D-Link DFL-M510 Installation guide

D-Link Nordic Technical Support 1
DFL-M510 FAQ

D-Link Nordic Technical Support 2
FAQ
Q: Why does the device memory usage exceed 80% right after start-up?
Q: Why does D-Link strongly suggest not managing DFL-M510 from the Internet?
Q: Do the”Standby Hosts” disappear from the host table after rebooting?
Q: After rebooting the DFL-M510, what configuration files would disappear? (Host table? Policy?
Report? …)
Q: What would happen after the hosts exceed 150 users?
Q: How does DFFL-M510 learn the host name? Why is the host name sometimes not shown? How
often does it send the host name query?
Q: What LOG information is included in the DFL-M510?
Q: How many days of data is kept in the DFL-M510 for report?
Q: What would happen after the concurrent session exceeds 12K?
Q: What is the difference between Bypass Mode and Bypass feature (DMZ/Hosts)?
Q: How to implement the DFL-M510 in the environment with L3 device?
Q: On which occasions should I use the DMZ bypass or Host bypass? Why?
Q: How does the DFL-M510 manage internal hosts in the DHCP environment?
Q: How to deploy DFL-M510 in VLAN environment?
Q: Why is the login time so long? What factors affect this?
Q: How many groups/templates/user-defined patterns does the DFL-M510 support?
Q: What is the “Default Group” used for?
Q: Why is there Priority for each group in the DFL-M510?
Q: Are Hosts able to belong to multiple Groups at the same time?
Q: Why can the template only be applied to a pre-defined group? Why can it not be applied to a
single host?
Q: Why is the “Wizard_Template” created by Setup Wizard unable to be modified?
Q: Why does the ”Win Pop-up message” fail?
Q: Can the DFL-M510 send Pop-up messages to clients in different
Q: Why are there only 9 keyword filters in the DFL-M510?

D-Link Nordic Technical Support 3
Q: Why does RTM show no data?
Q: How many bytes are transferred from DFL-M510 to the PC for RTM?
Q: How often is the data refreshed in Real Time Application?
Q: What are the main features of RTM in DFL-M510?
Q: Is it possible to identify the victim infected malicious problem with RTM?
Q: How does H.323 work? By port? By protocol?
Q: How many P2P applications can the DFL-M510 manage?
Q: What’s the difference between HTTP and web control in real-time application?
Q: Does Web Content keyword block ASCII code content? How does it work?
Q: What is the limitation to detect and block Skype?
Q: How does “Web Download” work? Are there any constraints?
Q: Does “Web Mail” pattern only detect the URL?
Q: Is there any detail Application list spported by the DFL-M510?
Q: How does DFL-M510 manage Streaming Media Applications?
Q: Why can the DFL-M510 only block or allow Skype / QQ? Is there no granular action control?
Q: How does DFL-M510 manage normal FTP and FTP applications like GETRight/FlashGet?
Q: Is the signature unidirectional or bidirectional?
MISC
Q: What happens after DFL-M510 blocks/detects malicious traffic?
Q: Is there any SNMP Set/Get/Trap list?

D-Link Nordic Technical Support 4
System
Q: Why does the device memory usage exceed 80% right after
start-up?
A: To achieve robustness and efficiency, we do not allocate memory dynamically
(runtime) in M510. Instead, we pre-allocate almost all necessary memory space for
tables and data objects during booting up and then do the memory management by our
own program, not the Operating System. Although the memory usage looks high right
after the booting, it tends to keep stable (from 80% to 89%) without too much peaks.
Q: Why does D-Link strongly suggest not managing DFL-M510
from the Internet?
A: Since the communication between M-510 device and Java GUl could be quite
bandwidth-consumptive (especially in signature download or firmware upgrade), the
GUI communication possibly affects the upstream bandwidth and introduce more latency
to outbound traffic. Moreover, the administrator may not have smooth RTM transaction
by the way if the upstream bandwidth is quite limited.
Q: Do the”Standby Hosts” disappear from the host table after
rebooting?
A: “Standby Hosts” will disappear only if device is reset to factory default status or the
user manually removes them from UI. On the other hand, “Stand by Hosts” is stored in
non-volatile memory so that rebooting the device does not clear it either. One
noticeable technical issue is the M510 store the “Standby Hosts” temporarily in a one-
way hash table, and a host record could be overwritten by another if hash collision
happens.

D-Link Nordic Technical Support 5
Q: After rebooting the DFL-M510, what configuration files would
disappear? (Host table? Policy? Report? …)
A: The report files and User Login logs will disappear after the reboot.
Q: What would happen after the hosts exceed 150 users?
A: Dropped or forwarded immediately. This is optional by setting the configuration
“forward” or “block” flag in “Setup Host” page of UI.
Q: How does DFFL-M510 learn the host name? Why is the host
name sometimes not shown? How often does it send the host
name query?
A: DFL-M510 utilizes the WINS service to make queries for host names. Sometimes
there is no name for a host in UI host table, and it may come from the following
reasons:
It is not a Microsoft Windows platform and does not support the WINS services The host
is enabled with the firewall embedded within Microsoft Windows platform and the
firewall blocks the WINS service.
The WINS service is disabled by user
The host name query begins from the moment right after it has been learned by M-510,
and the device negotiates with the host to get a name immediately. If the first query is
failed, DFL-M51 0 will send the other two queries in a 5 minutes’ interval. If these three
queries all fail, the name learning process is closed for this host.
Q: What LOG information is included in the DFL-M510?
A: The DFL-M510 does not contain a disk to store large bulks of data for log and report,
so therefore only the necessary information for network users is saved. Only “System
Log” is saved at present.
Q: How many days of data is kept in the DFL-M510 for report?
A: DFL-M51 0 keeps 7-day reports in system memory but they will be gone if device is
reset or reboot.

D-Link Nordic Technical Support 6
Q: What would happen after the concurrent session exceeds 12K?
A: Dropped or forwarded immediately. This is optional by setting the configuration
“forward” or “block” flag in “Setup Host” page of UI.

D-Link Nordic Technical Support 7
Deployment
Q: What is the difference between Bypass Mode and Bypass
feature (DMZ/Hosts)?
A: The Bypass Mode is performed by the system software, so that the packet
information including protocol and throughput is still recorded by the device. On the
other side, the Bypass feature is implemented by the hardware engine, so that
although it’s forwarding in wire-speed high performance, there will be no related
information left.
Q: How to implement the DFL-M510 in the environment with L3
device?
A: We do not suggest a user to put any Layer 3 switch beneath the DFL-M510. Though
it will not suffer the security and control management, the host information of traffic
through the switch will be aggregated.
Q: On which occasions should I use the DMZ bypass or Host
bypass? Why?
A: The DMZ is a trust area so that we do not have to check the traffic from this area
and the high throughput is desired. The same idea is also applied for hosts. A network
administrator can insert the DMZ servers into DMZ bypass list and host into host bypass
list for the wire-speed performance from DFL-M510. (But there is no log/report for the
bypassed traffic.)
Q: How does the DFL-M510 manage internal hosts in the DHCP
environment?
A: The DFL-M510 identifies the internal hosts by their unique MAC addresses, so that
the device will provide the precise traffic information and management capability in
DHCP environments. When you enable the “MAC-Lock” feature in the host table, no
matter how the lP address change, it would bind to the same MAC address.
Q: How to deploy DFL-M510 in VLAN environment?
A: In VLAN environment, the network administrator has to set up the supporting VLAN
Group IDs (up to 8) through the DFL-M510 console or UI.

D-Link Nordic Technical Support 8
UI
Q: Why is the login time so long? What factors affect this?
A: In Login process, the Ul (by Java applet) reads several data and system
configurations from the device and these suffer the login process. They include Network
setting, DMZ list, Bypassed hosts, Host table, Schedule, Policy file, Operation Mode,
Templates, Groups and Alert Message

D-Link Nordic Technical Support 9
Policy Setting
Q: How many groups/templates/user-defined patterns does the
DFL-M510 support?
A: Group: 10 groups
Template: 20 templates (built-in templates included)
User-defined rule: 512 rules
Q: What is the “Default Group” used for?
A: All users belong to the Default group.
Q: Why is there Priority for each group in the DFL-M510?
A: If the host belongs to multiple groups, the policy will be different. For example, John
belongs to Group A and Group B. The two group’s policies are different. DFL-M510
differentiates based on group priority.
Q: Are Hosts able to belong to multiple Groups at the same time?
A: Yes, hosts can belong to multiple groups. But the policy will be different. The policy
will depend on group priority.
Q: Why can the template only be applied to a pre-defined group?
Why can it not be applied to a single host?
A: It is true that the user cannot apply the modified rule template to a single user. The
user has to add the specified host into a host group before applying the rule template on
it. We’re doing this because we figured it’s more convenient to divide Intranet hosts into
different groups, and the administrator can define different templates accordingly. It
makes more sense to operate on group level than host level because in general there
are not many different templates in SME, and the policies applied to a host don’t tend to
change too often. Moreover, in our design a host can belong to different groups and

D-Link Nordic Technical Support 10
there’re priorities among groups. For example, the CEO of the company can be in
“Administrator” group and “Default” group in the same time. But he will only inherit the
privilege of “Administrator” group due to its higher priority. But since there’re priorities
among host groups, we don’t allow host-wise template operation because we cannot
prioritize between the single host and a host group. Indeed it introduces a little
inconvenience when applying a template to single host, but eventually the user benefits
from the host group design
Q: Why is the “Wizard_Template” created by Setup Wizard unable
to be modified?
A: This Template belongs to a pre-define template list, like the “Block all” Template. It
cannot be modified/deleted. This Template is generated by System/Setup Wizard. If you
want to modify it, please run System/Setup Wizard again.
Q: Why does the ”Win Pop-up message” fail?
A: The Windows Pop-up messages are delivered through UDP packets and this service
has low priority in Windows system. As the testing result shows, Windows system
possibly could receive the WinPop-up messages without showing them up. Moreover, If
the personal firewall is enabled in the system, the WinPop-up message could be blocked
by the firewall policies. ln addition, the WinPop-up service is able to be shutdown freely
in the target system.
Q: Can the DFL-M510 send Pop-up messages to clients in different
subnets under L3 switch?
A: WinPop-up messages are delivered by the DFL-M510 through UDP stream directly to
the target (i.e., not through the gateway, even the target is in the different subnet). So
that if the device and the target are not in the same subnet, the Win pop-up messages
will not reach to the target host.
Q: Why are there only 9 keyword filters in the DFL-M510?
A: We believe that nine filters are enough for normal situations. Performance issue is
another design consideration in this case.