D-Link DFL-1600 - Security Appliance User manual

CONTENTS
I Preface xvi
Document Version .............................. xvii
Disclaimer ................................... xvii
About this Document ............................ xvii
Typographical Conventions ........................ xviii
II Product Overview 2
1 Capabilities 3
1.1 Product Highlights .......................... 3
III Introduction to Networking 6
2 The OSI Model 7
3 Firewall Principles 9
3.1 The Role of the Firewall ...................... 9
3.1.1 What is a Firewall? ..................... 9
3.1.2 How does a Firewall work? ................. 9
3.2 What does a Firewall NOT protect against? ........... 10
3.2.1 Attacks on Insecure pre-installed Components . . . . . 11
3.2.2 Inexperienced Users on protected Networks . . . . . . . 11
3.2.3 Data-Driven Network Attacks ............... 11
3.2.4 Internal Attacks ....................... 13
3.2.5 Modems and VPN Connection .............. 13
3.2.6 Holes between DMZs and Internal Networks . . . . . . 14
i

ii
IV Administration 18
4 Configuration Platform 19
4.1 Configuring Via WebUI ....................... 19
4.1.1 Overview ............................ 19
4.1.2 Interface Layout ....................... 19
4.1.3 Configuration Operations .................. 22
4.2 Monitoring Via CLI .......................... 23
5 Logging 25
5.1 Overview ................................ 25
5.1.1 Importance & Capability .................. 25
5.1.2 Events ............................. 26
5.2 Log Receivers .............................. 28
5.2.1 Syslog Receiver ........................ 28
5.2.2 Memory Log Receiver .................... 29
5.2.3 SMTP Event Receiver .................... 29
6 Maintenance 31
6.1 Firmware Upgrades .......................... 31
6.2 Reset To Factory Defaults ...................... 32
6.3 Backup Configuration ........................ 34
7 Advanced Settings 35
7.1 Overview ................................ 35
V Fundamentals 38
8 Logical Objects 39
8.1 Address Book ............................. 39
8.1.1 IP address ........................... 39
8.1.2 Ethernet address ....................... 41
8.2 Services ................................. 41
8.2.1 Service Types ......................... 42
8.2.2 Error Report & Connection Protection . . . . . . . . . 46
8.3 Schedules ................................ 48
8.4 X.509 Certificates ........................... 49
8.4.1 Introduction to Certificates ................. 49
8.4.2 X.509 Certificates in D-Link Firewall . . . . . . . . . . 51
D-Link Firewalls User’s Guide

iii
9 Interfaces 53
9.1 Ethernet ................................. 53
9.1.1 Ethernet Interfaces ...................... 53
9.1.2 Ethernet Interfaces in D-Link Firewalls . . . . . . . . . 54
9.2 Virtual LAN (VLAN) ........................ 56
9.2.1 VLAN Infrastructure .................... 56
9.2.2 802.1Q VLAN Standard .................. 57
9.2.3 VLAN Implementation ................... 58
9.2.4 Using Virtual LANs to Expand Firewall Interfaces . . 59
9.3 DHCP .................................. 60
9.3.1 DHCP Client ......................... 60
9.4 PPPoE .................................. 61
9.4.1 PPP ............................... 62
9.4.2 PPPoE Client Configuration ................ 62
9.5 Interface Groups ............................ 65
9.6 ARP ................................... 66
9.6.1 ARP Table ........................... 66
10 Routing 69
10.1 Overview ................................ 69
10.2 Routing Hierarchy ........................... 70
10.3 Routing Algorithms .......................... 71
10.3.1 Static Routing ........................ 71
10.3.2 Dynamic Routing ....................... 72
10.3.3 OSPF .............................. 74
10.4 Route Failover ............................. 77
10.4.1 Scenario: Route Failover Configuration . . . . . . . . . 78
10.5 Dynamic Routing Implementation ................. 81
10.5.1 OSPF Process ......................... 81
10.5.2 Dynamic Routing Policy .................. 81
10.5.3 Scenarios: Dynamic Routing Configuration . . . . . . 82
10.6 Scenario: Static Routing Configuration .............. 87
10.7 Policy Based Routing(PBR) ..................... 88
10.7.1 Overview ............................ 88
10.7.2 Policy-based Routing Tables ................ 89
10.7.3 Policy-based Routing Policy ................ 89
10.7.4 PBR Execution ........................ 89
10.7.5 Scenario: PBR Configuration ............... 91
10.8 Proxy ARP ............................... 94
D-Link Firewalls User’s Guide

iv
11 Date & Time 95
11.1 Setting the Date and Time ..................... 96
11.1.1 Current Date and Time ................... 96
11.1.2 Time Zone ........................... 96
11.1.3 Daylight Saving Time(DST) ................ 97
11.2 Time Synchronization ........................ 98
11.2.1 Time Synchronization Protocols .............. 98
11.2.2 Timeservers .......................... 98
11.2.3 Maximum Adjustment ................... 99
11.2.4 Synchronization Interval .................. 99
12 DNS 101
13 Log Settings 103
13.1 Implementation ............................ 103
13.1.1 Defining Syslog Receiver .................. 103
13.1.2 Enabling Logging ....................... 104
VI Security Polices 108
14 IP Rules 109
14.1 Overview ................................ 109
14.1.1 Fields .............................. 110
14.1.2 Action types .......................... 111
14.2 Address Translation .......................... 112
14.2.1 Overview ............................ 112
14.2.2 NAT ............................... 112
14.2.3 Address translation in D-Link Firewall . . . . . . . . . 114
14.3 Scenarios: IP Rules Configuration . . . . . . . . . . . . . . . . . 116
15 Access (Anti-spoofing) 123
15.1 Overview ................................ 123
15.1.1 IP Spoofing .......................... 123
15.1.2 Anti-spoofing ......................... 124
15.2 Access Rule ............................... 124
15.2.1 Function ............................ 124
15.2.2 Settings ............................. 124
15.3 Scenario: Setting up Access Rule . . . . . . . . . . . . . . . . . 126
D-Link Firewalls User’s Guide

v
16 DMZ & Port Forwarding 127
16.1 General ................................. 127
16.1.1 Concepts ............................ 127
16.1.2 DMZ Planning ........................ 129
16.1.3 Benefits ............................. 130
17 User Authentication 131
17.1 Authentication Overview ...................... 131
17.1.1 Authentication Methods .................. 131
17.1.2 Password Criterion ...................... 132
17.1.3 User Types ........................... 133
17.2 Authentication Components ..................... 134
17.2.1 Local User Database(UserDB) . . . . . . . . . . . . . . . 134
17.2.2 External Authentication Server .............. 134
17.2.3 Authentication Agents ................... 135
17.2.4 Authentication Rules .................... 136
17.3 Authentication Process ........................ 137
17.4 Scenarios: User Authentication Configuration . . . . . . . . . 137
VII Content Inspection 146
18 Application Layer Gateway (ALG) 147
18.1 Overview ................................ 147
18.2 FTP ................................... 148
18.2.1 FTP Connections ....................... 148
18.2.2 Scenarios: FTP ALG Configuration . . . . . . . . . . . 150
18.3 HTTP .................................. 155
18.3.1 Components & Security Issues . . . . . . . . . . . . . . . 155
18.3.2 Solution ............................ 156
18.4 H.323 ................................... 158
18.4.1 H.323 Standard Overview .................. 158
18.4.2 H.323 Components ...................... 158
18.4.3 H.323 Protocols ........................ 159
18.4.4 H.323 ALG Overview .................... 160
18.4.5 Scenarios: H.323 ALG Configuration . . . . . . . . . . 161
19 Intrusion Detection System (IDS) 181
19.1 Overview ................................ 181
19.1.1 Intrusion Detection Rules .................. 182
19.1.2 Pattern Matching ....................... 182
D-Link Firewalls User’s Guide

vi
19.1.3 Action ............................. 182
19.2 Chain of Events ............................ 183
19.2.1 Scenario 1 ........................... 183
19.2.2 Scenario 2 ........................... 184
19.3 Signature Groups ........................... 186
19.4 Automatic Update of Signature Database . . . . . . . . . . . . 186
19.5 SMTP Log Receiver for IDS Events ................ 187
19.6 Scenario: Setting up IDS ...................... 189
VIII Virtual Private Network (VPN)192
20 VPN Basics 193
20.1 Introduction to VPN ......................... 193
20.1.1 VPNs vs Fixed Connections ................ 193
20.2 Introduction to Cryptography ................... 195
20.2.1 Encryption ........................... 195
20.2.2 Authentication & Integrity . . . . . . . . . . . . . . . . . 198
20.3 Why VPN in Firewalls ........................ 200
20.3.1 VPN Deployment ....................... 201
21 VPN Planning 207
21.1 VPN Design Considerations ..................... 207
21.1.1 End Point Security ...................... 208
21.1.2 Key Distribution ....................... 210
22 VPN Protocols & Tunnels 213
22.1 IPsec ................................... 213
22.1.1 IPsec protocols ........................ 214
22.1.2 IPsec Encapsulation Modes ................ 214
22.1.3 IKE ............................... 215
22.1.4 IKE Integrity & Authentication .............. 219
22.1.5 Scenarios: IPsec Configuration .............. 223
22.2 PPTP/ L2TP ............................. 228
22.2.1 PPTP .............................. 228
22.2.2 L2TP .............................. 234
22.3 SSL/TLS (HTTPS) .......................... 243
D-Link Firewalls User’s Guide

vii
IX Traffic Management 246
23 Traffic Shaping 247
23.1 Overview ................................ 247
23.1.1 Functions ............................ 248
23.1.2 Features ............................ 249
23.2 Pipes ................................... 249
23.2.1 Precedences and Guarantees ................ 250
23.2.2 Grouping Users of a Pipe .................. 252
23.2.3 Dynamic Bandwidth Balancing .............. 253
23.3 Pipe Rules ............................... 253
23.4 Scenarios: Setting up Traffic Shaping . . . . . . . . . . . . . . . 253
24 Server Load Balancing (SLB) 261
24.1 Overview ................................ 261
24.1.1 The SLB Module ....................... 261
24.1.2 SLB Features ......................... 262
24.1.3 Benefits ............................. 263
24.2 SLB Implementation ......................... 264
24.2.1 Distribution Modes ..................... 264
24.2.2 Distribution Algorithms ................... 264
24.2.3 Server Health Checks .................... 266
24.2.4 Packets Flow by SAT .................... 268
24.3 Scenario: Enabling SLB ....................... 268
X Misc.Features 272
25 Miscellaneous Clients 273
25.1 Overview ................................ 273
25.2 Dynamic DNS ............................. 273
25.3 Automatic Client Login ....................... 274
25.4 HTTP Poster .............................. 275
25.4.1 URL Format .......................... 275
26 DHCP Server & Relayer 277
26.1 DHCP Server .............................. 277
26.2 DHCP Relayer ............................. 279
D-Link Firewalls User’s Guide

viii
XI Transparent Mode 282
27 Transparent Mode 283
27.1 Overview ................................ 283
27.2 Transparent Mode Implementation in D-Link Firewalls . . . . 284
27.3 Scenarios: Enabling Transparent Mode .............. 286
XII ZoneDefense 292
28 ZoneDefense 293
28.1 Overview ................................ 293
28.2 ZoneDefense Switches ......................... 293
28.2.1 SNMP ............................. 294
28.3 Threshold Rules ............................ 295
28.4 Manual Blocking & Exclude Lists . . . . . . . . . . . . . . . . . 295
28.5 Limitations ............................... 296
28.6 Scenario: Setting Up ZoneDefense . . . . . . . . . . . . . . . . . 296
XIII High Availability 300
29 High Availability 301
29.1 High Availability Basics ....................... 301
29.1.1 What High Availability will do for you . . . . . . . . . 301
29.1.2 What High Availability will NOT do for you . . . . . . 302
29.1.3 Example High Availability setup . . . . . . . . . . . . . 303
29.2 How Rapid Failover is Accomplished . . . . . . . . . . . . . . . 303
29.2.1 The shared IP address and the failover mechanism . . 304
29.2.2 Cluster heartbeats ...................... 305
29.2.3 The synchronization interface . . . . . . . . . . . . . . . 306
29.3 Setting up a High Availability Cluster .............. 306
29.3.1 Planning the High Availability cluster . . . . . . . . . . 307
29.3.2 Creating a High Availability cluster . . . . . . . . . . . 307
29.4 Things to Keep in Mind ....................... 309
29.4.1 Statistics and Logging Issues ................ 309
29.4.2 Configuration Issues ..................... 310
XIV Appendix 312
A Console Commands Reference 315
D-Link Firewalls User’s Guide

ix
List of Commands .............................. 315
About .................................. 315
Access .................................. 316
ARP ................................... 316
ARPSnoop ............................... 317
Buffers .................................. 317
Certcache ................................ 318
CfgLog .................................. 319
Connections ............................... 319
Cpuid .................................. 320
DHCP .................................. 320
DHCPRelay .............................. 321
DHCPServer .............................. 321
DynRoute ................................ 322
Frags ................................... 322
HA .................................... 322
HTTPPoster .............................. 323
Ifacegroups ............................... 324
IfStat ................................... 324
Ikesnoop ................................. 325
Ipseckeepalive ............................. 326
IPSectunnels .............................. 326
IPSecstats ................................ 326
Killsa ................................... 327
License .................................. 327
Lockdown ................................ 328
Loghosts ................................. 328
Memory ................................. 328
Netcon .................................. 328
Netobjects ............................... 329
OSPF .................................. 329
Ping ................................... 330
Pipes ................................... 330
Proplists ................................. 331
ReConfigure .............................. 331
Remotes ................................. 332
Routes .................................. 332
Rules ................................... 333
Scrsave .................................. 333
Services ................................. 334
Shutdown ................................ 334
D-Link Firewalls User’s Guide

x
Sysmsgs ................................. 334
Settings ................................. 334
Stats ................................... 336
Time ................................... 337
Uarules ................................. 337
Userauth ................................ 337
Userdb .................................. 338
Vlan ................................... 339
B Customer Support 341
D-Link Firewalls User’s Guide

FIGURES & TABLES
2.1 The OSI 7-Layer Model. ....................... 8
4.1 WebUI Authentication Window. .................. 20
4.2 WebUI Main Display. ......................... 20
9.1 A VLAN Infrastructure. ....................... 57
9.1 802.1Q Standard Ethernet Frame. ................. 58
10.1 Route Failover Scenario ....................... 78
10.2 OSPF Process Scenario ....................... 82
10.3 Static Routing Scenario ....................... 87
14.1 Dynamic NAT. ............................. 114
14.1 SAT Example. ............................. 119
16.1 A Web Server in DMZ ........................ 128
18.1 FTP ALG Scenario 1 ......................... 150
18.2 FTP ALG Scenario 2 ......................... 153
18.3 H.323 Scenario 1. ........................... 162
18.4 H.323 Scenario 2. ........................... 166
18.5 H.323 Scenario 3. ........................... 169
18.6 H.323 Scenario 4. ........................... 172
18.7 H.323 Scenario 5. ........................... 174
19.1 IDS Chain of Events Scenario 1 .................. 183
19.2 IDS Chain of Events Scenario 2 .................. 185
19.3 Signature Database Update ..................... 187
xi

xii
19.4 An IDS Scenario ............................ 189
20.1 VPN Deployment Scenario 1 .................... 201
20.2 VPN Deployment Scenario 2 .................... 202
20.3 VPN Deployment Scenario 3 .................... 203
20.4 VPN Deployment Scenario 4 .................... 203
20.5 VPN Deployment Scenario 5 .................... 204
20.6 VPN Deployment Scenario 6 .................... 205
22.1 LAN-to-LAN Example Scenario. .................. 223
22.2 IPsec Roaming Client Example Scenario. . . . . . . . . . . . . . 225
22.1 PPTP Encapsulation. ......................... 228
22.2 L2TP Encapsulation. ......................... 235
23.1 IPv4 Packet Format .......................... 251
24.1 A SLB Logical View. ......................... 262
24.2 A SLB distribution algorithm example. .............. 266
24.3 Distribution by Stickiness and Round-Robin Algorithm . . . . 267
24.4 Distribution by Stickiness and Connection-Rate Algorithm . . 267
24.5 A SLB Scenario ............................ 269
27.1 Transparent Mode Scenario 1. ................... 286
27.2 Transparent Mode Scenario 2. ................... 288
28.1 A ZoneDefense Scenario. ....................... 297
29.1 Example HA Setup. .......................... 303
D-Link Firewalls User’s Guide

LIST OF SCENARIOS
Section 10.4: Route Failover Configuration .............. 78
Section 10.5: Dynamic Routing Configuration . . . . . . . . . . . . 82
Section 10.6: Static Routing Configuration .............. 87
Section 10.7: PBR Configuration .................... 91
Section 14.3: IP Rules Configuration .................. 116
Section 15.3: Setting up Access Rule .................. 126
Section 17.4: User Authentication Configuration . . . . . . . . . . 137
Section 18.2: FTP ALG Configuration ................. 150
Section 18.4: H.323 ALG Configuration ................ 161
Section 19.6: Setting up IDS ....................... 189
Section 22.1: IPsec Configuration .................... 223
Section 23.4: Setting up Traffic Shaping ................ 253
Section 24.3: Enabling SLB ....................... 268
Section 27.3: Enabling Transparent Mode .............. 286
Section 28.6: Setting Up ZoneDefense . . . . . . . . . . . . . . . . . 296
xiii

xiv

Part IPreface

Document Version
Version No.: 1.02
Disclaimer
Information in this user’s guide is subject to change without notice.
About this Document
This User’s Guide is designed to be a handy configuration manual as well
as an Internetworking and security knowledge learning tool for network
administrators.
The document attempts not only to present means for accomplishing
certain operations of the product, but provides fundamentals on what
concepts the functions are based on, how the various sections of the
product actually work, and why a certain set of configurations is performed,
in order to enhance the reader’s understanding.
The content of this guide is logically organized to Parts,Chapters, and
Sections, with Scenario analysis for every main feature, to better enable the
reader to learn various functions. Following the detailed parts and chapters,
supplemental information and an index of relevant terms in this guide are
presented.
xvii

Typographical Conventions
Example:
Configuration steps for achieving certain function.
WebUI :
Example steps for WebUI.
Note
Additional information the user should be aware of.
Tip
Suggestions on configuration that may be taken into consideration.
Caution
Critical information the user should follow when performing certain action.
Warning
Critical information the user MUST follow to avoid potential harm.
xviii