Planet SG-1000 User manual

VPN Security Gateway
SG-1000
User’s Manual

Copyright
Copyright (C) 2006 PLANET Technology Corp. All rights reserved.
The products and programs described in this User’s Manual are licensed products of PLANET
Technology, This User’s Manual contains proprietary information protected by copyright, and this User’s
Manual and all accompanying hardware, software, and documentation are copyrighted.
No part of this User’s Manual may be copied, photocopied, reproduced, translated, or reduced to any
electronic medium or machine-readable form by any means by electronic or mechanical. Including
photocopying, recording, or information storage and retrieval systems, for any purpose other than the
purchaser's personal use, and without the prior express written permission of PLANET Technology.
Disclaimer
PLANET Technology does not warrant that the hardware will work properly in all environments and
applications, and makes no warranty and representation, either implied or expressed, with respect to the
quality, performance, merchantability, or fitness for a particular purpose.
PLANET has made every effort to ensure that this User’s Manual is accurate; PLANET disclaims liability
for any inaccuracies or omissions that may have occurred.
Information in this User’s Manual is subject to change without notice and does not represent a
commitment on the part of PLANET. PLANET assumes no responsibility for any inaccuracies that may
be contained in this User’s Manual. PLANET makes no commitment to update or keep current the
information in this User’s Manual, and reserves the right to make improvements to this User’s Manual
and/or to the products described in this User’s Manual, at any time without notice.
If you find information in this manual that is incorrect, misleading, or incomplete, we would appreciate
your comments and suggestions.
CE mark Warning
This is a class A device, in a domestic environment, this product may cause radio interference, in which
case the user may be required to take adequate measures.
Trademarks
The PLANET logo is a trademark of PLANET Technology.
This documentation may refer to numerous hardware and software products by their trade names. In most,
if not all cases, these designations are claimed as trademarks or registered trademarks by their respective
companies.
To avoid the potential effects on the environment and human health as a result of the presence
of hazardous substances in electrical and electronic equipment, end users of electrical and
electronic equipment should understand the meaning of the crossed-out wheeled bin symbol.
Do not dispose of WEEE as unsorted municipal waste and have to collect such WEEE
separately.
１

２
Customer Service
For information on customer service and support for the VPN Security Gateway, please refer to the
following Website URL:
http://www.planet.com.tw
Before contacting customer service, please take a moment to gather the following information:
♦VPN Security Gateway serial number and MAC address
♦Any error messages that displayed when the problem occurred
♦Any software running when the problem occurred
♦Steps you took to resolve the problem on your own
Revision
User’s Manual for PLANET VPN Security Gateway
Model: SG-1000
Rev: 1.0 (October, 2006)
PartNo.EM-SG1000v1

３
Table of Contents
Chapter 1 Introduction .............................................................................. 6
1.1 Package Contents......................................................................... 7
1.2 Front View .................................................................................. 8
1.3 Rear View ................................................................................... 8
1.4 Specification ............................................................................... 8
System
Chapter 2 Administration ……………………………………………..... 10
2.1 Administrator ……………………………………………........ 12
2.2 Permitted IPs ……………………………………………......... 14
2.3 Logout ………………………………………………….…...... 15
2.4 Software Update …………………………………………....... 17
Chapter 3 Configure …………………………………………………..... 18
3.1 Setting ………………………………………………….…....... 23
3.2 Date/Time …………………………………………………...... 28
3.3 Multiple Subnet ………………………………...…………...... 29
3.4 Route Table ………………………………………………....... 33
3.5 DHCP ……………………………………………………….... 37
3.6 DDNS ……………………………………………...………..... 39
3.7 Host Table ……………………………………………….….... 41
3.8 Language ……………………………………………..……...... 42
Interface
Chapter 4 Interface …………………………………………………........ 43
4.1 LAN ………………………………….……………………..... 48
4.2 WAN ………………………………….……………………... 49
4.3 DMZ …………………………….………………………….... 57
Policy Object
Chapter 5 Address ……………………………………………………..... 59
5.1 Example ………………………………….…………………... 62
Chapter 6 Service ………………………………………………….…..... 69
6.1 Custom ………………………………….…………………..... 72
6.2 Group ………………………………….…………………....... 76

４
Chapter 7 Schedule …………………………………………………........ 79
Chapter 8 QoS ………………………………………………….……...... 82
8.1 Example ………………………………….………………....... 85
Chapter 9 Authentication ……………………………………………....... 87
9.1 Auth User and Group ……………………………………........ 93
9.2 RADIUS ………………………………….………………...... 97
9.3 POP3 Server ………………………………….…………........ 118
Chapter 10 Content Blocking …………………………………………...... 121
10.1 URL ………………………………….……………………..... 125
10.2 Script ……………………………….……………………....... 128
10.3 P2P ………………………….……………………………...... 130
10.4 IM …………………………….…………………………….... 132
10.5 Download …………………………….…………………........ 134
Chapter11 Virtual Server………………………………………………..... 136
11.1 Example ……………………………….…………………....... 140
Chapter12 VPN ………………………………………………………...... 155
12.1 Example……………………………………………………...... 163
Policy
Chapter13 Policy……………………………………………….………..... 187
13.1 Example ………………………………….………………....... 193
Web VPN / SSL VPN
Chapter14 Web VPN / SSL VPN ……………………………………....... 209
14.1 Example …………………………………………………........ 212
Anti-Attack
Chapter15 Alert Setting ………………………………………………...... 222
15.1 Internal Alert ………………………………………………..... 227
Chapter16 Atack Alarm ………………………………………………...... 231
16.1 Internal Alarm ……………………………………………....... 233
16.2 External Alarm ………………………………………………... 234

５
Monitor
Chapter17 LOG ……………………………………………….………...... 236
17.1 Traffic Log ……………………….…………………………... 238
17.2 Event Log ……………………….…………………………..... 242
17.3 Connection Log ……………………….…………………........ 245
17.4 Log Backup ……………………….………………………...... 248
Chapter18 Statistics …………………………………………….……....... 250
18.1 WAN ……………………….……………………………….... 252
18.2 Policy ……………………….………………………………... 254
Chapter19 Status …………………………………………….………….... 256
19.1 Interface ……………………….…………………………....... 257
19.2 Authentication ……………………….……………………..... 259
19.3 ARP Table ……………………….………………………........ 260
19.4 DHCP Clients ……………………….……………………....... 261

６
Chapter 1
Introduction
The innovation of the Internet has created a tremendous worldwide venue for E-
business and information sharing, but it also creates network security problems. The
security request will be the primary concerned for the enterprise. New model of Planet’s
VPN Security Gateway SG-1000, a special designed of VPN security gateway, provides
SSL, IPSec, and PPTP VPN. The SSL VPN function supports up to 50 SSL VPN
connection tunnels. The IPSec VPN feature provides IPSec VPN Trunk and IKE, SHA-
1, and MD5 Authentication. The PPTP VPN function supports PPTP server and client.
The SG-1000 provides Content Blocking feature to block specific URL, Script, IM, P2P,
and download file. Also, it is built-in Anomaly Flow IP function. This function supports
Hacker and Blaster Alert. An administrator could use this function to watch and track an
attacker.
This product is built-in two WAN ports. It supports WAN Load Balance and Fail-Over
Feature. Also, the QoS function provides Guaranteed Bandwidth and Priority
Bandwidth Utilization.
Product Features
♦VPN Connectivity: The VPN security gateway supports SSL VPN, IPSec VPN,
and PPTP server/client. The SSL VPN function supports up to 50 SSL VPN
connection tunnels. The IPSec VPN has DES, 3DES, and AES encryption and
SHA-1 / MD5 authentication. The network traffic over public Internet is secured.
♦VPN Trunk: VPN trunk function provides VPN load balance and VPN fail-over
feature to keep the VPN connection more reliable.
♦Content Filtering: The security gateway can block network connection based on
URLs, Scripts (The Pop-up, Java Applet, cookies and Active X), P2P (eDonkey,
Bit Torrent and WinMX), Instant Messaging (MSN, Yahoo Messenger, ICQ,
QQ and Skype) and Download. If there are new updated version of P2P or IM

７
software in client side, SG-1000 will detect the difference and update the
Content Filtering pattern to renew the filtering mechanism.
♦Policy-based Firewall: The built-in policy-based firewall prevent many known
hacker attack including SYN attack, ICMP flood, UDP flood, Ping of Death, etc.
The access control function allowed only specified WAN or LAN users to use
only allowed network services on specified time.
♦QoS: Network packets can be classified based on IP address, IP subnet and
TCP/UDP port number and give guarantee and maximum bandwidth with three
levels of priority.
♦Authentication: Web-based authentication allows users to be authenticated by
web browser. User database can be configured on the devices or through external
RADIUS server.
♦WAN Backup: The SG-1000 can monitor each WAN link status and
automatically activate backup links when a failure is detected. The detection is
based on the configurable target Internet addresses.
♦Outbound Load Balancing: The network sessions are assigned based on the
user configurable load balancing mode, including “Auto”, “Round-Robin”, “By
Traffic”, “By Session” and “By Packet”. User can also configure which IP or
TCP/UDP type of traffic use which WAN port to connect.
♦Multiple NAT: Multiple NAT allows local port to set multiple subnet works and
connect to the Internet through different WAN IP addresses.
1.1 Package Contents
SG-1000 x 1
Power Cord x 1
Quick Installation Guide x 1
User’s Manual CD x 1
Console cable x 1
RJ-45 cable
Rack-mount ear

1.2 Front View
- LED definition
LED Description
PWR Power is supplied to this device.
STATUS Blinks to indicate this devise is being turned
on and booting. After one minute, this LED
indicator will stop blinking, it means this
device is now ready to use.
Green Steady on indicates the port is
connected to other network device.
Blink to indicates there is traffic on
the port
WAN1,
WAN2,
LAN, DMZ
Orange Steady on indicates the port is
connected at 100Mbps speed
1.3 Rear View
1.4 Specification
Product VPN Security Gateway
Model SG-1000
Recommend concurrent
user 30 ~ 50
Hardware LAN 1 x 10/100 Based-TX RJ-45
WAN 2 x 10/100 Based-TX RJ-45
Ethernet
DMZ 1 x 10/100 Based-TX RJ-45
Software
８

９
Management Web
Network Connection Transparent mode, NAT, Multi-NAT
Routing Mode Static Route, RIPv2
Concurrent Sessions 110,000
New session / second 10,000
WAN to LAN
Throughput 100Mbps
VPN Throughput 18Mbps
VPN 3DES Throughput 17Mbps
VPN Function SSL, IPSec, PPTP server and client
DES, 3DES, and AES encrypting
SHA-1 / MD5 authentication algorithm
Remote access VPN (Client-to-Site) and Site to Site VPN
VPN Trunk
SSL VPN Internal Subnet of Server: 10
Connection Tunnels: 50
IPSec VPN Trunk 50
VPN Connection
Tunnels /Allow to
Configure
IPSec: 100 / 200
PPTP Serve: 32 / 32
PPTP Client: 16 / 16
Content Filtering URL Blocking
Blocks Popup, Java Applet, cookies and Active X
P2P Application Blocking
Instant Message Blocking
Download Blocking
Firewall Policy-based Firewall rule with schedule
NAT/ NAPT, SPI Firewall
QoS Policy-based bandwidth management
Guarantee and maximum bandwidth with 3 priority levels
Classify traffics based on IP, IP subnet, TCP/UDP port
User authentication Built-in user database with up to 200 entries
Support local database, RADIUS and POP3 authentication
Logs Log and alarm for event and traffic
Log can be saved from web, sent by e-mail or sent to syslog
server
Accounting Report Record inbound and outbound traffic’s utilization by Source
IP, Destination IP and Service
Statistics Traffic statistic for WAN interface and policies
Graphic display
Others Dynamic DNS, NTP, DHCP server, Virtual server,

１０
Chapter 2
Administration
“System” is the managing of settings such as the privileges of packets that pass through
the SG-1000 and monitoring controls. The System Administrators can manage, monitor,
and configure SG-1000 settings. But all configurations are “read-only” for all users
other than the System Administrator; those users are not able to change any setting of
the SG-1000.

Define the required fields of Administrator
Administrator Name:
The username of Administrators and Sub Administrator for the SG-1000. The
admin user name cannot be removed; and the sub-admin user can be removed or
configure.
The default Account: admin; Password: admin
Privilege:
The privileges of Administrators (Admin or Sub Admin). The username of the
main Administrator is Administrator with reading / writing privilege.
Administrator also can change the system setting, log system status, and to increase
or delete sub-administrator. Sub-Admin may be created by the Admin by clicking
New Sub Admin. Sub Admin have only read and monitor privilege and cannot
change any system setting value.
Configure:
Click Modify to change the “Sub-Administrator’s” password or click Remove to
delete a “Sub Administrator.”
１１

2.1 Adding a new Sub Administrator
STEP 1﹒In the Admin Web UI, click the New Sub Admin button to create a new
Sub Administrator.
STEP 2﹒In the Add New Sub Administrator Web UI and enter the following setting:
Sub Admin Name: sub_admin
Password: 12345
１２
dd the user or click Cancel to cancel it.
Confirm Password: 12345
STEP 3﹒Click OK to a
Add New Sub Admin

Modify the Administrator’s Password
STEP 1﹒In the Admin Web UI, locate the Administrator name you want to edit, and
click on Modify in the Configure field.
STEP 2﹒The Modify Administrator Password Web UI will appear. Enter the
following information:
Password: admin
New Password: 52364
Confirm Password: 52364
STEP 3﹒Click OK to confirm password change.
Modify Admin Password
１３

2.2Add Permitted IPs
STEP 1﹒Add the following setting in Permitted IPs of Administration:
Name: Enter master
IP Address: Enter 163.173.56.11
Netmask: Enter 255.255.255.255
Service: Select Ping, HTTP, and HTTPS.
Click OK
Complete add new permitted IPs
Setting Permitted IPs Web UI
Complete Add New Permitted Ips
To make Permitted IPs be effective, it must cancel the Ping,HTTP, and HTTPS
selection in the Web UI of SG-1000 that Administrator enter. (LAN, WAN, or DMZ Interface)
Before canceling the HTTP and HTTPS selection of Interface, must set up the Permitted IPs
first, otherwise, it would cause the situation of cannot enter Web UI by appointed Interface.
１４

2.3 Logout
STEP 1﹒Click Logout which locate in Browser’s above right to protect the system
while Administrator are away.
Confirm Logout Web UI
１５

STEP 2﹒Click OK and the logout message will appear in Web UI.
Logout Web UI Message
１６

2.4 Software Update
STEP 1﹒Select Software Update in System, and follow the steps below:
To obtain the version number from Version Number and obtain the
latest version from Internet. And save the latest version in the hardware
of the PC, which manage the SG-1000
Click Browse and choose the latest software version file.
Click OK and the system will update automatically.
It takes 3 minutes to update software. The system will reboot after update. During the
updating time, please don’t turn off the PC or leave the Web UI. It may cause some unexpected
mistakes. (Strong suggests updating the software from LAN to avoid unexpected mistakes.)
１７

１８
Chapter 3
Configure
The Configure is according to the basic setting of the SG-1000. In this chapter the
definition is Setting, Date/Time, Multiple Subnet, Route Table, DHCP, Dynamic DNS,
Hosts Table, and Language settings.

Define the required fields of Settings
SG-1000 Configuration:
The Administrator can import or export the system settings. Click OK to import
the file into the SG-1000 or click Cancel to cancel importing. You also can revive
to default value here.
Email Settings:
Select Enable E-mail Alert Notification under E-mail Settings. This function will
enable the SG-1000 to send e-mail alerts to the System Administrator when the
network is being attacked by hackers or when emergency conditions occur. (It can
be set from Settings-Hacker Alert in System to detect Hacker Attacks)
Web Management (WAN Interface):
The System Manager can change the port number used by HTTP port anytime.
(Remote Web UI management)
After HTTP port has changed, if the administrator want to enter Web UI from WAN, will
have to change the port number of browser. (For example: http://61.62.108.172:8080)
MTU Setting:
It provides the Administrator to modify the networking package length anytime. Its
default value is 1500 Bytes.
Link Speed / Duplex Mode:
By this function can set the transmission speed and mode of WAN Port when
connecting other device.
１９