GlobalSCAPE DMZ Gateway v3.1 User manual

GlobalSCAPE®DMZ Gateway v3.1
User Guide
Module for
EFT Server
6.3

GlobalSCAPE, Inc. (GSB)
Address:
4500 Lockhill-Selma Road, Suite 150
San Antonio, TX (USA) 78249
Sales:
[phone]
Sales (Toll Free):
[phone]
Technical Support:
[phone]
Web Support: http://www.globalscape.com/support/
© 2004-2011 GlobalSCAPE, Inc. All Rights Reserved
Last Updated: April 1, 2011

iii
Table of Contents
Introduction to GlobalSCAPE DMZ Gateway................................................................................................5
How Does it Work?....................................................................................................................................5
Technical Details.......................................................................................................................................6
DMZ Gateway Initialization and Connection Diagrams ................................................................................7
What's New in DMZ Gateway.....................................................................................................................12
Installing DMZ Gateway..............................................................................................................................13
System Requirements for DMZ Gateway v3...........................................................................................13
Installing DMZ Gateway on a Windows System .....................................................................................14
Installing DMZ Gateway on a non-Windows System ..............................................................................17
Installing DMZ Gateway on RedHat or SuSE Linux 32-Bit or 64-Bit...................................................18
Installing DMZ Gateway on Ubuntu Linux 32-Bit or 64-Bit..................................................................18
Solaris x86 32-Bit or 64-Bit..................................................................................................................19
Example of Installation Process...........................................................................................................19
Activating DMZ Gateway.........................................................................................................................21
Manually Registering and Deregistering the DMZ Gateway Server Daemon.........................................21
RedHat Enterprise Linux......................................................................................................................21
SuSE Linux..........................................................................................................................................21
Ubuntu Linux........................................................................................................................................22
Solaris..................................................................................................................................................22
Upgrading or Repairing DMZ Gateway...................................................................................................22
Uninstalling DMZ Gateway......................................................................................................................24
Uninstalling DMZ Gateway on a Windows System .............................................................................24
Uninstalling DMZ Gateway on a non-Windows System......................................................................24
RedHat Enterprise Linux, SuSE Linux, or Solaris x86 32-Bit or 64-Bit...........................................25
Ubuntu Linux 32-Bit or 64-Bit...........................................................................................................25
Example of Uninstallation Process on Solaris .................................................................................25
Administering DMZ Gateway ......................................................................................................................27
DMZ Gateway Components....................................................................................................................27
DMZ Gateway Server ..........................................................................................................................27
DMZ Gateway Server Service.............................................................................................................27
DMZ Gateway Administration Interface...............................................................................................27
DMZ Gateway System Files....................................................................................................................28
The DMZ Gateway Interface ...................................................................................................................28
Starting the DMZ Gateway Server Service .............................................................................................29
Specifying the Listening IP Addresses....................................................................................................30
What Does This Mean for the Peer Server Listeners?........................................................................30
What Does This Mean for the Client Listeners?..................................................................................30
Creating a Profile.....................................................................................................................................31
Renaming a Profile..................................................................................................................................33
Deleting a Profile .....................................................................................................................................33
Editing a Profile .......................................................................................................................................34
Controlling Access by IP Address ...........................................................................................................35

DMZ Gateway User Guide
iv
Managing the DMZ Gateway Server Service..........................................................................................36
Viewing Statistics.....................................................................................................................................36
Peer Notification Channels ..................................................................................................................37
Client Listeners....................................................................................................................................37
Statistics...............................................................................................................................................38
DMZ Gateway Logging............................................................................................................................39
DMZ Gateway Communications Activity Logging................................................................................39
DMZ Gateway Server Diagnostics Logging.........................................................................................40
DMZ Gateway Server Service Diagnostics Logging............................................................................40
DMZ Gateway Statistics Logging.........................................................................................................40
DMZ Gateway Server Event Viewer (Windows Operating Systems Only)..........................................41
DMZ Gateway Server Syslog (Solaris/Linux-based Operating Systems Only)..................................41
DMZ Gateway Administration Interface Logging.................................................................................42
DMZ Gateway Administration Diagnostics Logging.........................................................................42
DMZ Gateway AdminLauncher Diagnostics Logging ......................................................................42
Communicating with EFT Server or Mail Express Server...........................................................................43
Enabling DMZ Gateway in EFT Server ...................................................................................................43
Configuring the DMZ Gateway Connection in Mail Express...................................................................45
Routing AS2 Traffic through DMZ Gateway............................................................................................47
Using DMZ Gateway as an Outbound Proxy ..........................................................................................47
Testing the Configuration ........................................................................................................................53
Troubleshooting DMZ Gateway Communication ....................................................................................54
Interface Reference.....................................................................................................................................55
IP Access Exception Entry Dialog Box....................................................................................................55
New Profile Wizard--Profile name ...........................................................................................................55
New Profile Wizard--Peer Server Access................................................................................................56
New Profile Wizard--Configuration..........................................................................................................56
Frequently Used Commands (non-Windows) .........................................................................................57
License, Copyrights, and Release Notes....................................................................................................61
Copyright Information..............................................................................................................................61
DMZ Gateway Release Notes.................................................................................................................61
DMZ Gateway EULA...............................................................................................................................61

5
Introduction to GlobalSCAPE DMZ Gateway
GlobalSCAPE®DMZ Gateway is designed to reside in the demilitarized zone and provide secure
communication with a server behind intranet firewalls without requiring any inbound firewall holes
between the internal network and the DMZ, and with no sensitive data stored in the DMZ, even
temporarily. DMZ Gateway supports connections from the server through the use of Profiles (depending
on the license purchased).
How Does it Work?
Using EFT Server as an example of the server as illustrated below, when a Site is started, EFT Server
establishes an outbound connection to the DMZ Gateway (1). This proprietary, non-encrypted connection
is called the Peer Notification Channel (PNC). EFT Server and DMZ Gateway use the PNC to setup
subsequent communications between EFT Server and incoming client connections.
When a client (web browser, FTP client, etc.) connects to the DMZ Gateway (2) on the pre-approved
ports (21, 22, 80 443, etc.), DMZ Gateway creates a new “listener” (3), called an ephemeral port, and
gives this port and other relevant information to EFT Server over the PNC (4).
EFT Server then generates a new outbound connection (5) to the ephemeral port created by the DMZ
Gateway. Next, the DMZ Gateway "glues" the incoming client connection together with EFT Server’s new
connection (6), and from that point forward, the client’s communications are streamed through the DMZ
Gateway to EFT Server over this connection (7).

DMZ Gateway User Guide
6
Technical Details
The DMZ Gateway routes all client data to the server over the server-initiated socket without any
translation or modification to the packet’s payload. Thus, if the client is using HTTPS, then HTTPS traffic
goes over that streaming connection. Unlike a network hardware bridge/router device, the DMZ Gateway
does not "pass through" modified packets. The DMZ Gateway reads in a buffer full of data from the client
TCP/IP stream (~4KB) and then sends that data over the server's TCP/IP socket. They are completely
different TCP/IP packets with different source and destination locations; however, the payload is NOT
changed at all.
The DMZ Gateway does not forward client requests. The Peer Notification Channel (PNC) is used for
brokering new incoming client connections using the process outlined above. Once the incoming client
connection and the server connection are "glued" together, the client’s requests are streamed through the
DMZ Gateway to the server.
Both external (DMZ Gateway cloud facing) and internal (server-network facing) listening ports are
specified from within the server for each supported (and enabled) protocol. These ports can be the same
or different (even for the same protocol).
Once configured to work with the DMZ Gateway, the server (when running) will always attempt to initiate,
maintain, and if necessary reconnect to the DMZ Gateway server. No further administrative action is
required in the server to establish or maintain communications after the initial setup. From the DMZ
Gateway server perspective, if the PNC channel is broken, it will refuse new (and existing) client
connections until the server re-establishes a connection.
The server periodically queries the DMZ Gateway. If a reply is not received within 10 seconds, the server
considers the connection lost, severs the current connection, and then attempts to reconnect. The DMZ
Gateway also maintains its own awareness (ping/pong) of whether the server is connected. Every 30
seconds, DMZ Gateway determines whether it has received a pong message from the server since the
last ping. If it has, it will ping again; if not, it drops the connection. This allows it to free up ports if the
server is not available (no longer responds to ping) and for error reporting. (Refer to the Knowledge Base
article "How do EFT Server and DMZ Gateway Server communicate with each other?" for information
about changing these defaults in EFT Server 6.2 and later and DMZ Gateway 3.0 and later.)
DMZ Gateway performs client impersonation, which means none of the sockets created via the DMZ
Gateway have the DMZ Gateway IP address and port; instead, all sockets created through the DMZ
Gateway have the IP address and port of the client connection. This results in the server’s logs showing
the actual connecting client IP addresses and ports, rather than those of the DMZ Gateway.
Because the client connection is streamed through the DMZ Gateway to the server, user authentication is
handled by the server, as if the client were logging in directly to the server from the internal network.
With EFT Server, the DMZ Gateway can restrict incoming server PNC connections based upon IP
address. The DMZ Gateway can also restrict incoming client connections via the IP address ban feature.
Any IP addresses banned (manually or automatically) in EFT Server will also be banned by the DMZ
Gateway.
The server and DMZ Gateway PNC connection does not employ username and password credentials.
There is nothing sensitive contained in the PNC notifications that requires encryption.

7
DMZ Gateway Initialization and Connection Diagrams
The diagrams below illustrate the initialization and connection sequences for DMZ Gateway and EFT
Server communication.

DMZ Gateway User Guide
8

What's New in DMZ Gateway
9

DMZ Gateway User Guide
10