Ronde & Schwarz GP-T User manual

R&S®GP-U/GP-E/GP-S/GP-T
gateprotect Firewall
User Manual
User Manual
3646.3836.02 ─ 01
(T^VT2)
Cybersecurity

This document applies to the gateprotect software version 10.0. It describes the following R&S®gatepro-
tect Firewall models:
●R&S®gateprotect Firewall GP-U
●R&S®gateprotect Firewall GP-E
●R&S®gateprotect Firewall GP-S
●R&S®gateprotect Firewall GP-T
© 2017 Rohde & Schwarz Cybersecurity GmbH
Mühldorfstr. 15, 81671 Munich, Germany
Phone: [phone] - 223
Email: [email protected]
Internet: cybersecurity.rohde-schwarz.com
Printed in Germany – Subject to change – Data without tolerance limits is not binding.
R&S® is a registered trademark of Rohde & Schwarz GmbH & Co. KG.
Trade names are trademarks of the owners.
The following abbreviations are used throughout this manual: R&S®gateprotect Firewall is indicated as gateprotect Firewall.

Contents
R&S®GP-U/GP-E/GP-S/GP-T
3User Manual 3646.3836.02 ─ 01
Contents
1 About This Manual.................................................................................7
1.1 Audience........................................................................................................................ 7
1.2 What’s in This Manual.................................................................................................. 8
1.3 Conventions.................................................................................................................. 8
1.4 Related Resources........................................................................................................9
1.5 About Rohde & Schwarz Cybersecurity..................................................................... 9
2 Getting Started..................................................................................... 11
3 User Interface....................................................................................... 13
3.1 Web Client Components.............................................................................................13
3.1.1 Header Area..................................................................................................................14
3.1.2 Navigation Pane............................................................................................................15
3.1.3 Desktop......................................................................................................................... 15
3.2 Icons and Buttons.......................................................................................................17
3.3 Firewall Rule Settings.................................................................................................19
3.4 Menu Reference.......................................................................................................... 22
3.4.1 Firewall..........................................................................................................................22
3.4.1.1 License Settings............................................................................................................22
3.4.1.2 Updates Settings...........................................................................................................23
3.4.1.3 Administrators............................................................................................................... 26
3.4.1.4 User Authentication.......................................................................................................28
3.4.1.5 Server Access Settings................................................................................................. 41
3.4.1.6 Command Center Settings............................................................................................43
3.4.1.7 Time Settings................................................................................................................ 43
3.4.1.8 High Availability Settings...............................................................................................45
3.4.1.9 Backup.......................................................................................................................... 49
3.4.2 Network......................................................................................................................... 53
3.4.2.1 Interfaces...................................................................................................................... 53
3.4.2.2 Connections.................................................................................................................. 60
3.4.2.3 WLAN Settings..............................................................................................................67
3.4.2.4 Routing..........................................................................................................................69
3.4.2.5 DHCP Settings.............................................................................................................. 72

Contents
R&S®GP-U/GP-E/GP-S/GP-T
4User Manual 3646.3836.02 ─ 01
3.4.3 WAN..............................................................................................................................74
3.4.3.1 DNS Settings.................................................................................................................74
3.4.3.2 DynDNS Accounts........................................................................................................ 75
3.4.3.3 QoS Settings................................................................................................................. 76
3.4.3.4 QoS Connection Settings..............................................................................................77
3.4.4 Network Objects............................................................................................................78
3.4.4.1 Internet Objects.............................................................................................................78
3.4.4.2 Hosts............................................................................................................................. 79
3.4.4.3 Users.............................................................................................................................80
3.4.4.4 User Groups..................................................................................................................81
3.4.4.5 VPN Users.................................................................................................................... 82
3.4.4.6 VPN User Groups......................................................................................................... 83
3.4.4.7 Networks....................................................................................................................... 84
3.4.4.8 Host Groups.................................................................................................................. 84
3.4.4.9 IP Ranges..................................................................................................................... 85
3.4.4.10 VPN Hosts.....................................................................................................................86
3.4.4.11 VPN Groups.................................................................................................................. 87
3.4.4.12 VPN Networks...............................................................................................................88
3.4.4.13 Connections.................................................................................................................. 89
3.4.5 Desktop......................................................................................................................... 90
3.4.5.1 Services........................................................................................................................ 90
3.4.5.2 Desktop Rules...............................................................................................................90
3.4.6 UTM.............................................................................................................................. 91
3.4.6.1 Application Filter............................................................................................................91
3.4.6.2 URL/Content Filter........................................................................................................ 93
3.4.6.3 Antivirus Settings.......................................................................................................... 95
3.4.6.4 Email Security............................................................................................................... 98
3.4.6.5 Proxy........................................................................................................................... 101
3.4.7 VPN.............................................................................................................................103
3.4.7.1 IPsec Settings............................................................................................................. 104
3.4.7.2 VPN SSL Settings....................................................................................................... 105
3.4.7.3 VPN Connections........................................................................................................107
3.4.8 Certificate Management.............................................................................................. 114

Contents
R&S®GP-U/GP-E/GP-S/GP-T
5User Manual 3646.3836.02 ─ 01
3.4.8.1 Certificates.................................................................................................................. 114
3.4.8.2 Templates................................................................................................................... 117
3.4.8.3 OCSP/CRL Settings....................................................................................................118
3.4.8.4 Trusted Proxy CAs...................................................................................................... 119
3.4.9 Monitoring................................................................................................................... 119
3.4.9.1 SNMP Settings............................................................................................................119
3.4.9.2 Syslog Servers............................................................................................................ 121
3.4.9.3 Logs............................................................................................................................ 122
3.4.10 Network Tools............................................................................................................. 123
3.4.10.1 Ping Settings............................................................................................................... 124
3.4.10.2 Traceroute Settings.....................................................................................................124
Index....................................................................................................127

Contents
R&S®GP-U/GP-E/GP-S/GP-T
6User Manual 3646.3836.02 ─ 01

About This Manual
R&S®GP-U/GP-E/GP-S/GP-T
7User Manual 3646.3836.02 ─ 01
1 About This Manual
The gateprotect Firewall User Manual describes the innovative firewall solution from
Rohde & Schwarz Cybersecurity. gateprotect Firewall integrates firewall, application
control, web filtering, malware protection and many more functions in a single system.
Figure 1-1: Sample gateprotect Firewall GP-S 1900.
This document applies to four gateprotect Firewall product lines:
●Unified Line - Easy to use - the firewall solution for small companies which need an
easy-to-use solution to protect their office IT against cyberthreats from the Internet
●Extended Line - Easy to configure - the firewall solution for complex office networks
in medium-sized companies
●Specialized Line - Easy to customize - the perfectly tailored solution that meets the
high demands of complex network structures in industry and enterprise environ-
ments
●GP Tough - the firewall solution specifically designed for challenging environments
There are license-based features that distinguish individual product models within the
product lines from one another. For more information about your specific gateprotect
Firewall, see the information on the relevant data sheet.
See the topics below for more information about this document.
1.1 Audience
This manual is for the networking or computer technician responsible for installing and
configuring the gateprotect Firewall system and employees that use the web client to
define traffic filtering rules.
To use this document effectively, you have to have the following skills depending on
your responsibilities:
●To install and configure the hardware, you have to be familiar with telecommunica-
tions equipment and installation procedures. You also have to have good experi-
ence as a network or system administrator.
Audience

About This Manual
R&S®GP-U/GP-E/GP-S/GP-T
8User Manual 3646.3836.02 ─ 01
●To define filtering rules, you need to understand basic TCP/IP networking con-
cepts.
1.2 What’s in This Manual
The contents of this manual are designed to assist you in configuring your gateprotect
Firewall.
This document includes the following chapters:
1. Chapter 2, "Getting Started", on page 11
Log on to your gateprotect Firewall to set up the system for your network.
2. Chapter 3, "User Interface", on page 13
The sections in this chapter describe the components of the gateprotect Firewall
user interface.
1.3 Conventions
This topic explains the typographic conventions and other notations used to represent
information in this manual.
Elements of the web-based graphical user interface (GUI, or »web client«) are indica-
ted as follows:
Convention Description
"Graphical user interface ele-
ments"
All names of graphical user interface elements on the screen, such as
menu items, buttons, checkboxes, dialog boxes, list names are enclosed
by quotation marks.
"Top-level menu item > sub-
menu element"
A sequence of menu commands is indicated by greater than symbols
between menu items and the whole sequence being enclosed by quota-
tion marks. Select the submenu element from the top-level menu item.
KEYS Key names are written in capital letters.
List options, literal
text, filenames,
commands, program code
List options, literal text, filenames, commands, coding samples and
screen output are distinguished by their fixed-width font.
Links Links that you can click (e.g. references to other parts within this manual)
are displayed in blue font.
References References to parts of the product documentation are displayed in italics.
Notes
The following types of notes are used in this manual to indicate information which
expands on or calls attention to a particular point:
Conventions

About This Manual
R&S®GP-U/GP-E/GP-S/GP-T
9User Manual 3646.3836.02 ─ 01
This note is a little hint that can help make your work easier.
This note contains important additional information.
This note contains information that is important to consider. Non-observance can dam-
age your gateprotect Firewall or put your network security at risk.
1.4 Related Resources
This section describes additional documentation and other resources for information on
your gateprotect Firewall.
Refer to the following related documents and resources:
●Data Sheets summarize the technical characteristics of the different gateprotect
Firewall hardware models.
●Release Notes provide the latest information on each release.
●Our website at cybersecurity.rohde-schwarz.com provides a wealth of information
about our products and solutions as well as the latest company news and events.
For additional documents such as technical specifications, please visit the my gatepro-
tect portal at www.mygateprotect.com.
1.5 About Rohde & Schwarz Cybersecurity
Rohde & Schwarz Cybersecurity is an IT security company that protects companies
and public institutions around the world against cyberattacks.
The company develops and produces technologically leading solutions for information
and network security, including highly secure encryption solutions, next-generation fire-
walls and software for network analysis and endpoint security. As a result of the
DenyAll acquisition, the portfolio now includes vulnerability scanners and firewalls for
business-critical web applications.
The award-winning and certified IT security solutions range from compact, all-in-one
products to customized solutions for critical infrastructures. To prevent cyberattacks
proactively, rather than reactively, our trusted IT solutions are developed following the
security-by-design approach. Around 450 people are employed at the current locations
in Germany, France and Denmark.
About Rohde & Schwarz Cybersecurity

About This Manual
R&S®GP-U/GP-E/GP-S/GP-T
10User Manual 3646.3836.02 ─ 01
For more information, visit our website at cybersecurity.rohde-schwarz.com.
About Rohde & Schwarz Cybersecurity

Getting Started
R&S®GP-U/GP-E/GP-S/GP-T
11User Manual 3646.3836.02 ─ 01
2 Getting Started
Log on to your gateprotect Firewall to set up the system for your network.
When first started after delivery or a new installation, the gateprotect Firewall runs as a
test version for 30 days. For further information, see Chapter 3.4.1.1, "License Set-
tings", on page 22.
To begin working with your gateprotect Firewall, perform the following steps:
1. On the gateprotect Firewall logon page, enter admin as the "User Name" and the
factory default "Password" admin.
Figure 2-1: Logging on to the gateprotect Firewall.
2. Click "Login".
3. After your first logon using the standard credentials, the system prompts you to
change your password. The new password has to be at least six characters long.
You cannot skip this step.
The web client appears.
If you forget the new password entered, contact the Rohde & Schwarz Cybersecurity
support team to reset the password.
The admin password is included in a system backup.
Set your browser configuration to clear all session data and cookies when the browser
is closed. Otherwise, your admin session will be restored after the computer is reboo-
ted and unauthorized persons can access the firewall.

Getting Started
R&S®GP-U/GP-E/GP-S/GP-T
12User Manual 3646.3836.02 ─ 01

User Interface
R&S®GP-U/GP-E/GP-S/GP-T
13User Manual 3646.3836.02 ─ 01
3 User Interface
The sections in this chapter describe the components of the gateprotect Firewall user
interface.
The gateprotect Firewall web client requires a minimum display resolution of
1024 × 786 pixels (XGA).
The following browser versions (or newer) are supported, with JavaScript enabled:
●Google Chrome 10
●Chromium 10
●Firefox 12
Chapter 3.1, "Web Client Components", on page 13 provides an overview of the
main components of the web client.
Chapter 3.2, "Icons and Buttons", on page 17 explains the meaning of the icons and
buttons commonly used on the user interface and throughout this manual.
Chapter 3.3, "Firewall Rule Settings", on page 19 describes how a firewall rule for a
connection between two desktop nodes is set up.
Chapter 3.4, "Menu Reference", on page 22 reflects the arrangement of the menu
items in the navigation bar on the left side of the user interface. For information on the
available options, see the corresponding section.
3.1 Web Client Components
The gateprotect Firewall web client uses a standard tri-pane page layout with a com-
mon header area, a left navigation pane and a main content pane on the right.
Web Client Components

User Interface
R&S®GP-U/GP-E/GP-S/GP-T
14User Manual 3646.3836.02 ─ 01
Figure 3-1: gateprotect Firewall web client.
The information displayed in each area is described in the following sections.
3.1.1 Header Area
The header area (1) contains the following elements (from left to right):
Figure 3-2: gateprotect Firewall web client header area.
●the button to hide or show the navigation bar (the navigation bar is displayed by
default, see Chapter 3.1.2, "Navigation Pane", on page 15),
●the Rohde & Schwarz Cybersecurity logo,
●a language menu that allows you to select the language to be used in the web cli-
ent,
●a user menu to end the current user session and return to the logon dialog,
●a system menu to reboot or shut down / power off your gateprotect Firewall, and
●a help menu with links which provide access to a PDF version of the gateprotect
Firewall User Manual and to the Rohde & Schwarz Cybersecurity support website.
Depending on your browser settings, the PDF file is either displayed in a new tab
or window, or downloaded.
Web Client Components

User Interface
R&S®GP-U/GP-E/GP-S/GP-T
15User Manual 3646.3836.02 ─ 01
In addition, the header area displays unsaved configuration changes if you close an
editor panel by pressing the ESC key on your computer keyboard. Unsaved changes
are not displayed if you close an editor panel by clicking the button in the upper right
corner of the panel, however.
The PDF version of the gateprotect Firewall User Manual is also available from the
logon page. Click the "User Manual" link to access the file.
3.1.2 Navigation Pane
The navigation pane (2) is on the left side of the web client and consists of two parts.
The links in the left navigation bar provide access to the gateprotect Firewall settings.
The item list bar on the right is used to display information on the current desktop con-
figuration.
Both bars contain a "Filter" input field at the top which helps you quickly find a particu-
lar menu item or item list entry. Each input field works for the bar it is part of only. As
you type in one of the input fields, the gateprotect Firewall reduces the corresponding
list to show only those menu items or entries that contain the characters you are typ-
ing. Click in the input field to delete the search string and display an unfiltered view
of the list.
You can expand all menus in the navigation bar at once by clicking or collapse them
by clicking in the upper right corner of the navigation bar. Furthermore, you can hide
the navigation bar to maximize the desktop area by clicking in the header area. For
further information, see Chapter 3.1.1, "Header Area", on page 14.
The information displayed in the item list bar depends on, firstly, the menu item
selected in the navigation bar and, secondly, how much information you desire to be
displayed. You can unfold more detailed information by clicking or reduce the
amount of information presented by clicking in the upper right corner of the item list
bar.
See Chapter 3.4, "Menu Reference", on page 22 for details on the options available
in each view.
3.1.3 Desktop
The desktop (3) fills the main portion of the screen below the header area and to the
right of the navigation pane. The nodes and connections highlighted here depend on
the item selected in the navigation pane or on the desktop.
Web Client Components

User Interface
R&S®GP-U/GP-E/GP-S/GP-T
16User Manual 3646.3836.02 ─ 01
Figure 3-3: gateprotect Firewall web client desktop.
On the desktop, you always have a complete overview of your entire configured net-
work. You can edit various settings in this pane or view the details of a configuration.
A toolbar at the top of the desktop provides quick access to frequently used functions:
●If the system configuration changes, the " Activate" button is highlighted, prompt-
ing you to update your configuration. Click this button to save your current desktop
configuration changes and to activate them on the firewall.
●The buttons in the second section of the toolbar allow you to switch back and forth
between the selection and the connection tool. Use the selection tool for all actions
on the desktop, such as moving objects or selecting certain functions. With the
connection tool, you can create or edit a connection between two desktop objects.
For further information, see Chapter 3.3, "Firewall Rule Settings", on page 19.
●You can create an object on the desktop by clicking the respective desktop object
button in the next four sections of the toolbar. An editor panel automatically opens
where you can enter the data which is required for the object.
●It is possible to customize the desktop layout by dragging the objects to the desired
positions where they are automatically pinned. Use the buttons in the last section
of the toolbar to save and restore your customized layout or to arrange the objects
automatically.
All toolbar buttons use mouse-over pop-up labels for easy identification.
Web Client Components

User Interface
R&S®GP-U/GP-E/GP-S/GP-T
17User Manual 3646.3836.02 ─ 01
When you click a desktop object with the left mouse button, several buttons appear in
the circular menu, depending on the kind of desktop object. These buttons allow you to
adjust the settings for an existing object and to create or edit a connection between two
existing objects. Furthermore, you can hide or display objects attached to an object,
unpin an object from a specific location on the desktop or remove an object from the
desktop.
For further information, see Chapter 3.2, "Icons and Buttons", on page 17.
3.2 Icons and Buttons
This topic explains the icons and buttons commonly used on the user interface and
throughout this manual.
Icon/Button Description
Hide and show the navigation bar.
Move objects or select objects and functions on the desktop.
Create or edit a connection between two desktop objects.
Create an Internet object.
Create a host.
Create a host group.
Create a network.
Create an IP range.
Create a VPN host.
Create a VPN group.
Create a VPN network.
Create a VPN user.
Create a VPN user group.
Create a user.
Create a user group.
Discard all manual desktop layout changes and apply an automatic layout.
Save the current desktop layout.
Restore the last saved desktop layout.
Restore a backup.
Replace a certificate by importing a new certificate.
Fit the entire network to the desktop.
Icons and Buttons

User Interface
R&S®GP-U/GP-E/GP-S/GP-T
18User Manual 3646.3836.02 ─ 01
Icon/Button Description
Marks a menu item with settings to configure in the navigation bar.
Marks a table column with actions available for a table entry.
Unpin the desktop object to be able to move it along with the desktop node that
it is associated with via drag & drop on the desktop.
View and adjust the settings for a desktop object, a list item or a table entry.
Create a list item or a table entry based on a copy of an existing entry.
Delete a desktop object or an item list entry from the system after a positive
response to the confirmation request popping up.
Permanently revoke a certificate.
Delete a custom firewall rule from the system.
Remove a firewall rule with a predefined service from the firewall rules table.
Import a certificate or a blacklist/whitelist from a file.
Export a certificate or a blacklist/whitelist to a file.
Import a backup from a file.
Export a backup to a file.
Create a list item in the item list bar.
Unfold a menu item to view subordinate items in the navigation bar.
Unfold a web filter category to view its subcategories.
Unfold a service category for firewall rules to view its subservices.
Hide subordinate menu items in the navigation bar.
Hide subcategories of a web filter category.
Hide subservices of a service category for firewall rules.
Unfold more detailed information in the item list bar.
Reduce the amount of information given in the item list bar.
Collapse all menus in the navigation bar.
Expand a desktop node to view the desktop objects associated with it.
Expand all menus in the navigation bar.
Collapse a desktop node to hide the desktop objects associated with it.
Indicates that a certificate is still valid.
Indicates that a certificate has expired.
Verify a certificate.
Suspend a certificate or CA temporarily.
Resume a certificate that was previously suspended.
Recreate (renew) a certificate with an updated validity range.
Icons and Buttons

User Interface
R&S®GP-U/GP-E/GP-S/GP-T
19User Manual 3646.3836.02 ─ 01
Icon/Button Description
Close a pop-up window.
Clear all search criteria of a filter to show all results.
3.3 Firewall Rule Settings
This topic describes how to create a firewall rule for a connection between two desktop
objects.
Setting Up a Connection
To set up a connection between two desktop objects, perform the following steps:
1. Click the connection tool button in the toolbar at the top of the desktop.
2. Select the source object of the connection by clicking the appropriate desktop
object.
3. Select the target object of the connection by clicking the appropriate desktop
object.
The "Connection" panel opens, displaying, if applicable, already existing firewall
rules for this connection.
Alternatively, you can click the connection tool button in the circular menu of the
source object on the desktop and then select the target object.
Setting Up a Firewall Rule with a Predefined Service
Along with the "Connection" panel, a list of predefined services available for the con-
nection opens on the right side of the browser window. The list of services can be col-
lapsed and expanded by clicking the appropriate icon.
For further information, see Chapter 3.2, "Icons and Buttons", on page 17.
The "Filter" input field at the top of the list helps you quickly find a particular service. As
you type in the input field, the gateprotect Firewall reduces the list to show only those
services that contain the characters you are typing. Click in the input field to delete
the search string and display an unfiltered view of the list.
You can create a firewall rule using one of the predefined services by clicking the plus
button in front of the service. Afterwards, you can adjust the settings on the "Sched-
ule" and "Advanced" tabs (e.g. proxy and NAT settings) by editing the rule. The ports
and protocols are predefined and cannot be adjusted.
Setting Up a Custom Firewall Rule
If you require a port or protocol that is not covered by any of the predefined services,
you can add a custom rule to be applied to the connection.
Firewall Rule Settings

User Interface
R&S®GP-U/GP-E/GP-S/GP-T
20User Manual 3646.3836.02 ─ 01
To set up a custom firewall rule, perform the following steps:
1. In the "Rules" tab, click "Add Custom Rule " to set up a new firewall rule.
An editor panel opens.
2. On the editor panel, you can configure the following elements for the rule:
a) In the "Ports/Protocols" tab:
Field Description
"Name" Enter a unique name for the firewall rule.
"Ports and Protocols" To limit the rule to apply only to traffic from/to certain ports/port ranges
and/or protocols, click "Add" to open another editor panel.
On this panel, you can define the ports and protocols to be used:
●For TCP and UDP, you can specify individual ports or ranges to
limit the rule to apply only to traffic originating from a certain source
port and/or being transmitted to a certain destination port. Use the
input fields "Port From" and "To" to enter a value. The value can be
any integer from 1 to 65535. Enter a unique single port (for exam-
ple 800) or a port range using a hyphen '-' character (for example
800-810).
●You can specify protocols to which the rule should be applied by
selecting the appropriate checkboxes.
The buttons at the bottom right of the editor panel allow you to confirm
your changes ("OK") and to reject your changes ("Cancel"). The editor
panel closes and the secified ports/port ranges and/or protocols appear
as an entry in the list.
You can edit or delete each single entry in the list by clicking the appro-
priate button next to an entry. For further information, see Chapter 3.2,
"Icons and Buttons", on page 17.
b) In the "Schedule" tab, you can specify the time when the firewall rule is active.
The tab provides the following options:
● Set specific times and weekdays using the sliders.
● Click "Always On" - the rule is always active.
● Click "Always Off" - the rule is always inactive.
c) The "Advanced" settings tab provides the following options:
Field Description
"Proxy" For firewall rules with predefined services only if the predefined services
allow a proxy (HTTP, HTTPS, FTP, SMTP, SMTPS, POP3 or POP3S):
Select this checkbox to activate the proxy for this rule.
For a custom firewall rules only: From the drop-down list, select a proxy
for this rule. To remove the proxy, click to the right of the selected
proxy.
"NAT / Masquerad-
ing"
Specify the desired direction (bidirectional, left-to-right or
right-to-left) for NAT/masquerading or disable (Off) the feature
for this rule by selecting the respective radio button. The default setting
depends on the source and target objects selected for the connection.
"New source IP" Optional: If you have multiple outgoing IP addresses, specify the IP
address to be used for Source NAT. If you do not specify the IP
address, the system automatically chooses the main IP address of the
interface to which the packet has been routed.
Firewall Rule Settings