D-Link NetDefend DFL-2560G Manual

This document will guide you through the basic installation
process for your new D-Link security device.
Building Networks for People
DFL-2560 / DFL-2560G
Documentation also available on
CD and via the D-Link Website
Hardware Installation Guide
Firewall
Quick Installation Guide
Installations-Anleitung
Guide d’installation
Guía de instalación
Guida di Installazione

2 D-Link NetDefend Firewall
About This Guide
This guide contains step-by-step instructions
for setting up the D-Link DFL-2560/DFL-2560G
Firewall. Please note that the model you have
purchased may appear slightly different from
those shown in the illustrations.
Unpacking the Product
Open the shipping carton and carefully unpack
its contents. Please consult the packing list
located in following information to make sure all
items are present and undamaged. If any item
is missing or damaged, please contact your
local D-Link reseller for replacement.
One (1) DFL-2560(G) NetDefend UTM-
Firewall
One (1) Power Cord-
One (1) Console Cable- (RS232)
One (1) Ethernet Cable- (CAT5 UTP/Straight-through)
One (1) Ethernet Cable- (CAT5 UTP/ Cross Over)
One (1) Reference CD-
(Contains documentation in PDF format)
Two (2) Rack Mounting Brackets-
One (1) 12-Month IPS Subscription-
One (1) 12-Month Anti-Virus Subscription-
Product Overview
Front Panel - DFL-2560 and DFL-2560G
Item Feature Description
A LCD Panel Used to display status and operation
messages.
B Keypad These keys are used in conjunction with
the messages on the LCD Panel.
C LEDs Power LED (top): Indicates that the
NetDefend UTM rewall is powered on.
System LED (bottom): Indicates the
system status of the NetDefend UTM
rewall
D Console Port Used to access the NetDefendOS
Command Line Interface (CLI) via
RS232 Cable.
E USB Ports (2) Reserved for future use.
F 10/100/1000Mbps
Ethernet Ports*
The assigned numbers for the ports are
5 to 10 (from left to right).
G 10/100/1000Mbps
Ethernet Ports*
(DFL-2560) The assigned numbers for the ports are
1 to 4 (from left to right).
1000Mbps
SFP Port*
(DFL-2560G)
Figure 1. DFL-2560/ 2560G Front Panel
Table 1. DFL-2560/ 2560G Front Panel Descriptions
* Congurable Gigabit Ethernet ports with autosensing
duplex and auto MDI/MDIX. When conguring one of the
ports, reference the interface name that corresponds to
the location of the port. For the default interface name
bindings for each Ethernet port, see Table 2 “Default
Interface Assignment”.
BG F DE
A
C
Port
Interface
Name
Interface
Type IP Address
Web-Based
Mgmt
1 DMZ1 Static IP 172.17.100.254/24 Disabled
2 DMZ2 Static IP 172.17.110.254/24 Disabled
3 DMZ3 Static IP 172.17.120.254/24 Disabled
4 DMZ4 Static IP 172.17.130.254/24 Disabled
5 WAN1 DHCP
Client
N/A Disabled
6 WAN2 Static IP 192.168.120.254/24 Disabled
7 LAN1 Static IP 192.168.10.1/24 Enabled
8 LAN2 Static IP 192.168.20.1/24 Disabled
9 LAN3 Static IP 192.168.30.1/24 Disabled
10 LAN4 Static IP 192.168.40.1/24 Disabled
DFL-2560/ 2560G Default Interface Settings
Table 2. Default Interface Assignment
Note: D-Link NetDefend Firewalls only allow
Web GUI access from the LAN1 port by default
for security reasons. That means the Web GUI
access is only allowed on port No. 7 of front
plate by default for DFL-2560/DFL-2560G.

D-Link NetDefend Firewall 3
Device Status LEDs and Ethernet Port LEDs
The device LEDs show information about
current device status. When the device is
powered up, the POWER LED changes
from off to solid green and the SYSTEM
LED changes from off to solid green. Startup
takes approximately one minute to complete.
The Ethernet LEDs show the status of each
Ethernet port. Table 3 lists the name, color,
status, and description of each device LED.
Note: If you would like to turn the device
off and on again, we recommend waiting a
few seconds between shutting it down and
powering it back on.
Name Color Status - Description
Power Green Light Off - Device is
powered off.
Solid Green - Device is
powered on.
System Green/
Orange
Light Off - Device is
powered off or is starting
up.
Solid Green - System is
normal operation.
Solid Orange - System
failure or license
lockdown.
TX/RX Status Green Light Off - No Link.
Solid Green - Link
present.
Blinking Green - Port
is sending or receiving
data.
LINK Speed Green/
Orange
Light Off - Port is
operating at 10Mbps.
Solid Green - Port is
operating at 100Mbps.
Solid Orange - Port is
operating at 1000Mbps.
Link and TX/RX
for SFP port
(DFL-2560G only)
Orange Light Off - No Link.
Solid Orange - Link
Present and operating at
1000Mbps.
Blinking Orange - Port
is sending or receiving
data.
Figure 2. Ethernet
RJ-45 Port LEDs
Figure 3. Ethernet
SFP Port LEDs
(DFL-2560G only)
When you power on the DFL-2560/2560G,
the LCD panel will display following message:
“Press keypad to enter setup”. Once you press
any key on the keypad, it will lead you to enter
the startup menu. If you don’t press any keys
after ve seconds, the device will automatically
continue the NetDefendOS boot-up procedure.
If you press any keypad buttons within ve
seconds of powering the rewall on, the LCD
panel will display three options:
<Start Firewall>
If this option is selected, the system will
initialize, start the NetDefendOS software, and
load the saved conguration.
<Reset Firewall>
If this option is selected, the hardware will reset
to factory defaults. This option will carry out the
following steps:
Remove console security so there is no-
console password.
Restore all NetDefendOS settings to their-
default conguration
<Restore Cong>
When you select this option, the system will
restore all NetDefendOS settings to their
default conguration. Other options, such as
console security, will not be affected.
Note: Once you select “Reset Firewall” or
“Reset Cong” and conrm these options, all
saved settings will be permanently erased.
Figure 4. Button Denitions (During Boot-up)
Table 3. Device Status LED Descriptions
LCD Keypad Controls During Boot-up
Conrm Button
Not Used
Back Button Next Button

4 D-Link NetDefend Firewall
Item Description
Model Name: Device model name
System Status: System function status
CPU Load:
Connections:
CPU utilization and concurrent
sessions
Total BPS: Concurrent trafc per second
Total PPS: Concurrent packets per second
Date: Current device date
Time: Current device time
Uptime: The amount of time since last
restart
Mem: System memory utilization
IDS Sigs: IDS signature information
Interface Name:
(See Table 4.)
IP address for each interface
Core Version: Current rmware version
CPU Temp.
System Temp.
CPU and system temperature via
on board sensor
Fan Status Fan speed
Installing and Connection
Installing Equipment
This chapter describes how to install a
DFL-2560/DFL-2560G device in a standard
19-inch equipment rack and how to connect
network and power cables to the device.
Before You Begin
Observe the following precautions to help
prevent faults, equipment failures and injuries:
Before installation, always disconnect the-
power supply.
Ensure that the room in which you operate-
the device has adequate air circulation and
that the room temperature does not exceed
40˚C (104˚F).
Allow 1 meter (3 feet) of clear space from the-
front and back of the device.
Do not place the device in an equipment rack-
frame that blocks the air vents on the sides of
the chassis. Ensure that enclosed racks have
fans and vented sides.
Correct any of the following hazardous-
conditions before any installation: moist or
wet oors, leaks, ungrounded/frayed power
cables, or missing safety grounds.
You can mount the DFL-2560/DFL-2560G
device into a standard 19-inch equipment rack.
To install an DFL-2560/DFL-2560G device into
a rack:
1. Attach the mounting brackets to each side
of the chassis as shown in gure 6 and
secure them with the provided screws.
Figure 6. Attaching Rack Mount Brackets
Table 4. Device Status Shown on LCD Panel
Once the DFL-2560/2560G has completed its
system startup routine, the LCD panel will be
ready to display the device status information.
You can use the keypad to select a desired
display option. The following table lists the
status information that can be displayed on the
rewall’s LCD panel.
Figure 5. Button Denitions (After Boot-up)
LCD Keypad Controls After Boot-up
Next Button
Back Button

D-Link NetDefend Firewall 5
Connecting Power and Turning On/Off
2. Use the screws provided with the equipment
rack to mount the device in the rack.
Figure 7. Installation Using a Standard-sized
Equipment Rack
The AC Power cord shipped with the device
connects the device to earth ground when
plugged an AC grounding-type power outlet.
The device must be connected to earth ground
during normal operation.
To connect power to the device, plug one
end of the AC power core into the AC power
appliance inlet on the back panel of the device.
Plug the other end into an AC power source.
Note: D-Link recommends the use of a surge
protector with your power connection.
To power on the DFL-2560/2560G device,
press the AC power switch on the rear panel to
the on position. To power off the device, press
the power switch to the off position.
Connecting the Device to a Network
This section provides basic information
about physically connecting the DFL-2560 or
DFL-2560G to a network. Follow the steps
below to connect the rewall as shown in
Figure 8.
Connect an RJ-45 cable from the port1.
labeled 1 to the external router. The port
No. 5 is pre-allocated to the WAN1 network
segment.
Connect an RJ-45 cable from the port2.
labeled 1 to a switch in the DMZ1 network
segment.
Connect an RJ-45 cable from the port3.
labeled 7 to a switch in the LAN1 network
segment.
Connect an RS-232 cable from the console4.
port to a computer for CLI (Command Line
Interface) management access.
Figure 8. Basic Cabling Example
Console
WAN1
DMZ LAN1
Internet
Users
Server
Fram

6 D-Link NetDefend Firewall
Initial Conguration
The NetDefendOS software is pre-installed on
the DFL-2560/2560G device. When the device
is powered on, it is ready to be congured.
While the device has a default factory congu-
ration that allow you to initially connect to the
device, you must perform further conguration
for your specic network requirements.
Using the WebUI
To use the WebUI, the workstation from which
you are managing the device must initially be
on the same subnetwork as the device.
To access the device with the WebUI:
Use an Ethernet cable to connect your1.
workstation to the port labeled 7, which is
pre-allocated to LAN1.
Ensure your workstation is congured with 2.
a static IP address in the 192.168.10.0/24
subnet.
Note: Disable pop-up blocking software
or add the management IP address
https://192.168.10.1 to your pop-up
blocker’s allow list.
Launch your browser; enter the IP3.
address for the LAN1 interface, then press
Enter. (The factory default IP address is
https://192.168.10.1)
Step 4
Log into the NetDefend Firewall web interface.
The default login information is:
Username: admin
Password: admin
Note: The Language drop-down menu allows
you to select a language for the WebUI.
By factory default, NetDefend Firewall only
includes English. You may upload specic
language les from within the WebUI for
additional language support. At the moment,
the Japanese, Russian, Simplied Chinese
and Traditional Chinese language les are
available.
Using a Console Connection (RS-232 DCE)
Note: DFL-2560/2560G allows either HTTP
or a secure HTTPS connections from any
management host. However, for security
reasons, only a secure HTTPS connection is
allowed by default. For more information about
conguring connections settings, please refer
to the Firewall User Manual.
The NetDefend Firewall provides an RS-232
serial port that supports a connection to a
computer or console terminal for monitoring
and conguring the device. This port uses a
male DB-9 connector, implemented as a data
communication terminal equipment (DCE)
connection.
To use the console port connection, you need
the following equipment:
A terminal or a computer with both a serial1.
port and the ability to emulate a terminal.
Figure 10. Authentication Message
Figure 9. Browser Address
Browser Version
Microsoft Internet
Explorer
6.0 or higher
Mozilla Firefox 1.0 or higher
Netscape Navigator 8.0 or higher
Table 5. Browser Compatibility

D-Link NetDefend Firewall 7
To establish a console connection:
Plug the female end of the supplied RS-2321.
cable directly to the console port on the
Firewall, and tighten the captive retaining
screws.
Connect the other end of the cable to2.
a terminal or to the serial connector of
a computer running terminal emulation
software. Use the following settings for
terminal emulation software:
Baud rate: 9600
Data bits: 8
Parity: None
Stop bits: 1
Flow control: None
Once you have correctly set up the terminal,3.
switch on your device. A boot sequence will
appear on the terminal screen.
Once the boot sequence completes, the4.
command prompt is displayed, the device is
ready to be congured.
After initial setup, please refer to the
companion publications found in PDF
format on the accompanying Reference CD
for detailed instructions on conguring the
DFL-2560/2560G.
D-Link NetDefend Firewall User Manual
This document describes the general operation
and control of the NetDefendOS rmware,
D-Link’s proprietary operating system that
drives and controls the NetDefend rewall.
The User Manual includes detailed instructions
regarding typical administrative tasks.
Finalizing the Conguration
In addition to the user manual, the Reference
CD also includes many device conguration
examples. Additional help is available through
D-Link worldwide ofces listed in the appendix
of the User Manual or online. To learn more
about D-Link security product products, please
visit the website http://security.dlink.com.tw. For
support, please visit the website
http://support.dlink.com.tw, which will redirect
you to your regional D-Link website.
Additional Information
D-Link NetDefend Firewall Log
Reference Guide
This document describes all log messages that
might be generated by the NetDefendOS.
D-Link NetDefend Firewall CLI
Reference Guide
This document describes all available text-
based commands that can be used with the
RS232 Console or SSH interface to congure
the rewall.
A RS-232 cable with female DB-92.
connector. (included in the package)
If your Laptop or PC doesn’t have RS-2323.
connector, an adapter is required.
Note: DFL-2560/2560G does not come with an
RS-232 adapter.
Technical Support
United Kingdom (Mon-Fri)
website: http://www.dlink.co.uk
FTP: ftp://ftp.dlink.co.uk
Home Wireless/Broadband 0871 873 3000
(9.00am–06.00pm, Sat 10.00am-02.00pm)
Managed, Smart, & Wireless Switches, or
Firewalls 0871 873 0909 (09.00am- 05.30pm)
(BT 10ppm, other carriers may vary.)
Ireland (Mon-Fri)
All Products 1890 886 899 (09.00am-06.00pm,
Sat 10.00am-02.00pm)
Phone rates: €0.05ppm peak, €0.045ppm off
peak times

Diese Anleitung führt Sie durch den allgemeinen
Installationsprozess für Ihr neues D-Link-Sicherheitsgerät.
Building Networks for People
DFL-2560 / DFL-2560G
Die Dokumentation ist auch
auf CD und über die D-Link-
Website verfügbar.
Handbuch zur Hardwareinstallation
Firewall

10 D-Link NetDefend Firewall
Informationen zum Handbuch
Dieses Handbuch enthält ausführliche Anlei-
tungen zum Einrichten der D-Link DFL-2560/
DFL-2560G Firewall. Beachten Sie, dass Ihr
Modell sich möglicherweise geringfügig von
den Abbildungen unterscheidet.
Lieferumfang und Auspacken
des Produkts
Öffnen Sie den Versandkarton, entnehmen
Sie den Inhalt und packen Sie ihn vorsichtig
aus. Stellen Sie bitte sicher, dass alle auf der
Packliste aufgeführten Artikel auch tatsächlich
geliefert wurden und unbeschädigt sind. Sollte
ein Artikel fehlen oder beschädigt sein, wenden
Sie sich zum Zwecke einer Ersatzlieferung
umgehend an Ihren D-Link-Fachhändler.
Eine (1) DFL-2560(G) NetDefend UTM-
Firewall
Ein (1) Netzkabel-
Ein (1) Konsolenkabel- (RS232)
Ein (1) Ethernet-Kabel- (CAT5 UTP/Straight-Through)
Ein (1) Ethernet-Kabel- (CAT5 UTP/Cross-Over)
Eine (1) Referenz-CD-
(Enthält die Dokumentation im PDF-Format)
Zwei (2) Rackbefestigungsklammern-
Ein (1) IPS-Abonnement mit einer Gültigkeit-
von 12 Monaten
Ein (1) Anti-Virus-Abonnement mit einer-
Gültigkeit von 12 Monaten
Produktübersicht
Vorderseite - DFL-2560 und DFL-2560G
Element Merkmal Beschreibung
A LCD-Anzeige Dient zur Anzeige von Status- und
Betriebsmeldungen.
B Tastenfeld Diese Tasten werden in Verbindung mit
den Meldungen auf der LCD-Anzeige
verwendet.
C LEDs Betriebsanzeige (oben): Zeigt an, dass
die NetDefend UTM Firewall einge-
schaltet ist.
System-LED (unten): Zeigt den System-
status der NetDefend UTM Firewall an.
D Konsolenport Ermöglicht den Zugriff auf die NetDe-
fendOS-CLI (Command Line Interface)
über ein RS232-Kabel.
E USB-Ports (2) Für die zukünftige Verwendung reser-
viert.
F Ethernet-Ports
mit 10/100/1000
Mbit/s*
Den Ports sind die Nummern 5 - 10
zugewiesen (von links nach rechts).
G Ethernet-Ports
mit 10/100/1000
Mbit/s*
(DFL-2560) Den Ports sind die Nummern 1 - 4
zugewiesen (von links nach rechts).
1000 Mbit/s
SFP-Port*
(DFL-2560G)
Abbildung 1. Vorderseite der DFL-2560 / 2560G
Tabelle 1. Beschreibung der Vorderseite der
DFL-2560 / 2560G
* Kongurierbare Gigabit Ethernet-Ports mit Autosensing
Duplex und Auto-MDI/MDIX. Verweisen Sie bei der
Konguration eines Ports auf den Namen der Schnitt-
stelle, die dem jeweiligen Port entspricht. Die Standard-
zuordnungen der Schnittstellennamen für die einzelnen
Ethernet-Ports werden in Tabelle 2, „Standardschnittstel-
lenzuordnungen“, aufgelistet.
BG F DE
A
C
Port
Schnittstel-
lenname
Schnittstel-
lentyp IP-Adresse
Webba-
sierte
Verwaltung
1 DMZ1 Statische IP 172.17.100.254/24 Deaktiviert
2 DMZ2 Statische IP 172.17.110.254/24 Deaktiviert
3 DMZ3 Statische IP 172.17.120.254/24 Deaktiviert
4 DMZ4 Statische IP 172.17.130.254/24 Deaktiviert
5 WAN1 DHCP-Client – Deaktiviert
6 WAN2 Statische IP 192.168.120.254/24 Deaktiviert
7 LAN1 Statische IP 192.168.10.1/24 Aktiviert
8 LAN2 Statische IP 192.168.20.1/24 Deaktiviert
9 LAN3 Statische IP 192.168.30.1/24 Deaktiviert
10 LAN4 Statische IP 192.168.40.1/24 Deaktiviert
Standardeinstellungen für die DFL-2560 /
2560G-Schnittstellen
Tabelle 2. Standardschnittstellenzuordnung
Hinweis: Standardmäßig ermöglichen
D-Link NetDefend Firewalls aus Sicherheits-
gründen nur den webbasierten Zugriff auf
den LAN1-Port. Deshalb ist der Zugriff über
die Weboberäche standardmäßig nur auf
Port-Nr. 7 an der Vorderseite der DFL-2560 /
DFL-2560G möglich.