example........................................................................78
9.7.4 Configuring TimeRange...........................................................................80
9.7.4.1 Time RangeConfigurationParameters.......................................80
9.7.4.2 Access TimeRange Configuration Page –(Firewall èPolicy
List èTimeRange)......................................................................81
9.7.4.3 AddaTime Range........................................................................81
9.7.4.4 Modifya TimeRange....................................................................81
9.7.4.5 Deletea Time Range....................................................................82
9.7.4.6 Deletea Scheduleina Time Range............................................82
9.7.4.7 Time Range Example...................................................................82
9.8 FirewallStatistics –Firewall èStatistics...........................................................83
10 ConfiguringVPN....................................85
10.1 Default Parameters..............................................................................................85
10.2 VPNTunnelConfiguration Parameters..............................................................87
10.3 Establish VPN Connection Using AutomaticKeying.........................................90
10.3.1 AddaRule forVPNConnectionUsing Pre-sharedKey.........................91
10.3.2 ModifyVPN Rules......................................................................................92
10.3.3 DeleteVPNRules......................................................................................92
10.3.4 DisplayVPNRules....................................................................................92
10.4 Establish VPN Connection Using Manual Keys.................................................93
10.4.1 AddaRule forVPNConnectionUsing Manual Key...............................93
10.4.2 ModifyVPN Rules......................................................................................94
10.4.3 DeleteVPNRules......................................................................................94

ix
10.4.4 DisplayVPNRules....................................................................................94
10.5 VPN Statistics.......................................................................................................95
10.6 VPNConnectionExamples.................................................................................96
10.6.1 Intranet Scenario –firewall + VPN and noNATforVPN traffic..............96
10.6.1.1 ConfigureRules onInternet SecurityRouter1 (ISR1)...............97
10.6.1.2 ConfigureRules onInternet SecurityRouter2 (ISR2)...............98
10.6.1.3 EstablishTunnel and Verify........................................................100
10.6.2 ExtranetScenario –firewall+ static NAT+VPN forVPN traffic..........100
10.6.2.1 SetuptheInternetSecurityRouters...........................................101
10.6.2.2 Configure VPNRulesonISR1...................................................102
10.6.2.3 Configure VPNRulesonISR2...................................................104
10.6.2.4 EstablishTunnel and Verify........................................................107
11 ConfiguringRemoteAccess................109
11.1 RemoteAccess..................................................................................................109
11.2 Manage User Groups andUsers......................................................................109
11.2.1 UserGroup ConfigurationParameters...................................................109
11.2.2 Access UserGroup Configuration Page –(Remote Access èUser
Group).......................................................................................................110
11.2.3 AddaUserGroup and/or aUser............................................................110
11.2.4 Modifya UserGrouporaUser...............................................................111
11.2.5 Deletea User Groupor a User...............................................................111
11.2.6 UserGroup andUsersConfigurationExample.....................................112
11.3 ConfigureGroup ACLRules..............................................................................112
11.3.1 Group ACLSpecific Configuration Parameters.....................................112
11.3.2 Access Group ACLConfiguration Page –(Remote Access èGroup
ACL)..........................................................................................................113
11.3.3 Add/Modify/Delete Group ACL Rules.....................................................113
11.4 RemoteUser LoginProcess.............................................................................113
11.5 ConfigureFirewall forRemoteAccess.............................................................115
11.6 VirtualIP Address Configuration forRemoteAccess VPN.............................116
11.6.1 Access VPN Virtual IP ConfigurationPage –(RemoteAccess èVPN
VirtualIP)..................................................................................................116
11.6.2 Assign VPN Virtual IPAddress for Remote AccessUsers...................116
11.6.3 Change VirtualIPAssignmentsfor Remote AccessUsers..................117
11.6.4 DeleteVirtualIPAddressforRemote AccessUsers............................117
11.7 Configure VPNfor Remote Access..................................................................118

x
11.7.1 MainModeRemoteAccess....................................................................118
11.7.2 Aggressive Mode Remote Access.........................................................120
12 System Management...........................123
12.1 Configure SystemServices...............................................................................123
12.2 ChangetheLogin Password.............................................................................124
12.3 ModifySystemInformation................................................................................124
12.4 SetupDateand Time.........................................................................................125
12.4.1 View the SystemDateand Time............................................................126
12.5 SystemConfiguration Management.................................................................126
12.5.1 Reset SystemConfiguration...................................................................126
12.5.2 Backup SystemConfiguration................................................................127
12.5.3 Restore SystemConfiguration................................................................127
12.6 Upgrade Firmware..............................................................................................128
12.7 ResettheInternet SecurityRouter....................................................................129
12.8 LogoutConfiguration Manager..........................................................................130
13 ALG Configuration................................131
14 IP Addresses, Network Masks, and
Subnets................................................135
14.1 IP Addresses......................................................................................................135
14.1.1 Structureof anIPaddress.......................................................................135
14.2 Networkclasses.................................................................................................135
14.3 Subnetmasks.....................................................................................................136
15 Troubleshooting....................................139
15.1 Diagnosing ProblemusingIPUtilities...............................................................140
15.1.1 ping...........................................................................................................140
15.1.2 nslookup...................................................................................................141
16 Glossary...............................................143

xi
17 Index.....................................................149
List of Figures
Figure 2.1. FrontPanel LEDs.....................................................................................................................................3
Figure 2.2. Rear Panel Connections..........................................................................................................................3
Figure 3.1. Overview of HardwareConnections.....................................................................................................10
Figure 3.2.Login Screen...........................................................................................................................................14
Figure 3.3.SetupWizardHome Page.....................................................................................................................15
Figure 3.4.SetupWizard –PasswordConfiguration Page....................................................................................15
Figure 3.5.SetupWizard –SystemIdentityConfiguration Page..........................................................................16
Figure 3.6.SetupWizard –Date/Time ConfigurationPage...................................................................................16
Figure 3.7.SetupWizard –LANIP ConfigurationPage........................................................................................17
Figure 3.8.SetupWizard –DHCP ServerConfigurationPage.............................................................................17
Figure 3.9.SetupWizard –WAN PPPoE ConfigurationPage..............................................................................18
Figure 3.10.SetupWizard –WAN DynamicIP Configuration Page.....................................................................18
Figure 3.11.SetupWizard –WAN StaticIP ConfigurationPage..........................................................................19
Figure 4.1.ConfigurationManager LoginScreen...................................................................................................21
Figure 4.2.TypicalConfigurationManagerPage...................................................................................................22
Figure 4.3.SetupWizardHome Page.....................................................................................................................23
Figure 4.4.SystemInformation Page......................................................................................................................24
Figure 5.1.LAN IPAddressConfiguration Page....................................................................................................26
Figure 5.2.DHCP Configuration Page....................................................................................................................27
Figure 5.3.LAN Statistics Page...............................................................................................................................30
Figure 6.1.WAN PPPoEConfigurationPage.........................................................................................................31
Figure 6.2.WAN Dynamic IP (DHCP client)Configuration Page..........................................................................33
Figure 6.3.WAN Static IPConfigurationPage.......................................................................................................34
Figure 6.4.WAN StatisticsPage..............................................................................................................................35
Figure 7.1.RoutingConfiguration Page.................................................................................................................37
Figure 8.1.NetworkDiagramfor RFC-2136 DDNS...............................................................................................41
Figure 8.2.NetworkDiagramfor HTTP DDNS.......................................................................................................42
Figure 8.3.RFC-2136DDNSConfiguration Page..................................................................................................43
Figure 8.4.HTTP DDNS ConfigurationPage.........................................................................................................44
Figure 9.1StaticNAT –MappingFourPrivateIP Addresses toFour GloballyValidIP Addresses...................47
Figure 9.2Dynamic NAT –FourPrivateIPaddresses MappedtoThree ValidIPAddresses...........................47
Figure 9.3Dynamic NAT –PC-A can getanNATassociationafter PC-Bis disconnected................................47

xii
Figure 9.4 NAPT –Map AnyInternalPCs toa Single Global IP Address............................................................48
Figure 9.5ReverseStatic NAT –Mapa Global IP Address toAnInternalPC....................................................48
Figure 9.6ReverseNAPT –Relayed Incoming Packets tothe Internal Host Baseonthe Protocol,Port
Numberor IPAddress......................................................................................................................................48
Figure 9.7.Inbound ACLConfigurationPage.........................................................................................................49
Figure 9.8.Inbound ACL configuration example....................................................................................................52
Figure 9.9.Outbound ACLConfigurationPage......................................................................................................54
Figure 9.10. OutboundACLConfiguration Example..............................................................................................57
Figure 9.11.URLFilter ConfigurationPage............................................................................................................59
Figure 9.12.URLFilter Rule Example.....................................................................................................................60
Figure 9.13.Self AccessRuleConfiguration Page.................................................................................................61
Figure 9.14.Service ListConfigurationPage..........................................................................................................63
Figure 9.15.DoS Configuration Page......................................................................................................................66
Figure 9.16.Application Filter ConfigurationPage.................................................................................................69
Figure 9.17NetworkDiagramfor FTP FilterExample –Blocking FTPDeleteCommand..................................69
Figure 9.18. FTP FilterExample –Configuring FTP FilterRule............................................................................70
Figure 9.19FTP Filter Example –FirewallConfiguration Assistant......................................................................70
Figure 9.20FTP Filter Example –Add an FTPFilter toDenyFTP DeleteCommand........................................70
Figure 9.21. FTP FilterExample –Associate FTP Filter RuletoanACL Rule....................................................71
Figure 9.22.HTTP Filter Example –Configuring HTTP FilterRule.......................................................................71
Figure 9.23.HTTP Filter Example –Associate HTTP Filter RuletoanACL Rule...............................................72
Figure 9.24.ModifyanApplicationFilter.................................................................................................................73
Figure 9.25IP PoolConfiguration Page..................................................................................................................74
Figure 9.26.NetworkDiagramfor IP Pool Configuration.......................................................................................75
Figure 9.27.IPPool Example –Add Two IP Pools –MISgroup1and MISgroup2..............................................76
Figure 9.28.IPPool Example –DenyQUAKE-IIConnectionfor MISgroup1......................................................76
Figure 9.29.NATPool configuration page..............................................................................................................77
Figure 9.30.NetworkDiagramfor NATPool Example...........................................................................................79
Figure 9.31.NATPoolExample –Create a StaticNATPool................................................................................79
Figure 9.32.NATPoolExample –Associate a NATPool toanACL Rule...........................................................80
Figure 9.33. TimeRange ConfigurationPage........................................................................................................81
Figure 9.34. TimeRange Example –Create a TimeRange..................................................................................82
Figure 9.35. TimeRange Example –DenyFTP Accessfor MISgroup1DuringOfficeHours.............................82
Figure 9.36. Firewallactiveconnectionsstatistics..................................................................................................83
Figure 10.1.VPN TunnelConfigurationPage –Pre-sharedKeyMode...............................................................91
Figure 10.2.VPN TunnelConfigurationPage –Manual KeyMode......................................................................93
Figure 10.3.VPNStatistics Page.............................................................................................................................96

xiii
Figure 10.4. TypicalIntranet NetworkDiagram......................................................................................................97
Figure 10.5.IntranetVPN PolicyConfigurationon ISR1........................................................................................98
Figure 10.6.IntranetVPN PolicyConfigurationon ISR2........................................................................................99
Figure 10.7. TypicalExtranet NetworkDiagram...................................................................................................101
Figure 10.8.Extranet Example –VPNPolicyConfigurationonISR1..................................................................102
Figure 10.9.Extranet Example –Outgoing NATPoolConfiguration on ISR1...................................................103
Figure 10.10. ExtranetExample –IncomingNATPool ConfigurationonISR1.................................................103
Figure 10.11. ExtranetExample –OutboundACL Rule onISR1........................................................................104
Figure 10.12. ExtranetExample –Inbound ACL Ruleon ISR1...........................................................................104
Figure 10.13. ExtranetExample –VPN PolicyConfigurationonISR2................................................................105
Figure 10.14. ExtranetExample –OutgoingNATPoolConfigurationonISR2.................................................105
Figure 10.15. ExtranetExample –IncomingNATPool ConfigurationonISR2.................................................106
Figure 10.16. ExtranetExample –OutboundACL Rule onISR2........................................................................106
Figure 10.17. ExtranetExample –Inbound ACL Ruleon ISR2...........................................................................107
Figure 11.1.User GroupConfigurationPage........................................................................................................110
Figure 11.2.User Groupand Users Configuration Example...............................................................................112
Figure 11.3. Goup ACL ConfigurationPage.........................................................................................................113
Figure 11.4.LoginConsole.....................................................................................................................................114
Figure 11.5.LoginStatus Screen...........................................................................................................................114
Figure 11.6.NetworkDiagramfor InboundRemoteAccess...............................................................................114
Figure 11.7.User and User GroupConfigurationExample.................................................................................115
Figure 11.8. GroupACL Configuration Example..................................................................................................115
Figure 11.9.VPNVirtualIPConfiguration Page...................................................................................................116
Figure 11.10.NetworkDiagramfor VPNRemote Access...................................................................................117
Figure 11.11. MainMode Remote Access Example –Createa User Group and Add Two Users into the Group
..........................................................................................................................................................................118
Figure 11.12. MainMode Remote Access Example –Configurethe VirtualIP address..................................119
Figure 11.13. MainMode Remote Access Example –Remote VPNConnectionSetup for RoadWarrior”
Group................................................................................................................................................................119
Figure 11.14. Aggressive Mode RemoteAccess Example–CreateaUser Groupand AddTwoUsers intothe
Group................................................................................................................................................................120
Figure 11.15. Aggressive Mode RemoteAccess Example–Configurethe Virtual IP address........................120
Figure 11.16. Aggressive Mode RemoteAccess Example–Remote VPNConnectionSetupfor RoadWarrior”
Group................................................................................................................................................................121
Figure 12.1.SystemServices ConfigurationPage...............................................................................................123
Figure 12.2.PasswordConfigurationPage..........................................................................................................124
Figure 12.3.SystemInformationConfiguration Page...........................................................................................125
Figure 12.4.Dateand TimeConfiguration Page..................................................................................................125

xiv
Figure 12.5. DefaultSettingConfiguration Page..................................................................................................126
Figure 12.6.Backup SystemConfigurationPage.................................................................................................127
Figure 12.7.Restore SystemConfigurationPage................................................................................................128
Figure 12.8.Windows File Browser.......................................................................................................................128
Figure 12.9. FirmwareUpgrade Page...................................................................................................................129
Figure 12.10.ConfigurationManagerReset Page...............................................................................................129
Figure 12.11.ConfigurationManagerLogoutPage.............................................................................................130
Figure 12.12.Confirmationfor Closing Browser (IE)............................................................................................130
Figure 15.1.UsingthepingUtility..........................................................................................................................141
Figure 15.2.Usingthenslookup Utility..................................................................................................................142
List of Tables
Table2.1.FrontPanelLabel andLEDs....................................................................................................................3
Table2.2.RearPanelLabels andLEDs...................................................................................................................4
Table2.3.DoSAttacks...............................................................................................................................................5
Table2.4.VPNFeatures oftheInternet SecurityRouter.........................................................................................7
Table3.1.LEDIndicators.........................................................................................................................................10
Table3.2.Default SettingsSummary......................................................................................................................20
Table4.1.Descriptionof CommonlyUsed Buttons and Icons..............................................................................22
Table5.1.LANIP Configuration Parameters..........................................................................................................25
Table5.2.DHCPConfiguration Parameters...........................................................................................................28
Table5.3.DHCPAddressAssignment...................................................................................................................28
Table6.1.WAN PPPoEConfiguration Parameters...............................................................................................32
Table6.2.WAN Dynamic IPConfiguration Parameters........................................................................................32
Table6.3.WAN Static IPConfigurationParameters..............................................................................................34
Table7.1.Static Route ConfigurationParameters.................................................................................................38
Table8.1.DDNSConfiguration Parameters...........................................................................................................42
Table9.1.Inbound ACLRule Configuration Parameters.......................................................................................49
Table9.2.Outbound ACLRuleConfigurationParameters....................................................................................54
Table9.3.URL Filter Configuration Parameters.....................................................................................................58
Table9.4.Self Access ConfigurationParameters..................................................................................................61
Table9.5.ServiceList configuration parameters....................................................................................................63
Table9.6.DoSProtectionConfigurationParameters............................................................................................64
Table9.7.ApplicationFilter Configuration Parameters..........................................................................................67
Table9.8.IPPool Configuration Parameters..........................................................................................................73
Table9.9.NATPoolConfiguration Parameters......................................................................................................76

xv
Table9.10. TimeRange ConfigurationParameters...............................................................................................80
Table10.1.DefaultConnectionsintheInternetSecurityRouter...........................................................................85
Table10.2.Pre-configuredIKEproposals in the InternetSecurityRouter...........................................................85
Table10.3.Pre-configuredIPSec proposalsintheInternet SecurityRouter.......................................................86
Table10.4.VPNTtunnelConfiguration Parameter.................................................................................................87
Table10.5.VPNStatistics........................................................................................................................................95
Table10.6. OutboundUn-translated Firewall Rule forVPNPackets onISR1.....................................................98
Table10.7.InboundUn-translatedFirewallRule for VPN Packets onISR1........................................................98
Table10.8. OutboundUn-translated Firewall Rule forVPNPackets onISR1.....................................................99
Table10.9.InboundUn-translatedFirewallRule for VPN Packets onISR1......................................................100
Table11.1.UserGroupConfiguration Parameters..............................................................................................109
Table11.2. Group ACL SpecificConfigurationParameters................................................................................112
Table13.1.SupportedALG....................................................................................................................................131
Table14.1.IPAddressstructure............................................................................................................................135

Internet Security Router Users ManualChapter 1. Introduction
1 Introduction
Congratulations onbecomingthe ownerof the InternetSecurityRouter.Your LAN(localarea network) will
now be able to access theInternetusing yourhigh-speed broadband connection suchasthose with ADSLor
cable modem.
This User Manual will show you how tosetuptheInternet SecurityRouter, and how tocustomize its
configurationtogetthe mostout ofthis product.
1.1Features
„ 10/100Base-TEthernet router to provideInternetconnectivityto all computers onyour LAN
„ Firewall,NAT(NetworkAddress Translation),andIPSec VPNfunctionsto providesecureInternet
accessfor yourLAN
„ Automatic networkaddress assignment throughDHCPServer
„ Servicesincluding IP route, DNSand DDNS configuration,RIP,andIPperformancemonitoring
„ Configuration programaccessible via a web browser,suchas Microsoft Internet Explorer 5.5,
Netscape 7.0.2 or later.
1.2System Requirements
Inorder tousetheInternetSecurityRouterforInternetaccess, you must havethefollowing:
„ ADSL orcable modemandthecorrespondingserviceupand running, with atleastonepublic Internet
address assigned to yourWAN
„ Oneor morecomputerseach containing an Ethernet10Base-T/100Base-Tnetworkinterface card
(NIC)
„ (Optional)An Ethernethub/switch,ifyou are connectingthe devicetomorethan four computersonan
Ethernetnetwork.
„ For systemconfiguration usingthe supplied web-basedprogram:aweb browsersuchasInternet
Explorer v5.5 or later.
1.3Using this Document
1.3.1 Notational conventions
„ Acronyms aredefinedthe first timetheyappearintextandinthe glossary(Appendix16).
„ For brevity, the InternetSecurityRouter issometimes referredtoas therouter.”
„ The terms LAN and network are used interchangeablytorefertoagroup of Ethernet-connected
computersatonesite.
1.3.2 Typographical conventions
„ Italics are usedtoidentifyterms that aredefinedinthe glossary(Chapter 16).
„ Boldface typetextisused for items you selectfrommenus anddrop-downlists, and text strings you
type whenprompted bytheprogram.
1.3.3 Special messages
This documentuses the following iconsto callyour attentionto specificinstructionsorexplanations.

Chapter 1. IntroductionInternet Security Router Users Manual
2
Note
Provides clarificationor non-essentialinformation onthecurrent
topic.
Definition
Explains termsoracronyms that maybe unfamiliartomany
readers.Theseterms arealsoincluded inthe Glossary.
WARNING
Provides messages ofhighimportance, including messages
relating to personal safetyor systemintegrity.

Internet Security Router Users Manual Chapter 2. Getting to Know the Internet Security Router
3
2 Getting to Know the Internet Security Router
2.1Parts List
Inadditiontothisdocument, yourInternet SecurityRoutershouldcomewiththe following:
„ The Internet SecurityRouter
„ Power adapter
„ Ethernet cable( straight-through”type)
„ Optional consoleport cable(RJ-45)
2.2Front Panel
The frontpanel containsLED indicatorsthat show the status oftheunit.
Figure2.1.Front PanelLEDs
Table 2.1. Front PanelLabeland LEDs
Label Color Function
POWER greenOn: Unit is poweredon
Off: Unitis poweredoff
ALARM green(Forfactorytesting only)
WANgreenOn: WAN linkestablishedandactive
Flashing:Data istransmitted viaWAN connection
Off: NoWAN link
LAN1 –
LAN4 greenOn: LAN linkisestablished Flashing:Data istransmitted viaLAN connection
Off: NoLAN link
2.3Rear Panel
The rear panel containstheports for the unit'sdata and power connections.
Figure2.2.RearPanelConnections

Chapter 2. Getting to Know the Internet Security Router Internet Security Router User s Manual
4
Table 2.2.Rear PanelLabelsand LEDs
Label Function
Switchesthe unitonand off
POWER Connects tothe supplied poweradapter
Reset Resetsthedevice
CONSOLERJ-45 serialport for consolemanagement
WANConnects toyourWAN device,suchasADSLor
cable modem.
P1 –P4Connects the device to yourPC's Ethernetport,
or totheuplinkport onyourLAN'shub/switch,
usingthecableprovided
2.4Major Features
2.4.1 Firewall Features
The FirewallasimplementedintheInternet SecurityRouter provides thefollowing featuresto protectyour
networkfrombeingattacked and topreventyournetworkfrombeing usedas the springboard forattacks.
„ AddressSharing andManagement
„ Packet Filtering
„ Stateful PacketInspection
„ DefenseagainstDenial of Service Attacks
„ ApplicationContentFiltering
„ Log andAlert
„ RemoteAccess
„ KeywordbasedURL Filtering
2.4.1.1Address Sharing and Management
The Internet SecurityRouterFirewallprovides NATto sharea single high-speed Internetconnection andto
savethe cost ofmultipleconnectionsrequired for the hosts ontheLANsegments connectedtotheInternet
SecurityRouter. Thisfeatureconcealsnetworkaddressand preventsthemfrombecoming public.Itmaps
unregisteredIP addressesofhostsconnectedto the LAN with validonesfor Internetaccess.TheInternet
SecurityRouterFirewallalso providesreverseNATcapability, which enablesSOHOusersto host various
servicessuchase-mail servers, web servers, etc. TheNATrules drive the translation mechanismattheNAT
router. Thefollowing typesofNATaresupportedbytheInternet SecurityRouter.
„ StaticNAT –Mapsan internalhostaddresstoa globallyvalid Internetaddress(one-to-one). All
packets are directlytranslated with the informationcontained inthemap.
„ Dynamic NAT –Mapsan internalhost address dynamicallyto agloballyvalidInternetaddress (m-to-
n). Themap usuallycontainsapoolof internalIPaddresses (m) and a pool of globallyvalid InternetIP
addresses (n) with musually greater thann.Each internalIPaddressismapped tooneexternal IP
address ona first come first serve basis.
„ NAPT(NetworkAddress andPortTranslation) –Also calledIP Masquerading.Maps manyinternal
hosts toonlyonegloballyvalidInternetaddress.Themapusuallycontains apool ofnetworkports to
be used for translation. Everypacketistranslated withthegloballyvalidInternetaddress;theport
number is translated with a free pool fromthepoolof networkports.