Barracuda Control Server Service manual

Version 3.x

Copyright Notice
Copyright © 2004-2014, Barracuda Networks, Inc., 3175 S. Winchester Blvd, Campbell, CA 95008 USA
www.barracuda.com
v3.x-120323-06-140107sk
All rights reserved. Use of this product and this manual is subject to license. Information in this document is subject to change without notice.
Trademarks
Barracuda Cloud Control and Barracuda Control Server are trademarks of Barracuda Networks, Inc. All other brand and product names mentioned in this
document are registered trademarks or trademarks of their respective holders.

3
Contents
Chapter 1 – Getting Started . . . . . . . . . . . . . . . . . . . . . . . 5
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Concepts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Administrator Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Management Contexts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Cloud Control Context. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Group Context. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Product Context . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Exceptions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Chapter 2 – Using the Barracuda Control Server . . . . . . 11
Initial Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Prepare for Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Connect Barracuda Control Server to Network . . . . . . . . . . . . . . . . . 12
Configure IP Address and Network Settings . . . . . . . . . . . . . . . . . . 13
Network Path . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Configure Your Corporate Firewall . . . . . . . . . . . . . . . . . . . . . . . 13
Configure the Barracuda Control Server Administrative Settings. . . . . . . . 13
Configure SNMP Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Front Panel Indicator Lights. . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Connect to the Barracuda Control Server . . . . . . . . . . . . . . . . . . . . . 14
Using the Task Manager to Monitor System Tasks . . . . . . . . . . . . . . . . . 15
Troubleshooting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Testing Network Connectivity . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Connect to Barracuda Support Servers. . . . . . . . . . . . . . . . . . . . . 16
Contacting Technical Support. . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Chapter 3 – Accounts and Roles . . . . . . . . . . . . . . . . . . 17
Administrator Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Barracuda Control Server Administrator Account . . . . . . . . . . . . . 18
Barracuda Control Server Account Admin . . . . . . . . . . . . . . . . . 18
Creating the Barracuda Control Server Account Admin . . . . . . . . . . . . . . 18
Managing User Accounts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Administrator Actions . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Chapter 4 – Managing Products and Groups . . . . . . . . . 21
Barracuda Control Server Administration. . . . . . . . . . . . . . . . . . . . . . 22
Managing Products . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Connecting and Disconnecting Devices. . . . . . . . . . . . . . . . . . . . . 23
The Product Tree . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
The Firmware Tree . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
The Unit Health Pane . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Product Context . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Interpreting Device Statistics . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Synchronizing Settings Across a Group. . . . . . . . . . . . . . . . . . . . . 25
Settings Not Configurable in the Group Context . . . . . . . . . . . . . . . . 25
Dealing With Exceptions . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Exception Triangle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Exception Circle . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26

4 Barracuda Control Server Administrator’s Guide
Creating Groups. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Use Case Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Scenario: Opening a Support Tunnel on Multiple Devices . . . . . . . . . . . 27
Scenario: Synchronizing Firmware and Energize Updates . . . . . . . . . . . 28
Scenario: Applying Policies Across Multiple Barracuda Web Filters . . . . . . 28
Scenario: Aggregating Reports Across Multiple Products. . . . . . . . . . . . 28
Scenario: Synchronizing Security Policies Across Products . . . . . . . . . . 29
Chapter 5 – Task Manager . . . . . . . . . . . . . . . . . . . . . . . 31
Using the Task Manager to Monitor System Tasks . . . . . . . . . . . . . . . . . 32
Troubleshooting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Testing Network Connectivity . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Connect to Barracuda Support Servers. . . . . . . . . . . . . . . . . . . . . 32
Appendix A – About the Hardware . . . . . . . . . . . . . . . . . 33
Hardware Compliance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Notice for the USA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Notice for Canada . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Notice for Europe (CE Mark) . . . . . . . . . . . . . . . . . . . . . . . . 33
Appendix B – Limited Warranty and License . . . . . . . . . 35
Limited Warranty . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Exclusive Remedy. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
Exclusions and Restrictions . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Software License . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
Energize Update Software License . . . . . . . . . . . . . . . . . . . . . . . 37
Open Source Licensing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41

Getting Started 5
Chapter 1
Getting Started
This chapterprovides an overview of the Barracuda Control Server and describes important concepts.
Overview..............................................................................................6
Concepts ..............................................................................................6

6 Barracuda Control Server Administrator’s Guide
Overview
The Barracuda Control Server web interface enablesadministrators to monitor and configure multiple
Barracuda Networks products from a single console. Through the web interface, you can check the
health of all connected devices, run reports that are generated by gathering data from all the devices,
and assign roles with varied permissions to different types of users.
The Barracuda Control Server web interface provides for convenient configuration and management
of multiple Barracuda Networks device settings, while providing a view of each device web interface
for individual configuration or reporting.
Key statistics can be viewed by device type at a glance on the CLOUD CONTROL >Status page of the
web interface with the ability to drill down for more detail into the individual web interface for each
connected device.
This guide walks you through installation and initial configuration of your Barracuda Control Server,
and provides concepts and examples to help you understand how to manage Barracuda Networks
products with the Barracuda Control Server web interface according to your organization’s
deployment needs and security policies.
Concepts
Understanding these concepts enables you to take full advantage of the Barracuda Control Server
features for configuring and synchronizing settings on individual or groups of Barracuda Networks
products.
Administrator Access
There are two different administrator accounts:
•Barracuda Control Server Administrator Account – Manage and configure the Barracuda
Control Server. To configure and manage the Barracuda Control Server, log into the system
using admin as your user name and password. Once logged in, you can view and manage the
device, update security definitions, manage the displayed image, troubleshoot the device, and
view tasks and task errors.
•Barracuda Control Server Account Admin – Manage and connect products through the
Barracuda Control Server web interface. Create users and assign various permissions to each
user for access to the Barracuda Control Server, connect devices, and view device status.
Use the web interface to link your Barracuda Network devices including:
• Barracuda Spam Firewall
• Barracuda Web Filter
• Barracuda Web Application Firewall
• Barracuda Message Archiver
• Barracuda Link Balancer
• Barracuda Load Balancer
When you log in to the Barracuda Control Server as the account admin, the connected devices display
in the left pane.

Getting Started 7
Management Contexts
There are three ‘contexts’ you use to administer the Barracuda Control Server web interface and the
connected products. These contexts include:
•TheCloud Control context; for managing Barracuda Control Server web interface
configuration;
•TheProduct context; for managing an individual Barracuda Networks product using the
product web interface;
•TheGroup context; for managing a group of the same type of Barracuda Networks products
with one web interface, or for grouping products by company, location, or department.
These contexts are described briefly below.
Cloud Control Context
When you log into the Barracuda Control Server web interface, you first see the Cloud Control
context–on the CLOUD CONTROL > Status page–which displays a snapshot of product traffic
statistics for the connected Barracuda Networks product(s).
The Cloud Control pane on the left displays either a list of individual products connected to the
Barracuda Control Server, or groups of products which you create:

8 Barracuda Control Server Administrator’s Guide
The center pane provides an interface for managing your account and for connecting products, as well
as a snapshot of product traffic statistics for all connected products. The Unit Health pane on the right
includes a performance overview, connectivity, firmware, storage, and subscription status for each
individual product organized by product type:
Once you click on an individual product, either in the Cloud Control pane or in the Unit Health pane,
you leave the ‘Cloud Control context’ and drill-down into the product type web interface. The product
web interface displays activity for an individual product if you have only one of that type connected.
If you have multiple of one product type connected, the settings and statistics for all products of that
type display in one web interface as described below.
Group Context
Grouping Barracuda Networks products enables you to manage settings and apply policies across
multiple Barracuda Networks products of the same type from one web interface. You can also use
“grouping” to organize your Barracuda Networks products by location, company, department, etc.,
and you can include products of different types. Grouping happens in one of two ways:
1. By default, the Barracuda Control Server groups Barracuda Networks products by
product type. For example, if you have two or more Barracuda Web Application Firewalls
connected to a Barracuda Control Server, they are automatically grouped as such. You can then
click on that product type in the Cloud Control pane and see one web interface with aggregated
statistics and settings for all of the devices within that group. From the web interface, you can
set policies for all of the products in the group at the same time since they are the same product
type. This group context also enables reporting on aggregated statistics across a group.
2. You can create a grouping of two or more products. When you click on that group in the Cloud
Control pane, aggregated statistics display on the Status page for each product type in the group.
Additional reasons to manage products in the group context include:
• If you have many devices in one or more locations, managing them with a central console
enables you to easily track firmware versions across products and keep them up-to-date.
• Grouping devices by location helps you keep track of where each device is physically
located in case it needs service. As long as the unit is joined to the Barracuda Control
Server, you do not need to look up the admin password to configure or update the product.
• Grouping devices of the same type enables viewing ‘exceptions’ in which values for the
same setting differ across the devices.
• Grouping either devices of the same type or of different types provides a performance and
traffic statistic snapshot on the CLOUD CONTROL > Status page for each device in the
group. Statistics are aggregated for devices of the same type.

Getting Started 9
Product Context
If you have only one of any Barracuda Networks product type connected to the Barracuda Control
Server, when you click on that product link in the Cloud Control pane or in the Unit Health pane, the
web interface for that individual device displays. From the product web interface, you manage the
individual settings just as you would if you logged into the device directly.
Exceptions
When you have more than one of a Barracuda Networks product type connected to the Barracuda
Control Server, and you view the settings of all of them as a group (with one web interface as
described above), a yellow Exception ( ) icon displays if the value of the setting is not the same on
all devices in the group. When you hover the mouse over the icon, the Barracuda Control Server
clearly indicates what the values for that setting are on each device, so that you can change the settings
if desired. See Dealing With Exceptions for more information and examples.

10 Barracuda Control Server Administrator’s Guide

Using the Barracuda Control Server 11
Chapter 2
Using the Barracuda Control Server
This chapter covers features of the Barracuda Control Server appliance.
Initial Setup .......................................................................................12
Connect to the Barracuda Control Server.........................................14
Using the Task Manager to Monitor System Tasks............................15
Troubleshooting .................................................................................15
Contacting Technical Support............................................................16

12 Barracuda Control Server Administrator’s Guide
Initial Setup
These are the steps to set up your Barracuda Control Server.
Prepare for Installation
Before installing your Barracuda Control Server, verify you have the necessary equipment; if any
item is missing or damaged, please contact your Barracuda Networks Sales representative:
•BarracudaControl Server
• AC power cord
• Mounting rails
Also required for installation:
• Ethernet cables
• VGA monitor (recommended)
• PS2 keyboard (recommended)
Connect Barracuda Control Server to Network
To physically install the Barracuda Control Server:
1. Fasten the Barracuda Control Server to a standard 19-inch rack or other stable location.
2. Connect a CAT5 or CAT6 Ethernet cable from your network switch to the Ethernet port on the
back of your Barracuda Control Server.
The Barracuda Control Server supports both 10BaseT and 100BaseT Ethernet. Barracuda
Networks recommends using a 100BaseT connection for best performance.
Do not connect any other cables to the other connectors on the unit. These connectors are for
diagnostic purposes.
3. Connect a standard VGA monitor, PS2 keyboard, and the AC Power Cord to the appliance.
AC input voltage range is 100-240 volts at 50/60 Hz.
After you connect the AC power cord the Barracuda Control Server may power on for a few
seconds and then power off. This is standard behavior.
4. Press the Power button located on the front of the unit.
The login prompt for the administrative console displays on the monitor, and the light on the
front of the system turns on. For a description of each indicator light, refer to Front Panel
Indicator Lights.
Caution
Do not block the cooling vents located on the front and rear of the unit.

Using the Barracuda Control Server 13
Configure IP Address and Network Settings
To set an IP address from the administrative console:
1. Connect your keyboard and monitor directly to the Barracuda Control Server.
2. At the barracuda login prompt, enter admin for the login and admin for the password.
The User Confirmation Requested window displays the current IP configuration of the
Barracuda Control Server.
3. Using your Tab key, select Change and press Enter to change the IP configuration.
4. Enter the new IP address, netmask, and default gateway for your Barracuda Control Server.
Select Save to enter your changes. Select Exit.
The new IP address and network settings are applied to your Barracuda Control Server.
Network Path
Barracuda devices you wish to manage through the Barracuda Control Server must have a network
path between the two devices and at least one of the following ports available to communicate
between the devices: port 80, 8000, 23557, or 48320.
Configure Your Corporate Firewall
If your Barracuda Control Server is located behind a corporate firewall, you may need to open ports
1194 and ports 5120-5129 outbound for both TCP and UDP to allow communication between the
Barracuda Control Server and the Internet.
These ports are used to transfer data either to the Barracuda Control Server, or to another Barracuda
Networks appliance over the Internet. To restrict outbound network traffic on these ports, contact
Barracuda Networks Technical Support for a list of the IP addresses to allow.
Configure the Barracuda Control Server Administrative Settings
After specifying the IP address of the Barracuda Control Server, configure the Barracuda Control
Server from the administration interface.
To configure administrative settings on the Barracuda Control Server:
1. From a web browser, enter http:// followed by the IP address of the Barracuda Control Server,
followed by the default web interface HTTP Port (:8000).
For example: http://192.168.200.200:8000
2. Log into the administration interface using admin for both the username and password.
3. Go to CLOUD CONTROL > IP Configuration, and perform the following steps:
3a. In the TCP/IP Configuration section, verify the IP address, netmask, and default
gateway for your Barracuda Control Server (entered in step 4. above in the Configure
IP Address and Network Settings section).
3b. In the DNS Configuration section, enter the IP address of your primary and secondary
DNS servers (if these have not yet been set up).

14 Barracuda Control Server Administrator’s Guide
3c. If the Barracuda Control Server is behind a proxy server, enter the proxy server IP
address and port number, and if required, enter the proxy server username and password
in the Proxy Server Configuration section.
3d. Enter the default domain name of the Barracuda Control Server in the Domain
Configuration section.
Click Save Changes.
Configure SNMP Access
You can configure SNMP access between the Barracuda Control Server and an SNMP monitor or
other program used to query for system information on the CLOUD CONTROL > Administration page.
Front Panel Indicator Lights
The Barracuda Control Server has five indicator lights on the front panel that blink when the system
processes any message. Figure 2.1 displays the location of each of the lights.
Figure 2.1: Barracuda Control Server front panel indicator lights
Connect to the Barracuda Control Server
You can connect one or more Barracuda Networks products to a Barracuda Control Server by doing
the following:
1. Log into the Barracuda Control Server web interface as the Barracuda Control Server Account
Admin.
2. The CLOUD CONTROL > Status page displays, including a message indicating that no products
are connected.
3. Go to the CLOUD > Connect Products page, and copy the Validation Token.
4. In another browser window, log into the product you wish to connect to the Barracuda Control
Server as the administrator. From the product ADVANCED > Firmware Upgrade page, check to
Note
Whenever your Barracuda Control Server IP address is changed on the IP Configuration
page,you are disconnected fromthe administration interface. Youmust log in againusing
the new IP address.

Using the Barracuda Control Server 15
make sure you have the latest firmware installed on the product. If not, download and install it
before proceeding.
5. Enable Expert Mode on the product you wish to connect to by adding the following content to
the end of the URL in your browser address bar:
&expert=1
6. From the ADVANCED > Cloud Control page on the product, select Yes for Connect to
Barracuda Cloud Control.
7. Enter the username and password of the account admin for your Barracuda Control Server.
8. In the Barracuda Cloud Control field, enter the IP address or hostname of the Barracuda
Control Server.
9. Paste the Barracuda Control Server validation token you copied in step 3 into the associated
field.
10. Click Save Changes. Note that your product can connect with only one Barracuda Control
Server at a time.
11. In the Barracuda Control Server web interface, refresh your browser page and you should see, in
the Products pane on the left side of the page, a (1) immediately to the right of the newly
connected Barracuda Networks product type. By default, statistics are presented for that
product. Click on the product link to configure using the web interface for that device.
Using the Task Manager to Monitor System Tasks
The ADVANCED > Task Manager page provides a list of tasks that are in the process of being
performed, and displays any errors encountered when performing these tasks. Some of the tasks that
the Barracuda Control Server tracks include:
• Configuration restoration
• Connections
• Removal of invalid users
If a task takes a long time to complete, you can click the Cancel link next to the task name and then
run the task at a later time when the system is less busy. The Task Errors section lists an error until
you manually remove it from the list; errors are not automatically phased out over time.
Troubleshooting
Testing Network Connectivity
The Barracuda Control Server web interface provides a suite of tools to help diagnose potential
network problems, including ping, telnet, dig/NS-lookup, TCP dump, and traceroute. See the online
help on the Network Connectivity Tests section of the ADVANCED > Troubleshooting page for
details about using these tools. You must be logged in as the Barracuda Control Server administrator
to access the troubleshooting tools.

16 Barracuda Control Server Administrator’s Guide
Connect to Barracuda Support Servers
In the Support Diagnostics section of the ADVANCED > Troubleshooting page, you can initiate a
connection between your Barracuda Control Server and the Barracuda Networks Technical Support
Center which allows technical support engineers to troubleshoot any issues you may be experiencing.
Contacting Technical Support
To contact Barracuda Networks Technical Support:
• By phone: call 1-408-342-5400, or if you are in the United States, (888) Anti-Spam, or
[phone]
• By email: use [email protected]
• Online: visit http://www.barracuda.com/support and click Support Case Creation.
There is also a Barracuda Networks Support Forum available where users can post and answer other
users’ questions. You can log in or create a new Barracuda Networks account by clicking Sign In at
https://community.barracudanetworks.com/.

Accounts and Roles 17
Chapter 3
Accounts and Roles
Use this chapter to understand managing user accounts and permissions.
Administrator Access .........................................................................18
Managing User Accounts...................................................................19

18 Barracuda Control Server Administrator’s Guide
Administrator Access
There are two different administrator accounts, one to manage and configure the Barracuda Control
Server including IP configuration and SNMP management, and one to create users and connect and
manage products through the Barracuda Control Server web interface.
Barracuda Control Server Administrator Account
To configure and manage the Barracuda ControlServer, log into the device using admin as both your
user name and password. Once logged in, you can view and manage the device, update security
definitions, manage the images displayed in the web interface, troubleshoot thedevice, view tasks and
task errors, and create the Barracuda Control Server Account Admin. To change your password, log
into the web interface, and go to CLOUD CONTROL > My Account and change your password.
Barracuda Control Server Account Admin
Through the Barracuda Control Server web interface, you create users and assign various permissions
to each user for access to the Barracuda Control Server, connect devices, and view device status.
Use the web interface to link your Barracuda Networks devices, including:
• Barracuda Web Filter
• Barracuda Web Application Firewall
• Barracuda Message Archiver
• Barracuda Link Balancer
• Barracuda Load Balancer
When you log into the Barracuda Control Server as a Barracuda Control Server Account Admin, the
connected devices display in the left pane.
Creating the Barracuda Control Server Account Admin
To create the Barracuda Control Server Account Admin, log into the web interface using the
Barracuda Control Server Administrator Account (admin/admin), and complete the following steps:
1. Go to the CLOUD CONTROL > Account Management page, and in the Account Creation
section, enter the account admin name, administrator email address, and select the preferred
time zone for the account.
2. Click Create Account. The account displays in the Account View section.
3. A confirmation email containing the login credentials is sent to the email address entered in step
1 above. Use these credentials to log into the web interface to create users and assign
permissions, connect devices, and view device status.

Accounts and Roles 19
Managing User Accounts
To create a new Barracuda Control Server user, log into the Barracuda Control Server web interface
as the Barracuda Control Server Account Admin, and then use the following steps:
1. Go to the CLOUD CONTROL > User Management page, and in the Create User section, enter
the user email address, and select the preferred time zone.
2. From the Role drop-down menu, select from the following options:
•View Status only - User can view connected device statistics based on Access settings on
the CLOUD CONTROL > Status page.
•View Reports, Logs, and Status only - User can view connected device statistics on the
CLOUD CONTROL > Status page, and track events such as login, connecting, or
disconnecting specific devices by user, account, name, and date/time on the CLOUD
CONTROL > Audit Log page. You may wish to assign this role to a support person or
office manager to provide performance and traffic reports for each product type.
•AllActions- Use this role to create a Barracuda Control Server administrator account;
user can create users and assign permissions, connect devices, view device status, and
view tasks and task errors based on Access settings.
•Account Admin - Use this role to create a Barracuda Control Server account admin;
user can configure and manage the Barracuda Control Server, update security definitions,
and view tasks and task errors.
3. The Access list displays all devices currently connected to the Barracuda Control Server by
group. Select only those units you wish to make available to the user. Limit which units to which
the user has access. When a unit is checked, the user always has access to that unit. When a
folder is checked, the user has access to everything under that folder including and Barracuda
Networks devices added under the folder in the future. Removing units from the folder in the
future removes the user access. Note that the Account Admin role always has access to all
connected devices.
4. Click Create User to add the new user. An email is sent to the user’s email address with their
log in username and password. Once added, the user account displays in the User View table.
Administrator Actions
Once you create a user, the user account details display in the User View table on the CLOUD
CONTROL > User Management page. From this table you can take the following actions:
•Reset Password – Resets the user’s password; a new password is automatically generated and
sent to the user’s email address.
•Edit User – Modify the user’s time zone, role, and device access.
•Deactivate/Activate - Suspend or restart a Barracuda Control Server user account. Deactivated
users can no longer log into the Barracuda Control Server.
Note
Once logged into the Barracuda Control Server, users can manage their own
account information using the CLOUD CONTROL > My Account page.

20 Barracuda Control Server Administrator’s Guide