D-Link DFL-1600 - Security Appliance Manuel utilisateur

CONTENTS

I Preface xvi

Document Version .............................. xvii

Disclaimer ................................... xvii

About this Document ............................ xvii

Typographical Conventions ........................ xviii

II Product Overview 2

1 Capabilities 3

1.1 Product Highlights .......................... 3

III Introduction to Networking 6

2 The OSI Model 7

3 Firewall Principles 9

3.1 The Role of the Firewall ...................... 9

3.1.1 What is a Firewall? ..................... 9

3.1.2 How does a Firewall work? ................. 9

3.2 What does a Firewall NOT protect against? ........... 10

3.2.1 Attacks on Insecure pre-installed Components . . . . . 11

3.2.2 Inexperienced Users on protected Networks . . . . . . . 11

3.2.3 Data-Driven Network Attacks ............... 11

3.2.4 Internal Attacks ....................... 13

3.2.5 Modems and VPN Connection .............. 13

3.2.6 Holes between DMZs and Internal Networks . . . . . . 14

IV Administration 18

4 Conﬁguration Platform 19

4.1 Conﬁguring Via WebUI ....................... 19

4.1.1 Overview ............................ 19

4.1.2 Interface Layout ....................... 19

4.1.3 Conﬁguration Operations .................. 22

4.2 Monitoring Via CLI .......................... 23

5 Logging 25

5.1 Overview ................................ 25

5.1.1 Importance & Capability .................. 25

5.1.2 Events ............................. 26

5.2 Log Receivers .............................. 28

5.2.1 Syslog Receiver ........................ 28

5.2.2 Memory Log Receiver .................... 29

5.2.3 SMTP Event Receiver .................... 29

6 Maintenance 31

6.1 Firmware Upgrades .......................... 31

6.2 Reset To Factory Defaults ...................... 32

6.3 Backup Conﬁguration ........................ 34

7 Advanced Settings 35

7.1 Overview ................................ 35

V Fundamentals 38

8 Logical Objects 39

8.1 Address Book ............................. 39

8.1.1 IP address ........................... 39

8.1.2 Ethernet address ....................... 41

8.2 Services ................................. 41

8.2.1 Service Types ......................... 42

8.2.2 Error Report & Connection Protection . . . . . . . . . 46

8.3 Schedules ................................ 48

8.4 X.509 Certiﬁcates ........................... 49

8.4.1 Introduction to Certiﬁcates ................. 49

8.4.2 X.509 Certiﬁcates in D-Link Firewall . . . . . . . . . . 51

D-Link Firewalls User’s Guide

iii

9 Interfaces 53

9.1 Ethernet ................................. 53

9.1.1 Ethernet Interfaces ...................... 53

9.1.2 Ethernet Interfaces in D-Link Firewalls . . . . . . . . . 54

9.2 Virtual LAN (VLAN) ........................ 56

9.2.1 VLAN Infrastructure .................... 56

9.2.2 802.1Q VLAN Standard .................. 57

9.2.3 VLAN Implementation ................... 58

9.2.4 Using Virtual LANs to Expand Firewall Interfaces . . 59

9.3 DHCP .................................. 60

9.3.1 DHCP Client ......................... 60

9.4 PPPoE .................................. 61

9.4.1 PPP ............................... 62

9.4.2 PPPoE Client Conﬁguration ................ 62

9.5 Interface Groups ............................ 65

9.6 ARP ................................... 66

9.6.1 ARP Table ........................... 66

10 Routing 69

10.1 Overview ................................ 69

10.2 Routing Hierarchy ........................... 70

10.3 Routing Algorithms .......................... 71

10.3.1 Static Routing ........................ 71

10.3.2 Dynamic Routing ....................... 72

10.3.3 OSPF .............................. 74

10.4 Route Failover ............................. 77

10.4.1 Scenario: Route Failover Conﬁguration . . . . . . . . . 78

10.5 Dynamic Routing Implementation ................. 81

10.5.1 OSPF Process ......................... 81

10.5.2 Dynamic Routing Policy .................. 81

10.5.3 Scenarios: Dynamic Routing Conﬁguration . . . . . . 82

10.6 Scenario: Static Routing Conﬁguration .............. 87

10.7 Policy Based Routing(PBR) ..................... 88

10.7.1 Overview ............................ 88

10.7.2 Policy-based Routing Tables ................ 89

10.7.3 Policy-based Routing Policy ................ 89

10.7.4 PBR Execution ........................ 89

10.7.5 Scenario: PBR Conﬁguration ............... 91

10.8 Proxy ARP ............................... 94

D-Link Firewalls User’s Guide

11 Date & Time 95

11.1 Setting the Date and Time ..................... 96

11.1.1 Current Date and Time ................... 96

11.1.2 Time Zone ........................... 96

11.1.3 Daylight Saving Time(DST) ................ 97

11.2 Time Synchronization ........................ 98

11.2.1 Time Synchronization Protocols .............. 98

11.2.2 Timeservers .......................... 98

11.2.3 Maximum Adjustment ................... 99

11.2.4 Synchronization Interval .................. 99

12 DNS 101

13 Log Settings 103

13.1 Implementation ............................ 103

13.1.1 Deﬁning Syslog Receiver .................. 103

13.1.2 Enabling Logging ....................... 104

VI Security Polices 108

14 IP Rules 109

14.1 Overview ................................ 109

14.1.1 Fields .............................. 110

14.1.2 Action types .......................... 111

14.2 Address Translation .......................... 112

14.2.1 Overview ............................ 112

14.2.2 NAT ............................... 112

14.2.3 Address translation in D-Link Firewall . . . . . . . . . 114

14.3 Scenarios: IP Rules Conﬁguration . . . . . . . . . . . . . . . . . 116

15 Access (Anti-spooﬁng) 123

15.1 Overview ................................ 123

15.1.1 IP Spooﬁng .......................... 123

15.1.2 Anti-spooﬁng ......................... 124

15.2 Access Rule ............................... 124

15.2.1 Function ............................ 124

15.2.2 Settings ............................. 124

15.3 Scenario: Setting up Access Rule . . . . . . . . . . . . . . . . . 126

D-Link Firewalls User’s Guide

16 DMZ & Port Forwarding 127

16.1 General ................................. 127

16.1.1 Concepts ............................ 127

16.1.2 DMZ Planning ........................ 129

16.1.3 Beneﬁts ............................. 130

17 User Authentication 131

17.1 Authentication Overview ...................... 131

17.1.1 Authentication Methods .................. 131

17.1.2 Password Criterion ...................... 132

17.1.3 User Types ........................... 133

17.2 Authentication Components ..................... 134

17.2.1 Local User Database(UserDB) . . . . . . . . . . . . . . . 134

17.2.2 External Authentication Server .............. 134

17.2.3 Authentication Agents ................... 135

17.2.4 Authentication Rules .................... 136

17.3 Authentication Process ........................ 137

17.4 Scenarios: User Authentication Conﬁguration . . . . . . . . . 137

VII Content Inspection 146

18 Application Layer Gateway (ALG) 147

18.1 Overview ................................ 147

18.2 FTP ................................... 148

18.2.1 FTP Connections ....................... 148

18.2.2 Scenarios: FTP ALG Conﬁguration . . . . . . . . . . . 150

18.3 HTTP .................................. 155

18.3.1 Components & Security Issues . . . . . . . . . . . . . . . 155

18.3.2 Solution ............................ 156

18.4 H.323 ................................... 158

18.4.1 H.323 Standard Overview .................. 158

18.4.2 H.323 Components ...................... 158

18.4.3 H.323 Protocols ........................ 159

18.4.4 H.323 ALG Overview .................... 160

18.4.5 Scenarios: H.323 ALG Conﬁguration . . . . . . . . . . 161

19 Intrusion Detection System (IDS) 181

19.1 Overview ................................ 181

19.1.1 Intrusion Detection Rules .................. 182

19.1.2 Pattern Matching ....................... 182

D-Link Firewalls User’s Guide

19.1.3 Action ............................. 182

19.2 Chain of Events ............................ 183

19.2.1 Scenario 1 ........................... 183

19.2.2 Scenario 2 ........................... 184

19.3 Signature Groups ........................... 186

19.4 Automatic Update of Signature Database . . . . . . . . . . . . 186

19.5 SMTP Log Receiver for IDS Events ................ 187

19.6 Scenario: Setting up IDS ...................... 189

VIII Virtual Private Network (VPN)192

20 VPN Basics 193

20.1 Introduction to VPN ......................... 193

20.1.1 VPNs vs Fixed Connections ................ 193

20.2 Introduction to Cryptography ................... 195

20.2.1 Encryption ........................... 195

20.2.2 Authentication & Integrity . . . . . . . . . . . . . . . . . 198

20.3 Why VPN in Firewalls ........................ 200

20.3.1 VPN Deployment ....................... 201

21 VPN Planning 207

21.1 VPN Design Considerations ..................... 207

21.1.1 End Point Security ...................... 208

21.1.2 Key Distribution ....................... 210

22 VPN Protocols & Tunnels 213

22.1 IPsec ................................... 213

22.1.1 IPsec protocols ........................ 214

22.1.2 IPsec Encapsulation Modes ................ 214

22.1.3 IKE ............................... 215

22.1.4 IKE Integrity & Authentication .............. 219

22.1.5 Scenarios: IPsec Conﬁguration .............. 223

22.2 PPTP/ L2TP ............................. 228

22.2.1 PPTP .............................. 228

22.2.2 L2TP .............................. 234

22.3 SSL/TLS (HTTPS) .......................... 243

D-Link Firewalls User’s Guide

vii

IX Traﬃc Management 246

23 Traﬃc Shaping 247

23.1 Overview ................................ 247

23.1.1 Functions ............................ 248

23.1.2 Features ............................ 249

23.2 Pipes ................................... 249

23.2.1 Precedences and Guarantees ................ 250

23.2.2 Grouping Users of a Pipe .................. 252

23.2.3 Dynamic Bandwidth Balancing .............. 253

23.3 Pipe Rules ............................... 253

23.4 Scenarios: Setting up Traﬃc Shaping . . . . . . . . . . . . . . . 253

24 Server Load Balancing (SLB) 261

24.1 Overview ................................ 261

24.1.1 The SLB Module ....................... 261

24.1.2 SLB Features ......................... 262

24.1.3 Beneﬁts ............................. 263

24.2 SLB Implementation ......................... 264

24.2.1 Distribution Modes ..................... 264

24.2.2 Distribution Algorithms ................... 264

24.2.3 Server Health Checks .................... 266

24.2.4 Packets Flow by SAT .................... 268

24.3 Scenario: Enabling SLB ....................... 268

X Misc.Features 272

25 Miscellaneous Clients 273

25.1 Overview ................................ 273

25.2 Dynamic DNS ............................. 273

25.3 Automatic Client Login ....................... 274

25.4 HTTP Poster .............................. 275

25.4.1 URL Format .......................... 275

26 DHCP Server & Relayer 277

26.1 DHCP Server .............................. 277

26.2 DHCP Relayer ............................. 279

D-Link Firewalls User’s Guide

viii

XI Transparent Mode 282

27 Transparent Mode 283

27.1 Overview ................................ 283

27.2 Transparent Mode Implementation in D-Link Firewalls . . . . 284

27.3 Scenarios: Enabling Transparent Mode .............. 286

XII ZoneDefense 292

28 ZoneDefense 293

28.1 Overview ................................ 293

28.2 ZoneDefense Switches ......................... 293

28.2.1 SNMP ............................. 294

28.3 Threshold Rules ............................ 295

28.4 Manual Blocking & Exclude Lists . . . . . . . . . . . . . . . . . 295

28.5 Limitations ............................... 296

28.6 Scenario: Setting Up ZoneDefense . . . . . . . . . . . . . . . . . 296

XIII High Availability 300

29 High Availability 301

29.1 High Availability Basics ....................... 301

29.1.1 What High Availability will do for you . . . . . . . . . 301

29.1.2 What High Availability will NOT do for you . . . . . . 302

29.1.3 Example High Availability setup . . . . . . . . . . . . . 303

29.2 How Rapid Failover is Accomplished . . . . . . . . . . . . . . . 303

29.2.1 The shared IP address and the failover mechanism . . 304

29.2.2 Cluster heartbeats ...................... 305

29.2.3 The synchronization interface . . . . . . . . . . . . . . . 306

29.3 Setting up a High Availability Cluster .............. 306

29.3.1 Planning the High Availability cluster . . . . . . . . . . 307

29.3.2 Creating a High Availability cluster . . . . . . . . . . . 307

29.4 Things to Keep in Mind ....................... 309

29.4.1 Statistics and Logging Issues ................ 309

29.4.2 Conﬁguration Issues ..................... 310

XIV Appendix 312

A Console Commands Reference 315

D-Link Firewalls User’s Guide

Autres manuels pour DFL-1600 - Security Appliance

Ce manuel convient aux modèles suivants

Table des matières

Autres manuels D-Link Pare-feu

D-Link

D-Link DFL-210 - NetDefend - Security Appliance Manuel utilisateur

D-Link

D-Link DFL-200 - Security Appliance Manuel utilisateur

D-Link

D-Link DFL-210 - NetDefend - Security Appliance Manuel utilisateur

D-Link

D-Link DFL-300 - Security Appliance Manuel utilisateur

D-Link

D-Link NetDefend DFL-260E Manuel utilisateur

D-Link

D-Link DFL-500 Manuel utilisateur

D-Link

D-Link DFL-200 - Security Appliance Manuel utilisateur

D-Link

D-Link NetDefend DFL-260E Manuel utilisateur

D-Link

D-Link NetDefend DFL-800 Manuel utilisateur

D-Link

D-Link DFL-80 Manuel utilisateur

D-Link

D-Link NetDefend DFL-260E Manuel utilisateur

D-Link

D-Link DFL-1660-IPS-12 Manuel utilisateur

D-Link

D-Link DFL-1660-WCF-12 Manuel utilisateur

D-Link

D-Link DFL-1000 Manuel utilisateur

D-Link

D-Link DFL-600 Manuel utilisateur

D-Link

D-Link NetDefend DFL-800 Manuel utilisateur

D-Link

D-Link NetDefend SOHO DFL-160 Manuel utilisateur

D-Link

D-Link DFL-200 - Security Appliance Manuel utilisateur

D-Link

D-Link DFL-1100 - Security Appliance Manuel utilisateur

D-Link

D-Link DFL-1600 - Security Appliance Manuel utilisateur

D-Link

D-Link NetDefend DFL-CP310 Manuel utilisateur

D-Link

D-Link NetDefend DFL-1660 Manuel utilisateur

D-Link

D-Link DIR-330 - Wireless G VPN Router Manuel utilisateur

D-Link

D-Link DFL-1100 - Security Appliance Manuel utilisateur

Manuels Pare-feu populaires d'autres marques

Cisco

Cisco S190 Manuel utilisateur

Fortinet

Fortinet FortiGate Voice Series Manuel utilisateur

ADTRAN

ADTRAN NetVanta 2300 Manuel utilisateur

SecureLogix

SecureLogix ETM System Manuel utilisateur

NETGEAR

NETGEAR ProSafe FVX538 Manuel utilisateur

Lanner

Lanner FW-8877 Manuel utilisateur

Huawei

Huawei USG6000 Series Manuel d'installation et d'exploitation

H3C

H3C SecPath F5000-AI-15 Manuel utilisateur

Nexcom

Nexcom DNA 1150 Manuel utilisateur

Fortinet

Fortinet FortiGate-60 series Manuel utilisateur

Cisco

Cisco 3110 Manuel

Draytek

Draytek Vigor2860 Series Manuel utilisateur

Lanner electronics

Lanner electronics FW-7650 Series Manuel utilisateur

Swisscom

Swisscom Internet Backup Manuel utilisateur

SonicWALL

SonicWALL NSa 5700 Manuel utilisateur

DPtech

DPtech FW1000 SERIES Manuel utilisateur

FEITIAN

FEITIAN MultiPass FIDO Manuel utilisateur

EBLOCKER

EBLOCKER PRO Manuel utilisateur