D-Link NetDefendOS User manual

Network Security Solution http://www.dlink.com
NetDefendOS
Ver.11.04.01
Network Security Firewall
User Manual
Security
Security

User Manual
DFL-260E/860E/870/1660/2560/2560G
NetDefendOS Version 11.04.01
D-Link Corporation
No. 289, Sinhu 3rd Rd, Neihu District, Taipei City 114, Taiwan R.O.C.
http://www.DLink.com
Published 2016-10-03
Copyright ©2016

User Manual
DFL-260E/860E/870/1660/2560/2560G
NetDefendOS Version 11.04.01
Published 2016-10-03
Copyright ©2016
Copyright Notice
This publication, including all photographs, illustrations and software, is protected under
international copyright laws, with all rights reserved. Neither this manual, nor any of the material
contained herein, may be reproduced without the written consent of D-Link.
Disclaimer
The information in this document is subject to change without notice. D-Link makes no
representations or warranties with respect to the contents hereof and specifically disclaims any
implied warranties of merchantability or fitness for a particular purpose. D-Link reserves the right
to revise this publication and to make changes from time to time in the content hereof without
any obligation to notify any person or parties of such revision or changes.
Limitations of Liability
UNDER NO CIRCUMSTANCES SHALL D-LINK OR ITS SUPPLIERS BE LIABLE FOR DAMAGES OF ANY
CHARACTER (E.G. DAMAGES FOR LOSS OF PROFIT, SOFTWARE RESTORATION, WORK STOPPAGE,
LOSS OF SAVED DATA OR ANY OTHER COMMERCIAL DAMAGES OR LOSSES) RESULTING FROM
THE APPLICATION OR IMPROPER USE OF THE D-LINK PRODUCT OR FAILURE OF THE PRODUCT,
EVEN IF D-LINK IS INFORMED OF THE POSSIBILITY OF SUCH DAMAGES. FURTHERMORE, D-LINK
WILL NOT BE LIABLE FOR THIRD-PARTY CLAIMS AGAINST CUSTOMER FOR LOSSES OR DAMAGES.
D-LINK WILL IN NO EVENT BE LIABLE FOR ANY DAMAGES IN EXCESS OF THE AMOUNT D-LINK
RECEIVED FROM THE END-USER FOR THE PRODUCT.

Table of Contents
Preface...............................................................................................................17
1.NetDefendOSOverview .....................................................................................20
1.1.Features ...............................................................................................20
1.2.NetDefendOSArchitecture ......................................................................24
1.2.1.State-basedArchitecture ..............................................................24
1.2.2.NetDefendOSBuildingBlocks ........................................................24
1.2.3.BasicPacketFlow.........................................................................25
1.3.NetDefendOS State EnginePacketFlow .....................................................28
2.ManagementandMaintenance ..........................................................................33
2.1.ManagingNetDefendOS .........................................................................33
2.1.1.Overview ....................................................................................33
2.1.2.ConfiguringManagementAccess ...................................................34
2.1.3.AdministratorAccount .................................................................40
2.1.4.TheWebInterface ........................................................................41
2.1.5.TheCLI .......................................................................................46
2.1.6.CLIScripts...................................................................................58
2.1.7.SecureCopy................................................................................64
2.1.8.TheConsoleBootMenu ................................................................66
2.1.9.RADIUSManagementAuthentication .............................................67
2.1.10.ManagementAdvancedSettings ..................................................70
2.1.11.WorkingwithConfigurations .......................................................71
2.2.SystemDateandTime ............................................................................78
2.2.1.Overview ....................................................................................78
2.2.2.SettingDateandTimeManually.....................................................78
2.2.3.DaylightSavingTime ...................................................................79
2.2.4.UsingExternalTimeServers...........................................................82
2.2.5.SettingsSummaryforDateandTime ..............................................85
2.3.EventsandLogging ................................................................................87
2.3.1.Overview ....................................................................................87
2.3.2.LogMessages .............................................................................87
2.3.3.LogReceiverTypes ......................................................................88
2.3.4.TheMemoryLogReceiver(Memlog) ...............................................89
2.3.5.TheSyslogLogReceiver................................................................89
2.3.6.MailAlerting ...............................................................................92
2.3.7. Severity Filter and Message Exceptions ........................................... 96
2.3.8.SNMPTraps ................................................................................97
2.3.9.AdvancedLogSettings .................................................................98
2.3.10.Logsnoop .................................................................................99
2.4.Monitoring .......................................................................................... 103
2.4.1.Real-timeMonitorAlerts ............................................................. 103
2.4.2.TheLinkMonitor ....................................................................... 103
2.4.3.HardwareMonitoring ................................................................. 107
2.4.4.MemoryMonitoringSettings ....................................................... 109
2.5.SNMP ................................................................................................. 111
2.5.1.Management withSNMP ............................................................ 111
2.5.2.PersistentSNMPInterfaceIndexes ................................................ 115
2.5.3.SNMPAdvancedSettings ............................................................ 116
2.6.DiagnosticTools .................................................................................. 118
2.6.1.Overview .................................................................................. 118
2.6.2. The ping Command .................................................................... 118
2.6.3. The stats Command ................................................................... 122
2.6.4. The connections Command ......................................................... 123
2.6.5. The dconsole Command .............................................................. 125
2.6.6. The pcapdump Command ........................................................... 126
2.6.7. The traceroute Command ............................................................ 128
2.6.8. The frags Command ................................................................... 131
4

2.6.9. The selftest Command ................................................................ 133
2.7.Maintenance ....................................................................................... 135
2.7.1.VersionUpdateAlerts ................................................................. 135
2.7.2.Auto-UpdateMechanism ............................................................ 136
2.7.3.Backing UpConfigurations .......................................................... 136
2.7.4.RestoretoFactory Defaults.......................................................... 139
2.8.Languages .......................................................................................... 141
2.9.DiagnosticsandImprovements .............................................................. 142
3.Fundamentals ................................................................................................ 145
3.1.TheAddressBook ................................................................................ 145
3.1.1.Overview .................................................................................. 145
3.1.2.IPAddresses ............................................................................. 146
3.1.3.EthernetAddresses .................................................................... 148
3.1.4.AddressGroups ......................................................................... 148
3.1.5.Auto-GeneratedAddressObjects ................................................. 149
3.1.6.AddressBookFolders ................................................................. 150
3.1.7.FQDNAddressObjects ............................................................... 150
3.2.IPv6Support ....................................................................................... 156
3.3.Services .............................................................................................. 165
3.3.1.Overview .................................................................................. 165
3.3.2.CreatingCustomServices ............................................................ 167
3.3.3.ICMPServices ............................................................................ 171
3.3.4.CustomIP ProtocolServices ........................................................ 172
3.3.5.ServiceGroups .......................................................................... 173
3.3.6.CustomServiceTimeouts ............................................................ 174
3.3.7.PathMTUDiscovery ................................................................... 174
3.4.Interfaces ............................................................................................ 178
3.4.1.Overview .................................................................................. 178
3.4.2.EthernetInterfaces ..................................................................... 180
3.4.3.LinkAggregation ....................................................................... 191
3.4.4.VLAN ....................................................................................... 195
3.4.5.ServiceVLAN............................................................................. 199
3.4.6.PPPoE ...................................................................................... 202
3.4.7.GRETunnels .............................................................................. 205
3.4.8.6in4Tunnels ............................................................................. 209
3.4.9.LoopbackInterfaces ................................................................... 213
3.4.10.InterfaceGroups ...................................................................... 218
3.4.11.Layer2PassThrough ................................................................ 219
3.5.ARP .................................................................................................... 221
3.5.1.Overview .................................................................................. 221
3.5.2.TheARPCache .......................................................................... 221
3.5.3.ARPPublish .............................................................................. 223
3.5.4.UsingARPAdvanced Settings ...................................................... 226
3.6.IPRulesandIP Policies .......................................................................... 228
3.6.1.SecurityPolicies ......................................................................... 228
3.6.2.IPRuleSet Evaluation ................................................................. 232
3.6.3.IPRule...................................................................................... 233
3.6.4.MultipleIPRuleSets ................................................................... 235
3.6.5.IPRuleSet Folders ..................................................................... 240
3.6.6.ConfigurationObjectGroups ....................................................... 241
3.6.7.IPPolicy ................................................................................... 245
3.6.8.StatelessPolicy .......................................................................... 251
3.7.ApplicationControl .............................................................................. 253
3.8.Schedules ........................................................................................... 265
3.9.Certificates .......................................................................................... 268
3.9.1.Overview .................................................................................. 268
3.9.2.UploadingandUsingCertificates ................................................. 273
3.9.3.CRLDistributionPointLists ......................................................... 275
3.9.4.CAServer Access ....................................................................... 277
3.9.5. Creating Windows CA Server Requests .......................................... 279
3.10.DNS.................................................................................................. 281
User Manual
5

4.Routing ......................................................................................................... 285
4.1.Overview ............................................................................................ 285
4.2.StaticRouting ...................................................................................... 286
4.2.1.ThePrinciplesofRouting ............................................................ 286
4.2.2.StaticRouting ........................................................................... 290
4.2.3.RouteFailover ........................................................................... 296
4.2.4.HostMonitoringforRouteFailover ............................................... 299
4.2.5.AdvancedSettingsforRouteFailover ............................................ 301
4.2.6.ProxyARP ................................................................................. 302
4.2.7.BroadcastPacket Forwarding ...................................................... 304
4.3.Policy-basedRouting ............................................................................ 308
4.4.RouteLoadBalancing ........................................................................... 316
4.5.Virtual Routing .................................................................................... 323
4.5.1.Overview .................................................................................. 323
4.5.2.ASimpleScenario ...................................................................... 323
4.5.3.TheDisadvantageofRoutingRules............................................... 325
4.5.4.IPRuleSets withVirtualRouting ................................................... 328
4.5.5.MultipleIPrulesets .................................................................... 329
4.5.6.TroubleShooting ....................................................................... 329
4.6.OSPF .................................................................................................. 331
4.6.1.DynamicRouting ....................................................................... 331
4.6.2.OSPFConcepts .......................................................................... 334
4.6.3.OSPFComponents ..................................................................... 339
4.6.4.DynamicRoutingRules ............................................................... 345
4.6.5.SettingUpOSPF ........................................................................ 348
4.6.6.AnOSPFExample ...................................................................... 352
4.6.7.OSPFTroubleshooting ................................................................ 357
4.7.MulticastRouting ................................................................................. 361
4.7.1.Overview .................................................................................. 361
4.7.2. Multicast Forwarding with SAT Multiplex Rules ............................... 362
4.7.3.IGMPConfiguration ................................................................... 368
4.7.4.AdvancedIGMPSettings ............................................................. 374
4.7.5.TunnelingMulticastusingGRE ..................................................... 376
4.8.TransparentMode ................................................................................ 379
4.8.1.Overview .................................................................................. 379
4.8.2.EnablingInternetAccess ............................................................. 384
4.8.3.ATransparentModeUse Case...................................................... 386
4.8.4.SpanningTreeBPDUSupport ...................................................... 388
4.8.5.MPLSPassThrough .................................................................... 389
4.8.6. Advanced Settings for Transparent Mode ...................................... 390
5.DHCPServices ................................................................................................ 393
5.1.Overview ............................................................................................ 393
5.2.IPv4DHCPClient .................................................................................. 395
5.3.IPv4DHCPServer ................................................................................. 397
5.3.1.StaticIPv4DHCPHosts ............................................................... 401
5.3.2.CustomIPv4Options .................................................................. 402
5.4.IPv4DHCPRelay .................................................................................. 404
5.5.IPPools .............................................................................................. 408
5.6.DHCPv6 .............................................................................................. 411
5.6.1.DHCPv6Client ........................................................................... 411
5.6.2.DHCPv6Server .......................................................................... 414
6.SecurityMechanisms ...................................................................................... 421
6.1.AccessRules ........................................................................................ 421
6.1.1.Overview .................................................................................. 421
6.1.2.IPSpoofing ............................................................................... 422
6.1.3.AccessRuleSettings ................................................................... 422
6.2.ALGs .................................................................................................. 425
6.2.1.Overview .................................................................................. 425
6.2.2.TheHTTP ALG ........................................................................... 427
6.2.3.TheLightWeight HTTPALG......................................................... 432
6.2.4.TheFTPALG ............................................................................. 435
User Manual
6

6.2.5.TheTFTPALG ............................................................................ 447
6.2.6.TheSMTP ALG ........................................................................... 448
6.2.7.ThePOP3ALG ........................................................................... 457
6.2.8.ThePPTPALG ............................................................................ 461
6.2.9.TheSIPALG .............................................................................. 463
6.2.10.TheH.323ALG ......................................................................... 479
6.2.11.TheTLSALG ............................................................................ 500
6.3.WebContentFiltering ........................................................................... 503
6.3.1.Overview .................................................................................. 503
6.3.2.ActiveContentHandling ............................................................. 503
6.3.3.StaticContentFiltering ............................................................... 504
6.3.4.DynamicWebContentFiltering ................................................... 507
6.4.EmailFiltering andAnti-Spam ................................................................ 526
6.4.1.IPPolicyBasedEmailFiltering ...................................................... 526
6.4.2.ALGBasedEmailFiltering ............................................................ 534
6.4.3.DNSBLDatabases ...................................................................... 539
6.5.Anti-Virus Scanning .............................................................................. 541
6.5.1.Overview .................................................................................. 541
6.5.2.Implementation ........................................................................ 542
6.5.3.Anti-VirusOptions ..................................................................... 545
6.5.4.ActivatingAnti-Virus Scanning ..................................................... 546
6.5.5.TheAnti-Virus Cache .................................................................. 550
6.6.IntrusionDetection andPrevention ........................................................ 552
6.6.1.Overview .................................................................................. 552
6.6.2.IDPSubscriptions ....................................................................... 553
6.6.3.IDPRules .................................................................................. 554
6.6.4.Insertion/EvasionAttackPrevention ............................................. 556
6.6.5.IDPPatternMatching ................................................................. 557
6.6.6.IDPSignatureGroups ................................................................. 558
6.6.7.SettingUpIDP ........................................................................... 559
6.6.8.SMTPLog ReceiverforIDP Events ................................................. 562
6.6.9.BestPracticeDeployment ........................................................... 564
6.7.Denial-of-Service Attacks ....................................................................... 566
6.7.1.Overview .................................................................................. 566
6.7.2.DoSAttackMechanisms.............................................................. 566
6.7.3. Ping of Death Attacks .................................................................. 566
6.7.4.FragmentationOverlapAttacks.................................................... 567
6.7.5. The Land and LaTierra Attacks ...................................................... 567
6.7.6. The WinNuke attack .................................................................... 567
6.7.7.AmplificationAttacks ................................................................. 568
6.7.8.TCP SYN FloodAttacks ................................................................ 569
6.7.9. The Jolt2 Attack ......................................................................... 569
6.7.10.Distributed DoSAttacks ............................................................ 570
6.8.BlacklistingHostsandNetworks ............................................................. 571
7.AddressTranslation ........................................................................................ 574
7.1.Overview ............................................................................................ 574
7.2.NAT ................................................................................................... 576
7.3.NATPools ........................................................................................... 584
7.4.SAT .................................................................................................... 588
7.4.1.Introduction ............................................................................. 588
7.4.2.One-to-OneIPTranslation ........................................................... 590
7.4.3.Many-to-ManyIPTranslation ....................................................... 593
7.4.4.All-to-OneIPTranslation ............................................................. 596
7.4.5.Port Translation ......................................................................... 599
7.4.6. SAT with FwdFast Rules ............................................................... 600
7.4.7.UsinganIPPolicyforSAT ............................................................ 601
7.4.8.ProtocolsHandledbySAT ........................................................... 602
7.4.9.SATwithNAT ............................................................................ 603
8.UserAuthentication ........................................................................................ 608
8.1.Overview ............................................................................................ 608
8.2.AuthenticationSetup............................................................................ 610
User Manual
7

8.2.1.SetupSummary ......................................................................... 610
8.2.2.LocalUserDatabases .................................................................. 610
8.2.3.External RADIUSServers ............................................................. 614
8.2.4.External LDAP Servers ................................................................ 616
8.2.5.AuthenticationRules .................................................................. 624
8.2.6.AuthenticationProcessing .......................................................... 626
8.2.7.HTTPAuthentication .................................................................. 627
8.2.8.BruteForceProtection ................................................................ 630
8.3.ARPAuthentication .............................................................................. 633
8.4.CustomizingAuthenticationHTML ......................................................... 635
8.5.PoliciesRequiringAuthentication ........................................................... 639
8.6.UserIdentityAwareness ........................................................................ 641
8.7.MultiFactorAuthentication ................................................................... 650
8.8.RadiusRelay ........................................................................................ 652
8.9.RADIUSAccounting .............................................................................. 659
8.9.1.Overview .................................................................................. 659
8.9.2.RADIUSAccountingMessages ..................................................... 659
8.9.3.InterimAccountingMessages ...................................................... 661
8.9.4.Configuring RADIUSAccounting .................................................. 661
8.9.5.RADIUSAccountingSecurity ....................................................... 663
8.9.6. RADIUS Accounting and High Availability ...................................... 663
8.9.7. Handling Unresponsive RADIUS Servers ........................................ 663
8.9.8.AccountingandSystemShutdowns ............................................. 664
8.9.9.LimitationswithNAT .................................................................. 664
8.9.10.AdvancedRADIUSSettings ........................................................ 664
9.VPN .............................................................................................................. 667
9.1.Overview ............................................................................................ 667
9.1.1.VPNUsage ................................................................................ 667
9.1.2.VPNEncryption ......................................................................... 668
9.1.3.VPNPlanning ............................................................................ 669
9.1.4.KeyDistribution ......................................................................... 669
9.1.5.TheTLSAlternativeforVPN ......................................................... 670
9.2.VPNQuickStart .................................................................................... 671
9.2.1. IPsec LAN-to-LAN with Pre-shared Keys ......................................... 672
9.2.2.IPsec LAN-to-LANwithCertificates ............................................... 673
9.2.3. IPsec Roaming Clients with Pre-shared Keys ................................... 674
9.2.4. IPsec Roaming Clients with Certificates ......................................... 677
9.2.5. L2TP/IPsec Roaming Clients with Pre-Shared Keys ........................... 678
9.2.6. L2TP/IPsec Roaming Clients with Certificates ................................. 680
9.2.7.PPTPRoamingClients ................................................................. 680
9.2.8.iOSSetup ................................................................................. 681
9.3.IPsec Components ............................................................................... 683
9.3.1.Overview .................................................................................. 683
9.3.2.InternetKeyExchange (IKE) ......................................................... 683
9.3.3.IKEAuthentication ..................................................................... 690
9.3.4.IPsec Protocols(ESP/AH) ............................................................. 691
9.3.5.NATTraversal ............................................................................ 693
9.3.6.AlgorithmProposalLists ............................................................. 694
9.3.7.Pre-sharedKeys ......................................................................... 696
9.3.8.UsingIDLists withCertificates ..................................................... 697
9.3.9.DiffServwithIPsec ..................................................................... 699
9.4.IPsec Tunnels ....................................................................................... 701
9.4.1.Overview .................................................................................. 701
9.4.2. LAN-to-LAN Tunnels with Pre-shared Keys ..................................... 704
9.4.3.RoamingClients ........................................................................ 708
9.4.4.IKEv2Support ........................................................................... 713
9.4.5.IKEv2ClientSetup ...................................................................... 714
9.4.6. Fetching CRLs from an alternate LDAP server ................................. 719
9.4.7.TheIPsecTunnelSelection Process ............................................... 720
9.4.8.IPsec TunnelMonitoring ............................................................. 721
9.4.9.IPsec AdvancedSettings ............................................................. 723
User Manual
8

9.5.PPTP/L2TP .......................................................................................... 729
9.5.1.PPTPServers ............................................................................. 729
9.5.2.L2TPServers ............................................................................. 730
9.5.3.L2TP/PPTPServerAdvancedSettings ............................................ 736
9.5.4.PPTP/L2TPClients ...................................................................... 737
9.5.5.Thel2tpand pptpCommands ..................................................... 739
9.6.L2TPVersion3 ..................................................................................... 741
9.6.1.L2TPv3Server ........................................................................... 741
9.6.2.L2TPv3Client ............................................................................ 748
9.7.SSLVPN .............................................................................................. 752
9.7.1.Overview .................................................................................. 752
9.7.2.Configuring SSLVPNin NetDefendOS ........................................... 753
9.7.3.InstallingtheSSLVPN Client ........................................................ 755
9.7.4.SSLVPNSetup Example .............................................................. 759
9.8.VPNTroubleshooting ............................................................................ 762
9.8.1.GeneralTroubleshooting ............................................................ 762
9.8.2.Troubleshooting Certificates ....................................................... 763
9.8.3. The ike -stat Command ............................................................... 763
9.8.4. The ike -snoop Command ............................................................ 764
9.8.5. Management Interface Failure with VPN ........................................ 771
9.8.6.SpecificErrorMessages............................................................... 771
9.8.7.SpecificSymptoms..................................................................... 774
10.TrafficManagement ...................................................................................... 776
10.1.TrafficShaping ................................................................................... 776
10.1.1.Overview ................................................................................ 776
10.1.2.TrafficShapinginNetDefendOS ................................................. 777
10.1.3.SimpleBandwidthLimiting ....................................................... 780
10.1.4. Limiting Bandwidth in Both Directions ........................................ 781
10.1.5. Creating Differentiated Limits Using Chains ................................. 783
10.1.6.Precedences ............................................................................ 784
10.1.7.PipeGroups ............................................................................ 788
10.1.8.TrafficShapingRecommendations ............................................. 791
10.1.9.ASummaryof TrafficShaping .................................................... 793
10.1.10.MorePipe Examples ............................................................... 793
10.2.IDPTrafficShaping ............................................................................. 798
10.2.1.Overview ................................................................................ 798
10.2.2.SettingUpIDPTrafficShaping ................................................... 798
10.2.3.ProcessingFlow ....................................................................... 799
10.2.4. The Importance of Specifying a Network ...................................... 799
10.2.5.AP2PScenario......................................................................... 800
10.2.6.ViewingTrafficShapingObjects ................................................. 801
10.2.7. Guaranteeing Instead of Limiting Bandwidth ................................ 802
10.2.8.Logging .................................................................................. 802
10.3.ThresholdRules.................................................................................. 803
10.4.ServerLoadBalancing ......................................................................... 807
10.4.1.Overview ................................................................................ 807
10.4.2.SLBDistributionAlgorithms ....................................................... 809
10.4.3.Selecting Stickiness .................................................................. 809
10.4.4.SLBAlgorithmsandStickiness .................................................... 811
10.4.5.ServerHealthMonitoring .......................................................... 812
10.4.6. Setting Up SLB_SAT Rules .......................................................... 812
10.4.7.SLBPolicy ............................................................................... 816
11.HighAvailability ........................................................................................... 820
11.1.Overview .......................................................................................... 820
11.2.HAMechanisms ................................................................................. 823
11.3.SettingUpHA .................................................................................... 827
11.3.1.HardwareSetup ....................................................................... 827
11.3.2.WizardHASetup ...................................................................... 829
11.3.3.ManualHASetup ..................................................................... 831
11.3.4. Verifying that the Cluster Functions Correctly ............................... 832
11.3.5.UniqueSharedMacAddresses ................................................... 833
User Manual
9

11.4.HAIssues .......................................................................................... 834
11.5.UpgradinganHA Cluster ..................................................................... 837
11.6.LinkMonitoringandHA ...................................................................... 839
11.7.HAAdvancedSettings ......................................................................... 840
12.ZoneDefense ............................................................................................... 843
13.AdvancedSettings ........................................................................................ 849
13.1.IPLevelSettings ................................................................................. 849
13.2.TCPLevelSettings .............................................................................. 853
13.3.ICMPLevelSettings ............................................................................ 859
13.4.StateSettings .................................................................................... 860
13.5.Connection TimeoutSettings ............................................................... 862
13.6.LengthLimitSettings .......................................................................... 864
13.7.FragmentationSettings ....................................................................... 867
13.8.LocalFragmentReassemblySettings ..................................................... 871
13.9.SSL/TLSSettings ................................................................................. 872
13.10.MiscellaneousSettings ...................................................................... 875
A.SubscribingtoUpdates ................................................................................... 880
B.IDPSignatureGroups ...................................................................................... 884
C.VerifiedMIMEfiletypes .................................................................................... 888
D.TheOSI Framework ........................................................................................ 892
E.DFL-260E/860EPort BasedVLAN ....................................................................... 893
F.ThirdPartySoftwareLicenses ........................................................................... 895
Alphabetical Index ............................................................................................. 901
User Manual
10

List of Figures
1.1.PacketFlowSchematicPartI ............................................................................28
1.2.PacketFlowSchematicPartII ...........................................................................29
1.3.PacketFlowSchematicPartIII ..........................................................................30
1.4. Expanded Apply Rules Logic .............................................................................31
2.1.ManagementWorkstationConnection ..............................................................42
3.1.PathMTUDiscoveryProcessing ...................................................................... 175
3.2.LinkAggregation ......................................................................................... 192
3.3.VLANConnections ....................................................................................... 197
3.4.AServiceVLANUse Case ............................................................................... 200
3.5.AnExampleofGRE Usage .............................................................................. 207
3.6.IP6in4TunnelUsage ..................................................................................... 210
3.7.Acting as a6in4 TunnelServer ........................................................................ 212
3.8.AUse Case forLoopbackInterfaces ................................................................. 215
3.9. Setting Up Loopback Interfaces with Routing Tables .......................................... 216
3.10.ComponentsofLoopbackInterfaceSetup ...................................................... 217
3.11.AnARPPublish EthernetFrame .................................................................... 225
3.12.SimplifiedNetDefendOSTrafficFlow ............................................................. 231
3.13.CertificateValidationComponents ................................................................ 278
4.1.ATypicalRoutingScenario ............................................................................ 287
4.2. Using Local IP Address withanUnboundNetwork .............................................. 289
4.3.ARouteFailoverScenarioforISPAccess .......................................................... 296
4.4.AProxyARPExample .................................................................................... 303
4.5.TheRLBRoundRobinAlgorithm ..................................................................... 317
4.6.TheRLBSpilloverAlgorithm ........................................................................... 318
4.7.ARouteLoadBalancingScenario .................................................................... 320
4.8.Virtual Routing ............................................................................................ 324
4.9.TheDisadvantageofRoutingRules ................................................................. 325
4.10.TheAdvantageof Virtual Routing ................................................................. 326
4.11.ASimpleOSPFScenario ............................................................................... 332
4.12.OSPFProvidingRouteRedundancy ............................................................... 333
4.13.VirtualLinksConnecting Areas ..................................................................... 337
4.14.VirtualLinkswith Partitioned Backbone ......................................................... 338
4.15.NetDefendOSOSPFObjects ......................................................................... 339
4.16.DynamicRoutingRuleObjects ..................................................................... 347
4.17.AnOSPFExample ....................................................................................... 353
4.18. Multicast Forwarding - No Address Translation ................................................ 363
4.19.MulticastForwarding-AddressTranslation .................................................... 367
4.20.MulticastSnoopMode ................................................................................ 369
4.21.MulticastProxyMode .................................................................................. 369
4.22.TunnelingMulticastusingGRE ..................................................................... 377
4.23.Non-transparentModeInternetAccess .......................................................... 384
4.24.TransparentModeInternetAccess ................................................................ 385
4.25.TransparentModeUse Case ......................................................................... 386
4.26.AnExampleBPDURelayingScenario ............................................................. 389
5.1.DHCPServerObjects .................................................................................... 401
5.2.DHCPRelaywith ProxyARP ........................................................................... 405
6.1.DeployinganALG ........................................................................................ 426
6.2.HTTPALGProcessingOrder ........................................................................... 431
6.3.FTPALGHybridMode ................................................................................... 437
6.4.SMTPALG Usage .......................................................................................... 449
6.5.SMTPALG ProcessingOrder ........................................................................... 452
6.6.POP3ALGUsage .......................................................................................... 458
6.7.PPTPALGUsage ........................................................................................... 462
6.8.TLSTermination ........................................................................................... 501
6.9.WebContentFilteringFlow ........................................................................... 509
6.10.Anti-SpamFiltering ..................................................................................... 540
11

6.11.Anti-VirusMaliciousFileMessage .................................................................. 543
6.12.Anti-VirusMaliciousURLMessage ................................................................. 543
6.13.IDPDatabaseUpdating ............................................................................... 553
6.14.IDPSignatureSelection ............................................................................... 555
7.1.NATIPAddressTranslation ............................................................................ 576
7.2.ANATExample ............................................................................................ 578
7.3.AutomaticAddressTranslation ....................................................................... 581
7.4.AnonymizingwithNAT ................................................................................. 583
7.5.SATAddressTranslation ................................................................................ 593
7.6.SATwithNAT .............................................................................................. 603
8.1.NormalLDAP Authentication ......................................................................... 623
8.2. LDAP for PPP with CHAP, MS-CHAPv1 or MS-CHAPv2 ......................................... 624
8.3.UserIdentityAwareness ................................................................................ 641
8.4. The General TabintheIDAInterface ................................................................ 646
8.5. The Event Monitoring TabintheIDAInterface ................................................... 646
8.6. The Security Tab inthe IDA Interface ................................................................ 647
8.7. The Excluded Users TabintheIDAInterface ...................................................... 648
9.1.TheAHprotocol ........................................................................................... 692
9.2.TheESPprotocol .......................................................................................... 693
9.3.PPTPClientUsage ........................................................................................ 739
9.4.AnL2TPv3Example ...................................................................................... 742
9.5.SSLVPNBrowserConnection Choices ............................................................. 756
9.6.TheSSLVPNClientLogin ............................................................................... 757
9.7.TheSSLVPNClientStatistics .......................................................................... 758
10.1.PipeRulesDeterminePipe Usage .................................................................. 779
10.2. FwdFast RulesBypassTrafficShaping............................................................. 780
10.3.DifferentiatedLimitsUsingChains ................................................................ 783
10.4.TheEightPipePrecedences ......................................................................... 784
10.5.Minimum and MaximumPipe Precedence...................................................... 786
10.6.TrafficGroupedByIPAddress ....................................................................... 790
10.7.ABasicTrafficShapingScenario .................................................................... 794
10.8.IDPTrafficShapingP2PScenario ................................................................... 801
10.9.AServerLoadBalancingConfiguration .......................................................... 808
10.10.ConnectionsfromThree Clients .................................................................. 811
10.11.Stickiness andRound-Robin ....................................................................... 811
10.12.Stickiness andConnection-rate ................................................................... 812
D.1.The7 Layersof theOSI Model ........................................................................ 892
User Manual
12

List of Examples
1.ExampleNotation .............................................................................................17
2.1.ChangingtheManagementValidationTimeout ..................................................37
2.2.ChangingtheManagementInterfaceIPAddress .................................................38
2.3.ChangingaRemoteManagementObject ..........................................................38
2.4.ChangingtheHAManagementIPAddress .........................................................39
2.5.AddingRemoteManagementviaHTTPS ............................................................40
2.6. Remote Management via HTTPS with CA Signed Certificates ................................. 46
2.7.EnablingSSHRemoteAccess ...........................................................................52
2.8.EnablingSSHAuthenticationUsingSSHKeys .....................................................53
2.9.RunningaCLIScriptfromtheWebInterface .......................................................63
2.10.EnablingRADIUSManagementAuthentication .................................................70
2.11.ListingConfigurationObjects .........................................................................72
2.12.DisplayingaConfigurationObject ...................................................................73
2.13.EditingaConfigurationObject .......................................................................73
2.14.AddingaConfigurationObject .......................................................................74
2.15.DeletingaConfigurationObject .....................................................................75
2.16.UndeletingaConfigurationObject ..................................................................75
2.17.ListingModifiedConfigurationObjects ............................................................76
2.18.ActivatingandCommittingaConfiguration .....................................................76
2.19.SettingtheCurrentDateandTime ..................................................................78
2.20.SettingtheTimeZone ...................................................................................79
2.21.EnablingDSTwiththetzDatabase ..................................................................80
2.22.EnablingDSTManually ..................................................................................81
2.23.UsingtheD-LinkTimeServer .........................................................................83
2.24.ConfiguringCustomTimeServers ...................................................................83
2.25.ManuallyTriggeringaTimeSynchronization ....................................................84
2.26.ModifyingtheMaximumAdjustmentValue ......................................................84
2.27.ForcingTimeSynchronization ........................................................................85
2.28.EnableLoggingtoaSyslogHost .....................................................................90
2.29. Enabling Syslog RFC 5424 Compliance with Hostname ....................................... 91
2.30.SettingupaMailAlertingObject ....................................................................95
2.31.SendingSNMPTrapstoanSNMPTrapReceiver.................................................98
2.32.LinkMonitorSetup ..................................................................................... 106
2.33.EnablingSNMPVersions1and 2cMonitoring ................................................. 113
2.34.EnablingSNMPVersion3Monitoring ............................................................ 114
2.35.EnablingSNMPIndexPersistence ................................................................. 116
2.36. Disabling NetDefendOS Release Notifications ................................................. 135
2.37.PerformingaCompleteSystemBackup ......................................................... 138
2.38. Complete Hardware Reset to Factory Defaults ................................................ 139
2.39. Disabling Diagnostics and Quality Improvements Messaging ............................ 143
3.1.AddinganIP HostAddress............................................................................. 146
3.2.AddinganIP Network ................................................................................... 147
3.3.AddinganIP Range ...................................................................................... 147
3.4.DeletinganAddressObject ........................................................................... 147
3.5.AddinganEthernetAddress .......................................................................... 148
3.6.AddinganFQDN AddressObject .................................................................... 153
3.7. Setting the DNS Minimum TTL and Minimum Lifetime ....................................... 153
3.8.UsingFQDNObjectswithanIPPolicy .............................................................. 154
3.9.EnablingIPv6Globally .................................................................................. 156
3.10.EnablingIPv6onan Interface ....................................................................... 157
3.11.ManuallyAddingIPv6InterfaceAddresses ..................................................... 158
3.12.EnablingIPv6Advertisements ...................................................................... 160
3.13.AddinganIPv6Routeand EnablingProxyND ................................................. 161
3.14.ListingtheAvailableServices........................................................................ 166
3.15.ViewingaSpecificService ............................................................................ 167
3.16.CreatingaCustomTCP/UDPService .............................................................. 170
13

3.17.AddinganIP ProtocolService ....................................................................... 172
3.18.CreatingaService ....................................................................................... 173
3.19.EnablingPathMTUDiscovery ....................................................................... 176
3.20.LinkAggregation........................................................................................ 195
3.21.DefiningaVLAN ......................................................................................... 198
3.22.DefiningaServiceVLAN .............................................................................. 200
3.23.ConfiguringaPPPoEClient .......................................................................... 204
3.24.6in4TunnelConfiguration ........................................................................... 211
3.25.CreatingaLoopbackInterfacePair ................................................................ 217
3.26.CreatinganInterfaceGroup ......................................................................... 218
3.27.EnablingLayer2PassThrough ..................................................................... 219
3.28.DisplayingtheARPCache ............................................................................ 222
3.29.FlushingtheARPCache ............................................................................... 222
3.30.DefininganARP/NeighborDiscoveryObject ................................................... 225
3.31.CreatinganIP RuleSet ................................................................................ 235
3.32. Adding a Goto Rule ..................................................................................... 238
3.33.AddingaReturnRule .................................................................................. 239
3.34. Adding an Allow IPRule ............................................................................... 240
3.35. Setting up a Policy to Allow Connections to a DMZ .......................................... 247
3.36. Setting up a SAT Policy to an Internal Web Server ............................................ 248
3.37.Settingupa GeolocationFilter ..................................................................... 249
3.38.CreatingaStateless Policy ........................................................................... 251
3.39.SpecifyinganApplicationControlPolicy ........................................................ 253
3.40.UsinganApplicationControlRuleSet ............................................................ 255
3.41.ApplicationContentControl ........................................................................ 259
3.42.ApplicationContentControlwithLogging ..................................................... 260
3.43.Settingupa Time-Scheduled SecurityPolicy ................................................... 266
3.44. Uploading a Certificate with the Web Interface ............................................... 274
3.45.AssociatingCertificateswithIPsecTunnels ..................................................... 275
3.46.CRLDistributionPointList ........................................................................... 275
3.47.ConfiguringDNSServers ............................................................................. 281
4.1. Displaying the main RoutingTable .................................................................. 292
4.2. Adding a Route to the main Table ................................................................... 294
4.3.DisplayingtheCoreRoutes ............................................................................ 295
4.4.EnablingBroadcastForwardingona Route ...................................................... 306
4.5.CreatingaRoutingTable ............................................................................... 309
4.6.AddingRoutes ............................................................................................. 310
4.7.CreatingaRoutingRule................................................................................. 310
4.8.Policy-basedRoutingwithMultipleISPs ........................................................... 313
4.9.SettingUpRLB ............................................................................................. 321
4.10. Creating an OSPF Router Process .................................................................... 353
4.11. Add an OSPF Area ....................................................................................... 354
4.12. Add OSPF Interface Objects .......................................................................... 354
4.13. Import Routes from an OSPF AS into the Main Routing Table ............................. 355
4.14.ExportingtheRoutesintoan OSPFAS ............................................................ 356
4.15.EnablingOSPFDebugLogEvents ................................................................. 358
4.16. Forwarding Multicast Traffic with a SAT Multiplex IP Rule .................................. 363
4.17. Forwarding Multicast Traffic with a Multicast Policy ......................................... 365
4.18.MulticastForwarding-AddressTranslation .................................................... 367
4.19.IGMP-No AddressTranslation ...................................................................... 370
4.20. if1 Configuration ........................................................................................ 371
4.21. if2 Configuration-GroupTranslation ............................................................. 372
4.22.ATransparentModeUse Case ...................................................................... 386
5.1. Enabling an Ethernet Interface as a DHCP Client ................................................ 395
5.2.Settingupan IPv4DHCPserver ...................................................................... 399
5.3.StaticIPv4DHCPHostAssignment .................................................................. 401
5.4.Settingupa DHCPRelayer ............................................................................. 405
5.5.CreatinganIP Pool ....................................................................................... 410
5.6.DHCPv6ClientSetup .................................................................................... 413
5.7.DHCPv6Server Setup.................................................................................... 416
5.8.StaticDHCPv6HostAssignment ..................................................................... 418
User Manual
14

6.1.Settingupan Access Rule .............................................................................. 423
6.2.UsingtheLightWeight HTTP ALG ................................................................... 433
6.3.Protecting anFTP Serverwithan ALG .............................................................. 440
6.4.Protecting FTPClients ................................................................................... 444
6.5.SMTPALG Setup .......................................................................................... 453
6.6.POP3ALGSetup .......................................................................................... 459
6.7. SIP with Local Clients/Internet Proxy Using IP Rules ........................................... 470
6.8. SIP with Local Clients/Internet Proxy Using IP Policies ........................................ 471
6.9. Protecting Internal H.323 Phones Using IP Rules ................................................ 482
6.10. Protecting Internal H.323 Phones Using IP Policy Objects .................................. 483
6.11.H.323witha PrivateAddressUsingIPRules .................................................... 485
6.12. 2 Phones Behind Different NetDefend Firewalls Using IP Rules .......................... 487
6.13.UsingPrivateIPv4Addresses ........................................................................ 489
6.14.H.323withGatekeeper ................................................................................ 491
6.15. H.323 with Gatekeeper and two NetDefend Firewalls ....................................... 493
6.16.UsingH.323inan EnterpriseEnvironment ...................................................... 495
6.17.ConfiguringremoteofficesforH.323 ............................................................. 498
6.18. Allowing the H.323 Gateway to register with the Gatekeeper ............................ 499
6.19.StrippingActiveXandJava applets ................................................................ 504
6.20.URLFiltering Using IPRules .......................................................................... 506
6.21. Enabling Web Content Filtering Using IP Rules ................................................ 511
6.22.EnablingAuditMode .................................................................................. 513
6.23.Reclassifyingablockedsite .......................................................................... 514
6.24.EnablingWCFwithIPPolicies ....................................................................... 516
6.25.EditingContentFiltering HTTP BannerFiles .................................................... 522
6.26.EnablingtheWCFPerformanceLog .............................................................. 525
6.27.EmailfilteringofIMAPTraffic ........................................................................ 531
6.28.ActivatingAnti-Virus withan IPRule .............................................................. 547
6.29.ActivatingAnti-Virus withan IPPolicy ............................................................ 548
6.30.ChangingtheAnti-VirusCacheLifetime ......................................................... 550
6.31.SettingupIDP fora MailServer ..................................................................... 560
6.32.ConfiguringanSMTP LogReceiver ................................................................ 563
6.33.AddingaHost tothe Whitelist ...................................................................... 572
7.1. Specifying a NAT IPRule ................................................................................ 578
7.2. Specifying a NAT IPPolicy .............................................................................. 579
7.3.UsingNATPools .......................................................................................... 586
7.4.One-to-OneIPTranslation ............................................................................. 591
7.5.Many-to-Many IPTranslation ......................................................................... 594
7.6.All-to-OneIPTranslation ............................................................................... 597
7.7.Settingupa SATIPPolicy .............................................................................. 602
8.1.CreatingaLocal UserDatabase ...................................................................... 610
8.2.AddingaUserwithGroupMembership ........................................................... 611
8.3.ConfiguringaRADIUSServer ......................................................................... 615
8.4.UserAuthenticationSetupforWebAccess ....................................................... 629
8.5.EditingContentFiltering HTTP BannerFiles ...................................................... 636
8.6.PoliciesRequiringAuthentication ................................................................... 639
8.7.EnablingUserIdentityAwareness ................................................................... 642
8.8.RadiusRelay ................................................................................................ 655
8.9.RADIUSAccountingServer Setup ................................................................... 662
9.1.Usingan AlgorithmProposalList .................................................................... 695
9.2.Usinga Pre-Sharedkey ................................................................................. 696
9.3.Usingan IDList ............................................................................................ 698
9.4.PSKBasedLAN-to-LANIPsec TunnelSetup ....................................................... 705
9.5. PSK Based IPsec Tunnel for Roaming Clients Setup ............................................ 708
9.6. Certificate Based IPsec Tunnels for Roaming Clients ........................................... 710
9.7. Setting Up Config Mode Using a Predefined IP Pool ........................................... 712
9.8.UsingConfigModewithIPsecTunnels ............................................................ 713
9.9.IKEv2EAPClientSetup .................................................................................. 716
9.10.Settingupan LDAP server ........................................................................... 719
9.11.EnablingIPsec TunnelMonitoring ................................................................. 722
9.12.Settingupa PPTPserver .............................................................................. 730
User Manual
15

9.13.Settingupan L2TPserver ............................................................................ 731
9.14.Settingupan L2TPTunnelOverIPsec ............................................................ 732
9.15.L2TPv3Server Setup ................................................................................... 743
9.16.L2TPv3Server SetupWithIPsec .................................................................... 744
9.17.L2TPv3Server SetupForVLANs .................................................................... 746
9.18.L2TPv3ClientSetup .................................................................................... 749
9.19.L2TPv3ClientSetupWithIPsec ..................................................................... 750
9.20.SettingUpan SSLVPN Interface .................................................................... 759
9.21.SettingSSLVPNInterface ClientRoutes ......................................................... 761
10.1.ApplyingaSimpleBandwidthLimit ............................................................... 780
10.2.LimitingBandwidthinBothDirections ........................................................... 782
10.3.CreatingaThresholdRule ............................................................................ 805
10.4.SettingupSLB withIP Rules ......................................................................... 813
10.5.SettingupSLB withan SLBPolicy .................................................................. 816
11.1.EnablingAutomaticClusterSynchronization .................................................. 821
12.1.SettingUpZoneDefense .............................................................................. 846
User Manual
16

Preface
Intended Audience
The target audience for this reference guide is Administrators who are responsible for
configuring and managing NetDefend Firewalls which are running the NetDefendOS operating
system. This guide assumes that the reader has some basic knowledge of networks and network
security.
Text Structure and Conventions
The text is broken down into chapters and sub-sections. Numbered sub-sections are shown in
the table of contents at the beginning. An index is included at the end of the document to aid
with alphabetical lookup of subjects.
Where a "See chapter/section" link (such as: see Chapter 9, VPN) is provided in the main text, this
can be clicked to take the reader directly to that reference.
Text that may appear in the user interface of the product is designated by being in bold case.
Where a term is being introduced for the first time or being stressed it may appear in italics.
Where console interaction is shown in the main text outside of an example, it will appear in a box
with a gray background.
Where a web address reference is shown in the text, clicking it will open the specified URL in a
browser in a new window (some systems may not allow this).
For example, http://www.dlink.com.
Screenshots
This guide contains a minimum of screenshots. This is deliberate and is done because the manual
deals specifically with NetDefendOS and administrators have a choice of management user
interfaces. It was decided that the manual would be less cluttered and easier to read if it
concentrated on describing how NetDefendOS functions rather than including large numbers of
screenshots showing how the various interfaces are used. Examples are given but these are
largely textual descriptions of management interface usage.
Examples
Examples in the text are denoted by the header Example and appear with a gray background as
shown below. They contain a CLI example and/or a Web Interface example as appropriate. (The
NetDefendOS CLI Reference Guide documents all CLI commands.)
Example 1. Example Notation
Information about what the example is trying to achieve is found here, sometimes with an
explanatory image.
Command-Line Interface
The Command Line Interface example would appear here. It would start with the command
prompt followed by the command:
gw-world:/> somecommand someparameter=somevalue
17

Web Interface
The Web Interface actions for the example are shown here. They are also typically a numbered
list showing what items need to be opened followed by information about the data items that
need to be entered:
1. Go to: Item X > Item Y > Item Z
2. Now enter:
•DataItem1: datavalue1
•DataItem2: datavalue2
Highlighted Content
Sections of text which the reader should pay special attention to are indicated by icons on the
left hand side of the page followed by a short paragraph in italicized text. Such sections are of
the following types with the following purposes:
Note
This indicates some piece of information that is an addition to the preceding text. It may
concern something that is being emphasized, or something that is not obvious or
explicitly stated in the preceding text.
Tip
This indicates a piece of non-critical information that is useful to know in certain
situations but is not essential reading.
Caution
This indicates where the reader should be careful with their actions as an undesirable
situation may result if care is not exercised.
Important
This is an essential point that the reader should read and understand.
Warning
This is essential reading for the user as they should be aware that a serious situation
may result if certain actions are taken or not taken.
Trademarks
Preface
18

Certain names in this publication are the trademarks of their respective owners.
Windows is either registered trademarks or trademarks of Microsoft Corporation in the United
States and/or other countries.
Apple,Mac and Mac OS are trademarks of Apple Inc. registered in the United States and/or other
countries.
Preface
19

Chapter 1: NetDefendOS Overview
This chapter outlines the key features of NetDefendOS.
• Features, page 20
• NetDefendOS Architecture, page 24
• NetDefendOS State Engine Packet Flow, page 28
1.1. Features
D-Link NetDefendOS is the base software engine that drives and controls the range of NetDefend
Firewall hardware products.
NetDefendOS as a Network Security Operating System
Designed as a network security operating system, NetDefendOS features high throughput
performance with high reliability plus super-granular control. In contrast to products built on top
of standard operating systems such as Unix or Microsoft Windows, NetDefendOS offers seamless
integration of all its subsystems, in-depth administrative control of all functionality, as well as a
minimal attack surface which helps to negate the risk from security attacks.
NetDefendOS Objects
From the administrator's perspective the conceptual approach of NetDefendOS is to visualize
operations through a set of logical building blocks or objects. These objects allow the
configuration of NetDefendOS in an almost limitless number of different ways. This granular
control allows the administrator to meet the requirements of the most demanding network
security scenarios.
Key Features
NetDefendOS has an extensive feature set. The list below presents the key features of the
product:
IP Routing NetDefendOS provides a variety of options for IP routing
including static routing, dynamic routing (with OSPF) as
well as multicast routing capabilities. In addition,
20