Planet SG-1000 Manuel utilisateur

VPN Security Gateway

SG-1000

User’s Manual

The products and programs described in this User’s Manual are licensed products of PLANET

Technology, This User’s Manual contains proprietary information protected by copyright, and this User’s

Manual and all accompanying hardware, software, and documentation are copyrighted.

No part of this User’s Manual may be copied, photocopied, reproduced, translated, or reduced to any

electronic medium or machine-readable form by any means by electronic or mechanical. Including

photocopying, recording, or information storage and retrieval systems, for any purpose other than the

purchaser's personal use, and without the prior express written permission of PLANET Technology.

Disclaimer

PLANET Technology does not warrant that the hardware will work properly in all environments and

applications, and makes no warranty and representation, either implied or expressed, with respect to the

quality, performance, merchantability, or fitness for a particular purpose.

PLANET has made every effort to ensure that this User’s Manual is accurate; PLANET disclaims liability

for any inaccuracies or omissions that may have occurred.

Information in this User’s Manual is subject to change without notice and does not represent a

commitment on the part of PLANET. PLANET assumes no responsibility for any inaccuracies that may

be contained in this User’s Manual. PLANET makes no commitment to update or keep current the

information in this User’s Manual, and reserves the right to make improvements to this User’s Manual

and/or to the products described in this User’s Manual, at any time without notice.

If you find information in this manual that is incorrect, misleading, or incomplete, we would appreciate

your comments and suggestions.

CE mark Warning

This is a class A device, in a domestic environment, this product may cause radio interference, in which

case the user may be required to take adequate measures.

Trademarks

The PLANET logo is a trademark of PLANET Technology.

This documentation may refer to numerous hardware and software products by their trade names. In most,

if not all cases, these designations are claimed as trademarks or registered trademarks by their respective

companies.

To avoid the potential effects on the environment and human health as a result of the presence

of hazardous substances in electrical and electronic equipment, end users of electrical and

electronic equipment should understand the meaning of the crossed-out wheeled bin symbol.

Do not dispose of WEEE as unsorted municipal waste and have to collect such WEEE

separately.

１

２

Customer Service

For information on customer service and support for the VPN Security Gateway, please refer to the

following Website URL:

http://www.planet.com.tw

Before contacting customer service, please take a moment to gather the following information:

♦VPN Security Gateway serial number and MAC address

♦Any error messages that displayed when the problem occurred

♦Any software running when the problem occurred

♦Steps you took to resolve the problem on your own

Revision

User’s Manual for PLANET VPN Security Gateway

Model: SG-1000

Rev: 1.0 (October, 2006)

PartNo.EM-SG1000v1

３

Table of Contents

Chapter 1 Introduction .............................................................................. 6

1.1 Package Contents......................................................................... 7

1.2 Front View .................................................................................. 8

1.3 Rear View ................................................................................... 8

1.4 Specification ............................................................................... 8

System

Chapter 2 Administration ……………………………………………..... 10

2.1 Administrator ……………………………………………........ 12

2.2 Permitted IPs ……………………………………………......... 14

2.3 Logout ………………………………………………….…...... 15

2.4 Software Update …………………………………………....... 17

Chapter 3 Configure …………………………………………………..... 18

3.1 Setting ………………………………………………….…....... 23

3.2 Date/Time …………………………………………………...... 28

3.3 Multiple Subnet ………………………………...…………...... 29

3.4 Route Table ………………………………………………....... 33

3.5 DHCP ……………………………………………………….... 37

3.6 DDNS ……………………………………………...………..... 39

3.7 Host Table ……………………………………………….….... 41

3.8 Language ……………………………………………..……...... 42

Interface

Chapter 4 Interface …………………………………………………........ 43

4.1 LAN ………………………………….……………………..... 48

4.2 WAN ………………………………….……………………... 49

4.3 DMZ …………………………….………………………….... 57

Policy Object

Chapter 5 Address ……………………………………………………..... 59

5.1 Example ………………………………….…………………... 62

Chapter 6 Service ………………………………………………….…..... 69

6.1 Custom ………………………………….…………………..... 72

6.2 Group ………………………………….…………………....... 76

４

Chapter 7 Schedule …………………………………………………........ 79

Chapter 8 QoS ………………………………………………….……...... 82

8.1 Example ………………………………….………………....... 85

Chapter 9 Authentication ……………………………………………....... 87

9.1 Auth User and Group ……………………………………........ 93

9.2 RADIUS ………………………………….………………...... 97

9.3 POP3 Server ………………………………….…………........ 118

Chapter 10 Content Blocking …………………………………………...... 121

10.1 URL ………………………………….……………………..... 125

10.2 Script ……………………………….……………………....... 128

10.3 P2P ………………………….……………………………...... 130

10.4 IM …………………………….…………………………….... 132

10.5 Download …………………………….…………………........ 134

Chapter11 Virtual Server………………………………………………..... 136

11.1 Example ……………………………….…………………....... 140

Chapter12 VPN ………………………………………………………...... 155

12.1 Example……………………………………………………...... 163

Policy

Chapter13 Policy……………………………………………….………..... 187

13.1 Example ………………………………….………………....... 193

Web VPN / SSL VPN

Chapter14 Web VPN / SSL VPN ……………………………………....... 209

14.1 Example …………………………………………………........ 212

Anti-Attack

Chapter15 Alert Setting ………………………………………………...... 222

15.1 Internal Alert ………………………………………………..... 227

Chapter16 Atack Alarm ………………………………………………...... 231

16.1 Internal Alarm ……………………………………………....... 233

16.2 External Alarm ………………………………………………... 234

５

Monitor

Chapter17 LOG ……………………………………………….………...... 236

17.1 Traffic Log ……………………….…………………………... 238

17.2 Event Log ……………………….…………………………..... 242

17.3 Connection Log ……………………….…………………........ 245

17.4 Log Backup ……………………….………………………...... 248

Chapter18 Statistics …………………………………………….……....... 250

18.1 WAN ……………………….……………………………….... 252

18.2 Policy ……………………….………………………………... 254

Chapter19 Status …………………………………………….………….... 256

19.1 Interface ……………………….…………………………....... 257

19.2 Authentication ……………………….……………………..... 259

19.3 ARP Table ……………………….………………………........ 260

19.4 DHCP Clients ……………………….……………………....... 261

６

Chapter 1

Introduction

The innovation of the Internet has created a tremendous worldwide venue for E-

business and information sharing, but it also creates network security problems. The

security request will be the primary concerned for the enterprise. New model of Planet’s

VPN Security Gateway SG-1000, a special designed of VPN security gateway, provides

SSL, IPSec, and PPTP VPN. The SSL VPN function supports up to 50 SSL VPN

connection tunnels. The IPSec VPN feature provides IPSec VPN Trunk and IKE, SHA-

1, and MD5 Authentication. The PPTP VPN function supports PPTP server and client.

The SG-1000 provides Content Blocking feature to block specific URL, Script, IM, P2P,

and download file. Also, it is built-in Anomaly Flow IP function. This function supports

Hacker and Blaster Alert. An administrator could use this function to watch and track an

attacker.

This product is built-in two WAN ports. It supports WAN Load Balance and Fail-Over

Feature. Also, the QoS function provides Guaranteed Bandwidth and Priority

Bandwidth Utilization.

Product Features

♦VPN Connectivity: The VPN security gateway supports SSL VPN, IPSec VPN,

and PPTP server/client. The SSL VPN function supports up to 50 SSL VPN

connection tunnels. The IPSec VPN has DES, 3DES, and AES encryption and

SHA-1 / MD5 authentication. The network traffic over public Internet is secured.

♦VPN Trunk: VPN trunk function provides VPN load balance and VPN fail-over

feature to keep the VPN connection more reliable.

♦Content Filtering: The security gateway can block network connection based on

URLs, Scripts (The Pop-up, Java Applet, cookies and Active X), P2P (eDonkey,

Bit Torrent and WinMX), Instant Messaging (MSN, Yahoo Messenger, ICQ,

QQ and Skype) and Download. If there are new updated version of P2P or IM

７

software in client side, SG-1000 will detect the difference and update the

Content Filtering pattern to renew the filtering mechanism.

♦Policy-based Firewall: The built-in policy-based firewall prevent many known

hacker attack including SYN attack, ICMP flood, UDP flood, Ping of Death, etc.

The access control function allowed only specified WAN or LAN users to use

only allowed network services on specified time.

♦QoS: Network packets can be classified based on IP address, IP subnet and

TCP/UDP port number and give guarantee and maximum bandwidth with three

levels of priority.

♦Authentication: Web-based authentication allows users to be authenticated by

web browser. User database can be configured on the devices or through external

RADIUS server.

♦WAN Backup: The SG-1000 can monitor each WAN link status and

automatically activate backup links when a failure is detected. The detection is

based on the configurable target Internet addresses.

♦Outbound Load Balancing: The network sessions are assigned based on the

user configurable load balancing mode, including “Auto”, “Round-Robin”, “By

Traffic”, “By Session” and “By Packet”. User can also configure which IP or

TCP/UDP type of traffic use which WAN port to connect.

♦Multiple NAT: Multiple NAT allows local port to set multiple subnet works and

connect to the Internet through different WAN IP addresses.

1.1 Package Contents

SG-1000 x 1

Power Cord x 1

Quick Installation Guide x 1

User’s Manual CD x 1

Console cable x 1

RJ-45 cable

Rack-mount ear

1.2 Front View

- LED definition

LED Description

PWR Power is supplied to this device.

STATUS Blinks to indicate this devise is being turned

on and booting. After one minute, this LED

indicator will stop blinking, it means this

device is now ready to use.

Green Steady on indicates the port is

connected to other network device.

Blink to indicates there is traffic on

the port

WAN1,

WAN2,

LAN, DMZ

Orange Steady on indicates the port is

connected at 100Mbps speed

1.3 Rear View

1.4 Specification

Product VPN Security Gateway

Model SG-1000

Recommend concurrent

user 30 ~ 50

Hardware LAN 1 x 10/100 Based-TX RJ-45

WAN 2 x 10/100 Based-TX RJ-45

Ethernet

DMZ 1 x 10/100 Based-TX RJ-45

Software

８

９

Management Web

Network Connection Transparent mode, NAT, Multi-NAT

Routing Mode Static Route, RIPv2

Concurrent Sessions 110,000

New session / second 10,000

WAN to LAN

Throughput 100Mbps

VPN Throughput 18Mbps

VPN 3DES Throughput 17Mbps

VPN Function SSL, IPSec, PPTP server and client

DES, 3DES, and AES encrypting

SHA-1 / MD5 authentication algorithm

Remote access VPN (Client-to-Site) and Site to Site VPN

VPN Trunk

SSL VPN Internal Subnet of Server: 10

Connection Tunnels: 50

IPSec VPN Trunk 50

VPN Connection

Tunnels /Allow to

Configure

IPSec: 100 / 200

PPTP Serve: 32 / 32

PPTP Client: 16 / 16

Content Filtering URL Blocking

Blocks Popup, Java Applet, cookies and Active X

P2P Application Blocking

Instant Message Blocking

Download Blocking

Firewall Policy-based Firewall rule with schedule

NAT/ NAPT, SPI Firewall

QoS Policy-based bandwidth management

Guarantee and maximum bandwidth with 3 priority levels

Classify traffics based on IP, IP subnet, TCP/UDP port

User authentication Built-in user database with up to 200 entries

Support local database, RADIUS and POP3 authentication

Logs Log and alarm for event and traffic

Log can be saved from web, sent by e-mail or sent to syslog

server

Accounting Report Record inbound and outbound traffic’s utilization by Source

IP, Destination IP and Service

Statistics Traffic statistic for WAN interface and policies

Graphic display

Others Dynamic DNS, NTP, DHCP server, Virtual server,

Table des matières

Autres manuels Planet Porte

Planet

Planet VIP-110 Manuel utilisateur

Planet

Planet MH-2001 Manuel utilisateur

Planet

Planet WPG-200N Manuel utilisateur

Planet

Planet WPG-130N Manuel utilisateur

Planet

Planet Content Security Gateway CS-500 Manuel utilisateur

Planet

Planet ICG-2510W-LTE Series Manuel utilisateur

Planet

Planet MH-4000 Manuel utilisateur

Planet

Planet VIP-450 Manuel utilisateur

Planet

Planet VGW-402 Manuel utilisateur

Planet

Planet MH-1000 Manuel utilisateur

Planet

Planet WPG-130N Manuel utilisateur

Planet

Planet ICG-2515 Series Manuel utilisateur

Planet

Planet VIP-880 Series Manuel utilisateur

Planet

Planet UMG-2000 Manuel utilisateur

Planet

Planet VIP 24 Series Manuel utilisateur

Planet

Planet BM-2101 Manuel utilisateur

Planet

Planet VGW-402 Manuel utilisateur

Planet

Planet MH-2300 Manuel utilisateur

Planet

Planet IMG-2100T Manuel utilisateur

Planet

Planet ICG-2515-NR Series Manuel utilisateur

Planet

Planet WSG-401 Manuel utilisateur

Planet

Planet VCG-1500WG-LTE Manuel utilisateur

Planet

Planet WPG-210N Manuel utilisateur

Planet

Planet CS-2001 Manuel utilisateur

Manuels Porte populaires d'autres marques

LST

LST M500RFE-AS Manuel utilisateur

Kinnex

Kinnex Media Gateway Manuel utilisateur

2N Telekomunikace

2N Telekomunikace 2N StarGate Manuel utilisateur

Mitsubishi Heavy Industries

Mitsubishi Heavy Industries Superlink SC-WBGW256 Manuel utilisateur

ZyXEL Communications

ZyXEL Communications ZYWALL2 ET 2WE Manuel utilisateur

Telsey

Telsey CPVA 500 - SIP Manuel utilisateur

RTA

RTA 460A-NNA4 Fiche technique

Shaw

Shaw Gateway HDPVR Manuel utilisateur

ABB

ABB VSN900 Guide de démarrage rapide

Commander

Commander Pulse Manuel utilisateur

2N Telekomunikace

2N Telekomunikace ATEUS EasyGate 501309E Manuel utilisateur

NETGEAR

NETGEAR C6300BD Manuel utilisateur

Amit

Amit CDW531AM Manuel utilisateur

HMS

HMS Netbiter EasyConnect EC150 Manuel utilisateur

Huawei

Huawei EchoLife HG620 Manuel utilisateur

AT&T

AT&T U-verse 3801 Manuel d'utilisation et d'entretien

Logic IO

Logic IO RTCU MX2 turbo Manuel utilisateur

Suttle

Suttle MediaMAX MXM-521 Manuel utilisateur