Global Technology GB-500 User manual




GB-500
Firewall
APPLIANCE
Product
Guide
powered by
GNAT Box
System Software

Table of Contents iii
Copyright
© 1996-2003, Global Technology Associates, Incorporated (GTA). All rights reserved.
Except as permitted under copyright law, no part of this manual may be reproduced or distrib-
uted in any form or by any means without the prior permission of Global Technology Associates,
Incorporated.
RoBoX GB-500 Product Guide July 2003
Technical Support
GTA includes 30 days installation support from the day you receive the initial shipment. GTA’s
direct customers in the USA should call or email GTA using the telephone and email address
below. International customers should contact a local GTA authorized channel partner.
Tel: [phone] Email: [email protected]
Disclaimer
Neither GTA, nor its distributors and dealers, make any warranties or representations, either
expressed or implied, as to the software and documentation, including without limitation, the
condition of software and implied warranties of its merchantability or fitness for a particular
purpose. GTA shall not be liable for any lost profits or for any direct, indirect, incidental, conse-
quential or other damages suffered by licensee or others resulting from the use of the program
or arising out of any breach of warranty. GTA further reserves the right to make changes to the
specifications of the program and contents of the manual without obligation to notify any person
or organization of such changes.
Mention of third-party products is for informational purposes only and constitutes neither an
endorsement nor a recommendation for their use. GTA assumes no responsibility with regard to
the performance or use of these products.
Every effort has been made to ensure that the information in this manual is accurate. GTA is not
responsible for printing or clerical errors.
Trademarks
GNAT Box is a registered trademark of Global Technology Associates, Incorporated. RoBoX and
Surf Sentinel are trademarks of Global Technology Associates, Incorporated.
GTA acknowledges all trademarks appearing in this document. This product includes software
developed by the University of California, Berkeley and its contributors. Netscape Navigator
is a trademark of Netscape Communications Corporation. Internet Explorer is a trademark of
Microsoft Corporation. WELF and WebTrends are trademarks of NetIQ. All other products are
trademarks of their respective companies.
Global Technology Associates, Inc.
3505 Lake Lynda Drive, Suite 109 • Orlando, FL 32817 USA
Tel: [phone] • Fax: [phone] • Web: http://www.gta.com • Email: [email protected]
Lead Development Team: Larry Baird, Richard Briley, Jim Silas, Brad Plank.
Technical Consulting: David Brooks. Documentation: Mary Swanson.

Table of Contents iii
Contents
1 INTRODUCTION 1
GNAT Box Basics ………………………………………………………………………… 1
Requirements …………………………………………………………………………… 1
Registration ………………………………………………………………………………… 2
Activation Codes ………………………………………………………………………… 2
Support ……………………………………………………………………………………… 2
Support Options ……………………………………………………………………… 3
Upgrades ………………………………………………………………………………… 3
About This Guide ………………………………………………………………………… 3
Additional Documentation ……………………………………………………………… 4
About GB-500 ……………………………………………………………………………… 5
Features …………………………………………………………………………………… 5
Optional Features ……………………………………………………………………… 5
Additional Software Products ………………………………………………………… 5
Software Specifications ………………………………………………………………… 6
Hardware Design ………………………………………………………………………… 6
Status Displays ………………………………………………………………………… 7
Hardware Specifications ……………………………………………………………… 8
2 INSTALLATION 9
Preinstallation ……………………………………………………………………………… 9
Install Utilities and Documentation……………………………………………………… 9
Temporarily Configure Workstation …………………………………………………… 9
LAN Using the Default IP Network…………………………………………………… 10
Connect the GB-500 ……………………………………………………………………… 10
3 SET UP DEFAULT CONFIGURATION 11
Basic Configuration using Web Interface ………………………………………… 11
Network Information ……………………………………………………………………… 13
Re-configure Workstation ……………………………………………………………… 14
Access the GB-500 ……………………………………………………………………… 14
Basic Configuration using GBAdmin ……………………………………………… 14
Network Information ……………………………………………………………………… 15
Re-configure Workstation ……………………………………………………………… 16
Access the GB-500 ……………………………………………………………………… 16
4 TROUBLESHOOTING 17
Guidelines …………………………………………………………………………………… 17
Troubleshooting Q & A ………………………………………………………………… 18
INDEX 23

GB-500 Firewall Appliance Product Guideiv 1 – Introduction 1

GB-500 Firewall Appliance Product Guideiv 1 – Introduction 1
1 Introduction
GNAT Box Basics
Global Technology Associates, Inc., has been designing and building Internet
rewalls since 1994. In 1996, GTA developed the rst truly affordable
commercial-grade rewall, the GNAT Box®. Since then, ICSA-certied
GNAT Box System Software has become the engine that drives all GTA
rewall systems.
Powered by GNAT Box System Software, GTA's rewall systems currently
include the small-to-medium enterprise (SME) rewalls, GB-1500 and GB-
1200; the RoBoX line, for remote ofce/branch ofce applications, including
GB-750, GB-500, and GB-200; and GTA’s powerful software-based products.
Requirements
To connect the GB-500 Firewall Appliance, you will need:
• An external power supply.
• Two Ethernet cables, one for each required network.
• A crossover cable to connect to a host or router, or a straight-through
cable to connect to a hub or switch.
An external power supply, a yellow crossover cable and a grey straight-
through cable, as well as a null modem cable for the Console interface, are
included with rewall appliances.
In addition, to use GNAT Box System Software, you will need:
• An understanding of TCP/IP networking.
• Network IP addresses for all network interfaces used.
• Netmasks for each attached network.
• Default route for External Network.
• Which services to allow inbound (if any).
• Which services to restrict outbound (if any).

GB-500 Firewall Appliance Product Guide2
1 – Introduction 3
Registration
To register, go to www.gta.com, click on Support and then the GTA Support
Center link. If you already have an account, enter your user ID and password
in the login screen; if not, click New Account, enter the prole information.
Once you have completed the form, click Add to save the prole.
Return to the login screen and enter your user ID and password. Click on the
Support Center link, then click on Product Registration in the Account Home
screen for your support information. Enter your serial number and activation
(unlock) code, then click Submit. Your new product will now appear in the
View Registered Products screen, accessible from the Account Home page.
In addition to qualifying you for installation support, your product registration
will allow GTA to inform you about upgrades and special offers.
Note
If you cannot retrieve your registration code, or a code does not appear
under Registered Products, please email support with a brief description
of your problem in the body of the email. Include the product serial
number and your Support Center User ID in the message subject.
Activation Codes
All commercial GTA Firewalls use activation codes to protect software. For
rewall appliances, the required code is pre-installed. Additional features
require separate feature activation codes. Serial numbers and activation codes
are printed on packaging and are also available under View Registered Products
on the GTA Support site, www.gta.com. GNAT Box System Software can be
copied for backup purposes.
Support
Installation ("up and running") support is available to registered users. If you
have registered your product and need installation assistance during the rst
30 days, contact the GTA Support team by email at [email protected]. Include
your product name, serial number, registration number, feature activation code
numbers for your optional products, and a System or Hardware Conguration
Report, if possible.
Installation support covers only the aspects of conguration related to instal-
lation and default setup of the rewall. For further assistance, contact GTA
Sales staff for information about support offerings.

GB-500 Firewall Appliance Product Guide2
1 – Introduction 3
Support Options
If you need support after installation and conguration to defaults, a variety of
support contracts are available. Contact GTA Sales staff for more information.
Contracts range from support by the incident to full coverage for a year.
Other avenues for assistance are available through the GNAT Box Mailing
List, on the GTA website, found at www.gta.com, or through an authorized
GTA Channel Partner.
Upgrades
Once registered, you can view available upgrades in the GTA Support Center.
If the Action eld in the Registered Products section indicates that there is an
upgrade for your product, click on the Free Upgrade link. When you return
to the Registered Product List, click the product’s serial number and see the
Product Details section to obtain the new activation code. The section will
also display previous activation codes. Upgrades are also available in Support
Center Downloads. Only downloads for your version will be shown.
Caution
Back up your conguration before upgrading!
About This Guide
This Product Guide shows how to set up and install the GB-500 and change
the factory settings to your network’s default conguration. The GNAT BOX
SYSTEM SOFTWARE USER'S GUIDE includes conguration functions, descrip-
tions of GBAdmin and the Web interface, administrative tools and GNAT
Box-specic terms.
A few conventions are used in this guide to help you recognize specic
elements of the text. If you are viewing this in a PDF, color variations are also
used to emphasize notes, warnings and new sections.
Documentation Conventions
SMALL CAPS FIELD NAMES IN BODY TEXT.
BOLD SMALL CAPS NAMES OF PUBLICATIONS.
Bold Italics Emphasis.
Courier Screen text.
Condensed Bold Menus, menu items, buttons.

GB-500 Firewall Appliance Product Guide4
1 – Introduction 5
Additional Documentation
For instructions on installation, registration and setup of a GTA Firewall in
default conguration, see your GTA Firewall’s product guide; for optional
features, see the appropriate Feature Guide. User’s Guides, Product Guides
and Feature Guides are delivered with new GTA products; these manuals and
other documentation for registered products can also be found on the GTA
website, www.gta.com.
Documents on the website are either in plain text (*.txt) or Portable Document
Format (PDF) which requires Adobe Acrobat Reader version 5.0. A free copy
of the reader can be obtained at www.adobe.com. Documents received from
GTA Support may also be in email or Microsoft Word format (*.doc).
Documentation Map
Products and Options
GNAT Box System Software ............GNAT Box System Software User‘s Guide
GTA Firewall Installation .............................................................Product Guides
Global Management System for Firewalls.............................GMS User’s Guide
Reporting...................................................... GTA Reporting Suite User’s Guide
Content Filtering ..........................Surf Sentinel Content Filtering Feature Guide
High Availability ...........................................H2A High Availability Feature Guide
Virtual Private Networking ................................. GNAT Box VPN Feature Guide
VPN Examples ............................................ GNAT Box VPN to VPN Tech Docs
Utilities & Information
Logging Utilities .......... GNAT Box System Software User’s Guide & Addendum
Database Maintenance ..................GMS & GTA Reporting Suite User’s Guides
Troubleshooting .................................................... Product and Feature Guides
Ports & Services............................................................................. Product CDs
Drivers & NICs (GNAT Box Pro, Flash) ........................................ www.gta.com
Frequently Asked Questions .......................................... FAQs on www.gta.com
Web Interface, GBAdmin..................GNAT Box System Software User’s Guide
Console interface ..............................................Console Interface User’s Guide

GB-500 Firewall Appliance Product Guide4
1 – Introduction 5
About GB-500
The GB-500 Firewall Appliance is a self-contained unit with the system
software pre-installed. This guide describes and explains how to install and
initially congure the GB-500. For conguration options and eld descrip-
tions see the GNAT BOX SYSTEM SOFTWARE USER’S GUIDE.
Features
• 10,000 concurrent sessions
• Two versions available: 50 concurrent outbound users, or
Unrestricted concurrent outbound users
• DNS, DHCP Servers
• Three 10/100 Ethernet ports
• ICSA-certied GNAT Box System Software
• IPSec VPN with 1 mobile client license
• Local Content List (LCL) ltering
• PPP/PPPoE/PPTP
• Secure Email Proxy (SMTP)
• Secure remote management
• Stateful Packet Inspection
• Time-based lters
• Transparent NAT (Network Address Translation )
• Two DB-9 serial interfaces
• USB interface
• User authentication
Optional Features
• Surf Sentinel
• Support Contracts
• Additional VPN mobile user licenses
Additional Software Products
• GTA Reporting Suite
• GMS (Global Management System)

GB-500 Firewall Appliance Product Guide6
1 – Introduction 7
Software Specifications
• Address Objects 150
• Concurrent Connections 10,000
• Maximum Concurrent Mobile VPNs 25
• DNS Domains 5
• DNS Hosts 255
• DNS Networks 80
• IP Aliases 25
• IP Pass Through Filters 50
• PPPs 5
• Outbound Filters 200
• Protocols 255
• Remote Access Filters 200
• Security Associations 50
• Static Maps 50
• Static Routes 50
• Time Groups 100
• Tunnels 50
• URL Access Lists 50
• Local Content Lists 75
• User Authentication 200
• VPN Objects 10
Hardware Design
The GB-500 Firewall Appliance is a desktop unit designed to minimize heat
generation without cooling fans. It has three high speed 10/100 Ethernet
interfaces to ensure high performance and network design exibility and two
multifunction DB-9 serial interfaces to provide access for a serial console
and a dial-up modem/ISDN TA. Flash memory stores and runs pre-installed
system software. Power is supplied by an external block type transformer.
Caution
At least six (6) inches of clearance should be provided above and below
the system to allow efcient cooling. Inadequate clearance can cause
the system to overheat.

GB-500 Firewall Appliance Product Guide6
1 – Introduction 7
Status Displays
The GB-500 has seven LEDs on the front panel, indicating power, connec-
tivity and activity. When the red GTA logo on the front panel of the GB-500
is lit, the GB-500 is powered on. Two groups of three LEDs labeled 0, 1 and 2
correspond to the network interfaces; the amber LEDs blink whenever activity
at any speed is detected by the rewall, while the green LEDs will be lit
whenever the network interface is connected.
Three sets of lights on the back panel correspond to the indicator lights on the
front, except that the colors are reversed: amber is link and green is activity.
Warning
There are no user serviceable parts in the GB-500. Opening the unit
will void the warranty on the system.
GB-500 Front and Back Panel
LED Indicators – Front Panel
Red Power When the rewall is powered up, the red GTA logo power
LED indicator will be lit.
Green Link A green LED is lit when the network interface is active.
Amber Activity An amber LED is lit when data is being transmitted or
received at any speed.

GB-500 Firewall Appliance Product Guide8 2 – Installation 9
Hardware Specifications
Physical Specications
Chassis 1.75” h x 10.5” d x 9” w (4.45 cm x 26.67 cm x 22.86 cm)
Weight 4 lbs (1.814 kg)
Power Specications
MTBF (Mean Time Between Failure) Minimum–300,000 Hours
Input Voltage 100 - 240 VAC
Input Frequency 50 - 60 Hz
Output Voltage 12 VDC, 3 amps maximum (36 watts)
Operational Specications
Temperature 0 to 140° F (0° to 60° C)
Relative Humidity 10% - 90%, non-condensing
Elevation 0 - 10,000 ft
Storage Specications
Temperature -20°C - 85°C
Relative Humidity 5% - 95%, non-condensing
Memory
CPU 533 Mhz VIA Eden
Memory 128 Mb
Flash Memory 64 Mb
I/O Interfaces
3 10/100 Ethernet interfaces. Ethernet 10Base-T on UTP
Cat. 3, 4 and 5, and Fast Ethernet 100Base-TX on UTP
Cat. 5. Interfaces 0, 1 and 3 are active and available.
2 RS-232 (DB-9). The Serial Console port should be set to
38,400 bps, 8 bit, 1 stop, no parity and ow control to
Hardware.
1 USB port. Reserved.

GB-500 Firewall Appliance Product Guide8 2 – Installation 9
2 Installation
Preinstallation
Installing the GB-500 requires that the system be connected to your local
area network (LAN). This allows the administrator to connect to the GB-500,
congure the network settings to match the local network address scheme and
perform connectivity tests. The GB-500 can be congured and administered
using any of the user interfaces. Installation procedures for GBAdmin and the
Web user interfaces are described in this document.
Note that the IP Address 192.168.71.254 is the factory setting for the
Protected Network interface (0) port on the GB-500.
Install Utilities and Documentation
Prior to installation of the GB-500, install the utility software and docu-
mentation on your workstation. If the workstation is running Windows 95,
98, NT, Me, XP or Windows 2000, there is an automated installer on the
Installation CD that will install these les. If the workstation is running a non-
Windows based OS (e.g., Macintosh or Unix) or an older version of Windows,
locate the directory on the CD-ROM for your OS and use the Read Me docu-
ment to install the documentation and utility programs.
Temporarily Configure Workstation
The factory network information settings on the GB-500 are unlikely to match
your network, so you must temporarily congure a local workstation to match
the GB-500's network information settings in order to congure the GB-500
and integrate it into your network.
Note
Please refer to the GNAT BOX SYSTEM SOFTWARE USER’S GUIDE for specic
information about editing Network Information.
Once you are able to connect to the rewall, the network information can be
changed to match the existing address scheme on your network and you can
reset your local machine to its original IP Address.

GB-500 Firewall Appliance Product Guide10 3 – Set Up Default Configuration 11
LAN Using the Default IP Network
If your local area network is currently using the 192.168.71.0 network, make
sure that the IP address 192.168.71.254 is not currently assigned to any device
on your network. If a device does have this IP address assigned:
• Set up an isolated network that contains only the GB-500 Firewall
Appliance and a workstation that will be used to congure the system;
connect the GB-500 and your workstation to a hub that has no other
connections.
• Optionally, use an Ethernet crossover cable and connect your work-
station directly to the GB-500’s Protected Network interface, (port 0).
A yellow crossover cable is included with hardware appliances.
Connect the GB-500
Connect the GB-500 to a hub or switch on your local area network using the
Protected Network interface, (the rst interface port 0, see illustration GB-500
Rear Panel) and a standard (straight-through) network cable. By default, 0 is
assigned the IP address 192.168.71.254. Use a crossover cable to connect the
rewall directly to a host or router.
Connect the power supply into a power outlet, then insert the power connector
tip into the GB-500. Since there is no power switch on the GB-500 system,
applying power will cause the boot process to begin.
The system will be operational in about one minute. Check to see that the
Power LED on the front panel is lit. The Link LED on NIC “0” should be lit.
Installation of the GB-500 is complete. The next step is to enter your basic
network information in the GB-500's default conguration.

GB-500 Firewall Appliance Product Guide10 3 – Set Up Default Configuration 11
3 Set Up Default Configuration
The following sections will describe how to set up your GB-500 in the default
conguration, in which all internal users are allowed outbound and no unsolic-
ited inbound connections are allowed.
Basic Configuration using Web Interface
Start a web browser on your workstation and enter the following URL into the
browser Address eld: https://192.168.71.254.
Note
Web setup requires a browser that supports frames.
If your network and cables are congured correctly, you will be prompted
with a Security Alert dialog indicating that the Certicate Authority is not one
you have chosen to trust; that the security certicate date is valid; and that the
name on the security certicate does not match the name of the site.
Security Alert
Select Yes, or if your alert differs, choose the selection that allows you to
proceed. You will establish your GB-500 certicate once you have logged on
to the rewall. See the GNAT BOX SYSTEM SOFTWARE USER'S GUIDE.

GB-500 Firewall Appliance Product Guide12
3 – Set Up Default Configuration 13
Next, in the login screen, enter the default user ID, "gnatbox" (all lower case),
press the <Tab> key, then enter the default password, also "gnatbox" (all lower
case). Select OK or press the <Return> key when nished.
User ID and Password
Note
GTA recommends changing the default user ID and password. See
the GNAT BOX SYSTEM SOFTWARE USER'S GUIDE for instructions.
Web Interface
Exception
GNAT Box System Software is known to be incompatible with Internet
Explorer 5 for Macintosh. If your browser does not allow you to continue
past the Security Alert screen in order to set up your new GB-500, GTA
recommends using another compatible browser such as Mozilla
(www.mozilla.org), Netscape (www.netscape.com) or Opera
(www.opera.com) to administer your rewall, that allows you to use
SSL encryption, or using a compatible browser, GBAdmin or Console
to install GB-500, disable SSL, then use Internet Explorer 5 with SSL
encryption disabled. See Technical Documents on the CD and on
www.gta.com for information about installing the GTA certicate or
disabling SSL encryption.

GB-500 Firewall Appliance Product Guide12
3 – Set Up Default Configuration 13
Network Information
The GB-500 comes congured with factory settings which need to be changed
to match our network settings. Click on Basic Conguration and expand the
menu to select Network Information. On the Network Information screen:
• Congure IP and netmasks, (expressed in either dotted decimal or
CIDR notation), for your External and Protected Networks.
• Disable the DHCP option on the external interface if necessary, as it
is set by default.
• Set the Default Route to your Internet router IP address.
• Set the Host Name to that given to the rewall in your DNS server.
Once you have completed Network Information, apply the changes by
clicking on the Save. The GB-500 will now be on a different logical network
(assuming you’ve changed the default IP address for the Protected Network)
and you will not be able to access the GTA Firewall from your workstation,
since the rewall will now be on a different network.
The GB-500 has three network interfaces. Only one External and one
Protected Network interface are required to initially congure and test the
GTA Firewall. The other interface can be dened as any of the three network
types: Protected, External or PSN (Private Service Network, GTA's DMZ).
See the GNAT BOX SYSTEM SOFTWARE USER'S GUIDE for more information
about the functions of the network interface types.
Network Information

GB-500 Firewall Appliance Product Guide14
3 – Set Up Default Configuration 15
Re-configure Workstation
Re-congure your workstation back to its original IP address, now on the
same network as the GTA Firewall.
Access the GB-500
After re-conguring your workstation, you can access the GB-500 using the
new IP address assigned to the Protected Network interface.
The GB-500 should now be active and functioning in default security mode,
(all internal users are allowed outbound and no unsolicited inbound connec-
tions are allowed). You can now perform any additional conguration tasks.
See the GNAT BOX SYSTEM SOFTWARE USER'S GUIDE for more information.
Basic Configuration using GBAdmin
Select GBAdmin (GBAdmin.exe) from the program menu. This opens a blank
GBAdmin interface, similar to the following screen: Select File from the
toolbar, then select Open.
GBAdmin Interface
Note
GBAdmin must be installed on a local workstation running Windows
95, 98, NT 4.0, XP, Me, or Windows 2000.

GB-500 Firewall Appliance Product Guide14
3 – Set Up Default Configuration 15
In Open File dialog box, in the Source area, select Network. In the Server
eld, enter the default IP Address for the GB-500 (192.168.71.254). Make
sure that there is a check in the box next to Conguration in the Information to
Load section. Once this is complete, press the <return> key or click OK.
The system will prompt you for a user ID and password. Enter the default user
ID, which is "gnatbox" (all lower case), then press the <return> key. Next,
enter the default password, which is also "gnatbox" (all lower case), then press
the <return> key or select OK when nished.
User ID and Password
Note
GTA recommends changing the default user ID and password. See
the GNAT BOX SYSTEM SOFTWARE USER'S GUIDE for instructions.
Network Information
The GB-500 comes congured with factory settings. These settings need to
be changed to match the settings on your network. Click on the "+" next to
Basic Conguration to expand the menu if it is not open. Select Network
Information to display the network settings.
The GB-500 comes congured with factory settings which need to be changed
to match our network settings. Click on Basic Conguration and expand the
menu to select Network Information. On the Network Information screen:
• Congure IP and netmasks, (expressed in either dotted decimal or
CIDR notation), for your External and Protected Networks.
• Disable the DHCP option on the external interface if necessary, as it
is set by default.
• Set the Default Route to your Internet router IP address.
• Set the Host Name to that given to the rewall in your DNS server.
Once you have completed the Network Information form, apply the changes
to the GB-500 by clicking on the single diskette icon on the tool bar to save
the data. The GB-500 will now be on a different logical network (assuming
you’ve changed the default IP address for the Protected Network).

GB-500 Firewall Appliance Product Guide16 4 – Troubleshooting 17
The GB-500 has three network interfaces; two are used for Protected and
External Networks. The other network interfaces can be dened as any of the
three network types: Protected, External or PSN (Private Service Network,
GTA's DMZ). Only External and Protected Network interface are required
to initially congure and test the GTA Firewall. See the GNAT BOX SYSTEM
SOFTWARE USER'S GUIDE for more information about the functions of the
network interface types.
Network Information
Once you click Save on the Network Information screen you will not be able
to access the GB-500 from your workstation, since the rewall will now be on
a different network.
Re-configure Workstation
Re-congure your workstation back to its original IP address, now on the
same network as the GTA Firewall.
Access the GB-500
After re-conguring your workstation, you can access the GB-500 using the
new IP address assigned to the Protected Network interface.
The GB-500 should now be active and functioning in the default security
mode, (all internal users are allowed outbound and no unsolicited inbound
connections are allowed). You can now perform additional conguration tasks.
See the GNAT BOX SYSTEM SOFTWARE USER'S GUIDE for more information.