Page 2
Clavister. Disclaimer The information in this document is subject to change without notice. Clavister makes no representations or warranties with respect to the contents hereof and specifically disclaims any implied warranties of merchantability or fitness for a particular purpose. Clavister reserves the right to revise this publication and to make changes from time to time in the content hereof without any obligation to notify any person or parties of such revision or changes.
1. W30 Product Overview ..................7 1.1. Unpacking the W30 ................. 7 1.2. Interfaces and Ports ................. 9 2. Registering with Clavister .................. 12 3. W30 Installation ....................17 3.1. General Installation Guidelines ..............17 3.2. Flat Surface Installation ................19 3.3.
Page 4
1.3. The W30 Ethernet Interface Ports ............... 9 3.1. The W30 Local Console Port ................21 3.2. Rear view of the Clavister W30 ................23 3.3. W30 Power Switch and Power Inlet Socket ............23 5.1. An 8 x RJ45 Gigabit Interface Expansion Module for the W30 ........ 68 5.2.
The target audience for this guide is the administrator who has taken delivery of a packaged Clavister W30 appliance and is setting it up for the first time. The guide takes the user from unpacking and installation of the device through to power-up, including network connections and initial cOS Core configuration.
Page 6
Where a "See section" link is provided in the main text, this can be clicked on to take the reader directly to that reference. For example, see Section 4.6, “Setup Troubleshooting ”. Web links Web links included in the document are clickable. For example, http://www.clavister.com. Trademarks Certain names in this publication are the trademarks of their respective owners.
1.1. Unpacking the W30 Figure 1.1. An Unpacked Clavister W30 Appliance This section details the unpacking of the W30 appliance. Open the packaging box used for shipping and carefully unpack the contents. The delivered product packaging should contain the following: •...
Page 8
If any items are missing from the W30 package, please contact the reseller or distributor. All relevant documentation in PDF format can be downloaded from the Clavister website and is included in the ZIP file distributions of new cOS Core versions.
Chapter 1: W30 Product Overview 1.2. Interfaces and Ports This section is an overview of the W30 product's external design. Figure 1.2. Clavister W30 Connection Ports The W30 features the following connection ports on the front panel: • 6 x RJ45 Gigabit Ethernet interfaces with the logical cOS Core names G1, G2, G3, G4, G5, and •...
The wizard is described in Section 4.2, “Web Interface and Wizard Setup”. Manual registration of the W30 on the Clavister website - This is described in the last half of this section. Manual registration may be necessary if the W30 does not have Internet access.
Page 13
Chapter 2: Registering with Clavister The customer login page is presented. It is assumed that a new customer is accessing the site for the first time so they should press the Register button. If already registered, log in and skip to step 8.
Page 14
When the confirmation link in the email is clicked, the new customer is taken to a webpage to indicate that confirmation has been successful. They should now log in to the Clavister website with the credentials they have submitted during registration.
Page 15
Core Setup Wizard which will appear as a browser popup window in the Web Interface when cOS Core starts for the first time. Log in to the Clavister website and select the Register License option. The registration page is displayed. Under the tab Hardware Serial Number and Service Tag, enter the Hardware Serial Number and Service Tag must be entered.
Page 16
Once the W30 hardware unit is registered, a cOS Core license for the unit becomes available for download and installation from Clavister servers. This installation can be done automatically through the cOS Core Setup Wizard which is described in Section 4.2, “Web Interface and Wizard Setup”.
• Local Console Port Connection, page 21 • Connecting Power, page 23 3.1. General Installation Guidelines Follow these geneneral guidelines when installing your Clavister W30 appliance: • Safety Take notice of the safety guidelines laid out in Chapter 8, Safety Precautions. These are specified in multiple languages.
Page 18
Chapter 3: W30 Installation A third party surge protection device should be considered and is strongly recommended as a means to prevent electrical surges reaching the appliance. This is mentioned again in Section 3.5, “Connecting Power”. • Temperature Do not install the appliance in an environment where the ambient temperature during operation might fall outside the specified operating range.
Chapter 3: W30 Installation 3.2. Flat Surface Installation The W30 can be mounted on any appropriate stable, flat, level surface that can safely support the weight of the appliance and its attached cables. However, the W30 is designed to be rack mounted and installation on a flat surface is not recommended.
Chapter 3: W30 Installation 3.3. Rack Installation The W30 is designed to be installed in most standard 19-inch equipment racks. In the packaging for the W30 there should be included a Rack Mount Kit which consists of two brackets, each of which has three screws for attachment to the front-sides of the unit as shown in the image below.
Chapter 3: W30 Installation 3.4. Local Console Port Connection The local console port is the physical RJ45 RS-232 port on the far left-hand side front panel of the W30 and is marked with the letter "C". Figure 3.1. The W30 Local Console Port This local console port allows direct management connection to the appliance, either from a separate computer running console emulation software or from a console terminal.
Page 22
Chapter 3: W30 Installation • A terminal or a computer with a serial port and the ability to emulate a terminal (for example, the open source puTTY software). • The terminal console should have the following settings: 9600 bps. No parity. iii.
Please review the electrical safety information in Chapter 8, Safety Precautions. The image below shows the back of the W30. This is divided into four sections secured by screws. Figure 3.2. Rear view of the Clavister W30 Connecting AC Power To connect power, follow these steps: Plug the end of the power cord into the power inlet socket on the W30.
Page 24
Chapter 3: W30 Installation The W30 will boot up and cOS Core will start. After a brief period of time, cOS Core will be initialized and the W30 appliance is ready for configuration from a management workstation using either the Web Interface or the Command Line Interface (CLI) as the management interface.
Clavister's cOS Core network security operating system is preloaded on the W30 and will automatically boot up after power is applied. After boot-up is complete, an external management computer workstation can be used to configure cOS Core.
Page 27
Chapter 4: cOS Core Configuration A standard web browser running on a standalone computer (also referred to as the management workstation) can be used to access the cOS Core Web Interface. This provides an intuitive graphical interface for cOS Core management. When this interface is accessed for the first time, a setup wizard runs automatically to guide a new user through key setup steps.
Page 28
Automatic MDI-X and a crossover cable is not necessary. Workstation Ethernet Interface Setup Traffic will be able to flow between the designated workstation interface and the Clavister Security Gateway interface because they are on the same IP network. This means the workstation interface should be first assigned the following static IPv4 addresses: •...
Chapter 4: cOS Core Configuration 4.2. Web Interface and Wizard Setup This chapter describes the setup when accessing cOS Core for the first time through a web browser. The user interface accessed in this way is called the Web Interface. It assumes that a physical network connection has been set up from a management computer to the default management Ethernet interface as described in Section 4.1, “Management Workstation Connection”.
Page 30
Chapter 4: cOS Core Configuration It is possible to configure cOS Core to use a CA signed certificate instead of self-signed certificate for the management login and doing this is described in the cOS Core Administration Guide. The Login Dialog cOS Core will next respond like a web server with the initial login dialog page as shown below.
Page 31
Chapter 4: cOS Core Configuration the Clavister Security Gateway is being used in Transparent Mode between two internal networks, then the configuration setup is best done with manual Web Interface steps or through the CLI instead of through the wizard and these are explained in the two sections that follow.
Page 32
Chapter 4: cOS Core Configuration Wizard step 3: Select the WAN interface Next, you will be asked for the WAN interface that will be used to connect to an ISP for Internet access. Wizard step 4: Select the WAN interface settings This step selects how the WAN connection to the Internet will function.
Page 33
Chapter 4: cOS Core Configuration These four different connection options are discussed next in the subsections 4A to 4D that follow. • 4A. Static - manual configuration Information supplied by the ISP should be entered in the next wizard screen. All fields need to be entered except for the Secondary DNS server field.
Page 34
DNS servers are set automatically after connection with PPTP. Wizard step 5: DHCP server settings If the Clavister Security Gateway is to function as a DHCP server, it can be enabled here in the wizard on a particular interface or configured later.
Page 35
Chapter 4: cOS Core Configuration Wizard step 6: Helper server settings Optional NTP and Syslog servers can be enabled here in the wizard or configured later. Network Time Protocol servers keep the system date and time accurate. Syslog servers can be used to receive and store log messages sent by cOS Core.
Page 36
Once the wizard has been successfully finished and activated, it cannot be run again. The exception to this is if the Clavister Security Gateway has its factory defaults restored in which case the appliance will behave as though it were being started for the first time.
Core. Ethernet Interfaces The physical connection of external networks to the Clavister Security Gateway is through the various Ethernet interfaces which are provided by the hardware platform. On first-time startup, cOS Core scans for these interfaces and determines which are available and allocates their names.
Page 38
Chapter 4: cOS Core Configuration Important: The time server URL requires the "dns:" prefix When specifying a URL in cOS Core for the time server, it must have the prefix "dns:". Once the values are set correctly, we can press the OK button to save the values while we move on to more steps in cOS Core configuration.
Page 39
Reconfiguration is a process that the cOS Core administrator may initiate often. Normally, reconfiguration takes a brief amount of time and causes only a slight delay in traffic throughput. Active user connections through the Clavister Security Gateway should rarely be lost. Tip: How frequently to commit configuration changes It is up to the administrator to decide how many changes to make before activating a new configuration.
Page 40
IPv4 address 10.5.4.1. The ISP's gateway is the first router hop towards the public Internet from the Clavister Security Gateway. Go to Objects > Address Book in the Web Interface. The current contents of the address book will be listed and will contain a number of predefined objects automatically created by cOS Core after it scans the interfaces for the first time.
Page 41
Chapter 4: cOS Core Configuration Tip: Creating address book folders New folders can be created when needed and provide a convenient way to group together related IP address objects. The folder name can be chosen to indicate the folder's contents. Now click the Add button at the top left of the list and choose the IP4 Address option to add a new address to the folder.
Page 42
At this point, the connection to the Internet is configured but no traffic can flow to or from the Internet since all traffic needs a minimum of the following two cOS Core configuration objects to exist before it can flow through the Clavister Security Gateway: •...
Page 43
Chapter 4: cOS Core Configuration The destination network in the IP rule is specified as the predefined IP4 Address object all-nets. This is used since it cannot be known in advance to which IP address web browsing will be directed and all-nets allows browsing to any IP address. IP rules are processed in a top down fashion, with the search ending at first matching rule.
Page 44
For the Internet connection to work, a route also needs to be defined so that cOS Core knows on which interface the web browsing traffic should leave the Clavister Security Gateway. This route will define the interface where the network all-nets (in other words, any network) will be found. If the default main routing table is opened by going to Network >...
Page 45
DHCP client. Usually, a DHCP Host Name does not need to be specified but can sometimes be used by an ISP to uniquely identify this Clavister Security Gateway as a particular DHCP client to the ISP's DHCP server.
Page 46
Chapter 4: cOS Core Configuration For PPPoE connection, we must create a PPPoE tunnel interface associated with the physical Ethernet interface. Assume that the physical interface is G2 and the PPPoE tunnel object created is called wan_pppoe. Go to Network > Interfaces and VPN > PPPoE and select Add > PPPoE Tunnel.
Page 47
DHCP Server Setup If the Clavister Security Gateway is to act as a DHCP server then this can be set up in the following way: First, create an IP4 Address object which defines the address range to be handed out. Here, it is assumed that this has the name dhcp_range.
Page 48
Chapter 4: cOS Core Configuration An example IP pool range might be 196.168.1.10 - 192.168.1.20 with a netmask of 255.255.0.0. In addition, it is important to specify the Default gateway for the server. This will be handed out to DHCP clients on the internal networks so that they know where to find the public Internet. The default gateway is always the IPv4 address of the interface on which the DHCP server is configured, in this case, G3_ip.
Page 49
As a further example of setting up IP rules, it can be very useful to allow ICMP Ping requests to flow through the Clavister Security Gateway. As discussed earlier, the cOS Core will drop any traffic unless an IP rule explicitly allows it. Let us suppose that we wish to allow the pinging of external hosts with the ICMP protocol by computers on the internal G3_net network.
Page 50
The IP rule again has the NAT action and this is necessary if the protected local hosts have private IPv4 addresses. The ICMP requests will be sent out from the Clavister Security Gateway with the IP address of the interface connected to the ISP as the source interface. Responding hosts will send back ICMP responses to this single IP and cOS Core will then forward the response to the correct private IPv4 address.
Page 51
Chapter 4: cOS Core Configuration Logging can now be enabled on this rule with the desired severity. Click the Log Settings tab, and click the Enable logging box. All log messages generated by this rule will be given the selected severity and which will appear in the text of the log messages. It is up to the administrator to choose the severity and depends on how they would like to classify the messages.
Page 52
Chapter 4: cOS Core Configuration Doing this is described in Section 4.5, “License Installation Methods”.
Chapter 4: cOS Core Configuration 4.4. CLI Setup This chapter describes the setup steps using CLI commands instead of the setup wizard. The CLI is accessible using either one of two methods: • Using an SSH (Secure Shell) client, across a network connection to the IPv4 address 192.168.1.1 on the default management Ethernet interface.
Page 54
Ethernet Interfaces The connection of external networks to the Clavister Security Gateway is via the various Ethernet interfaces which are provided by the hardware platform. On first-time startup, cOS Core scans for these interfaces and determines which are available and allocates their names. The first interface detected in the scan becomes the initial default management interface and this can only be changed after initial startup.
Page 55
Chapter 4: cOS Core Configuration Note: Private IPv4 addresses are used for example only Each installation's IP addresses will be different from the example IP addresses but they are used here only to illustrate how setup is done. Also, these addresses are private IPv4 addresses and in reality an ISP would use public IPv4 addresses instead.
Page 56
Chapter 4: cOS Core Configuration EthernetDevice: 0:G2 1:<empty> AutoSwitchRoute: AutoInterfaceNetworkRoute: AutoDefaultGatewayRoute: ReceiveMulticastTraffic: Auto MemberOfRoutingTable: Comments: <empty> Setting the default gateway on the interface has the additional effect that cOS Core automatically creates a route in the default main routing table that has the network all-nets routed on the interface.
Page 57
Chapter 4: cOS Core Configuration Device:/> set DNS DNSServer1=dns1_address Assuming a second IP object called dns2_address has been defined, the second DNS server is specified with: Device:/> set DNS DNSServer2=dns2_address B. DHCP - automatic configuration Alternatively, all required IP addresses can be automatically retrieved from the ISP's DHCP server by enabling DHCP on the interface connected to the ISP.
Page 58
Chapter 4: cOS Core Configuration source interface and source network (in this example, the network G3_net and interface G3) to flow to the destination network all-nets and the destination interface which is the PPPoE tunnel that has been defined. D. PPTP setup For PPTP connection, first create the PPTP tunnel interface.
Page 59
Chapter 4: cOS Core Configuration DHCP Server Setup If the Clavister Security Gateway is to act as a DHCP server then this can be set up in the following way: First define an IPv4 address object which has the address range that can be handed out. Here, we will use the IPv4 range 192.168.1.10 - 192.168.1.20 as an example and this will be available on the...
Page 60
The IP rule again has the NAT action and this is necessary if the protected local hosts have private IPv4 addresses. The ICMP requests will be sent out from the Clavister Security Gateway with the IP address of the interface connected to the ISP as the source interface. Responding hosts will send back ICMP responses to this single IP and cOS Core will then forward the response to the correct private IP address.
Core for another two hours. To remove this 2 hour restriction, a valid license must be installed. Licenses are files which are made available for download from the Clavister servers but before they become available, the user must have registered themselves with Clavister and doing this is described in Chapter 2, Registering with Clavister.
Page 62
CLI is only possible for the first time a license is installed. After that, future license installations can only be performed using the following two methods: • Manually, by logging into and downloading from the Clavister website and then uploading manually to cOS Core. •...
If the Input counters in the hardware section of the output are not increasing then the error is likely to be in the cabling. However, it may simply be that the packets are not getting to the Clavister Security Gateway in the first place. This can be confirmed with a packet sniffer if it is available.
Page 64
Chapter 4: cOS Core Configuration This will display console messages that show all the ARP packets being received on the different interfaces and confirm that the correct cables are connected to the correct interfaces. To look at the ARP activity only a particular interface, follow the command with the interface name: Device:/>...
IP rules identify the targeted traffic using combinations of the source/destination interface/network combined with protocol type. By default, no IP rules are defined so all traffic is dropped. At least one IP rule needs to be defined before traffic can traverse the Clavister Security Gateway.
Page 66
Staying Informed Clavister maintains an RSS feed of announcements that can be subscribed to at https://forums.clavister.com/rss-feeds/announcements/. It is recommended to subscribe to this feed so that you receive notifications when new releases of cOS Core versions are available for download and installation.
Chapter 5: Interface Expansion Modules The W30 product has a single expansion slot which can accept a Clavister interface expansion module. There are three different module types available and these are purchased separately to the W30 unit. Each of the three module types has different capabilities and can be one of the following: •...
Chapter 5: Interface Expansion Modules Figure 5.2. An 8 x SFP Gigabit Interface Expansion Module for the W30 Figure 5.3. A 2 x SFP+ 10 Gigabit Interface Expansion Module for the W30 The full connection capabilities of all these Ethernet interfaces are listed in Appendix A, W30 Specifications.
Page 70
Chapter 5: Interface Expansion Modules The module should engage with rails on either side. Do not force it as it may not be properly aligned or may be the wrong way up. Secure the module by hand tightening the two screws on either side. These screws are on springs and will first need to be pushed in to make contact with the thread in the chassis.
Two of the W30 expansion module options provide connectivity for Small Form Pluggable (SFP) and Small Form Pluggable Plus (SFP+) modules.The W30 expansion modules do not come as standard with any SFP or SFP+ modules but they can be ordered from your Clavister reseller. Shown below is a typical SFP unit.
Chapter 6: Resetting to Factory Defaults In some circumstances, it may be necessary to reset the W30 hardware to the state it was in when it left the factory. This is known as a reset to factory defaults. With the W30, a factory reset is only possible via the software boot menu. There is no manual reset button on the hardware itself.
Page 74
Chapter 6: Resetting to Factory Defaults Warning: Current configuration and cOS Core upgrades are lost The factory defaults will include the default configuration and the original version of cOS Core that the product left the factory with. This means: • The current cOS Core configuration will be lost but can be restored if a backup is available.
Start Date (as defined below). The warranty will only apply to failure of the product if Clavister is informed of the failure not later than two (2) years from the Start Date or thirty (30) days after that the failure was or ought to have been noticed by the customer.
Page 76
Sjögatan 6J 891 60 Örnsköldsvik SWEDEN If the product has not yet been registered with the Clavister through its client web, a proof of purchase (such as a copy of the dated purchase invoice) must be provided with the shipped product.
Chapter 8: Safety Precautions Safety Precautions Clavister W30 devices are Safety Class I products and have protective ground terminals. There must be an uninterrupted safety earth ground from the main power source to the product’s input wiring terminals, power cord, or supplied power cord set. Whenever it is likely that the protection has been impaired, disconnect the power cord until the ground has been restored.
Page 78
Chapter 8: Safety Precautions Informations concernant la sécurité Cet appareil est un produit de classe I et possède une borne de mise à la terre. La source d’alimentation principale doit être munie d’une prise de terre de sécurité installée aux bornes du câblage d’entree, sur le cordon d’alimentation ou le cordon de raccordement fourni avec le produit.
Page 79
Chapter 8: Safety Precautions • se la vostra LAN copre un’area servita da più di un sistema di distribuzione elettrica, accertatevi che i collegamenti a terra di sicurezza siano ben collegati fra loro; • i cavi LAN possono occasionalmente andare soggetti a pericolose tensioni transitorie (ad esempio, provocate da lampi o disturbi nella griglia d’alimentazione della società...
Appendix A: W30 Specifications Dimensions, Weight and MTBF Height x Width x Depth (mm) 44 x 431 x 305 Hardware Weight 4 kg (without expansion module fitted) 8 x RJ45 Module Weight 0.25 kg 8 x SFP Module Weight 0.2 kg 2 x SFP+ Module Weight 0.16 kg Hardware Form Factor...
Page 81
Appendix A: W30 Specifications For more information about Clavister products, go to: http://www.clavister.com.
If a PC running Microsoft XP™ is being used as the cOS Core management workstation, the computer's Ethernet interface connected to the Clavister Security Gateway must be configured with an IPv4 address which belongs to the network 192.168.1.0/24 and is different from the security gateway's address of 192.168.1.1.
Page 85
Appendix C: Windows XP IP Setup Note: DNS addresses can be entered later To browse the Internet from the management workstation via the security gateway, it is possible to go back to the last step's properties dialog later and enter DNS server IP addresses.
If a PC running Microsoft Vista™ is being used as the cOS Core management workstation, the computer's Ethernet interface connected to the Clavister Security Gateway must be configured with an IPv4 address which belongs to the network 192.168.1.0/24 and is different from the security gateway's address of 192.168.1.1.
Page 87
Appendix D: Windows Vista IP Setup Select and display the properties for Internet Protocol Version 4 (TCP/IPv4). In the properties dialog, select the option Use the following IP address and enter the following values: • IP Address: 192.168.1.30 • Subnet mask: 255.255.255.0 •...
If a PC running Microsoft Windows 7™ is being used as the cOS Core management workstation, the computer's Ethernet interface connected to the Clavister Security Gateway must be configured with an IPv4 address which belongs to the network 192.168.1.0/24 and is different from the security gateway's address of 192.168.1.1.
Page 89
Appendix E: Windows 7 IP Setup Select and display the properties for Internet Protocol Version 4 (TCP/IPv4). In the properties dialog, select the option Use the following IP address and enter the following values: • IP Address: 192.168.1.30 • Subnet mask: 255.255.255.0 •...
If a PC running Microsoft Windows 7 is being used as the cOS Core management workstation, the computer's Ethernet interface connected to the Clavister Security Gateway must be configured with an IPv4 address which belongs to the network 192.168.1.0/24 and is different from the security gateway's address of 192.168.1.1.
Page 91
Appendix F: Windows 8 IP Setup The properties for the selected interface will appear. Select and display the properties for Internet Protocol Version 4 (TCP/IPv4). In the properties dialog, select the option Use the following IP address and enter the following values: •...
Appendix G: Apple Mac IP Setup An Apple Mac can be used as the management workstation for initial setup of a Clavister Security Gateway. To do this, a selected Ethernet interface on the Mac must be configured correctly with a static IP.
Page 93
Appendix G: Apple Mac IP Setup Now set the following values: • IP Address: 192.168.1.30 • Subnet Mask: 255.255.255.0 • Router: 192.168.1.1 Click Apply to complete the static IP setup.
Page 94
Clavister AB Sjögatan 6J SE-89160 Örnsköldsvik SWEDEN Phone: +46-660-299200 www.clavister.com...
Need help?
Do you have a question about the Wolf W30 and is the answer not in the manual?
Questions and answers