D-Link DFL-700 - Security Appliance User manual

D-Link DFL-700
Network Security Firewall
Manual
Building Networks for People
(02/03/2005)
TM

2
Contents
Introduction....................................................................................6
Features and Benefits........................................................................... 6
Introduction to Firewalls........................................................................ 6
Introduction to Local Area Networking .................................................. 7
LEDs ..................................................................................................... 8
Physical Connections............................................................................ 8
Package Contents................................................................................. 9
System Requirements........................................................................... 9
Managing D-Link DFL-700...........................................................10
Resetting the DFL-700................................................................................10
Administration Settings...............................................................11
Administrative Access ..........................................................................11
Add ping access to an interface..................................................................13
Add Admin access to an interface...............................................................13
Add Read-only access to an interface........................................................14
Enable SNMP access to an interface .........................................................14
System..........................................................................................15
Interfaces ............................................................................................ 15
Change IP of the LAN or DMZ interface.....................................................15
WAN Interface Settings – Using Static IP...................................................16
WAN Interface Settings – Using DHCP......................................................16
WAN Interface Settings – Using PPPoE.....................................................17
WAN Interface Settings – Using PPTP.......................................................18
WAN Interface Settings – Using BigPond...................................................19
Traffic Shaping............................................................................................19
MTU Configuration......................................................................................20
Routing................................................................................................ 21
Add a new Static Route...............................................................................22
Remove a Static Route...............................................................................22
Logging ............................................................................................... 23
Enable Logging...........................................................................................24
Enable Audit Logging..................................................................................24
Enable E-mail alerting for IDS/IDP events..................................................24
Time .................................................................................................... 25
Changing time zone....................................................................................26
Using NTP to sync time...............................................................................26

3
Setting time and date manually...................................................................26
Firewall..........................................................................................27
Policy................................................................................................... 27
Policy modes...............................................................................................27
Action Types................................................................................................27
Source and Destination Filter......................................................................28
Service Filter...............................................................................................28
Schedule.....................................................................................................28
Intrusion Detection / Prevention..................................................................28
Traffic Shaping............................................................................................29
Add a new policy.........................................................................................30
Change order of policy................................................................................31
Delete policy................................................................................................31
Configure Intrusion Detection .....................................................................31
Configure Intrusion Prevention ...................................................................32
Port mapping / Virtual Servers ............................................................ 33
Add a new mapping....................................................................................33
Delete mapping...........................................................................................34
Administrative users............................................................................ 35
Add Administrative User..............................................................................35
Change Administrative User Access level ..................................................36
Change Administrative User Password.......................................................36
Delete Administrative User..........................................................................37
Users................................................................................................... 38
The DFL-700 RADIUS Support...................................................................38
Enable User Authentication via HTTP / HTTPS..........................................39
Enable RADIUS Support.............................................................................39
Add User.....................................................................................................40
Change User Password..............................................................................40
Delete User.................................................................................................41
Schedules ........................................................................................... 42
Add new recurring schedule .......................................................................42
Add new one-time schedule........................................................................43
Services .............................................................................................. 44
Adding TCP, UDP or TCP/UDP Service......................................................44
Adding IP Protocol ......................................................................................45
Grouping Services ......................................................................................45
Protocol-independent settings ....................................................................46
VPN..................................................................................................... 47
IPSec VPN between two networks .............................................................48
Creating a LAN-to-LAN VPN Tunnel...........................................................48
IPSec VPN between client and an internal network ...................................49
Creating a Roaming Users Tunnel..............................................................49
VPN – Advanced Settings................................................................... 50

4
Limit MTU....................................................................................................50
IKE Mode ....................................................................................................50
IKE DH Group.............................................................................................50
PFS – Perfect Forward Secrecy .................................................................50
NAT Traversal .............................................................................................50
Keepalives...................................................................................................50
Proposal Lists..............................................................................................51
IKE Proposal List.........................................................................................51
IPSec Proposal List.....................................................................................51
Certificates.......................................................................................... 52
Trusting Certificates....................................................................................52
Local identities ............................................................................................52
Certificates of remote peers........................................................................52
Certificate Authorities..................................................................................53
Identities......................................................................................................53
Content Filtering.................................................................................. 54
Edit the URL Global Whitelist......................................................................54
Edit the URL Global Blacklist......................................................................55
Active content handling...............................................................................56
Servers..........................................................................................57
DHCP Server Settings......................................................................... 57
Enable DHCP Server..................................................................................58
Enable DHCP Relay....................................................................................58
Disable DHCP Server/Relayer....................................................................58
DNS Relayer Settings......................................................................... 60
Enable DNS Relayer...................................................................................60
Disable DNS Relayer..................................................................................61
Tools..............................................................................................62
Ping..................................................................................................... 62
Ping Example..............................................................................................62
Dynamic DNS...................................................................................... 63
Add Dynamic DNS Settings........................................................................63
Backup................................................................................................ 64
Exporting the DFL-700’s Configuration.......................................................64
Restoring the DFL-700’s Configuration.......................................................64
Restart/Reset ...................................................................................... 65
Restarting the DFL-700...............................................................................65
Restoring system settings to factory defaults.............................................65
Upgrade .............................................................................................. 67
Upgrade Firmware ......................................................................................67
Upgrade IDS Signature-database...............................................................67
Status............................................................................................68

5
System................................................................................................ 68
Interfaces ............................................................................................ 69
VPN..................................................................................................... 70
Connections........................................................................................ 71
DHCP Server ...................................................................................... 72
How to read the logs....................................................................73
USAGE events.................................................................................... 73
DROP events ...................................................................................... 73
CONN events...................................................................................... 73
Appendixes...................................................................................75
Appendix A: ICMP Types and Codes.................................................. 75
Appendix B: Common IP Protocol Numbers....................................... 77

6
Introduction
The DFL-700 provides three 10/100M Ethernet network interface ports, which are (1)
Internal/LAN, (1) External/WAN, and (1) DMZ port. It also provides easily operated software
WebUI that allows users to set system parameters or monitor network activities using a Web
browser.
Features and Benefits
 Firewall Security
 VPN Server/Client Supported
 Content Filtering
 Bandwidth Management
The DFL-700 features an extensive Traffic Shaper for bandwidth
management.
 Web Management
Configurable through any networked computer’s Web browser using
Netscape or Internet Explorer.
 Access Control supported
Allows you to assign different access rights for different users, such
as Admin or Read-Only User.
Introduction to Firewalls
A firewall is a device that sits between your computer and the Internet that prevents
unauthorized access to or from your network. A firewall can be a computer using firewall
software or a special piece of hardware built specifically to act as a firewall. In most
circumstances, a firewall is used to prevent unauthorized Internet users from accessing
private networks or corporate LAN’s and Intranets.
A firewall monitors all of the information moving to and from your network and analyzes
each piece of data. Each piece of data is then checked against a set of criteria configured by
the administrator. If any data does not meet the criteria, that data is blocked and discarded. If
the data meets the criteria, the data is passed through. This method is called packet filtering.
A firewall can also run specific security functions based on the type of application or type
of port that is being used. For example, a firewall can be configured to work with an FTP or
Telnet server. Or a firewall can be configured to work with specific UDP or TCP ports to allow
certain applications or games to work properly over the Internet.

7
Introduction to Local Area Networking
Local Area Networking (LAN) is the term used when connecting several computers
together over a small area such as a building or group of buildings. LANs can be connected
over large areas. A collection of LANs connected over a large area is called a Wide Area
Network (WAN).
A LAN consists of multiple computers connected to each other. There are many types of
media that can connect computers together. The most common media is CAT5 cable (UTP or
STP twisted pair wire.) On the other hand, wireless networks do not use wires; instead they
communicate over radio waves. Each computer must have a Network Interface Card (NIC),
which communicates the data between computers. A NIC is usually a 10Mbps network card,
or 10/100Mbps network card, or a wireless network card.
Most networks use hardware devices such as hubs or switches that each cable can be
connected to in order to continue the connection between computers. A hub simply takes any
data arriving through each port and forwards the data to all other ports. A switch is more
sophisticated, in that a switch can determine the destination port for a specific piece of data.
A switch minimizes network traffic overhead and speeds up the communication over a
network.
Networks take some time in order to plan and implement correctly. There are many ways
to configure your network. You may want to take some time to determine the best network
set-up for your needs.

8
LEDs
Power: A solid light indicates a proper connection to the power supply.
Status: A System status indicator that flashes to indicate an active system. If the LED has
a solid light, the unit is defective.
WAN, LAN, & DMZ: Ethernet port indicators that light green. The LED flickers when the
ports are sending or receiving data.
Physical Connections
COM Port: Serial access to the firewall software, 9600, 8bit, None Parity, 1Stop bit.
DMZ Port: Use this port to connect to the company’s server(s), which needs direct
connection to the Internet (FTP, SNMP, HTTP, DNS).
Internal Ports (LAN): Use this port to connect to the internal network of the office.
External Port (WAN): Use this port to connect to the external router, DSL modem, or
Cable modem.
Reset: Use to reset the DFL-700 to the original default settings.
DC Power: Connect one end of the power supply to this port, the other end to the
electrical wall outlet.

9
Package Contents
Contents of Package:
• D-Link DFL-700 Firewall
• Manual and CD
• Quick Installation Guide
• 5V/3A AC Power adapter
• Straight-through CAT-5 cable
Note: Using a power supply with a different voltage rating than the one included
with the DFL-700 will cause damage and void the warranty for this product.
If any of the above items are missing, please contact your reseller.
System Requirements
• Computer with a Windows, Macintosh, or Unix based operating system with an
installed Ethernet adapter.
• Internet Explorer or Netscape Navigator, version 6.0 or above, with JavaScript
enabled.

10
Managing D-Link DFL-700
When a change is
made to the
configuration, a new
icon named Activate
Changes will appear.
When all changes made
by the administrator are
done, the changes need
to be saved and activated
to take effect by clicking
on the Activate Changes
button on the Activate
Configuration Changes
page. The firewall will
save the configuration and
reload it, making the new
changes take effect. In
order to make the
changes permanent, the
administrator must login
again. This has to be done before a configurable timeout has been reached. This can be set
on the Activate Configuration Changes page, by choosing the time from the dropdown menu.
Resetting the DFL-700
To reset the DFL-700 to factory default settings you must hold the reset button down for at
least 15 seconds after powering on the unit. You will first hear one beep, which will indicate
that the firmware is being restored. Keep the button pressed in until you hear two short
consecutive beeps. After this you can release the reset button and the DFL-700 will continue
to load and startup in default mode, i.e. with 192.168.1.1 on the LAN interface.

11
Administration Settings
Administrative Access
Ping – If enabled, it specifies who can ping the IP interface of the DFL-700. Enabling
Default allows anyone to ping the interface IP.
Admin – If enabled, it allows all users with admin access to connect to the DFL-700 and
change configuration; this can be HTTPS or HTTP and HTTPS.
Read-Only – If enabled, it allows all users with read-only access to connect to the DFL-
700 and look at the configuration; this can be HTTPS or HTTP and HTTPS. If there is no
Admin access specified on an interface and only read-only, admin users can still connect
but will be in read-only mode.

12
SNMP – Specifies if SNMP should or should not be allowed on the interface. The DFL-700
only supports read-only access.

13
Add ping access to an interface
To add ping access click on the interface you would like to add it to.
Follow these steps to add ping access to an interface.
Step 1. Click on the interface you would like to add it to.
Step 2. Enable the Ping checkbox.
Step 3. Specify which networks are allowed to ping the interface, for example
192.168.1.0/24 for a whole network or 172.16.0.1 – 172.16.0.10 for a range.
Click the Apply button below to apply the settings or click Cancel to discard changes.
Example:
Add Admin access to an interface
To add admin access, click on the interface you would like to add it to. Only users with
administrator rights can login on interfaces where there is only admin access enabled.
Follow these steps to add admin access to an interface.
Step 1. Click on the interface you would like to add it to.
Step 2. Enable the Admin checkbox.
Step 3. Specify which networks are allowed to access the interface, for example
192.168.1.0/24 for a whole network or 172.16.0.1 – 172.16.0.10 for a range.
Step 4. Specify protocol used to access the DFL-700 from the dropdown menu, either
HTTP and HTTPS (Secure HTTP) or only HTTPS.
Click the Apply button below to apply the settings or click Cancel to discard changes.
Example:

14
Add Read-only access to an interface
To add read-only access, click on the interface you would like to add it to. Note that if you
only have read-only access enabled on an interface, all users will only have read-only access,
even if they are administrators.
Follow these steps to add read-only access to an interface.
Step 1. Click on the interface you would like to add it to.
Step 2. Enable the Read-only checkbox.
Step 3. Specify which networks are allowed read-only access to the interface, for example
192.168.1.0/24 for a whole network or 172.16.0.1 – 172.16.0.10 for a range.
Step 4. Specify protocol used to access the DFL-700 from the dropdown menu, either
HTTP and HTTPS (Secure HTTP) or only HTTPS.
Click the Apply button below to apply the settings or click Cancel to discard changes.
Example:
Enable SNMP access to an interface
Follow these steps to add read-only SNMP access to an interface.
Step 1. Click on the interface you would like to add it to.
Step 2. Enable the Read-only checkbox.
Step 3. Specify which networks are allowed to receive SNMP traps, for example
192.168.1.0/24 for a whole network or 172.16.0.1 – 172.16.0.10 for a range.
Step 4. Specify the community string used to authenticate the DFL-700.
Click the Apply button below to apply the settings or click Cancel to discard changes.
Example:

15
System
Interfaces
Click on System in the menu bar, and then click interfaces below it.
Change IP of the LAN or DMZ interface
Follow these steps to change the IP of the LAN or DMZ interface.
Step 1. Choose which interface to view or change under the Available interfaces list.
Step 2. Fill in the IP address of the LAN or DMZ interface. These are the addresses that
will be used to ping the firewall, remotely control it, and used as the gateway for the
internal hosts or DMZ hosts.
Step 3. Choose the correct Subnet mask of this interface from the drop down menu.
Click the Apply button below to apply the settings or click Cancel to discard changes.

16
WAN Interface Settings – Using Static IP
If you are using Static IP, you have
to fill in the IP address information
provided to you by your ISP. All fields
are required except the Secondary DNS
Server. Note: Do not use the numbers
displayed in these fields, they are only
used as an example.
• IP Address – The IP
address of the WAN
interface. This is the
address that may be used
to ping the firewall, remotely control it, and be used as the source address for
dynamically translated connections.
• Subnet Mask – Size of the external network.
• Gateway IP – Specifies the IP address of the default gateway used to access the
Internet.
• Primary and Secondary DNS Server – The IP addresses of your DNS servers;
only the Primary DNS is required.
WAN Interface Settings – Using DHCP
If you are using DHCP, there is no
need to complete any fields.

17
WAN Interface Settings – Using PPPoE
Use the following procedure to
configure the DFL-700 external
interface to use PPPoE (Point-to-Point
Protocol over Ethernet). This
configuration is required if your ISP
uses PPPoE to assign the IP address
of the external interface. You will have
to fill in the username and password
provided to you by your ISP.
• Username – The login or
username supplied to you
by your ISP.
• Password – The
password supplied to you by your ISP.
• Service Name – When using PPPoE some ISPs require you to fill in a Service
Name.
• Primary and Secondary DNS Server – The IP addresses of your DNS servers;
these are optional and are often provided by the PPPoE service.

18
WAN Interface Settings – Using PPTP
PPTP over Ethernet connections
are used in some DSL and cable
modem networks.
You need to enter your account
details, and possibly also IP
configuration parameters of the
actual physical interface that the
PPTP tunnel runs over. Your ISP
should supply this information.
• Username – The login
or username supplied
to you by your ISP.
• Password – The
password supplied to
you by your ISP.
• PPTP Server IP – The
IP of the PPTP server
that the DFL-700 will
connect to.
Before PPTP can be used to connect to you ISP, the physical (WAN) interface parameters
need to entered. You can use either DHCP or Static IP, depending on the type of ISP used.
Your ISP should supply this information.
If using static IP, this information needs to be filled in.
• IP Address – The IP address of the WAN interface. This IP is used to connect to
the PPTP server.
• Subnet Mask – Size of the external network.
• Gateway IP – Specifies the IP address of the default gateway used to access the
Internet.

19
WAN Interface Settings – Using BigPond
The ISP Telstra BigPond uses
BigPond for authentication; the IP is
assigned with DHCP.
• Username – The login
or username supplied to
you by your ISP.
• Password – The
password supplied to
you by your ISP.
Traffic Shaping
When Traffic Shaping is enabled and the correct maximum up and downstream
bandwidth is specified, it is possible to control which policies have the highest priority when
large amounts of data are moving through the DFL-700. For example, the policy for the Web
server might be given higher priority than the policies for most employees' computers.
You can use traffic shaping to guarantee the amount of bandwidth available through the
firewall for a policy. Guarantee bandwidth to make sure that there is enough bandwidth
available for a high-priority service. You can also use traffic shaping to limit the amount of
bandwidth available through the firewall for a policy. Limit bandwidth to keep less important
services from using bandwidth needed for more important services.
Note: If the limit is set too high, i.e. higher then your Internet connection, the traffic
shaping will not work at all.

20
MTU Configuration
To improve the performance of your Internet connection, you can adjust the maximum
transmission unit (MTU) of the packets that the DFL-700 transmits from its external interface.
Ideally, you want this MTU to be the same as the smallest MTU of all the networks between
the DFL-700 and the Internet. If the packets the DFL-700 sends are larger, they get broken up
or fragmented, which could slow down transmission speeds.
Trial and error is the only sure way of finding the optimal MTU, but there are some
guidelines that can help. For example, the MTU of many PPP connections is 576, so if you
connect to the Internet via PPPoE, you may want to set the MTU size to this value. DSL
modems may also have small MTU sizes. Most ethernet networks have an MTU of 1500.
Note: If you connect to your ISP using DHCP to obtain an IP address for the external
interface, you cannot set the MTU below 576 bytes due to DHCP communication
standards.
Click the Apply button below to apply the settings or click Cancel to discard changes.