Freedom9 freeGuard Blaze 2100 User manual

freeGuard Blaze 2100
User Guide
Version 3R2

COPYRIGHT NOTICE
© Copyright 2007 Freedom9 Inc.
ALL RIGHTS RESERVED.
Under the copyright law, this manual and the software described within can not be copied in
whole or part, without written permission of the manufacturer, except in the normal use of the
software to make a backup copy. The same proprietary and copyright notices must be affixed to
any permitted copies as were affixed to the original. An exception does not allow copies to be
made for others, whether or not sold, but all of the materials purchased can be sold, given, or
loaned to another person. Under the law, copying includes translating this information into
another language or format.
Information contained in this document is subject to change without notice.
TRADEMARKS
Hyper-Terminal is a registered trademark of Hillgraeve Inc.
SecureCRT is a registered trademark of VanDyke Technologies Inc.
Other products mentioned in this document may be trademarks and/or registered trademarks
of their respective companies and are the sole properties of their respective company.

. . . . .
Version 3R2, Security Appliance User Guide iii
. . . . .
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Contents
1 Introduction 1-1
About Document Conventions 1-1
Command Line Interface (CLI) Conventions 1-1
Browser-Based Graphical User Interface (WebGUI) Conventions 1-2
Illustration Conventions 1-3
2 Getting Started 2-1
Before You Install 2-1
Installation Precautions 2-1
What you must know for Installation 2-1
Installing the freeGuard Blaze 2100 2-2
Connecting the Power 2-2
Connecting the freeGuard Blaze 2100 to Other Network Devices 2-2
Configuring the freeGuard Blaze 2100 2-3
Configuring the Software 2-5
3 Security Zones and Interfaces 3-1
Security Zones 3-1
Creating and Modifying Custom Security Zones 3-4
Creating Custom Security Zones 3-4
Deleting Custom Security Zones 3-4
Blocking Within a Zone 3-5
Viewing Zone Configurations 3-6
Configuring Interfaces and Subinterfaces 3-7
Configuring Interfaces 3-7
Binding Interfaces to a Security Zone 3-8
Moving Interfaces between Security Zones 3-9
Configuring Subinterfaces 3-9
Deleting Subinterfaces 3-10

iv Version 3R2, Security Appliance User Guide
Configuring Interface Modes 3-11
Configuring NAT-Enabled Mode 3-11
Configuring Route Mode 3-12
Viewing Interface Information 3-13
Configuring Transparent Mode 3-15
Advanced Interface Settings 3-22
Configuring Maximum Transmission Unit (MTU) Settings 3-23
Configuring Interface Link Up/Down 3-23
Configuring Address Resolution Protocol (ARP) 3-24
Enabling Interface Management 3-25
Disabling Interface Management 3-25
Setting the Interface Speed 3-26
Authentication Using RADIUS 3-26
How the RADIUS Challenge-Response Mode Works 3-26
RADIUS Client Attributes 3-28
RADIUS Backup Server 3-29
Alternate Connection Methods 3-33
PPPoE: Point-to-Point Protocol over Ethernet 3-33
4 System Management 4-1
Using the Console to Manage the freeGuard Blaze 2100 4-1
About Console Cable Requirements 4-2
Accessing the Console 4-2
Re-enabling the Console Interface 4-3
Viewing Console Interface Settings 4-3
Setting the Console Display 4-3
Setting the Console Timeout 4-4
Exiting the Console 4-4
Using SSH to Manage the freeGuard Blaze 2100 4-4
Generating SSH Host Keys 4-4
Enable SSH Globally 4-4
Enabling SSH on a Specific Interface 4-5
Disabling SSH on a Specific Interface 4-5
Viewing SSH Settings 4-5
Managing Users for the freeGuard Blaze 2100 4-6
Changing Your Administrator Password 4-6
About Additional Types of Users 4-7
Changing the Admin-r password 4-7
Viewing Current Users 4-7
Managing Software for the freeGuard Blaze 2100 4-7
Storing Software Image Files in Flash Memory 4-8

. . . . .
Version 3R2, Security Appliance User Guide v
Downloading New Software 4-8
Uploading New Software 4-8
Saving MOS software to flash memory using TFTP 4-9
Saving Boot software to flash memory using TFTP 4-9
Setting the Software as Primary or Secondary 4-9
Saving the Configuration File for Export 4-9
View the Running Configuration 4-10
View the Saved Configuration 4-10
Resetting and Restarting the freeGuard Blaze 2100 4-11
Resetting the Appliance 4-11
Resetting the Software 4-11
Restarting the freeGuard Blaze 2100 4-11
Additional System Management Tasks 4-12
Viewing System Information 4-12
Creating Aliases 4-14
Deleting Aliases 4-15
Viewing Current Aliases 4-15
Configuring Domain Names 4-15
Deleting Domain Names 4-15
Configuring Host Names 4-16
Deleting Host Names 4-16
Using Network Time Protocol (NTP) 4-16
Configuring NTP Settings 4-17
Configuring the NTP Update Interval 4-17
Viewing Current NTP Settings 4-17
Deleting NTP Server IP Entries 4-18
Configuring Manual Update using NTP 4-18
Maintaining Clock Settings with NTP 4-18
Configuring the Clock to Use NTP 4-19
Configuring the Time Zone 4-19
Using Domain Name Service (DNS) 4-19
Deleting DNS Host IP Addresses 4-20
Displaying Current DNS Host Settings 4-21
Using Ping 4-21
Using Traceroute 4-21
5 Attack Detection and Prevention 5-1
Network Attacks 5-1
Attack Stages 5-2
Detecting an Attack 5-2
About Denial of Service (DoS and DDoS) Attacks 5-4

vi Version 3R2, Security Appliance User Guide
Preventing Network Port Attacks 5-5
Configuring the freeGuard Blaze 2100 to Defend Against DoS and DDoS Attacks 5-6
Configuring ICMP Flood Prevention 5-7
Configuring UDP Flood Prevention 5-7
Configuring SYN Flood Prevention 5-7
Configuring FIN Flood Prevention 5-8
Configuring IP Fragment Prevention 5-9
Configuring TCP-FIN-no-ACK 5-9
Additional Attack Detection and Prevention 5-10
Viewing Attack Settings 5-10
6 Logging 6-1
Logging 6-1
Logging Levels 6-1
Log Modules 6-2
Traffic and Event Log Management 6-3
Log Module Settings 6-3
Setting Log Modules 6-3
Disabling Log Module Settings 6-4
Viewing the log module settings 6-4
Viewing the Traffic and Event Log 6-5
Admin Mail Server 6-6
Configure the Security Appliance to send E-mail Notification using the Admin Mail
Option 6-6
Deleting the Admin Mail Server 6-7
Removing E-mail Addresses from the Admin Mail Server 6-7
Syslog Management 6-7
Deleting the Syslog host IP address 6-8
Disabling the Syslog Host Log Options 6-8
Syslog Message Format 6-9
Syslog Message Sample: 6-9
SNMP MIB Groups 6-10
System Group 6-11
Interface Group 6-11
Address Translation Group 6-11
IP Group 6-12
IP Address 6-12
IP Route 6-13
IP Net to Media 6-14
ICMP Group Scalars 6-15
TCP Group Scalars 6-16

. . . . .
Version 3R2, Security Appliance User Guide vii
TCP Connection 6-16
UDP Group Scalars 6-17
UDP Listener 6-17
SNMP Group 6-17
Transmission Group (DOT3STATs) 6-18
Transmission Group (DOT3COLLISION) 6-19
Configuring SNMP on the Security Appliance 6-19
Enabling SNMP on a Specified Interface 6-20
Configuring the SNMP Community String 6-21
Configuring the SNMP Listener Port 6-21
Configuring the SNMP System Name 6-21
Deleting the SNMP System Name 6-21
Configuring the SNMP System Locations 6-21
Deleting the SNMP location 6-22
Configuring the SNMP System Contact 6-22
Deleting the SNMP System Contact 6-22
Viewing the SNMP Settings 6-22
View the SNMP Community Settings 6-22
View the SNMP Statistics 6-23
Viewing the Interface Statistics 6-24
7 Virtual Private Networks 7-1
Virtual Private Networks 7-1
About IP Security (IPsec) 7-2
the Diffie-Hellman Group 7-5
Security Association 7-5
Site-to-Site VPN Requirements 7-6
VPN Special Considerations 7-6
Configuring Manual Key VPN Implementations 7-7
Creating Manual Key VPN Tunnels 7-7
Creating Security Policy with the VPN Tunnels 7-8
Deleting Manual Key VPN Tunnels 7-16
Modifying Manual Key VPN Tunnels 7-17
Configuring Internet Key Exchange 7-17
Creating IKE Phase 1 and Phase 2 Proposals 7-17
Configuring an IKE Tunnel using a Pre-Shared Secret 7-19
Transparent Mode VPN Deployment 7-29
Advanced VPN Configuration Options 7-32
Dead Peer Detection (DPD) 7-32
NAT-Traversal (NAT-T) 7-32
Perfect Forward Secrecy (PFS) 7-32

viii Version 3R2, Security Appliance User Guide
Replay Protection 7-33
View a VPN Tunnel 7-33
8 Routing 8-1
Static Routes 8-1
Adding Static Routes 8-2
Deleting Static Routes 8-3
Modifying Static Routes 8-3
Setting the Default Route 8-4
Displaying Route Information 8-4
Routing Information Protocol (RIP) 8-6
Configuring RIP 8-7
Enabling and Disabling RIP on Interfaces 8-8
Disable Route Summarization 8-8
Enable or Disable Split Horizon 8-9
Enable RIP Authentication 8-9
Accepting Packets with Non-Zero Reserved Fields 8-9
9 Policy Configuration 9-1
About Security Policies 9-1
About Traffic Flow Among Policies 9-1
About Security Policy Types 9-2
Configuring Policies 9-4
Creating Policies 9-5
Naming Policies 9-6
Reordering Polices 9-7
Disabling Policies 9-8
Re-enabling Policies 9-9
Deleting Policies 9-9
Viewing Policies 9-9
Enable Policy Logging 9-11
Configuring Address Objects 9-11
Creating Address Objects 9-12
Deleting Address Objects 9-13
Modifying Address Objects 9-14
Creating Address Groups 9-15
Adding Objects to an Address Group 9-15
Deleting Address Groups 9-17
Deleting Address Objects from an Address Group 9-17
Adding Comments to Address Groups 9-17

. . . . .
Version 3R2, Security Appliance User Guide ix
Configuring Service Objects 9-18
Viewing Predefined Service Objects 9-18
Configuring Custom Service Objects 9-18
Deleting Service Objects 9-19
Modifying Service Objects 9-19
Configuring Service Timeouts 9-20
Configuring Service Groups 9-20
Creating Service Groups 9-21
Deleting Service Groups 9-22
Removing Service Objects from Groups 9-22
Modifying Service Groups 9-22
Adding Comments to Service Groups 9-23
About Schedules 9-23
Creating One-time Schedules 9-23
Creating Recurring Schedules 9-24
Adding Schedules to Policies 9-25
Deleting Schedules 9-27
Viewing Schedules 9-27
10 Address Translation 10-1
Network Address Translation 10-1
Configuring Source Network Address Translation 10-2
About Port Address Translation (PAT) 10-2
Configuring Dynamic IP (DIP) Pools 10-3
Source NAT Configurations 10-3
Configuring Source NAT: Many-to-One with Port Address Translation 10-4
Configuring Source NAT: Many-to-Many with Port Address Translation 10-4
Configuring Destination NAT and Port Mapping 10-5
Destination NAT Configurations 10-5
Configuring Destination NAT: One-to-One 10-6
Configuring Destination NAT: One-to-One with Port Mapping 10-6
Configuring Destination NAT: Many-to-One 10-6
Configuring Destination NAT: Many-to-One with Port Mapping 10-7
Configuring Destination NAT: Many-to-Many 10-7
11 High Availability 11-1
About High Availability 11-1
Software Architecture overview 11-1
CLI Commands 11-2
HA Configuration 11-3

xVersion 3R2, Security Appliance User Guide
12 PKI and X.509/Digital Certificates 12-1
About Public Key Infrastructure and X.509/Digital Certificates 12-1
PKI Basics 12-2
A typical Digital Certificate 12-3
Self-signed certificate 12-4
CLI Commands 12-4
Generating a Self-Signed Certificate 12-4
Creating a Certificate Request 12-5
Importing a certificate 12-6
Using a Certificate for a VPN tunnel 12-6
A Pre-defined Services A-1
B Glossary B-1

Version 3R2 Security Appliance User Guide 1-1
I NTRODUCTION 1
The Security Appliance is a Gigabit security appliance that addresses the
security requirements of today’s high performance networks on the
perimeter and interior LAN segments. Equipped with an extensive
firewall feature set, the Security Appliance has the capability to protect
network hosts from wide ranging and high volume attacks meant to take
network resources offline.
Features available on the freeGuard Blaze 2100 include:
• Stateful packet inspection
•IPsecVPN
• Prevention of 30+ DoS and DDoS attacks
• Extensive Network Address Translation (NAT) features including: one-
to-one, many-to-one, many-to-many, and port address translation
(PAT)
• 802.1Q VLAN support
• Granular access control using network objects, services, and
schedules
• Zone based security
• Secure CLI management using SSH
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
ABOUT DOCUMENT CONVENTIONS
This section explains the Command Line Interface (CLI), the browser
based graphical user interface (WebGUI), and the illustration
conventions used in this guide.
COMMAND LINE INTERFACE (CLI) CONVENTIONS
The following conventions are used when presenting the syntax of the
command line interface (CLI):
• Values inside square brackets [ ] are optional.
• Values inside braces { } are required.

INTRODUCTION
About Document Conventions
1-2 Security Appliance User Guide Version 3R2
1
• For commands that require a selection from a pre-defined list of
values, each value in the list is separated by a pipe ( | ).
• Variables appear in italic.
• When a CLI command appears within the context of a sentence in this
document, it is in bold (except for variables, which are always in
italic). For example: “Use the get system command to display
general information about the freeGuard Blaze 2100.”
Variable CLI values are described in Table 1-1
Table 1-1: Variable CLI Values Used in This Guide
BROWSER-BASED GRAPHICAL USER INTERFACE (WEBGUI)
CONVENTIONS
• Values inside square brackets [ ] are optional.
• Values inside braces { } are required.
• For commands that require a selection from a pre-defined list of
values, each value in the list is separated by a pipe ( | ).
• Variables appear in italic.
When a WebGUI command appears within the context of a sentence in
this document, it is in bold (except for variables, which are always in
italic). For example: “Use click on the XXXX command to display general
information about the freeGuard Blaze 2100.”
Variable CLI Value Description
addr_str Defines an IP address range assignment
dst_adr Destination address assigned in a policy
fqdn Fully Qualified Domain Name
ip_addr Defines an IP address assignment
number Numeric value assigned for a specific command
name_str Name value assignment
password_str New password assignment is required
src_adr Source address assigned in a policy
srvc Service assigned in a policy
zone name Zone used in a specific command

. . . . .
INTRODUCTION
About Document Conventions
Version 3R2 Security Appliance User Guide 1-3
ILLUSTRATION CONVENTIONS
Figure 1-1 shows the graphics used in illustrations in this guide.
Figure 1-1: Illustration Conventions

INTRODUCTION
About Document Conventions
1-4 Security Appliance User Guide Version 3R2
1

Version 3R2 Security Appliance User Guide 2-1
G ETTING S TARTED 2
This chapter describes how to install, configure, and manage the
freeGuard Blaze 2100. This chapter includes the following topics:
•Before You Install
•Installing the freeGuard Blaze 2100
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
BEFORE YOU INSTALL
Familiarize yourself with the following topics before installing the
freeGuard Blaze 2100:
•Before You Install
•Installing the freeGuard Blaze 2100
INSTALLATION PRECAUTIONS
[WARNING] Obey these precautions when you install the
freeGuard Blaze 2100. Observing these precautions can prevent
injuries, equipment failures, and potential shutdown of the
freeGuard Blaze 2100.
[WARNING] Always assume the power supply for the freeGuard
Blaze 2100 is connected to the power outlet.
<CAUTION> Room temperature might not be adequate for long term
use of the freeGuard Blaze 2100; for optimum environmental
requirements for the freeGuard Blaze 2100, refer to the Security
Appliance Specifications Guide.
<CAUTION> Be careful of additional hazards, including frayed power
cords, wet or moist floors, and missing safety grounds.
WHAT YOU MUST KNOW FOR INSTALLATION
You must understand the following concepts before you install the
freeGuard Blaze 2100 for the first time:
• Basic understanding of TCP/IP.

GETTING STARTED
Installing the freeGuard Blaze 2100
2-2 Security Appliance User Guide Version 3R2
2
• IP addresses and subnet masks.
• Network Address Translation (NAT). For more information, refer to
Chapter 10, “Address Translation.”
• Creating a policy. For more information, refer to Chapter 9, “Policy
Configuration.”
• Routing. For more information, refer to Chapter 8, “Routing.”
• Security zones. For more information, refer to Chapter 3, “Security
Zones and Interfaces.”
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
INSTALLING THE FREEGUARD BLAZE 2100
This section guides you through the installation of the freeGuard Blaze
2100. Once you are familiar with the previous section, Before You Install
on page 2-1, prepare to proceed with the actual installation.
To install the freeGuard Blaze 2100, perform the tasks described in the
following sections:
•Connecting the Power
•Connecting the freeGuard Blaze 2100 to Other Network Devices
•Configuring the freeGuard Blaze 2100
CONNECTING THE POWER
You must connect a power source to the freeGuard Blaze 2100 before
you configure the appliance.
To connect the power:
1On the freeGuard Blaze 2100, plug the DC connector end of the power cable into
the DC power receptacle on the back of the appliance.
2Plug the AC adapter end into a surge protected AC power source.
The freeGuard Blaze 2100 is now powered ON.
CONNECTING THE FREEGUARD BLAZE 2100 TO OTHER NETWORK
DEVICES
Once the power is connected to the freeGuard Blaze 2100, you can
connect it to other network devices. Use either of the Ethernet interfaces

. . . . .
GETTING STARTED
Installing the freeGuard Blaze 2100
Version 3R2 Security Appliance User Guide 2-3
labeled eth0 through eth7. Use these interfaces to connect other
network devices as necessary.
Figure 2-1 displays the eth1 interface connected to an Internet router
using a twisted pair Ethernet cable, while the eth0 interface is connected
to a switch on your local area network (LAN) using another twisted pair
Ethernet cable.
Figure 2-1: Connecting the freeGuard Blaze 2100 to other Network
Devices
CONFIGURING THE FREEGUARD BLAZE 2100
After you supply power to the freeGuard Blaze 2100, use the console
interface to initially configure the card.
Table 2-1 lists the required console cable pin-out that you use to manage
the freeGuard Blaze 2100.
Table 2-1: Console Cable Pin-Out
Female 2x5 Header Female DB9
11
26
32
47
53
68
74

GETTING STARTED
Installing the freeGuard Blaze 2100
2-4 Security Appliance User Guide Version 3R2
2
CONNECTING THE CONSOLE CABLE
To use the console interface, you must connect the null modem cable
included in the product packaging.
To connect the console cable to the freeGuard Blaze 2100:
1Connect the female 2x5 header of the console cable to the console port on the
freeGuard Blaze 2100.
2Connect the other female DB9 connector to a serial interface on a laptop or desktop
machine.
3To access the freeGuard Blaze 2100 console interface, launch a terminal emulation
program.
[NOTE] Hyper-Terminal by Hillgraeve Inc. is a suitable terminal
emulation program, and is included with most Windows operating
systems.
The default login credentials are admin and admin. These credentials are case
sensitive.
4Enter the following settings in the terminal application:
• Baud Rate—38,400
• Parity—No
• Data Bits—8
• Stop Bit—1
• Flow Control—None
5Press Enter to view the login prompt.
6At the login prompt, type admin.
7At the password prompt, type admin.
89
95
10 NC
Table 2-1: Console Cable Pin-Out (Continued)
Female 2x5 Header Female DB9

. . . . .
GETTING STARTED
Installing the freeGuard Blaze 2100
Version 3R2 Security Appliance User Guide 2-5
CONFIGURING THE SOFTWARE
To configure the freeGuard Blaze 2100 software for the first time,
perform the steps in the following sections:
1Changing the Admin Password
2Configuring Interfaces
3Configuring Network Address Translation (NAT))
4Configuring the Default Route
5Configuring a Policy from Trust to Untrust
6Viewing the Policy Configuration
CHANGING THE ADMIN PASSWORD
Because all <Security Appliances> are preconfigured with the same
password, you must change the admin password.
Use the set admin command to change the password:
set admin password {password_str}
save
CONFIGURING INTERFACES
Configure the freeGuard Blaze 2100 to protect a network like that
displayed in Figure 2-2. This configuration allows all workstations
connected to the eth0 interface to use the freeGuard Blaze 2100 as their
default gateway to the Internet. In this configuration, the eth0 interface
is connected to the inside LAN Switch and the eth1 interface is
connected to your Internet router. The eth0 interface is bound to the

GETTING STARTED
Installing the freeGuard Blaze 2100
2-6 Security Appliance User Guide Version 3R2
2
zone trust and the eth1 interface is bound to the zone untrust. This
allows you to manage access control between the zones.
Figure 2-2: Network Protection
Use the set interface command to assign the zone, IP address and
netmask to both interfaces as shown in Figure 2-2.
EXAMPLE: CONFIGURING INTERFACE ETH0
Use the set interface command to bind the eth0 interface to the trust
zone with an IP address and netmask of 10.0.0.1/24:
set interface eth0 ip 10.0.0.1/24
set interface eth0 zone trust
save
GUI EXAMPLE: CONFIGURING INTERFACE ETH0
1Network > Interface > Edit (for eth0)
2Enter the following, then click Apply:
Zone Name: Trust
Static IP: (select this option when present)
IP Address/Netmask: 10.0.0.1/24
EXAMPLE: CONFIGURING INTERFACE ETH1
Use the set interface command to bind the eth1 interface to the trust
zone with an IP address and netmask of 4.4.4.1/24:
set interface eth1 ip 4.4.4.1
set interface eth1 zone untrust