Bandura Cyber TIG BT-500 User manual

August 2019 • Version 3.72
USER’S MANUAL

While Bandura Cyber has attempted to verify that the information in this document is accurate
and complete, some typographical or technical errors may exist The recipient of this document
is solely responsible for all decisions relating to or use of the information provided herein.
The information contained in this publication is effective as of the publication date below and is
subject to change without notice.
This publication contains proprietary information that is protected by copyright. All rights are
reserved. No part of this document may be reproduced or transmitted in any form or by any
means, electronic or mechanical, or translated into another language, without the prior written
consent of Bandura Cyber, Inc.
This edition published August 2019.
© 2019 Bandura Cyber, Inc.
Bandura Cyber firmware is also protected by copyright law and constitutes valuable confidential
and proprietary information of Bandura Cyber, Inc. and its licensors. The Bandura Cyber
firmware and all related documentation, is provided for use only in accordance with the terms of
the license agreement. Unauthorized reproduction or distribution of the firmware or any portion
thereof could result in severe civil or criminal penalties.
All trademarks are the property of their respective owners.
1

Table of Contents
1 Introduction
1.1 Overview
1.2 Support
1.3 Specifications
1.4 What’s Included
2 Configuration
2.1 Initial Configuration
2.2 First Login
2.2.1 Accessing the Bandura Cyber TIG
2.2.2 Logging In
2.2.3 Changing Your Password
2.2.4 Changing Date/Time
2.2.5 Change Admin Interface Network Address
2.2.6 Confirm the Bandura Cyber TIG can Access the Internet
2.3 Console Modes
2.4 Overview of Bandura Cyber TIG Configuration
2.5 Configuring the Bridge Filters
2.6 Configuring a Resource Group
2.7 Configuring Administration
3 Bandura Cyber TIG Menu Reference
3.1 Dashboard
3.1.1 Connection Summary
3.1.2 Threat Summary
3.1.3 Filters
3.2 Resource Groups
3.2.1 Creating a Resource Group
3.2.2 Edit
3.2.3 Resources
3.2.4 Country Policies
3.2.5 Risk Thresholds
3.2.6 Exception Lists
3.2.9 Alerts
3.2.10 Live Stats
3.2.11 Delete
3.3 Manage Lists
2

3.3.1 Exception Lists
3.3.2 Service Groups
3.3.3 IP Blacklists
3.3.4 Domain Blacklists
3.3.5 IP Whitelists
3.3.6 Domain Whitelists
3.4 Logs
3.4.1 Connections
3.4.2 Domain Logs
3.4.3 System
3.5 Users
3.5.1 Accounts
3.5.1.1 Creating a New User
3.5.1.2 Show User Sessions
3.5.1.3 Edit User
3.5.1.4 Delete User
3.5.2 Maintenance Users
3.5.3 Change Password
3.6 Network
3.6.1 Admin Interface
3.6.1.1 HTTPS Access Settings
3.6.1.2 Ping Access Settings
3.6.2 Bridging Interface
3.6.3 IPsec Settings
3.6.4 ARP Table
3.7 Settings
3.7.1 General
3.7.2 Bypass
3.7.3 External Syslog
3.7.4 GMC
3.7.5 Date/Timezone
3.7.6 Alarm
3.7.7 Banner
3.7.8 HTTPS
3.7.8.1 General Settings
3.7.8.2 Certificates
3.7.8.2.1 View Existing Certificate
3.7.8.2.2 Generate and Install New Self Signed Certificate
3.7.8.2.3 Generate CSR
3

3.7.8.2.4 Import and Export Certificate
3.7.8.2.5 Upload CA Certificate
3.7.8.2.6 Upload Certificate Revocation List
3.7.9 SNMP
3.7.9.1 General Settings
3.7.9.2 SNMP Users
3.7.9.2 SNMP Access
3.7.9.3 SNMP Traps
3.7.10 NTP
3.7.11 TACACS+
3.7.12 SMTP
3.8 Providers
3.8.1 System Providers
3.8.2 HIPPIE Provider
3.9 Update Software
3.10 System
3.10.1 Active Sessions
3.10.2 Reboot
3.10.3 Shutdown
3.10.4 Self-Test
3.10.5 Maintenance Mode
3.10.6 System Information
3.10.7 License Information
3.10.8 Import/Export
3.10.8.1 System Configuration
3.11 Logout
4 Consoles
4.1 Maintenance Mode Console
4.2 Recovery Console
4.2.1 Network Configuration
4.2.2 License Management
4.2.3 Log File Management
4.2.4 Firmware Management
5 Appendices
5.1 References
4

1 Introduction
1.1 Overview
Bandura Threat Intelligence Gateway
Bandura Cyber TIG uses threat intelligence to block known threats and unwanted internet
traffic from entering your network and prevents your own systems from sending information to
suspicious locations. This device resides between your firewall and your external network,
where it acts as an OSI Level 2 network bridge, and so is invisible to the internet. The device
can also be deployed behind your firewall providing visibility into threats and unwanted traffic
that’s bypassing your firewall. Bandura Cyber TIG incorporates the unique HIPPIE™
(High-Speed Internet Protocol Packet Inspection Engine) technology, which determines the
country of origin of each packet and based on Autonomous System Number (ASN) what
organization the packet is coming from. Bandura Cyber TIG uses a Threat Intelligence Engine
to filter packets against dynamic threat intelligence indicators to determine if the packet is
malicious. Bandura Cyber TIG filters inbound and outbound packets at wire speeds.
This manual provides a comprehensive description of the features and utilities of the Bandura
Cyber TIG.
5

Features at a Glance
HIPPIE™ Filter
A country code/Internet Protocol address
map that determines the country of origin of
each packet, and filters inbound and
outbound packets at wire speeds.
Threat Intelligence Engine
Filters IPs and domains using threat
intelligence indicators that are integrated into
Bandura Cyber TIG. Bandura Cyber TIG
comes “out of the box” with millions of threat
intelligence indicators across 17 threat
categories. Bandura Cyber TIG also includes
open source, industry, and government IP
and domain blacklists.
Scalable & Open Platform
Bandura Cyber TIG can filter traffic against
over 100 million unique IP and domain
indicators at wire speeds. Bandura Cyber
TIG is an open platform and via plug-ins and
STIX/TAXII support can easily integrate with
additional threat intelligence sources.
Transparent Bridging
The Bandura Cyber TIG acts as a bridge,
placed in between a firewall and the external
or internal network, eliminating the need to
make large configuration changes to the
network.
Role Based Access Control
Administrators assign roles to users, which
restrict the type of configuration that can be
done on the Bandura Cyber TIG.
IP Addressing Capabilities (IPv4 & IPv6)
Simultaneously supports both IPv4 and IPv6
for present and future infrastructure needs.
High Volume Traffic Capability
Available in five models, supporting network
speeds of 300 Mbps, 600 Mbps, 1 Gb, 2 Gb,
or 10 Gb.
Comprehensive Logging Utility
Maintains log history indexed for quick
access, providing a large set of information
for analysis.
Graphical User Interface (GUI)
A simple, intuitive web interface that makes
the Bandura Cyber TIG easy to administer.
6

Transparent Bridge
The Bandura Cyber TIG is a transparent bridge security appliance that can be rapidly deployed
in line with the network it protects, requiring no changes to an existing network. It uses
HIPPIE™ technology to filter packets by country, IP network, or specific IP address.
Additionally, it uses a Threat Intelligence Engine to filter packets based on dynamic threat
intelligence indicators that are integrated within Bandura Cyber TIG.
Unlike a traditional firewall, Bandura Cyber TIG is not configured in a NAT or Route mode.
Instead, Bandura Cyber TIG is a Level 2 bridge that filters traffic in line. Bandura Cyber TIG can
also be deployed out-of-band providing visibility into network traffic but no blocking capabilities.
Since the device operates at Level 2 of the OSI model, the network bridge ports are not visible
or searchable by anyone, keeping it out of reach of attackers.
A transparent bridge reduces the configuration complexity and saves time. In addition to its use
in large corporate and government networks, it is ideal for branch offices and smaller networks
which may consist of a single WAN connection and a router.
HIPPIE™ Filter
HIPPIE™ is a country code/Internet Protocol address engine that rapidly determines the country
of origin and Autonomous Systems Number (ASN) for incoming packets, and the destination
country and ASN for outgoing packets. The Bandura Cyber TIG country map GUI allows you to
specify which countries should be blocked or allowed based on your policy. You can also
specify additional allow/deny rules for IP networks or addresses with as much granularity as
desired across the entire IP address space.
1.2 Support
Please visit the Bandura Cyber TIG Help Desk site for answers to frequently asked questions.
Technical Support is available by phone and email according to the Service Level Agreement
that was purchased with the unit.
Help Desk Site
https://helpdesk.banduracyber.com
Phone
1-855-765-4925
Email
[email protected]
7

1.3 Specifications
MODEL COMPARISON
BT-500
BT-1G
BT-10G
Standard
(BT-1G)
High Availability
(BT-1G-A)
Data Center
(BT-1G-X
NETWORKING
Bridging Interface
Bypass Mode
1 Gb Copper
RJ45
Bypass Mode
1 Gb Copper
RJ45
Bypass Mode
1 Gb Copper
RJ45 or 1Gb
Short-Run Fiber
Bypass Mode
1 Gbit Copper
RJ45 or 1 Gbit
Short-Run Fiber
Bypass Mode
1 Gbit Copper
RJ45 or 1 Gbit
Short-Run Fiber
Bridge Pairs
Single
Single
Two Bridge Pairs
Active/Standby
Active/Active
Two Bridge Pairs
Active/Standby
Active/Active
Two Bridge Pairs
Active/Standby
Active/Active
Management Interface
10/100/1000
Copper RJ45
10/100/1000
Copper RJ45
10/100/1000
Copper RJ45
10/100/1000
Copper RJ45
10/100/1000
Copper RJ45
Throughput Limits
500 Mb
1 Gb
1 Gb
2 x 1 Gb
10 Gb
Connections per Second
10,000
10,000
40,000
80,000
500,000
Concurrent Connections
500,000
500,000
1,000,000
2,000,000
2,000,000
Typical Deployment
SOHO
Enterprise
Enterprise
Enterprise/Data
Center
Data Center
HARDWARE
Solid State Drive
✓
✓
✓
Redundant Power
Supplies
✓
✓
RAID
✓
✓
DIMENSIONS & POWER
Appliance Dimensions
7.25W x 5.5D x
1.7H (in)
17W x 11.5D x
1.7H (in)
17W x 11.5D x
1.7H (in)
17W x 26.5D x
1.7H (in)
17W x 26.5D x
1.7H (in)
Mounting
Desktop
1U rack mount
1U rack mount
1U rack mount
1U rack mount
Shipping Weight
5 lbs.
15 lbs.
25 lbs.
35 lbs.
35 lbs.
AC Power
100-240 VAC
100-240 VAC
100-240 VAC
100-240 VAC
100-240 VAC
8

1.4 What’s Included
The following items are included with the Bandura Cyber TIG:
● Appliance
● Power Cord(s)
● Rack Mount Equipment
● Welcome Sheet
● Registration Packet
2 Configuration
This high-speed security appliance will filter out known threats and unwanted internet traffic at
line speeds. Although it is powerful, the Bandura Cyber TIG is simple to configure with an
intuitive graphical interface. This section of the manual is a thorough guide to setting up a new
Bandura Cyber TIG. See the Bandura Cyber TIG Menu Reference section of this manual for
descriptions of the main screens of the Bandura Cyber TIG administration interface.
2.1 Initial Configuration
YOUR BANDURA CYBER TIG ARRIVES WITH AN ‘ALLOW ALL’ POLICY CONFIGURATION
Once the appliance is powered on, take a look at the back of the Bandura Cyber TIG and locate
the multiple ethernet ports. Depending on the model you have, you will see one or two ports
labeled ‘Outside’ and one or two ports labeled ‘Inside’, and a port labeled ‘Admin’. Any other
ports can be ignored for now.
We first want to set up the ‘Admin’ port, as this is the port where you will administer the Bandura
Cyber TIG. The ‘Admin’ port is also where your Bandura Cyber TIG will constantly receive
updated information from our servers. Connect an ethernet cable from the ‘Admin’ port of the
Bandura Cyber TIG to a switch inside your local network, then connect your computer to the
same switch.
9

Configuring a New Bandura Cyber TIG
● Review this manual thoroughly and consider your security plan.
● Configure your computer to have an internet address in the range of 192.168.1.12 to
192.168.1.254. To avoid any network routing problems, you may want to turn off any
other internet connections on this computer, such as WiFi.
● Connect your computer to the Admin port on the Bandura Cyber TIG, using a standard
UTP CAT5, CAT5e or CAT6 ethernet cable.
● The IP address of the Bandura Cyber TIG’s Administration Interface is 192.168.1.1, with
a network mask of 255.255.255.0.
● Configure the Bandura Cyber TIG according to this manual and your security plan and
place the Bandura Cyber TIG in your network.
2.2 First Login
2.2.1 Accessing the Bandura Cyber TIG
The setup process consists of readdressing the ‘Admin’ port of the Bandura Cyber TIG to fit
within your internal private networks. By default, the address is 192.168.1.1. Unless this address
is within one of your private networks, it will need to be readdressed.
Open a terminal or command prompt and ping the address with the following commands so we
can monitor when we have established a connection:
●Linux or Mac: ping 192.168.1.1
10

● Windows: ping -t 192.168.1.1
If you get a ‘Request Timed Out’ message, move on to the readdressing step and leave this
window up.
Readdressing
Windows:
● Go to your Network and Sharing Center and click Change Adapter Settings from the
left-hand side. Click on our connection.
● In the new window, select Properties. Select Internet Protocol Version 4 from the list
of items and click on Properties.
● Select the radio button next to Use the Following IP Address and input an IP address
of 192.168.1.2.
● The subnet mask should auto recognize this as a 24-bit mask. If not, you’ll need to
manually enter 255.255.255.0.
● After confirming your entry, click OK and close the Properties window. You should now
start seeing a reply from the Bandura Cyber TIG in the command prompt window.
Mac:
● Go to your System Preferences and click on Network.
● Find your network adaptor on the left and select Advanced.
● Go to TCP/IP Settings and configure as follows:
○ Configure IPv4: Manually
○ IPv4 Address: 192.168.1.2
○ Subnet Mask: 255.255.255.0
○ Router:
● Click OK and check your running terminal for the pings to start hitting the Bandura Cyber
TIG.
Linux:
● Visit our Helpdesk Article for assistance in setting up static IP addresses.
2.2.2 Logging In
In the address bar of your browser, type https://192.168.1.1. The ‘https’ heading is very
important as the Bandura Cyber TIG will not respond to a regular http request.
If you come across a screen stating that your connection is not secure, you’ll need to add an
exception, go to advanced settings, or click on a link that will allow you to connect after
accepting the warning (depending on your browser).
You should be directed to the Bandura Cyber TIG login screen. The default credentials are:
11

● Username: admin
● Password: admin
The first screen you should see when logging into your new Bandura Cyber TIG is the
registration screen. Now is the best time to register an account with the support site. Otherwise,
please be sure to register as soon as possible after completing the setup process. You can do
so by going to https://support.banduracyber.com and clicking Register.
2.2.3 Changing Your Password
YOU WILL NEED TO CHANGE YOUR ROLE TO SECURITY ADMIN TO MAKE ANY
SETTINGS CHANGES.
12

Navigate to Users > Accounts from the side menu to view your admin account. Find Actions
and click on the Edit User icon.
Click on the Change Password button at the top of the page. Enter a new password and enter
it again to confirm. Click Submit to save your changes.
YOUR PASSWORD CAN ALSO BE CHANGED FROM THE USERS > CHANGE PASSWORD
MENU OPTION.
By default, a new Bandura Cyber TIG requires passwords to be at least eight characters in
length. New passwords must also contain at least three characters per group, or classes of
characters.
13

There are four character groups:
● Upper case characters: A-Z
● Lower case characters: a-b
● Numbers: 0-9
● Symbols, such as: !@#$%^_
According to the default security settings on the Bandura Cyber TIG, these are valid passwords:
● Ar43P5df (eight characters and three groups)
● 3RTy_22e8 (nine characters and four groups)
These are not valid passwords:
● A4_e (only four characters)
● REVLPQWDSG (only one character group)
2.2.4 Changing Date/Time
It is important that your Bandura Cyber TIG has the correct time. Navigate to Settings >
Date/Timezone and set the correct timezone. Set the date and time if necessary.
2.2.5 Change Admin Interface Network Address
Your Bandura Cyber TIG’s administration port has the default IP address of 192.168.1.1. Unless
this is within your private network, you will need to readdress it.
The Bandura Cyber TIG has several levels of security for the administration port. Navigate to
Network > Admin Interface to limit access to this port from only specific networks or
addresses.
14

Enter the network where you will place the Bandura Cyber TIG into HTTPS IPv4 Access. You
cannot ping the Bandura Cyber TIG unless your IP address is added into the appropriate list.
Add your network and any other networks you would like to have ping access to Ping IPv4
Access.
15

The manual is using example network settings. Please be sure to input the correct information
to match your network during this step. Once you have added your local network to the ‘Ping
IPv4 Access’ list, you can readdress the Bandura Cyber TIG admin port.
Replace the default address with an open address on your private network and the
corresponding subnet mask, and input your Gateway and DNS Server addresses.
Once you have confirmed your addresses are input correctly, click on Submit. Be sure to select
Yes when the warning dialog box appears. This will allow the Bandura Cyber TIG to
automatically give the new network HTTPS access so you can log into the UI from the new
network.
16

Now you will need to revert the network setting changes that were made earlier:
Windows:
● Go to your Network and Sharing Center and select the radio button next to Obtain an
IP Address Automatically.
● Click OK and you should be redirected to the login page of the Bandura Cyber TIG.
Mac:
● Go to the network adapter screen we had open previously, and change the Configure
IPv4 drop down box back to DHCP, or your prior settings.
Linux:
● Visit our Help Desk Article for assistance in reverting your network settings.
If you come across a screen stating that your connection is not secure, you’ll need to add an
exception, go to advanced settings, or click on a link that will allow you to connect after
accepting the warning (depending on your browser).
2.2.6 Confirm the Bandura Cyber TIG can Access the Internet
We will want to confirm that the Bandura Cyber TIG is able to access our support server to get
updates. Navigate to Providers > System Providers from the side menu.
17

Take a look at the Last Updated section with the date and time of the last update. If the date
you see is not recent, the unit is still working to establish a connection with the support server.
You can click on Update Now in the upper right-hand corner to refresh the screen until you
have the correct date and time.
Now it’s time to place the Bandura Cyber TIG in your network. Connect the Outside ethernet
port toward the public internet, and the Inside ethernet port toward your internal network.
The following diagram shows the typical placement of the Bandura Cyber TIG into a network
between the internet border router and your firewall.
During this process, you will want to navigate to Network > Bridging Interface to confirm your
settings. You will see details about your Inside and Outside ethernet interfaces. Both interfaces
should read ‘No Link Detected’ before plugging in any cables. Refresh the page once you have
connected your cables to see the two links now being detected.
2.3 Console Modes
The Maintenance Mode Console and Recovery Console are low level interfaces to the
Bandura Cyber TIG, accessible only through the physical video, keyboard (USB or PS/2), and
serial ports on the Bandura Cyber TIG. These console modes are used to reset certain
functions of the Bandura Cyber TIG, or to restore it to factory default settings.
To use the console modes, you can attach a standard monitor with VGA connector and
keyboard with USB or PS/2 connector to the ports found on the front or back of the unit.
18

You can also use the RS-232 serial port, and connect a VT100 compatible text terminal or
terminal emulator, using these serial settings:
● 38400 baud
● 8 data bits
● 1 stop bit
● No parity
The Bandura Cyber TIG can be placed into Maintenance Mode at any time from the user
interface, or from the console itself. The Bandura Cyber TIG will enter Maintenance Mode if it
fails a Self Test or if log files fill up and overwrite is disabled.
When the Bandura Cyber TIG is placed into Maintenance Mode, all internet traffic is allowed to
flow through the Bandura Cyber TIG. The Bandura Cyber TIG will not begin to filter connections
until it is taken out of Maintenance Mode.
The recovery console can be used to restore the Bandura Cyber TIG to its factory default
settings, or correct specific items, such as resetting the admin account password.
Please be aware that attaching a networked virtual keyboard, video and mouse (KVM) device
or a serial device server to your Bandura Cyber TIG in order to remotely access console mode
may be a security risk.
2.4 Overview of Bandura Cyber TIG Configuration
Your Bandura Cyber TIG comes with three active ethernet network ports. Two of these ports
bridge and filter traffic between your local network and the internet, and the third port is used to
configure and monitor your Bandura Cyber TIG’s operation. The bridging and administration
ports are configured separately.
Your Bandura Cyber TIG has two broad categories of configuration which are largely unrelated
to each other:
● Configuration that filters internet traffic between the bridging ports, via rules, policies,
world maps, exception lists, etc.
● Configuration regarding administrative functions of the Bandura Cyber TIG, including
user accounts, the HTTPS server, SNMP, security certificates, etc.
2.5 Configuring the Bridge Filters
The Bandura Cyber TIG comes with two bridge ports:
● Connects to your internet connection or border gateway
● Connects to your firewall or main interior router
Resource groups are created to control the flow of data through these bridge ports.
19