D-Link NetDefend DFL-1660 User manual

Network Security Solution http://www.dlink.com
NetDefendOS
Ver.2.40.03
Network Security Firewall
User Manual
Security
Security

User Manual
DFL-260E/860E/1660/2560/2560G
NetDefendOS Version 2.40.03
D-Link Corporation
No. 289, Sinhu 3rd Rd, Neihu District, Taipei City 114, Taiwan R.O.C.
http://www.DLink.com
Published 2013-02-20
Copyright ©2013

User Manual
DFL-260E/860E/1660/2560/2560G
NetDefendOS Version 2.40.03
Published 2013-02-20
Copyright © 2013
Copyright Notice
This publication, including all photographs, illustrations and software, is protected under
international copyright laws, with all rights reserved. Neither this manual, nor any of the material
contained herein, may be reproduced without the written consent of D-Link.
Disclaimer
The information in this document is subject to change without notice. D-Link makes no
representations or warranties with respect to the contents hereof and specifically disclaims any
implied warranties of merchantability or fitness for a particular purpose. D-Link reserves the right to
revise this publication and to make changes from time to time in the content hereof without any
obligation to notify any person or parties of such revision or changes.
Limitations of Liability
UNDER NO CIRCUMSTANCES SHALL D-LINK OR ITS SUPPLIERS BE LIABLE FOR
DAMAGES OF ANY CHARACTER (E.G. DAMAGES FOR LOSS OF PROFIT, SOFTWARE
RESTORATION, WORK STOPPAGE, LOSS OF SAVED DATA OR ANY OTHER
COMMERCIAL DAMAGES OR LOSSES) RESULTING FROM THE APPLICATION OR
IMPROPER USE OF THE D-LINK PRODUCT OR FAILURE OF THE PRODUCT, EVEN IF
D-LINK IS INFORMED OF THE POSSIBILITY OF SUCH DAMAGES. FURTHERMORE,
D-LINK WILL NOT BE LIABLE FOR THIRD-PARTY CLAIMS AGAINST CUSTOMER FOR
LOSSES OR DAMAGES. D-LINK WILL IN NO EVENT BE LIABLE FOR ANY DAMAGES IN
EXCESS OF THE AMOUNT D-LINK RECEIVED FROM THE END-USER FOR THE
PRODUCT.

Table of Contents
Preface ...............................................................................................................15
1. NetDefendOS Overview ....................................................................................17
1.1. Features ................................................................................................17
1.2. NetDefendOS Architecture ......................................................................20
1.2.1. State-based Architecture ...............................................................20
1.2.2. NetDefendOS Building Blocks .......................................................20
1.2.3. Basic Packet Flow ........................................................................21
1.3. NetDefendOS State Engine Packet Flow .....................................................24
2. Management and Maintenance ............................................................................29
2.1. Managing NetDefendOS ..........................................................................29
2.1.1. Overview ...................................................................................29
2.1.2. The Default Administrator Account .................................................30
2.1.3. The Web Interface .......................................................................30
2.1.4. The CLI .....................................................................................36
2.1.5. CLI Scripts .................................................................................45
2.1.6. Secure Copy ...............................................................................49
2.1.7. The Console Boot Menu ...............................................................51
2.1.8. Management Advanced Settings .....................................................53
2.1.9. Working with Configurations .........................................................54
2.2. Events and Logging ................................................................................60
2.2.1. Overview ...................................................................................60
2.2.2. Log Messages .............................................................................60
2.2.3. Creating Log Receivers .................................................................61
2.2.4. Logging to MemoryLogReceiver ....................................................61
2.2.5. Logging to Syslog Hosts ...............................................................61
2.2.6. Severity Filter and Message Exceptions ...........................................63
2.2.7. SNMP Traps ...............................................................................63
2.2.8. Advanced Log Settings .................................................................65
2.3. RADIUS Accounting ..............................................................................66
2.3.1. Overview ...................................................................................66
2.3.2. RADIUS Accounting Messages ......................................................66
2.3.3. Interim Accounting Messages ........................................................68
2.3.4. Configuring RADIUS Accounting ..................................................68
2.3.5. RADIUS Accounting Security ........................................................69
2.3.6. RADIUS Accounting and High Availability ......................................69
2.3.7. Handling Unresponsive RADIUS Servers .........................................70
2.3.8. Accounting and System Shutdowns .................................................70
2.3.9. Limitations with NAT ...................................................................70
2.3.10. Advanced RADIUS Settings ........................................................71
2.4. Monitoring ............................................................................................72
2.4.1. The Link Monitor ........................................................................72
2.4.2. SNMP Monitoring .......................................................................74
2.4.3. Hardware Monitoring ...................................................................77
2.4.4. Memory Monitoring Settings .........................................................79
2.5. The pcapdump Command ........................................................................81
2.6. Maintenance ..........................................................................................84
2.6.1. Auto-Update Mechanism ...............................................................84
2.6.2. Backing Up Configurations ...........................................................84
2.6.3. Restore to Factory Defaults ............................................................86
3. Fundamentals ...................................................................................................89
3.1. The Address Book ..................................................................................89
3.1.1. Overview ...................................................................................89
3.1.2. IP Addresses ...............................................................................89
3.1.3. Ethernet Addresses .......................................................................91
3.1.4. Address Groups ...........................................................................92
3.1.5. Auto-Generated Address Objects ....................................................93
3.1.6. Address Book Folders ...................................................................93
4

3.2. IPv6 Support .........................................................................................94
3.3. Services ..............................................................................................100
3.3.1. Overview .................................................................................100
3.3.2. Creating Custom Services ............................................................101
3.3.3. ICMP Services ..........................................................................104
3.3.4. Custom IP Protocol Services ........................................................106
3.3.5. Service Groups ..........................................................................106
3.3.6. Custom Service Timeouts ............................................................107
3.4. Interfaces ............................................................................................108
3.4.1. Overview .................................................................................108
3.4.2. Ethernet Interfaces .....................................................................110
3.4.3. VLAN .....................................................................................117
3.4.4. PPPoE .....................................................................................120
3.4.5. GRE Tunnels ............................................................................122
3.4.6. Interface Groups ........................................................................126
3.5. ARP ..................................................................................................128
3.5.1. Overview .................................................................................128
3.5.2. The ARP Cache .........................................................................128
3.5.3. ARP Publish .............................................................................130
3.5.4. Using ARP Advanced Settings .....................................................133
3.5.5. ARP Advanced Settings Summary ................................................134
3.6. IP Rules .............................................................................................137
3.6.1. Security Policies ........................................................................137
3.6.2. IP Rule Evaluation .....................................................................140
3.6.3. IP Rule Actions .........................................................................141
3.6.4. Editing IP rule set Entries ............................................................142
3.6.5. IP Rule Set Folders ....................................................................143
3.6.6. Configuration Object Groups .......................................................144
3.7. Schedules ...........................................................................................148
3.8. Certificates .........................................................................................150
3.8.1. Overview .................................................................................150
3.8.2. Certificates in NetDefendOS ........................................................152
3.8.3. CA Certificate Requests ..............................................................154
3.9. Date and Time .....................................................................................156
3.9.1. Overview .................................................................................156
3.9.2. Setting Date and Time ................................................................156
3.9.3. Time Servers ............................................................................157
3.9.4. Settings Summary for Date and Time ............................................160
3.10. DNS .................................................................................................163
4. Routing .........................................................................................................167
4.1. Overview ............................................................................................167
4.2. Static Routing ......................................................................................168
4.2.1. The Principles of Routing ............................................................168
4.2.2. Static Routing ...........................................................................172
4.2.3. Route Failover ..........................................................................177
4.2.4. Host Monitoring for Route Failover ...............................................180
4.2.5. Advanced Settings for Route Failover ............................................182
4.2.6. Proxy ARP ...............................................................................183
4.3. Policy-based Routing ............................................................................186
4.4. Route Load Balancing ...........................................................................193
4.5. OSPF .................................................................................................199
4.5.1. Dynamic Routing .......................................................................199
4.5.2. OSPF Concepts .........................................................................202
4.5.3. OSPF Components .....................................................................207
4.5.4. Dynamic Routing Rules ..............................................................213
4.5.5. Setting Up OSPF .......................................................................216
4.5.6. An OSPF Example .....................................................................219
4.5.7. OSPF Troubleshooting ...............................................................224
4.6. Multicast Routing .................................................................................227
4.6.1. Overview .................................................................................227
4.6.2. Multicast Forwarding with SAT Multiplex Rules .............................228
4.6.3. IGMP Configuration ..................................................................232
User Manual
5

4.6.4. Advanced IGMP Settings ............................................................237
4.7. Transparent Mode ................................................................................240
4.7.1. Overview .................................................................................240
4.7.2. Enabling Internet Access .............................................................245
4.7.3. Transparent Mode Scenarios ........................................................246
4.7.4. Spanning Tree BPDU Support ......................................................250
4.7.5. Advanced Settings for Transparent Mode .......................................251
5. DHCP Services ..............................................................................................255
5.1. Overview ............................................................................................255
5.2. DHCP Servers .....................................................................................256
5.2.1. Static DHCP Hosts .....................................................................259
5.2.2. Custom Options .........................................................................261
5.3. DHCP Relaying ...................................................................................262
5.3.1. DHCP Relay Advanced Settings ...................................................263
5.4. IP Pools ..............................................................................................265
6. Security Mechanisms .......................................................................................269
6.1. Access Rules .......................................................................................269
6.1.1. Overview .................................................................................269
6.1.2. IP Spoofing ..............................................................................270
6.1.3. Access Rule Settings ..................................................................270
6.2. ALGs .................................................................................................272
6.2.1. Overview .................................................................................272
6.2.2. The HTTP ALG ........................................................................273
6.2.3. The FTP ALG ...........................................................................276
6.2.4. The TFTP ALG .........................................................................285
6.2.5. The SMTP ALG ........................................................................286
6.2.6. The POP3 ALG .........................................................................295
6.2.7. The PPTP ALG .........................................................................296
6.2.8. The SIP ALG ............................................................................297
6.2.9. The H.323 ALG ........................................................................308
6.2.10. The TLS ALG .........................................................................322
6.3. Web Content Filtering ...........................................................................325
6.3.1. Overview .................................................................................325
6.3.2. Active Content Handling .............................................................325
6.3.3. Static Content Filtering ...............................................................326
6.3.4. Dynamic Web Content Filtering ...................................................328
6.4. Anti-Virus Scanning .............................................................................343
6.4.1. Overview .................................................................................343
6.4.2. Implementation .........................................................................343
6.4.3. Activating Anti-Virus Scanning ....................................................344
6.4.4. The Signature Database ..............................................................344
6.4.5. Subscribing to the D-Link Anti-Virus Service .................................345
6.4.6. Anti-Virus Options .....................................................................345
6.5. Intrusion Detection and Prevention ..........................................................349
6.5.1. Overview .................................................................................349
6.5.2. IDP Availability for D-Link Models ..............................................349
6.5.3. IDP Rules .................................................................................351
6.5.4. Insertion/Evasion Attack Prevention ..............................................353
6.5.5. IDP Pattern Matching .................................................................354
6.5.6. IDP Signature Groups .................................................................355
6.5.7. IDP Actions ..............................................................................356
6.5.8. SMTP Log Receiver for IDP Events ..............................................357
6.6. Denial-of-Service Attack Prevention ........................................................361
6.6.1. Overview .................................................................................361
6.6.2. DoS Attack Mechanisms .............................................................361
6.6.3. Ping of Death and Jolt Attacks .....................................................361
6.6.4. Fragmentation overlap attacks: Teardrop, Bonk, Boink and Nestea ......362
6.6.5. The Land and LaTierra attacks .....................................................362
6.6.6. The WinNuke attack ...................................................................362
6.6.7. Amplification attacks: Smurf, Papasmurf, Fraggle ...........................363
6.6.8. TCP SYN Flood Attacks .............................................................364
6.6.9. The Jolt2 Attack ........................................................................364
User Manual
6

6.6.10. Distributed DoS Attacks ............................................................364
6.7. Blacklisting Hosts and Networks .............................................................366
7. Address Translation ........................................................................................369
7.1. Overview ............................................................................................369
7.2. NAT ..................................................................................................370
7.3. NAT Pools ..........................................................................................375
7.4. SAT ...................................................................................................378
7.4.1. Translation of a Single IP Address (1:1) .........................................378
7.4.2. Translation of Multiple IP Addresses (M:N) ....................................383
7.4.3. All-to-One Mappings (N:1) .........................................................385
7.4.4. Port Translation .........................................................................387
7.4.5. Protocols Handled by SAT ..........................................................387
7.4.6. Multiple SAT Rule Matches .........................................................387
7.4.7. SAT and FwdFast Rules ..............................................................388
8. User Authentication ........................................................................................391
8.1. Overview ............................................................................................391
8.2. Authentication Setup .............................................................................393
8.2.1. Setup Summary .........................................................................393
8.2.2. The Local Database ....................................................................393
8.2.3. External RADIUS Servers ...........................................................395
8.2.4. External LDAP Servers ...............................................................395
8.2.5. Authentication Rules ..................................................................402
8.2.6. Authentication Processing ...........................................................404
8.2.7. A Group Usage Example .............................................................405
8.2.8. HTTP Authentication .................................................................405
8.3. Customizing Authentication HTML Pages ................................................410
9. VPN .............................................................................................................415
9.1. Overview ............................................................................................415
9.1.1. VPN Usage ...............................................................................415
9.1.2. VPN Encryption ........................................................................416
9.1.3. VPN Planning ...........................................................................417
9.1.4. Key Distribution ........................................................................417
9.1.5. The TLS Alternative for VPN ......................................................418
9.2. VPN Quick Start ..................................................................................419
9.2.1. IPsec LAN to LAN with Pre-shared Keys .......................................420
9.2.2. IPsec LAN to LAN with Certificates .............................................421
9.2.3. IPsec Roaming Clients with Pre-shared Keys ..................................422
9.2.4. IPsec Roaming Clients with Certificates .........................................424
9.2.5. L2TP Roaming Clients with Pre-Shared Keys .................................425
9.2.6. L2TP Roaming Clients with Certificates ........................................427
9.2.7. PPTP Roaming Clients ...............................................................427
9.3. IPsec Components ................................................................................429
9.3.1. Overview .................................................................................429
9.3.2. Internet Key Exchange (IKE) .......................................................429
9.3.3. IKE Authentication ....................................................................435
9.3.4. IPsec Protocols (ESP/AH) ...........................................................436
9.3.5. NAT Traversal ..........................................................................437
9.3.6. Algorithm Proposal Lists .............................................................439
9.3.7. Pre-shared Keys ........................................................................440
9.3.8. Identification Lists .....................................................................441
9.4. IPsec Tunnels ......................................................................................444
9.4.1. Overview .................................................................................444
9.4.2. LAN to LAN Tunnels with Pre-shared Keys ................................... 446
9.4.3. Roaming Clients ........................................................................446
9.4.4. Fetching CRLs from an alternate LDAP server ................................451
9.4.5. Troubleshooting with ikesnoop .....................................................452
9.4.6. IPsec Advanced Settings .............................................................459
9.5. PPTP/L2TP .........................................................................................463
9.5.1. PPTP Servers ............................................................................463
9.5.2. L2TP Servers ............................................................................464
9.5.3. L2TP/PPTP Server advanced settings ............................................469
9.5.4. PPTP/L2TP Clients ....................................................................469
User Manual
7

9.6. SSL VPN ............................................................................................472
9.6.1. Overview .................................................................................472
9.6.2. Configuring SSL VPN in NetDefendOS .........................................473
9.6.3. Installing the SSL VPN Client ......................................................475
9.6.4. Setup Example ..........................................................................478
9.7. CA Server Access ................................................................................480
9.8. VPN Troubleshooting ...........................................................................483
9.8.1. General Troubleshooting .............................................................483
9.8.2. Troubleshooting Certificates ........................................................484
9.8.3. IPsec Troubleshooting Commands ................................................484
9.8.4. Management Interface Failure with VPN ........................................485
9.8.5. Specific Error Messages ..............................................................485
9.8.6. Specific Symptoms ....................................................................488
10. Traffic Management ......................................................................................491
10.1. Traffic Shaping ..................................................................................491
10.1.1. Overview ................................................................................491
10.1.2. Traffic Shaping in NetDefendOS .................................................492
10.1.3. Simple Bandwidth Limiting .......................................................494
10.1.4. Limiting Bandwidth in Both Directions ........................................495
10.1.5. Creating Differentiated Limits Using Chains ................................. 496
10.1.6. Precedences ............................................................................498
10.1.7. Pipe Groups ............................................................................502
10.1.8. Traffic Shaping Recommendations ..............................................505
10.1.9. A Summary of Traffic Shaping ...................................................506
10.1.10. More Pipe Examples ...............................................................507
10.2. IDP Traffic Shaping ............................................................................512
10.2.1. Overview ................................................................................512
10.2.2. Setting Up IDP Traffic Shaping ..................................................512
10.2.3. Processing Flow .......................................................................513
10.2.4. The Importance of Specifying a Network ...................................... 513
10.2.5. A P2P Scenario ........................................................................514
10.2.6. Viewing Traffic Shaping Objects ................................................515
10.2.7. Guaranteeing Instead of Limiting Bandwidth ................................. 516
10.2.8. Logging .................................................................................516
10.3. Threshold Rules .................................................................................517
10.4. Server Load Balancing ........................................................................520
10.4.1. Overview ................................................................................520
10.4.2. SLB Distribution Algorithms ......................................................521
10.4.3. Selecting Stickiness ..................................................................522
10.4.4. SLB Algorithms and Stickiness ...................................................523
10.4.5. Server Health Monitoring ..........................................................524
10.4.6. Setting Up SLB_SAT Rules ........................................................525
11. High Availability ..........................................................................................529
11.1. Overview ..........................................................................................529
11.2. HA Mechanisms .................................................................................531
11.3. Setting Up HA ...................................................................................534
11.3.1. HA Hardware Setup .................................................................534
11.3.2. NetDefendOS Manual HA Setup .................................................535
11.3.3. Verifying the Cluster Functions ..................................................536
11.3.4. Unique Shared Mac Addresses ...................................................537
11.4. HA Issues .........................................................................................538
11.5. Upgrading an HA Cluster .....................................................................540
11.6. Link Monitoring and HA ......................................................................542
11.7. HA Advanced Settings ........................................................................543
12. ZoneDefense ................................................................................................545
12.1. Overview ..........................................................................................545
12.2. ZoneDefense Switches .........................................................................546
12.3. ZoneDefense Operation .......................................................................547
12.3.1. SNMP ....................................................................................547
12.3.2. Threshold Rules .......................................................................547
12.3.3. Manual Blocking and Exclude Lists .............................................547
12.3.4. ZoneDefense with Anti-Virus Scanning ........................................ 549
User Manual
8

12.3.5. Limitations .............................................................................549
13. Advanced Settings .........................................................................................552
13.1. IP Level Settings ................................................................................552
13.2. TCP Level Settings .............................................................................556
13.3. ICMP Level Settings ...........................................................................561
13.4. State Settings .....................................................................................562
13.5. Connection Timeout Settings ................................................................564
13.6. Length Limit Settings ..........................................................................566
13.7. Fragmentation Settings ........................................................................568
13.8. Local Fragment Reassembly Settings .....................................................572
13.9. Miscellaneous Settings ........................................................................573
A. Subscribing to Updates ...................................................................................576
B. IDP Signature Groups .....................................................................................578
C. Verified MIME filetypes .................................................................................582
D. The OSI Framework .......................................................................................586
Alphabetical Index .............................................................................................587
User Manual
9

List of Figures
1.1. Packet Flow Schematic Part I ...........................................................................24
1.2. Packet Flow Schematic Part II ..........................................................................25
1.3. Packet Flow Schematic Part III .........................................................................26
1.4. Expanded Apply Rules Logic ............................................................................27
3.1. VLAN Connections ......................................................................................118
3.2. An ARP Publish Ethernet Frame .....................................................................132
3.3. Simplified NetDefendOS Traffic Flow .............................................................140
4.1. A Typical Routing Scenario ...........................................................................169
4.2. Using Local IP Address with an Unbound Network ............................................171
4.3. A Route Failover Scenario for ISP Access .........................................................177
4.4. A Proxy ARP Example ..................................................................................184
4.5. The RLB Round Robin Algorithm ...................................................................194
4.6. The RLB Spillover Algorithm .........................................................................195
4.7. A Route Load Balancing Scenario ...................................................................197
4.8. A Simple OSPF Scenario ...............................................................................200
4.9. OSPF Providing Route Redundancy .................................................................201
4.10. Virtual Links Connecting Areas ....................................................................205
4.11. Virtual Links with Partitioned Backbone .........................................................206
4.12. NetDefendOS OSPF Objects ........................................................................207
4.13. Dynamic Routing Rule Objects .....................................................................214
4.14. An OSPF Example ......................................................................................220
4.15. Multicast Forwarding - No Address Translation ................................................229
4.16. Multicast Forwarding - Address Translation ....................................................231
4.17. Multicast Snoop Mode .................................................................................233
4.18. Multicast Proxy Mode .................................................................................233
4.19. Non-transparent Mode Internet Access ...........................................................245
4.20. Transparent Mode Internet Access .................................................................245
4.21. Transparent Mode Scenario 1 ........................................................................247
4.22. Transparent Mode Scenario 2 ........................................................................248
4.23. An Example BPDU Relaying Scenario ...........................................................251
5.1. DHCP Server Objects ...................................................................................259
6.1. Deploying an ALG .......................................................................................272
6.2. HTTP ALG Processing Order .........................................................................275
6.3. FTP ALG Hybrid Mode .................................................................................277
6.4. SMTP ALG Processing Order .........................................................................288
6.5. Anti-Spam Filtering ......................................................................................290
6.6. PPTP ALG Usage ........................................................................................296
6.7. TLS Termination ..........................................................................................323
6.8. Dynamic Content Filtering Flow .....................................................................329
6.9. IDP Database Updating .................................................................................350
6.10. IDP Signature Selection ...............................................................................352
7.1. NAT IP Address Translation ..........................................................................370
7.2. A NAT Example ..........................................................................................372
7.3. Anonymizing with NAT ................................................................................374
7.4. The Role of the DMZ ....................................................................................379
8.1. Normal LDAP Authentication ........................................................................401
8.2. LDAP for PPP with CHAP, MS-CHAPv1 or MS-CHAPv2 ..................................402
9.1. The AH protocol ..........................................................................................437
9.2. The ESP protocol .........................................................................................437
9.3. PPTP Client Usage .......................................................................................471
9.4. SSL VPN Browser Connection Choices ............................................................475
9.5. The SSL VPN Client Login ............................................................................476
9.6. The SSL VPN Client Statistics ........................................................................477
9.7. Certificate Validation Components ..................................................................481
10.1. Pipe Rules Determine Pipe Usage ..................................................................493
10.2. FwdFast Rules Bypass Traffic Shaping ...........................................................494
10.3. Differentiated Limits Using Chains ................................................................497
10.4. The Eight Pipe Precedences ..........................................................................498
10