DPtech DPX8000 Series User manual

i
DPX8000 Series Deep Service Switching Gateway
User Configuration Guide
Firewall Service Board Module v1.0

ii
Hangzhou DPtech Technologies Co., Ltd. provides full- range technical support.
If you need any help, please contact Hangzhou DPtech Technologies Co., Ltd. and its sale agent,
according to where you purchase their products.
Hangzhou DPtech Technologies Co., Ltd.
Address: 6th floor, zhongcai mansion, 68 tonghelu, Binjiangqu, Hangzhoushi
Address code: 310051

iii
Declaration
Copyright 2013
Hangzhou DPtech Technologies Co., Ltd.
All rights reserved.
No Part of the manual can be extracted or copied by any company or individuals without written
permission, and cannot be transmitted by any means.
Owing to product upgrading or other reasons, information in this manual is subject to change.
Hangzhou DPtech Technologies Co., Ltd. has the right to modify the content in this manual, as it is
a user guides, Hangzhou DPtech Technologies Co., Ltd. made every effort in the preparation of this
document to ensure accuracy of the contents, but all statements, information, and recommendations
in this document do not constitute the warranty of any kind express or implied.

iv
Table of Contents
CHAPTER 1 FIREWALL 2
1.1 INTRODUCTION TO FIREWALL 2
1.2 PACKET FILTERING POLICY 3
1.2.1 PACKET FILTERING POLICY 3
1.2.2 PACKET FILTERING POLICY LOG 5
1.2.3 ALG CONFIGURATION 6
1.3 IPV6PACKET FILTERING POLICY 7
1.4 NAT 8
1.4.1 INTRODUCTION TO NAT 8
1.4.2 SOURCE NAT 8
1.4.3 DESTINATION NAT 9
1.4.4 ONE TO ONE NAT 10
1.4.5 ADDRESS POOL 11
1.4.6 ALG CONFIGURATION 11
1.5 NAT_PT 12
1.6 BASIC ATTACK PROTECTION 13
1.6.1 BASIC ATTACK PROTECTION 13
1.6.2 BASIC ATTACK LOG QUERY 14
1.7 SESSIONS LIMIT 15
1.8 SERVICE LIMITATION 15
1.9 IPV4 BASIC DDOSPROTECTION 16
1.9.1 DEFEND OBJECT MANAGEMENT 16
1.9.2 CONFIGURATION AND TENDENCY 17
1.9.3 PROTECTION HISTORY 18
1.10 BLACKLIST 19
1.10.1 BLACKLIST 19
1.10.2 BLACKLIST QUERY 20
1.10.3 BLACKLIST LOG QUERY 20
1.11 QOS 21
1.11.1 VIP BANDWIDTH GUARANTEE 21
1.11.2 TRAFFIC SHAPING 22
1.12 ANTI-ARP-SPOOFING 22
1.12.1 ANTI-ARP-SPOOFING 22
1.12.2 ARP CONFIGURATION 23
CHAPTER 2 LOAD BALANCING 25
2.1 LINK LOAD BALANCING 25
2.1.1 INTRODUCTION TO LINK LOAD BALANCING 25
2.1.2 LINK CONFIG 25
2.1.3 ISP 26
2.2 LOGIC LINK GROUP 26
2.3 LINK HEALTH CHECK 27

v
CHAPTER 3 VPN 28
3.1.1 INTRODUCTION TO IPSEC 28
3.1.2 IPSEC VPN CONFIGURATION 28
3.1.3 DPVPN 30
3.1.4 XAUTH USER 31
3.1.5 IPSEC INTERFACE 31
3.1.6 DISPLAY CONNECTIONS 31
3.1.7 OPERATION LOG 32
3.2 L2TP 33
3.2.1 INTRODUCTION TO L2TP 33
3.2.2 L2TP 33
3.3 GRE VPN 34
3.3.1 INTRODUCTION TO THE GRE 34
3.3.2 CONFIGURING GRE CONFIGURATION 34
3.4 SSL VPN 35
3.4.1 INTRODUCTION TO THE SSL VPN 35
3.4.2 GLOBAL CONFIGURATION 35
3.4.3 RESOURCE CONFIGURATION 36
3.4.4 USER MANAGEMENT 36
3.4.5 ONLINE USER STATUS 37
3.4.6 OPERATION LOG QUERY 37
CHAPTER 4 IDS INTEGRATION 39
4.1 IDS INTEGRATION LOG 39

vi
List of Figures
Figure1-1 Firewall module........................................................................................................................................ 3
Figure1-2 Packet filtering policy............................................................................................................................... 3
Figure1-3 Packet filtering policy log......................................................................................................................... 5
Figure1-4 Packet filtering policy log......................................................................................................................... 6
Figure1-5 ALG configuration.................................................................................................................................... 7
Figure1-6 IPv6 packet filtering policy....................................................................................................................... 7
Figure1-7 Source NAT.............................................................................................................................................. 8
Figure1-8 Destination NAT....................................................................................................................................... 9
Figure1-9 One to one NAT...................................................................................................................................... 10
Figure1-10 Address pool......................................................................................................................................... 11
Figure1-11 ALG configuration................................................................................................................................ 12
Figure1-12 ALG configuration................................................................................................................................ 12
Figure1-13 Basic attack protection.......................................................................................................................... 13
Figure1-14 Basic attack log query........................................................................................................................... 14
Figure1-15 Session limitation.................................................................................................................................. 15
Figure1-16 Service limitation.................................................................................................................................. 16
Figure1-17 Defend object management................................................................................................................... 16
Figure1-18 Traffic status and monitoring................................................................................................................ 17
Figure1-19 DDOS defend settings........................................................................................................................... 18
Figure1-20 Protection history.................................................................................................................................. 19
Figure1-21 Blacklist configuration.......................................................................................................................... 19
Figure1-22 Blacklist query ...................................................................................................................................... 20
Figure1-23 Blacklist log query................................................................................................................................ 20
Figure1-24 VIP bandwidth guarantee...................................................................................................................... 21
Figure1-25 Traffic shaping...................................................................................................................................... 22
Figure1-26 Anti-ARP-Spoofing .............................................................................................................................. 23
Figure1-27 ARP configuration................................................................................................................................ 24
Figure2-1 Link load balancing................................................................................................................................. 25
Figure2-2 ISP........................................................................................................................................................... 26
Figure2-3 Logic link group...................................................................................................................................... 27
Figure2-4 Link health check.................................................................................................................................... 27
Figure3-1 IPsec VPN configuration ........................................................................................................................ 29
Figure3-2 DPVPN ................................................................................................................................................... 30
Figure3-3 Xauth user............................................................................................................................................... 31
Figure3-4 IPsec interface......................................................................................................................................... 31
Figure3-5 Display connection.................................................................................................................................. 31
Figure3-6 Operation log .......................................................................................................................................... 32
Figure3-7 L2TP ....................................................................................................................................................... 33
Figure3-8 GRE ........................................................................................................................................................ 34
Figure3-9 SSL VPN................................................................................................................................................. 35
Figure3-10 Resource configuration......................................................................................................................... 36
Figure3-11 Resource configuration......................................................................................................................... 37
Figure3-12 Online user status.................................................................................................................................. 37
Figure3-13 Operation log query .............................................................................................................................. 38

vii
Figure4-1 IDS integration log.................................................................................................................................. 39

DPX8000 Series Deep Service Switching Gateway User
Configuration Guide Firewall Service Board Module v1.0
1
List of Tables
Table1-1 packet filtering policy................................................................................................................................. 4
Table1-2 Configuring action...................................................................................................................................... 4
Table1-3 Packet filtering policy log .......................................................................................................................... 6
Table1-4 ALG configuration..................................................................................................................................... 7
Table1-5 Source NAT configuration......................................................................................................................... 8
Table1-6 Destination NAT configuration.................................................................................................................. 9
Table1-7 One to one NAT configuration................................................................................................................. 10
Table1-8 Address pool configuration...................................................................................................................... 11
Table1-9 Alg configuration..................................................................................................................................... 12
Table1-10 Basic attack protection ........................................................................................................................... 13
Table1-11 Basic attack log query ............................................................................................................................ 14
Table1-12 Exceeding control................................................................................................................................... 15
Table1-13 Defend object management.................................................................................................................... 16
Table1-14 Traffic and status monitoring ................................................................................................................. 17
Table1-15 DDOS defend settings............................................................................................................................ 18
Table1-16 Blacklist configuration........................................................................................................................... 19
Table1-17 Blacklist query........................................................................................................................................ 20
Table1-18 Blacklist log query ................................................................................................................................. 21
Table1-19 VIP bandwidth guarantee....................................................................................................................... 21
Table1-20 Anti-ARP-Spoofing................................................................................................................................ 23
Table1-21 ARP configuration.................................................................................................................................. 24
Table2-1 Link load balancing.................................................................................................................................. 25
Table2-2 ISP............................................................................................................................................................ 26
Table3-1 IPsec VPN configuration.......................................................................................................................... 29
Table3-2 DPVPN..................................................................................................................................................... 30
Table3-3 Display connections ................................................................................................................................. 31
Table3-4 Operation log............................................................................................................................................ 32
Table3-5 L2TP......................................................................................................................................................... 33
Table3-6 GRE.......................................................................................................................................................... 34
Table3-7 Global configuration ................................................................................................................................ 35

DPX8000 Series Deep Service Switching Gateway User
Configuration Guide Firewall Service Board Module v1.0
2
Chapter 1 Firewall
1.1 Introduction to Firewall
Firewall can control the incoming and outgoing data packet and block intrusion from outside network, the
followings are provided by firewall, including:
Packet filtering
IPv6 packet filtering
NAT
NAT_PT
Basic protection
Sessions limitation
Service limit
Basic DDoS
Advanced Algorithm
Blacklist
QoS
Anti-ARP-spoofing
Traffic analysis
To view the firewall menu, you choose Firewall module > Packet filtering, as shown in Figure1-1.

DPX8000 Series Deep Service Switching Gateway User
Configuration Guide Firewall Service Board Module v1.0
3
Figure1-1 Firewall module
1.2 Packet Filtering Policy
1.2.1 Packet Filtering Policy
Packet filtering is to inspect the source domain, destination domain, originator source IP, originator destination IP,
originator source MAC, originator destination MAC, service, IP fragment, flow re-mark, action for every data
packet.
To enter the packet filtering policy page, you choose Firewall module > Packet filtering, as shown in Figure1-2.
Figure1-2 Packet filtering policy
Table1-1 describes the details of packet filtering policy.