D-Link DFL-800 - Security Appliance Installation and operating instructions

D-Link International
Confidential and proprietary
1
D-Link And TheGreenBow Solution
D
DF FL L- -8 80 00 0
N
Ne et td de ef fe en nd d I IP PS S/ /U UT TM M
F
Fi ir re ew wa al ll l
A
Ap pp pl li ic ca at ti io on n N No ot te e
Version 2.00
(2009-5-28)

D-Link International
Confidential and proprietary
2
Revision History
Date Rev. Description Editor
2009-4-24 1.0
Interoperability Compliance Testing Negotiate mode for
Phase1 and Phase2 using TheGreenBow VPN Client
software and D-Link product’s DFL-800. John Yoong
2009-5-28 2.0 Added the function VPN User Authentication using
TheGreenBow VPN Client software (X-Auth) and DFL- 800
(External Radius Server) and changed the network
diagram. John Yoong
1. Introduction
The objective of this document is to provide a guide describing how to configure the
devices to achieve the same environment as show at the network topology.
Users of this document are expected to already possess basic knowledge of D-Link
devices and TheGreenBow VPN software, and are familiar with how to perform basic
configurations. Only important configurations, such as those pertaining to interfacing and
integrating, will be described in this document.
For purpose of reference, configuration files for each device are available for download.
2. Audience
This document is intended for project engineers or end users that need to implement
DFL series and TheGreenBow software at the sites.
3. Objective
This topology consist the scenarios that integrates using TheGreenBow VPN program
and D-Link Firewall and demonstrate integrations and network solutions to OBUs, and in
addition, to Partners and Customers from D-Link International.
4. List of Equipment and Software
The table below shows the devices information.
Device No. Device Name Device Model Firmware
1 TheGreenBow VPN Client Software - 4.6x
2 Netdefend IPS Firewall DFL-800 2.20.03.08-8257
3 WinRadius Radius Server - 4.00

D-Link International
Confidential and proprietary
3
5. Network Diagram
Note: Router is set to allow IPSec pass through.
6. Configurations
In this document, we will only describe the main configurations for this Scenario. The
configurations setting for all the D-Link products will not be described here and for more
detail about the product you can download their user guide.
1) TheGreenBow VPN Client (IPSec) and D-Link Security Solutions
(VPN Client ÆDFL-800)
2) TheGreenBow VPN Client (XAuth) and D-Link Security Solutions
(VPN Client ÆDFL-800 ÆRadius Server)
6.1 TheGreenBow VPN Client (IPSec) and D-Link Security Solutions
(VPN Client ÆDFL-800)
In this scenario the user can connect back to the headquarter database by using
TheGreenBow VPN Client connection to DFL-800.
All configurations are based on DFL-800 (F/W: 2.20.03.08-8257) and TheGreenBow
VPN Client (F/W: 4.60.0.0)

D-Link International
Confidential and proprietary
4
The steps in this configuration are:
•Setup DFL-800 for VPN tunneling
•Setup Pre-shared Key
•Phase 1 and Phase 2 algorithms setup
•Setting up IPSec-Tunnel
•Setup IP Rules
•Setup TheGreenBow VPN Client software
•Setup Phase 1
•Setup Phase 2
6.1.1) Setup DFL-800 for VPN tunneling
6.1.1.1) Setup Pre-Shared Key
1) Login to the DFL-800 and click “Authenticate Objects” and add a
new “Pre-shared Key” and fill in the passphrase and name.

D-Link International
Confidential and proprietary
5
6.1.1.2) Phase 1 and Phase 2 algorithms setup
1) At the “IKE Algorithms”, select the Encryption and Integrity
algorithms for your phase 1 authenticate.
2) Next is the “IPSec Algorithms”, select the Encryption and
Integrity algorithms for the Phase 2.

D-Link International
Confidential and proprietary
6
6.1.1.3) Setting up IPSec-Tunnel
1) After we finish setting up the algorithms, next we will need to
create the “IPSec-Tunnel” as show below.
2) Next, click on the “Authentication” tab and select the “Pre-
Shared Key” you have setup at the steps 1.

D-Link International
Confidential and proprietary
7
3) After selecting the Pre-Shared Key, next is to enable the
“Dynamically add route” at the routing tab.
4) Last step is to make sure the DH Group at the IKE setting is the
same setting for the TheGreenBow VPN Client software.
6.1.1.4) Setup IP Rules
Now is to setup the IP Rules so there the DFL-800 knows where
to direct all the traffic to.
1) First add a new interface group name “IPSec-LAN” by grouping
up “IPSec-Tunnel” and “LAN”.

D-Link International
Confidential and proprietary
8
2) Next, click “IP Rules” and add a new IP rule as show below.

D-Link International
Confidential and proprietary
9
6.1.2) Setup TheGreenBow VPN Client Software
6.1.2.1) Setup Phase 1
1) Right click on the “Root” to add a new “Phase1”, next fill in the IP
address for this VPN client and Remote gateway IP follow by
Preshared Key and IKE setting.
Note: the Preshared Key and IKE must be the same setting set in the DFL-800.

D-Link International
Confidential and proprietary
10
6.1.2.2) Setup Phase 2
1) Right click on the “Phase1” to add a new “Phase2”, next fill in the
VPN Client address for this VPN client and Remote gateway IP
follow by ESP setting.
Note: the ESP Encryption and Authentication setting must be the same in the
DFL-800 IPSec-Tunnel.

D-Link International
Confidential and proprietary
11
6.2 TheGreenBow VPN Client Software (X-Auth) and D-Link security
solutions (VPN ClientÆDFL-800)
In this scenario the client will be authenticate (X-Auth) before the user can connect back
to the headquarter database by using TheGreenBow VPN Client connection to DFL-800
authenticate by External Authentication (Radius Server).
All configurations are based on DFL-800 (F/W: 2.20.03.08-8257), TheGreenBow VPN
Client (F/W: 4.60.0.0) and WinRadius (Version 4.00)
Note: Before configuration this solution, please make sure that your DFL-800 and VPN Client had
the IPSec setting configured. Please refer to (6.1 - TheGreenBow VPN Client software (IPSec)
and D-Link Security Solutions (VPN Client
Æ DFL-800))
The steps in this configuration are:
•Setup DFL-800 for X-Auth
•Enable the X-Auth in DFL-800
•Setup the External Authentication Server
•Setup TheGreenBow VPN Client software
•Enable the X-Auth Function
•Setup WinRadius Server
•Set the Secret Key

D-Link International
Confidential and proprietary
12
6.2.1) Setup DFL-800 for X-Auth
6.2.1.1) Enable the X-Auth in DFL-800
1) At the “Interfaces ÆIPSec”, select the IPSec tunnel you have
created in the previous solution and at the “XAuth” tab, enable the
function as show below.
6.2.1.2) Setup the External Authentication Server (i.e. Radius)
1) Add the IP Address for the Radius Server in the “Address Book”.

D-Link International
Confidential and proprietary
13
2) Select the “User Authentication ÆExternal User Database”
and add a new “Radius Server” with the setting as show below.
Note: the Shared Secret must be the same key in the Radius Server.
3) Next, add a New Rule in the “User Authentication Rules”.

D-Link International
Confidential and proprietary
14
4) At the “Authentication Options”, select the Radius Server you
have created and select the Radius Method as “CHAP”.
5) Save and activate the setting.

D-Link International
Confidential and proprietary
15
6.2.2) Setup TheGreenBow VPN Client software
6.2.2.1) Enable the X-Auth Function
) enu, tick the box for the “X-Auth
Popup”.
1Inside the “P1 Advanced” m
2) Click “Ok” and “Save &Apply” the setting.

D-Link International
Confidential and proprietary
16
6.2.3) Setup WinRadius Server
6.2.3.1) Set the Secret Key
1)Click the “System” from the “Setting” drop down list
2)Key in the “NAS Secret”.
Note: The NAS Secret must be the same key set in the DFL-800 “Shared
Key”.
3)
Click “OK”, close and start the WinRadius Server again.

D-Link International
Confidential and proprietary
17
7. Interoperability Compliance Testing
7.1) General Test Approach
tunnel using different Negotiate Mode in phase 1 anda. Open the VPN
phase 2:
Series Negotiate Mode
Phase 1 Phase 2
AES-SHA AES-SHA
AES-MD5 AES-SHA
3DES-MD5 AES-SHA
3DES-SHA AES-SHA
DES-MD5 AES-SHA
DES-SHA AES-SHA
AES-SHA AES-MD5
AES-MD5 AES-MD5
3DES-MD5 AES-MD5
3DES-SHA AES-MD5
DES-MD5 AES-MD5
DES-SHA AES-MD5
AES-SHA 3DES-SHA
AES-MD5 3DES-SHA
3DES-MD5 3DES-SHA
3DES-SHA 3DES-SHA
DES-MD5 3DES-SHA
DES-SHA 3DES-SHA
AES-SHA 3DES-MD5
AES-MD5 3DES-MD5
3DES-MD5 3DES-MD5
3DES-SHA 3DES-MD5
DES-MD5 3DES-MD5
DES-SHA 3DES-MD5
AES-SHA DES-SHA
AES-MD5 DES-SHA
3DES-MD5 DES-SHA

D-Link International
Confidential and proprietary
18
Series Negotiate Mode
Phase 1 Phase 2
3DES-SHA DES-SHA
DES-MD5 DES-SHA
DES-SHA DES-SHA
AES-SHA DES-MD5
AES-MD5 DES-MD5
3DES-MD5 DES-MD5
3DES-SHA DES-MD5
DES-MD5 DES-MD5
DES-SHA DES-MD5
b. C rs in th ius and during the X-Auth popup, key
in the users ID and Password from the WinRadius.
reate use e WinRad

D-Link International
Confidential and proprietary
19
7.2) Test Result
a. The VPN tunnel will be open at any negotiate mode set in Phase 1
and Phase 2.
TheGreenBow VPN Client software

D-Link International
Confidential and proprietary
20
b. The DFL-800 will show the tunnel is up at their VPN status.
DFL-800 IPSec
b. Client is able to Ping to the remote network.