D-Link NetDefendOS User manual

Network Security Solution http://www.dlink.com
NetDefendOS
Ver.11.04.01
Network Security Firewall
User Manual
Security
Security

User Manual
DFL-260E/860E/870/1660/2560/2560G
NetDefendOS Version 11.04.01
D-Link Corporation
No. 289, Sinhu 3rd Rd, Neihu District, Taipei City 114, Taiwan R.O.C.
http://www.DLink.com
Published 2016-10-03
Copyright ©2016

User Manual
DFL-260E/860E/870/1660/2560/2560G
NetDefendOS Version 11.04.01
Published 2016-10-03
Copyright ©2016
Copyright Notice
This publication, including all photographs, illustrations and software, is protected under
international copyright laws, with all rights reserved. Neither this manual, nor any of the material
contained herein, may be reproduced without the written consent of D-Link.
Disclaimer
The information in this document is subject to change without notice. D-Link makes no
representations or warranties with respect to the contents hereof and specifically disclaims any
implied warranties of merchantability or fitness for a particular purpose. D-Link reserves the right
to revise this publication and to make changes from time to time in the content hereof without
any obligation to notify any person or parties of such revision or changes.
Limitations of Liability
UNDER NO CIRCUMSTANCES SHALL D-LINK OR ITS SUPPLIERS BE LIABLE FOR DAMAGES OF ANY
CHARACTER (E.G. DAMAGES FOR LOSS OF PROFIT, SOFTWARE RESTORATION, WORK STOPPAGE,
LOSS OF SAVED DATA OR ANY OTHER COMMERCIAL DAMAGES OR LOSSES) RESULTING FROM
THE APPLICATION OR IMPROPER USE OF THE D-LINK PRODUCT OR FAILURE OF THE PRODUCT,
EVEN IF D-LINK IS INFORMED OF THE POSSIBILITY OF SUCH DAMAGES. FURTHERMORE, D-LINK
WILL NOT BE LIABLE FOR THIRD-PARTY CLAIMS AGAINST CUSTOMER FOR LOSSES OR DAMAGES.
D-LINK WILL IN NO EVENT BE LIABLE FOR ANY DAMAGES IN EXCESS OF THE AMOUNT D-LINK
RECEIVED FROM THE END-USER FOR THE PRODUCT.

Table of Contents
Preface...............................................................................................................17
1.NetDefendOSOverview .....................................................................................20
1.1.Features ...............................................................................................20
1.2.NetDefendOSArchitecture ......................................................................24
1.2.1.State-basedArchitecture ..............................................................24
1.2.2.NetDefendOSBuildingBlocks ........................................................24
1.2.3.BasicPacketFlow.........................................................................25
1.3.NetDefendOS State EnginePacketFlow .....................................................28
2.ManagementandMaintenance ..........................................................................33
2.1.ManagingNetDefendOS .........................................................................33
2.1.1.Overview ....................................................................................33
2.1.2.ConfiguringManagementAccess ...................................................34
2.1.3.AdministratorAccount .................................................................40
2.1.4.TheWebInterface ........................................................................41
2.1.5.TheCLI .......................................................................................46
2.1.6.CLIScripts...................................................................................58
2.1.7.SecureCopy................................................................................64
2.1.8.TheConsoleBootMenu ................................................................66
2.1.9.RADIUSManagementAuthentication .............................................67
2.1.10.ManagementAdvancedSettings ..................................................70
2.1.11.WorkingwithConfigurations .......................................................71
2.2.SystemDateandTime ............................................................................78
2.2.1.Overview ....................................................................................78
2.2.2.SettingDateandTimeManually.....................................................78
2.2.3.DaylightSavingTime ...................................................................79
2.2.4.UsingExternalTimeServers...........................................................82
2.2.5.SettingsSummaryforDateandTime ..............................................85
2.3.EventsandLogging ................................................................................87
2.3.1.Overview ....................................................................................87
2.3.2.LogMessages .............................................................................87
2.3.3.LogReceiverTypes ......................................................................88
2.3.4.TheMemoryLogReceiver(Memlog) ...............................................89
2.3.5.TheSyslogLogReceiver................................................................89
2.3.6.MailAlerting ...............................................................................92
2.3.7. Severity Filter and Message Exceptions ........................................... 96
2.3.8.SNMPTraps ................................................................................97
2.3.9.AdvancedLogSettings .................................................................98
2.3.10.Logsnoop .................................................................................99
2.4.Monitoring .......................................................................................... 103
2.4.1.Real-timeMonitorAlerts ............................................................. 103
2.4.2.TheLinkMonitor ....................................................................... 103
2.4.3.HardwareMonitoring ................................................................. 107
2.4.4.MemoryMonitoringSettings ....................................................... 109
2.5.SNMP ................................................................................................. 111
2.5.1.Management withSNMP ............................................................ 111
2.5.2.PersistentSNMPInterfaceIndexes ................................................ 115
2.5.3.SNMPAdvancedSettings ............................................................ 116
2.6.DiagnosticTools .................................................................................. 118
2.6.1.Overview .................................................................................. 118
2.6.2. The ping Command .................................................................... 118
2.6.3. The stats Command ................................................................... 122
2.6.4. The connections Command ......................................................... 123
2.6.5. The dconsole Command .............................................................. 125
2.6.6. The pcapdump Command ........................................................... 126
2.6.7. The traceroute Command ............................................................ 128
2.6.8. The frags Command ................................................................... 131
4

2.6.9. The selftest Command ................................................................ 133
2.7.Maintenance ....................................................................................... 135
2.7.1.VersionUpdateAlerts ................................................................. 135
2.7.2.Auto-UpdateMechanism ............................................................ 136
2.7.3.Backing UpConfigurations .......................................................... 136
2.7.4.RestoretoFactory Defaults.......................................................... 139
2.8.Languages .......................................................................................... 141
2.9.DiagnosticsandImprovements .............................................................. 142
3.Fundamentals ................................................................................................ 145
3.1.TheAddressBook ................................................................................ 145
3.1.1.Overview .................................................................................. 145
3.1.2.IPAddresses ............................................................................. 146
3.1.3.EthernetAddresses .................................................................... 148
3.1.4.AddressGroups ......................................................................... 148
3.1.5.Auto-GeneratedAddressObjects ................................................. 149
3.1.6.AddressBookFolders ................................................................. 150
3.1.7.FQDNAddressObjects ............................................................... 150
3.2.IPv6Support ....................................................................................... 156
3.3.Services .............................................................................................. 165
3.3.1.Overview .................................................................................. 165
3.3.2.CreatingCustomServices ............................................................ 167
3.3.3.ICMPServices ............................................................................ 171
3.3.4.CustomIP ProtocolServices ........................................................ 172
3.3.5.ServiceGroups .......................................................................... 173
3.3.6.CustomServiceTimeouts ............................................................ 174
3.3.7.PathMTUDiscovery ................................................................... 174
3.4.Interfaces ............................................................................................ 178
3.4.1.Overview .................................................................................. 178
3.4.2.EthernetInterfaces ..................................................................... 180
3.4.3.LinkAggregation ....................................................................... 191
3.4.4.VLAN ....................................................................................... 195
3.4.5.ServiceVLAN............................................................................. 199
3.4.6.PPPoE ...................................................................................... 202
3.4.7.GRETunnels .............................................................................. 205
3.4.8.6in4Tunnels ............................................................................. 209
3.4.9.LoopbackInterfaces ................................................................... 213
3.4.10.InterfaceGroups ...................................................................... 218
3.4.11.Layer2PassThrough ................................................................ 219
3.5.ARP .................................................................................................... 221
3.5.1.Overview .................................................................................. 221
3.5.2.TheARPCache .......................................................................... 221
3.5.3.ARPPublish .............................................................................. 223
3.5.4.UsingARPAdvanced Settings ...................................................... 226
3.6.IPRulesandIP Policies .......................................................................... 228
3.6.1.SecurityPolicies ......................................................................... 228
3.6.2.IPRuleSet Evaluation ................................................................. 232
3.6.3.IPRule...................................................................................... 233
3.6.4.MultipleIPRuleSets ................................................................... 235
3.6.5.IPRuleSet Folders ..................................................................... 240
3.6.6.ConfigurationObjectGroups ....................................................... 241
3.6.7.IPPolicy ................................................................................... 245
3.6.8.StatelessPolicy .......................................................................... 251
3.7.ApplicationControl .............................................................................. 253
3.8.Schedules ........................................................................................... 265
3.9.Certificates .......................................................................................... 268
3.9.1.Overview .................................................................................. 268
3.9.2.UploadingandUsingCertificates ................................................. 273
3.9.3.CRLDistributionPointLists ......................................................... 275
3.9.4.CAServer Access ....................................................................... 277
3.9.5. Creating Windows CA Server Requests .......................................... 279
3.10.DNS.................................................................................................. 281
User Manual
5

4.Routing ......................................................................................................... 285
4.1.Overview ............................................................................................ 285
4.2.StaticRouting ...................................................................................... 286
4.2.1.ThePrinciplesofRouting ............................................................ 286
4.2.2.StaticRouting ........................................................................... 290
4.2.3.RouteFailover ........................................................................... 296
4.2.4.HostMonitoringforRouteFailover ............................................... 299
4.2.5.AdvancedSettingsforRouteFailover ............................................ 301
4.2.6.ProxyARP ................................................................................. 302
4.2.7.BroadcastPacket Forwarding ...................................................... 304
4.3.Policy-basedRouting ............................................................................ 308
4.4.RouteLoadBalancing ........................................................................... 316
4.5.Virtual Routing .................................................................................... 323
4.5.1.Overview .................................................................................. 323
4.5.2.ASimpleScenario ...................................................................... 323
4.5.3.TheDisadvantageofRoutingRules............................................... 325
4.5.4.IPRuleSets withVirtualRouting ................................................... 328
4.5.5.MultipleIPrulesets .................................................................... 329
4.5.6.TroubleShooting ....................................................................... 329
4.6.OSPF .................................................................................................. 331
4.6.1.DynamicRouting ....................................................................... 331
4.6.2.OSPFConcepts .......................................................................... 334
4.6.3.OSPFComponents ..................................................................... 339
4.6.4.DynamicRoutingRules ............................................................... 345
4.6.5.SettingUpOSPF ........................................................................ 348
4.6.6.AnOSPFExample ...................................................................... 352
4.6.7.OSPFTroubleshooting ................................................................ 357
4.7.MulticastRouting ................................................................................. 361
4.7.1.Overview .................................................................................. 361
4.7.2. Multicast Forwarding with SAT Multiplex Rules ............................... 362
4.7.3.IGMPConfiguration ................................................................... 368
4.7.4.AdvancedIGMPSettings ............................................................. 374
4.7.5.TunnelingMulticastusingGRE ..................................................... 376
4.8.TransparentMode ................................................................................ 379
4.8.1.Overview .................................................................................. 379
4.8.2.EnablingInternetAccess ............................................................. 384
4.8.3.ATransparentModeUse Case...................................................... 386
4.8.4.SpanningTreeBPDUSupport ...................................................... 388
4.8.5.MPLSPassThrough .................................................................... 389
4.8.6. Advanced Settings for Transparent Mode ...................................... 390
5.DHCPServices ................................................................................................ 393
5.1.Overview ............................................................................................ 393
5.2.IPv4DHCPClient .................................................................................. 395
5.3.IPv4DHCPServer ................................................................................. 397
5.3.1.StaticIPv4DHCPHosts ............................................................... 401
5.3.2.CustomIPv4Options .................................................................. 402
5.4.IPv4DHCPRelay .................................................................................. 404
5.5.IPPools .............................................................................................. 408
5.6.DHCPv6 .............................................................................................. 411
5.6.1.DHCPv6Client ........................................................................... 411
5.6.2.DHCPv6Server .......................................................................... 414
6.SecurityMechanisms ...................................................................................... 421
6.1.AccessRules ........................................................................................ 421
6.1.1.Overview .................................................................................. 421
6.1.2.IPSpoofing ............................................................................... 422
6.1.3.AccessRuleSettings ................................................................... 422
6.2.ALGs .................................................................................................. 425
6.2.1.Overview .................................................................................. 425
6.2.2.TheHTTP ALG ........................................................................... 427
6.2.3.TheLightWeight HTTPALG......................................................... 432
6.2.4.TheFTPALG ............................................................................. 435
User Manual
6

6.2.5.TheTFTPALG ............................................................................ 447
6.2.6.TheSMTP ALG ........................................................................... 448
6.2.7.ThePOP3ALG ........................................................................... 457
6.2.8.ThePPTPALG ............................................................................ 461
6.2.9.TheSIPALG .............................................................................. 463
6.2.10.TheH.323ALG ......................................................................... 479
6.2.11.TheTLSALG ............................................................................ 500
6.3.WebContentFiltering ........................................................................... 503
6.3.1.Overview .................................................................................. 503
6.3.2.ActiveContentHandling ............................................................. 503
6.3.3.StaticContentFiltering ............................................................... 504
6.3.4.DynamicWebContentFiltering ................................................... 507
6.4.EmailFiltering andAnti-Spam ................................................................ 526
6.4.1.IPPolicyBasedEmailFiltering ...................................................... 526
6.4.2.ALGBasedEmailFiltering ............................................................ 534
6.4.3.DNSBLDatabases ...................................................................... 539
6.5.Anti-Virus Scanning .............................................................................. 541
6.5.1.Overview .................................................................................. 541
6.5.2.Implementation ........................................................................ 542
6.5.3.Anti-VirusOptions ..................................................................... 545
6.5.4.ActivatingAnti-Virus Scanning ..................................................... 546
6.5.5.TheAnti-Virus Cache .................................................................. 550
6.6.IntrusionDetection andPrevention ........................................................ 552
6.6.1.Overview .................................................................................. 552
6.6.2.IDPSubscriptions ....................................................................... 553
6.6.3.IDPRules .................................................................................. 554
6.6.4.Insertion/EvasionAttackPrevention ............................................. 556
6.6.5.IDPPatternMatching ................................................................. 557
6.6.6.IDPSignatureGroups ................................................................. 558
6.6.7.SettingUpIDP ........................................................................... 559
6.6.8.SMTPLog ReceiverforIDP Events ................................................. 562
6.6.9.BestPracticeDeployment ........................................................... 564
6.7.Denial-of-Service Attacks ....................................................................... 566
6.7.1.Overview .................................................................................. 566
6.7.2.DoSAttackMechanisms.............................................................. 566
6.7.3. Ping of Death Attacks .................................................................. 566
6.7.4.FragmentationOverlapAttacks.................................................... 567
6.7.5. The Land and LaTierra Attacks ...................................................... 567
6.7.6. The WinNuke attack .................................................................... 567
6.7.7.AmplificationAttacks ................................................................. 568
6.7.8.TCP SYN FloodAttacks ................................................................ 569
6.7.9. The Jolt2 Attack ......................................................................... 569
6.7.10.Distributed DoSAttacks ............................................................ 570
6.8.BlacklistingHostsandNetworks ............................................................. 571
7.AddressTranslation ........................................................................................ 574
7.1.Overview ............................................................................................ 574
7.2.NAT ................................................................................................... 576
7.3.NATPools ........................................................................................... 584
7.4.SAT .................................................................................................... 588
7.4.1.Introduction ............................................................................. 588
7.4.2.One-to-OneIPTranslation ........................................................... 590
7.4.3.Many-to-ManyIPTranslation ....................................................... 593
7.4.4.All-to-OneIPTranslation ............................................................. 596
7.4.5.Port Translation ......................................................................... 599
7.4.6. SAT with FwdFast Rules ............................................................... 600
7.4.7.UsinganIPPolicyforSAT ............................................................ 601
7.4.8.ProtocolsHandledbySAT ........................................................... 602
7.4.9.SATwithNAT ............................................................................ 603
8.UserAuthentication ........................................................................................ 608
8.1.Overview ............................................................................................ 608
8.2.AuthenticationSetup............................................................................ 610
User Manual
7

8.2.1.SetupSummary ......................................................................... 610
8.2.2.LocalUserDatabases .................................................................. 610
8.2.3.External RADIUSServers ............................................................. 614
8.2.4.External LDAP Servers ................................................................ 616
8.2.5.AuthenticationRules .................................................................. 624
8.2.6.AuthenticationProcessing .......................................................... 626
8.2.7.HTTPAuthentication .................................................................. 627
8.2.8.BruteForceProtection ................................................................ 630
8.3.ARPAuthentication .............................................................................. 633
8.4.CustomizingAuthenticationHTML ......................................................... 635
8.5.PoliciesRequiringAuthentication ........................................................... 639
8.6.UserIdentityAwareness ........................................................................ 641
8.7.MultiFactorAuthentication ................................................................... 650
8.8.RadiusRelay ........................................................................................ 652
8.9.RADIUSAccounting .............................................................................. 659
8.9.1.Overview .................................................................................. 659
8.9.2.RADIUSAccountingMessages ..................................................... 659
8.9.3.InterimAccountingMessages ...................................................... 661
8.9.4.Configuring RADIUSAccounting .................................................. 661
8.9.5.RADIUSAccountingSecurity ....................................................... 663
8.9.6. RADIUS Accounting and High Availability ...................................... 663
8.9.7. Handling Unresponsive RADIUS Servers ........................................ 663
8.9.8.AccountingandSystemShutdowns ............................................. 664
8.9.9.LimitationswithNAT .................................................................. 664
8.9.10.AdvancedRADIUSSettings ........................................................ 664
9.VPN .............................................................................................................. 667
9.1.Overview ............................................................................................ 667
9.1.1.VPNUsage ................................................................................ 667
9.1.2.VPNEncryption ......................................................................... 668
9.1.3.VPNPlanning ............................................................................ 669
9.1.4.KeyDistribution ......................................................................... 669
9.1.5.TheTLSAlternativeforVPN ......................................................... 670
9.2.VPNQuickStart .................................................................................... 671
9.2.1. IPsec LAN-to-LAN with Pre-shared Keys ......................................... 672
9.2.2.IPsec LAN-to-LANwithCertificates ............................................... 673
9.2.3. IPsec Roaming Clients with Pre-shared Keys ................................... 674
9.2.4. IPsec Roaming Clients with Certificates ......................................... 677
9.2.5. L2TP/IPsec Roaming Clients with Pre-Shared Keys ........................... 678
9.2.6. L2TP/IPsec Roaming Clients with Certificates ................................. 680
9.2.7.PPTPRoamingClients ................................................................. 680
9.2.8.iOSSetup ................................................................................. 681
9.3.IPsec Components ............................................................................... 683
9.3.1.Overview .................................................................................. 683
9.3.2.InternetKeyExchange (IKE) ......................................................... 683
9.3.3.IKEAuthentication ..................................................................... 690
9.3.4.IPsec Protocols(ESP/AH) ............................................................. 691
9.3.5.NATTraversal ............................................................................ 693
9.3.6.AlgorithmProposalLists ............................................................. 694
9.3.7.Pre-sharedKeys ......................................................................... 696
9.3.8.UsingIDLists withCertificates ..................................................... 697
9.3.9.DiffServwithIPsec ..................................................................... 699
9.4.IPsec Tunnels ....................................................................................... 701
9.4.1.Overview .................................................................................. 701
9.4.2. LAN-to-LAN Tunnels with Pre-shared Keys ..................................... 704
9.4.3.RoamingClients ........................................................................ 708
9.4.4.IKEv2Support ........................................................................... 713
9.4.5.IKEv2ClientSetup ...................................................................... 714
9.4.6. Fetching CRLs from an alternate LDAP server ................................. 719
9.4.7.TheIPsecTunnelSelection Process ............................................... 720
9.4.8.IPsec TunnelMonitoring ............................................................. 721
9.4.9.IPsec AdvancedSettings ............................................................. 723
User Manual
8

9.5.PPTP/L2TP .......................................................................................... 729
9.5.1.PPTPServers ............................................................................. 729
9.5.2.L2TPServers ............................................................................. 730
9.5.3.L2TP/PPTPServerAdvancedSettings ............................................ 736
9.5.4.PPTP/L2TPClients ...................................................................... 737
9.5.5.Thel2tpand pptpCommands ..................................................... 739
9.6.L2TPVersion3 ..................................................................................... 741
9.6.1.L2TPv3Server ........................................................................... 741
9.6.2.L2TPv3Client ............................................................................ 748
9.7.SSLVPN .............................................................................................. 752
9.7.1.Overview .................................................................................. 752
9.7.2.Configuring SSLVPNin NetDefendOS ........................................... 753
9.7.3.InstallingtheSSLVPN Client ........................................................ 755
9.7.4.SSLVPNSetup Example .............................................................. 759
9.8.VPNTroubleshooting ............................................................................ 762
9.8.1.GeneralTroubleshooting ............................................................ 762
9.8.2.Troubleshooting Certificates ....................................................... 763
9.8.3. The ike -stat Command ............................................................... 763
9.8.4. The ike -snoop Command ............................................................ 764
9.8.5. Management Interface Failure with VPN ........................................ 771
9.8.6.SpecificErrorMessages............................................................... 771
9.8.7.SpecificSymptoms..................................................................... 774
10.TrafficManagement ...................................................................................... 776
10.1.TrafficShaping ................................................................................... 776
10.1.1.Overview ................................................................................ 776
10.1.2.TrafficShapinginNetDefendOS ................................................. 777
10.1.3.SimpleBandwidthLimiting ....................................................... 780
10.1.4. Limiting Bandwidth in Both Directions ........................................ 781
10.1.5. Creating Differentiated Limits Using Chains ................................. 783
10.1.6.Precedences ............................................................................ 784
10.1.7.PipeGroups ............................................................................ 788
10.1.8.TrafficShapingRecommendations ............................................. 791
10.1.9.ASummaryof TrafficShaping .................................................... 793
10.1.10.MorePipe Examples ............................................................... 793
10.2.IDPTrafficShaping ............................................................................. 798
10.2.1.Overview ................................................................................ 798
10.2.2.SettingUpIDPTrafficShaping ................................................... 798
10.2.3.ProcessingFlow ....................................................................... 799
10.2.4. The Importance of Specifying a Network ...................................... 799
10.2.5.AP2PScenario......................................................................... 800
10.2.6.ViewingTrafficShapingObjects ................................................. 801
10.2.7. Guaranteeing Instead of Limiting Bandwidth ................................ 802
10.2.8.Logging .................................................................................. 802
10.3.ThresholdRules.................................................................................. 803
10.4.ServerLoadBalancing ......................................................................... 807
10.4.1.Overview ................................................................................ 807
10.4.2.SLBDistributionAlgorithms ....................................................... 809
10.4.3.Selecting Stickiness .................................................................. 809
10.4.4.SLBAlgorithmsandStickiness .................................................... 811
10.4.5.ServerHealthMonitoring .......................................................... 812
10.4.6. Setting Up SLB_SAT Rules .......................................................... 812
10.4.7.SLBPolicy ............................................................................... 816
11.HighAvailability ........................................................................................... 820
11.1.Overview .......................................................................................... 820
11.2.HAMechanisms ................................................................................. 823
11.3.SettingUpHA .................................................................................... 827
11.3.1.HardwareSetup ....................................................................... 827
11.3.2.WizardHASetup ...................................................................... 829
11.3.3.ManualHASetup ..................................................................... 831
11.3.4. Verifying that the Cluster Functions Correctly ............................... 832
11.3.5.UniqueSharedMacAddresses ................................................... 833
User Manual
9

11.4.HAIssues .......................................................................................... 834
11.5.UpgradinganHA Cluster ..................................................................... 837
11.6.LinkMonitoringandHA ...................................................................... 839
11.7.HAAdvancedSettings ......................................................................... 840
12.ZoneDefense ............................................................................................... 843
13.AdvancedSettings ........................................................................................ 849
13.1.IPLevelSettings ................................................................................. 849
13.2.TCPLevelSettings .............................................................................. 853
13.3.ICMPLevelSettings ............................................................................ 859
13.4.StateSettings .................................................................................... 860
13.5.Connection TimeoutSettings ............................................................... 862
13.6.LengthLimitSettings .......................................................................... 864
13.7.FragmentationSettings ....................................................................... 867
13.8.LocalFragmentReassemblySettings ..................................................... 871
13.9.SSL/TLSSettings ................................................................................. 872
13.10.MiscellaneousSettings ...................................................................... 875
A.SubscribingtoUpdates ................................................................................... 880
B.IDPSignatureGroups ...................................................................................... 884
C.VerifiedMIMEfiletypes .................................................................................... 888
D.TheOSI Framework ........................................................................................ 892
E.DFL-260E/860EPort BasedVLAN ....................................................................... 893
F.ThirdPartySoftwareLicenses ........................................................................... 895
Alphabetical Index ............................................................................................. 901
User Manual
10