CyberGuard SnapGear User manual

SnapGearFirewall VPN Appliance
User Manual
Revision 1.9.1
March 12,2004
SnapGear –A CyberGuard Company
7984 South Welby Park Drive #101
Salt Lake City, Utah 84084
Email: [email protected]
Web: www.snapgear.com

Contents
1. Introduction.............................................................................................. 1
SnapGear Gateway Appliances ...........................................................................1
SnapGear PCI Appliances ...................................................................................2
Document Conventions........................................................................................4
Your SnapGear Gateway Appliance.....................................................................5
SnapGear Gateway Appliance Features..............................................................8
Your SnapGear PCI Appliance.............................................................................9
SnapGear PCI Appliance Features....................................................................10
2. Getting Started....................................................................................... 11
SnapGear Gateway Appliances .........................................................................11
Set up a PC to Connect to the SnapGear Management Console.......................11
Set up the SnapGear Appliance’s Password and LAN Connection Settings.......14
Set up the SnapGear Appliance’s Internet Connection Settings.........................17
Set up the PCs on your LAN to Access the Internet...........................................18
SnapGear PCI Appliances .................................................................................22
Install your SnapGear Appliance in a Spare PCI Slot.........................................22
Install the Network Driver on your PC................................................................22
Set up your PC to Connect to the SnapGear Management Console..................22
Set up the SnapGear Appliance’s Password and Network Connection Settings.24
Disabling the Reset Button on your SnapGear PCI Appliance............................29
3. Network Connections............................................................................30
Connections.......................................................................................................30
LAN....................................................................................................................31
Internet...............................................................................................................32
Internet Connection Methods.............................................................................33
COM/Modem......................................................................................................36
DMZ...................................................................................................................38
Services on the DMZ Network............................................................................38
Load Balancing..................................................................................................39
Internet Failover.................................................................................................40
Routes ...............................................................................................................42
Advanced...........................................................................................................43
QoS Traffic Shaping...........................................................................................47

4. Dialin Setup ............................................................................................ 48
Dialin Setup .......................................................................................................49
Dialin User Accounts..........................................................................................51
Remote User Configuration................................................................................54
5. DHCP Server........................................................................................... 60
DHCP Server Configuration...............................................................................60
DHCP Proxy ......................................................................................................64
6. Firewall.................................................................................................... 65
Incoming Access................................................................................................65
SnapGear Web Server.......................................................................................67
Packet Filtering..................................................................................................70
NAT ...................................................................................................................74
Rules .................................................................................................................77
Access Control and Content Filtering.................................................................78
7. Intrusion Detection ................................................................................86
Basic Intrusion Detection and Blocking..............................................................88
Advanced Intrusion Detection............................................................................90
8. Web Cache..............................................................................................95
Web Cache Setup..............................................................................................96
Network Shares .................................................................................................97
Peers ...............................................................................................................100
Set up LAN PCs to Use the Web Cache ..........................................................100
9. Virtual Private Networking...................................................................101
PPTP Client Setup...........................................................................................102
PPTP Server Setup..........................................................................................104
IPSec Setup.....................................................................................................115
Configuring the Branch Office SnapGear Appliance.........................................115
Configuring the Headquarters SnapGear Appliance.........................................129
Tunnel List.......................................................................................................133
NAT Traversal Support....................................................................................137
Dynamic DNS Support.....................................................................................137
Certificate Management...................................................................................138
Troubleshooting...............................................................................................144
GRE.................................................................................................................148
L2TP................................................................................................................154

10. System .................................................................................................. 156
Date and Time .................................................................................................156
Users ...............................................................................................................158
Diagnostics......................................................................................................161
Advanced.........................................................................................................163
Technical Support............................................................................................166
Appendix A –IP Address Ranges............................................................... 167
Appendix B –Terminology .......................................................................... 168
Appendix C –System Log ...........................................................................175
Access Logging................................................................................................175
Creating Custom Log Rules .............................................................................177
Rate Limiting....................................................................................................180
Administrative Access Logging ........................................................................180
Boot Log Messages .........................................................................................181

Introduction 1
1. Introduction
This chapter provides an overview of your SnapGear appliance’s features and
capabilities, and explains how to install and configure your SnapGear appliance.
This manual describes how to take advantage of the features of your SnapGear
appliance, including setting up network connections, a secure firewall and a VPN. It also
describes how to set up the SnapGear appliance on your existing or new network using
the SnapGear Management Console web administration pages.
SnapGear Gateway Appliances
The SnapGear gateway appliance range (SME530, SME550, SME570, SME575)
enables your office LAN to share a single, secure Internet connection.
The SnapGear appliance provides Internet security and privacy of communications for
small and medium enterprises. It simply and securely connects your office to the
Internet, and with its robust stateful firewall, shields your computers from outside threats.
The SnapGear appliance checks and filters data packets to prevent unauthorized
intruders gaining access.
The SnapGear appliance’s NAT/masquerading firewall means that although computers
on your office network can see and access resources on the Internet, all outsiders see is
the SnapGear gateway appliance’s external address.
SnapGear appliance models SME570 and SME575 have an additional Ethernet port that
may be configured as a physically separate DMZ to host servers accessible to the
outside world,in order to further secure your local network. Alternatively,it may be
configured as a second Internet connection to perform network load balancing.
The SnapGear appliance provides you with a Virtual Private Network (VPN) server. A
VPN enables remote workers or branch offices to securely access your company network
to send and receive data at a very low cost. With the SnapGear appliance, you can
remotely access your office network securely using the Internet. The SnapGear
appliance can also connect to external VPNs as a client.

Introduction 2
The following figure shows how your SnapGear appliance interconnects.
Figure 1-1
SnapGear PCI Appliances
The SnapGear PCI appliance (PCI630, PCI635)is a hardware-based firewall and VPN
server embedded in a 10/100 Ethernet PCI network interface card (NIC). It is installed
into the host PC like a regular NIC, providing a transparent firewall to shield the host PC
from malicious Internet traffic, and VPN services to allow secure remote access to the
host PC.
This appliance is recommended for:
•Security conscious businesses that wish to separate firewall and VPN issues from
server/desktop operating systems.
•Businesses that wish to eliminate the "soft center".
•For environments where the integrity of the host server operating environment
cannot be controlled or trusted.
Unlike SnapGear gateway appliances, a single SnapGear PCI appliance it is not intended
as a means for your entire office LAN to be connected to, and shielded from, the Internet.
Installing a SnapGear appliance in each network connected PC gives it its own
independently manageable, enterprise-grade VPN server and firewall, running in isolation
from the host operating system.

Introduction 3
This approach offers an increased measure of protection against internal threats as well
as conventional Internet security concerns. You can update, configure and monitor the
firewall and VPN connectivity of a workstation or server from any web browser. In the
event of a breach, you have complete control over individual PCs' access policies
independent of the host PC's operating system, even if the system has been subverted
and is denying normal administrator access.
All network filtering and what can be CPU intensive cryptographic processing is handled
entirely by the SnapGear appliance. This has the advantage over the traditional
approach of a host-based personal software firewall and VPN services of not taxing the
host PC's resources.
Bridged mode
By default, the SnapGear PCI appliance operates in bridged mode. This is distinctly
different from the NAT/masquerading behavior of the SnapGear gateway appliance
range.
In bridged mode, the SnapGear appliance uses two IP addresses. Note that these
addresses are both in the same range as the LAN, as no NAT/masquerading is being
performed (see the chapter entitled Firewall for more information).
One IP address is used to manage the SnapGear appliance via the SnapGear
management console web administration pages.
The other is the host PC's IP address, configurable through the host operating system
identical to a regular NIC. This is the IP address that other PCs on the LAN see. It
should be dynamically (DHCP) or statically configured to use the same gateway, DNS,
etc. settings as a regular PC on the LAN.
It is possible to configure the SnapGear appliance to run in NAT mode. This is discussed
in the chapter entitled Network Connections.
Secure by default
By default,the SnapGear applianceruns a fully secured stateful firewall. This means
from the PC that it is plugged into, most network resources are freely accessible.
However, any services that the PC provides, such as file shares or web services (e.g. IIS)
will not be visible to thegeneral office LAN without further configuration of the SnapGear
appliance.For details on how services on the host PC can be made available to the
general office LAN, see the section Allowing individual ports in bridged mode at the end
of the chapter entitled Firewall.

Introduction 4
Document Conventions
This document uses different fonts and typefaces to show specific actions.
Warning/Note
Text like this highlights important issues.
Bold text in procedures indicates text that you type,or the name of a screen object (e.g.
a menu or button).

Introduction 5
Your SnapGear Gateway Appliance
SnapGear gateway appliances include:
•SME530
•SME550
•SME570
•SME575
The following items are included with your SnapGear gateway appliance:
•Power adaptor
•Installation CD
•Printed Quick Install guide
•Cabling including
o1normal straight through UTP cable (blue color)
o1crossover UTP cable (either gray or red color)
Front panel LEDs
The front and rear panels contain LEDs indicating status. An example of the front panel
LEDs are illustrated in the following figure and detailed in the following table.
Figure 1-2

Introduction 6
Note
Not all the LEDs described below are present on all SnapGear appliance models.Also,
labels vary from model to model.
Label Activity Description
Power On Power is supplied to the SnapGear appliance
Flashing The SnapGear appliance is operating correctly
Heart Beat
On If this LED is on and not flashing, an operating error
has occurred
LAN Activity
Flashing Network traffic on the LAN network interface
WAN Activity
Flashing Network traffic on the Internet network interface
DMZ Activity Flashing Network traffic on the DMZ network interface
Serial Activity
Flashing For either of the SnapGear appliance COM ports,
these LEDs indicate receive and transmit data
Online On An Internet connection has been established
VPN On Virtual Private Networking is enabled