D-Link DFL- 2500 Manuals

Table of Contents

• 2

  User Manual
• 4

  Table of Contents
• 12

  Preface
• 12

  Example Notation
• 14

  Netdefendos Overview
  • 14

    Features
  • 17

    Netdefendos Architecture
    • 17

      State-Based Architecture
    • 17

      Netdefendos Building Blocks
    • 18

      Basic Packet Flow
  • 20

    Netdefendos State Engine Packet Flow
• 20

  Packet Flow Schematic Part I
• 21

  Packet Flow Schematic Part II
• 22

  Packet Flow Schematic Part III
• 23

  Expanded Apply Rules Logic
• 25

  Management and Maintenance
  • 25

    Managing Netdefendos
    • 25

      Overview
    • 26

      The Default Administrator Account
    • 26

      The Web Interface
• 29

  Enabling Remote Management Via HTTPS
  • 30

    The CLI
• 34

  Enabling SSH Remote Access
  • 36

    CLI Scripts
  • 39

    Secure Copy
  • 41

    The Console Boot Menu
  • 43

    Management Advanced Settings
  • 44

    Working With Configurations
• 44

  Listing Configuration Objects
• 45

  Displaying a Configuration Object
• 45

  Editing a Configuration Object
• 46

  Adding a Configuration Object
• 47

  Deleting a Configuration Object
• 47

  Undeleting a Configuration Object
• 47

  Listing Modified Configuration Objects
• 48

  Activating and Committing a Configuration
  • 49

    Events and Logging
    • 49

      Overview
    • 49

      Event Messages
    • 49

      Event Message Distribution
• 50

  Enable Logging to a Syslog Host
  • 51

    Snmp Traps
  • 52

    Advanced Log Settings
• 52

  Sending SNMP Traps to an SNMP Trap Receiver
  • 54

    RADIUS Accounting
    • 54

      Overview
    • 54

      RADIUS Accounting Messages
    • 56

      Interim Accounting Messages
    • 56

      Activating RADIUS Accounting
    • 56

      RADIUS Accounting Security
    • 56

      RADIUS Accounting and High Availability
    • 57

      Handling Unresponsive Servers
    • 57

      Accounting and System Shutdowns
    • 57

      Limitations With NAT
    • 57

      RADIUS Advanced Settings
• 58

  RADIUS Accounting Server Setup
  • 59

    SNMP Monitoring
    • 60

      SNMP Advanced Settings
• 60

  Enabling SNMP Monitoring
  • 62

    The Pcapdump Command
  • 65

    Maintenance
    • 65

      Auto-Update Mechanism
    • 65

      Creating Backup Files
    • 66

      Configuration Backup and Restore
• 66

  Backing Up the Entire System
  • 67

    Restore to Factory Defaults
• 67

  Complete Hardware Reset to Factory Defaults
• 70

  Fundamentals
  • 70

    The Address Book
    • 70

      Overview
    • 70

      IP Addresses
• 71

  Adding an IP Host
• 71

  Adding an IP Network
• 71

  Adding an IP Range
  • 72

    Ethernet Addresses
• 72

  Deleting an Address Object
• 72

  Adding an Ethernet Address
  • 73

    Address Groups
  • 73

    Auto-Generated Address Objects
  • 74

    Address Book Folders
  • 75

    Services
    • 75

      Overview
• 75

  Viewing a Specific Service
  • 76

    TCP and UDP Based Services
• 77

  Adding a TCP/UDP Service
  • 78

    ICMP Services
  • 79

    Custom IP Protocol Services
• 79

  Adding an IP Protocol Service
  • 80

    Interfaces
    • 80

      Overview
    • 81

      Ethernet Interfaces
• 83

  Enabling DHCP
  • 85

    Vlan
• 86

  Defining a VLAN
  • 87

    Pppoe
  • 89

    GRE Tunnels
• 89

  Configuring a Pppoe Client
  • 92

    Interface Groups
• 92

  Creating an Interface Group
  • 94

    Arp
    • 94

      Overview
    • 94

      ARP in Netdefendos
    • 94

      ARP Cache
• 95

  Displaying the ARP Cache
• 95

  Flushing the ARP Cache
  • 96

    Static and Published ARP Entries
• 96

  Defining a Static ARP Entry
  • 97

    Using ARP Advanced Settings
  • 98

    ARP Advanced Settings Summary
  • 101

    The IP Rule Set
    • 101

      Security Policies
• 102

  Simplified Netdefendos Traffic Flow
  • 103

    IP Rule Evaluation
  • 104

    IP Rule Actions
  • 105

    Editing IP Rule Set Entries
  • 105

    IP Rule Set Folders
• 105

  Adding an Allow IP Rule
  • 107

    Schedules
• 107

  Setting Up a Time-Scheduled Policy
  • 109

    Certificates
    • 109

      Overview
    • 111

      Certificates in Netdefendos
    • 111

      CA Certificate Requests
• 111

  Uploading a Certificate
• 111

  Associating Certificates With Ipsec Tunnels
  • 113

    Date and Time
    • 113

      Overview
    • 113

      Setting Date and Time
    • 113

      Setting the Current Date and Time
    • 114

      Time Servers
• 114

  Setting the Time Zone
• 114

  Enabling DST
• 115

  Enabling Time Synchronization Using SNTP
• 116

  Manually Triggering a Time Synchronization
• 116

  Modifying the Maximum Adjustment Value
• 116

  Forcing Time Synchronization
  • 117

    Settings Summary for Date and Time
• 117

  Enabling the D-Link NTP Server
  • 119

    Dns
• 119

  Configuring DNS Servers
• 122

  Routing
  • 122

    Overview
  • 123

    Static Routing
    • 123

      The Principles of Routing
• 126

  Using Local IP Address With an Unbound Network
  • 127

    Static Routing
• 128

  Displaying the Routing Table
  • 130

    Route Failover
• 130

  Displaying the Core Routes
• 131

  A Route Failover Scenario for ISP Access
  • 133

    Host Monitoring for Route Failover
  • 135

    Proxy ARP
  • 137

    Policy-Based Routing
    • 137

      Overview
    • 137

      Policy-Based Routing Tables
    • 137

      Policy-Based Routing Rules
    • 138

      PBR Table Selection
    • 138

      The Ordering Parameter
• 139

  Creating a Policy-Based Routing Table
• 139

  Creating the Route
• 139

  Policy-Based Routing Configuration
  • 141

    Route Load Balancing
• 142

  The RLB Round Robin Algorithm
• 142

  The RLB Spillover Algorithm
• 145

  A Route Load Balancing Scenario
• 145

  Setting Up RLB
  • 147

    Dynamic Routing
    • 147

      Dynamic Routing Overview
    • 148

      Ospf
• 150

  Virtual Links Example 1
• 151

  Virtual Links Example 2
  • 152

    Dynamic Routing Policy
• 152

  Importing Routes From an OSPF AS Into the Main Routing Table
• 153

  Exporting the Default Route Into an OSPF AS
  • 155

    Multicast Routing
    • 155

      Overview
    • 155

      Multicast Forwarding Using the SAT Multiplex Rule
• 156

  Multicast Forwarding - No Address Translation
• 157

  Forwarding of Multicast Traffic Using the SAT Multiplex Rule
• 158

  Multicast Forwarding - Address Translation
  • 159

    IGMP Configuration
• 160

  Multicast Snoop
• 160

  Multicast Proxy
• 161

  IGMP - No Address Translation
• 162

  If1 Configuration
• 163

  If2 Configuration - Group Translation
  • 164

    Advanced IGMP Settings
  • 167

    Transparent Mode
    • 167

      Overview
    • 171

      Enabling Internet Access
• 171

  Non-Transparent Mode Internet Access
• 172

  Transparent Mode Internet Access
  • 173

    Transparent Mode Scenarios
• 173

  Transparent Mode Scenario 1
• 173

  Setting Up Transparent Mode for Scenario 1
• 174

  Transparent Mode Scenario 2
• 175

  Setting Up Transparent Mode for Scenario 2
  • 177

    Spanning Tree BPDU Support
  • 177

    Advanced Settings for Transparent Mode
• 177

  An Example BPDU Relaying Scenario
• 182

  DHCP Services
  • 182

    Overview
  • 183

    DHCP Servers
• 184

  Setting Up a DHCP Server
• 184

  Checking the Status of a DHCP Server
  • 185

    Static DHCP Assignment
    • 185

      DHCP Advanced Settings
• 185

  Setting Up Static DHCP
  • 187

    DHCP Relaying
• 187

  Setting Up a DHCP Relayer
  • 188

    DHCP Relay Advanced Settings
  • 190

    IP Pools
• 191

  Creating an IP Pool
• 193

  Security Mechanisms
  • 193

    Access Rules
    • 193

      Introduction
    • 193

      IP Spoofing
    • 194

      Access Rule Settings
• 195

  Setting Up an Access Rule
  • 196

    Algs
    • 196

      Overview
• 196

  Deploying an ALG
  • 197

    The HTTP ALG
• 199

  HTTP ALG Processing Order
  • 200

    The FTP ALG
• 202

  Protecting an FTP Server With an ALG
• 205

  Protecting FTP Clients
  • 206

    The TFTP ALG
  • 207

    The SMTP ALG
• 209

  SMTP ALG Processing Order
• 210

  Dnsbl Spam Filtering
• 211

  DNSBL SPAM Filtering
  • 216

    The POP3 ALG
  • 216

    The SIP ALG
  • 226

    The H.323 ALG
• 228

  Protecting Phones Behind D-Link Firewalls
• 230

  H.323 With Private IP Addresses
• 231

  Two Phones Behind Different D-Link Firewalls
• 232

  Using Private IP Addresses
• 233

  H.323 With Gatekeeper
• 235

  H.323 With Gatekeeper and Two D-Link Firewalls
• 236

  Using the H.323 ALG in a Corporate Environment
• 238

  Configuring Remote Offices for H.323
• 238

  Allowing the H.323 Gateway to Register With the Gatekeeper
  • 239

    The TLS ALG
• 239

  TLS Termination
  • 242

    Web Content Filtering
    • 242

      Overview
    • 242

      Active Content Handling
    • 243

      Static Content Filtering
• 243

  Stripping Activex and Java Applets
• 244

  Setting Up a White and Blacklist
  • 245

    Dynamic Web Content Filtering
• 245

  Dynamic Content Filtering Flow
• 247

  Enabling Dynamic Web Content Filtering
• 248

  Enabling Audit Mode
• 250

  Reclassifying a Blocked Site
• 257

  Editing Content Filtering HTTP Banner Files
  • 259

    Anti-Virus Scanning
    • 259

      Overview
    • 259

      Implementation
    • 260

      Activating Anti-Virus Scanning
    • 260

      The Signature Database
    • 261

      Subscribing to the D-Link Anti-Virus Service
    • 261

      Anti-Virus Options
    • 263

      Activating Anti-Virus Scanning
  • 265

    Intrusion Detection and Prevention
    • 265

      Overview
    • 265

      IDP Availability in D-Link Models
• 266

  IDP Database Updating
  • 267

    IDP Rules
  • 268

    Insertion/Evasion Attack Prevention
  • 269

    IDP Pattern Matching
  • 270

    IDP Signature Groups
  • 271

    IDP Actions
  • 272

    SMTP Log Receiver for IDP Events
  • 272

    Configuring an SMTP Log Receiver
• 273

  Setting Up IDP for a Mail Server
  • 276

    Denial-Of-Service Attack Prevention
    • 276

      Overview
    • 276

      Dos Attack Mechanisms
    • 276

      Ping of Death and Jolt Attacks
    • 277

      Fragmentation Overlap Attacks: Teardrop, Bonk, Boink and Nestea
    • 277

      The Land and Latierra Attacks
    • 277

      The Winnuke Attack
    • 278

      Amplification Attacks: Smurf, Papasmurf, Fraggle
    • 279

      TCP SYN Flood Attacks
    • 279

      The Jolt2 Attack
    • 279

      Distributed Dos Attacks
  • 280

    Blacklisting Hosts and Networks
• 281

  Adding a Host to the Whitelist
• 283

  Address Translation
  • 283

    Nat
• 284

  NAT IP Address Translation
• 285

  Adding a NAT Rule
• 287

  Anonymizing With NAT
  • 288

    NAT Pools
• 289

  Using NAT Pools
  • 291

    Sat
    • 291

      Translation of a Single IP Address (1:1)
• 291

  Enabling Traffic to a Protected Web Server in a DMZ
• 293

  Enabling Traffic to a Web Server On an Internal Network
  • 294

    Translation of Multiple IP Addresses (M:N)
• 295

  Translating Traffic to Multiple Protected Web Servers
  • 297

    All-To-One Mappings (N:1)
  • 297

    Port Translation
  • 297

    Protocols Handled By SAT
  • 298

    Multiple SAT Rule Matches
  • 298

    SAT and Fwdfast Rules
• 302

  User Authentication
  • 302

    Overview
  • 304

    Authentication Setup
    • 304

      Setup Summary
    • 304

      The Local Database
    • 304

      External RADIUS Servers
    • 305

      External LDAP Servers
• 308

  Normal LDAP Authentication
  • 309

    Authentication Rules
• 309

  LDAP for PPP With CHAP, Ms-Chapv1 or Ms-Chapv2
  • 310

    Authentication Processing
  • 311

    HTTP Authentication
• 313

  Creating an Authentication User Group
• 313

  User Authentication Setup for Web Access
• 314

  Configuring a RADIUS Server
  • 315

    Customizing HTML
• 316

  Editing Content Filtering HTTP Banner Files
• 319

  Vpn
  • 319

    Overview
    • 319

      VPN Usage
    • 320

      VPN Encryption
    • 320

      VPN Planning
    • 321

      Key Distribution
    • 321

      The TLS Alternative for VPN
  • 323

    VPN Quick Start
    • 323

      Ipsec LAN to LAN With Pre-Shared Keys
    • 324

      Ipsec LAN to LAN With Certificates
    • 325

      Ipsec Roaming Clients With Pre-Shared Keys
    • 327

      Ipsec Roaming Clients With Certificates
    • 328

      L2TP Roaming Clients With Pre-Shared Keys
    • 329

      L2TP Roaming Clients With Certificates
    • 330

      PPTP Roaming Clients
  • 332

    Ipsec Components
    • 332

      Overview
    • 332

      Internet Key Exchange (IKE)
    • 338

      IKE Authentication
    • 339

      Ipsec Protocols (ESP/AH)
• 339

  The AH Protocol
  • 340

    NAT Traversal
• 340

  The ESP Protocol
  • 341

    Algorithm Proposal Lists
  • 342

    Pre-Shared Keys
• 342

  Using an Algorithm Proposal List
• 343

  Using a Pre-Shared Key
  • 344

    Identification Lists
• 344

  Using an Identity List
  • 346

    Ipsec Tunnels
    • 346

      Overview
    • 346

      LAN to LAN Tunnels With Pre-Shared Keys
    • 347

      Roaming Clients
    • 347

      Setting Up a PSK Based VPN Tunnel for Roaming Clients
• 348

  Setting Up a Self-Signed Certificate Based VPN Tunnel for Roaming Clients
• 349

  Setting Up a CA Server Issued Certificate Based VPN Tunnel for Roaming Clients
• 351

  Setting Up Config Mode
• 351

  Using Config Mode With Ipsec Tunnels
  • 352

    Fetching Crls From an Alternate LDAP Server
  • 352

    Troubleshooting With Ikesnoop
• 352

  Setting Up an LDAP Server
  • 360

    Ipsec Advanced Settings
  • 363

    Pptp/L2Tp
    • 363

      PPTP Servers
    • 364

      L2TP Servers
• 364

  Setting Up a PPTP Server
• 364

  Setting Up an L2TP Server
• 365

  Setting Up an L2TP Tunnel Over Ipsec
  • 368

    L2TP/PPTP Server Advanced Settings
  • 369

    PPTP/L2TP Clients
• 370

  PPTP Client Usage
  • 371

    CA Server Access
• 372

  Certificate Validation Components
  • 374

    VPN Troubleshooting
  • 376

    Management Interface Failure With Vpn
• 378

  Traffic Management
  • 378

    Traffic Shaping
    • 378

      Introduction
    • 379

      Traffic Shaping in Netdefendos
• 380

  Packet Flow of Pipe Rule Set to Pipe
• 380

  Fwdfast Rules Bypass Traffic Shaping
  • 381

    Simple Bandwidth Limiting
• 381

  Applying a Simple Bandwidth Limit
  • 382

    Limiting Bandwidth in Both Directions
  • 383

    Creating Differentiated Limits With Chains
  • 383

    Precedences
• 384

  The Eight Pipe Precedences
  • 385

    Guarantees
• 385

  Minimum and Maximum Pipe Precedence
  • 386

    Differentiated Guarantees
  • 387

    Groups
• 387

  Traffic Grouped Per IP Address
  • 388

    Recommendations
  • 389

    A Summary of Traffic Shaping
  • 390

    More Pipe Examples
• 390

  A Basic Traffic Shaping Scenario
  • 394

    IDP Traffic Shaping
    • 394

      Overview
    • 394

      Setup
    • 395

      Processing Flow
    • 395

      The Importance of Specifying a Network
    • 396

      A P2P Scenario
    • 396

      Viewing Traffic Shaping Objects
• 396

  IDP Traffic Shaping P2P Scenario
  • 397

    Guaranteeing Instead of Limiting Bandwidth
  • 398

    Logging
  • 399

    Threshold Rules
    • 399

      Overview
    • 399

      Limiting the Connection Rate/Total Connections
    • 399

      Grouping
    • 399

      Rule Actions
    • 400

      Multiple Triggered Actions
    • 400

      Exempted Connections
    • 400

      Threshold Rules and Zonedefense
    • 400

      Threshold Rule Blacklisting
  • 401

    Server Load Balancing
    • 401

      Overview
    • 401

      A Server Load Balancing Configuration
    • 402

      Identifying the Servers
    • 402

      The Load Distribution Mode
    • 403

      The Distribution Algorithm
• 403

  Connections From Three Clients
• 404

  Stickiness and Round-Robin
• 404

  Stickiness and Connection Rate
  • 405

    Server Health Monitoring
  • 405

    SLB_SAT Rules
• 406

  Setting Up SLB
• 409

  High Availability
  • 409

    Overview
  • 411

    HA Mechanisms
  • 413

    HA Setup
    • 413

      Hardware Setup
• 413

  High Availability Setup
  • 414

    Netdefendos Manual HA Setup
  • 415

    Verifying the Cluster Is Functioning
  • 416

    Using Unique Shared Mac Addresses
  • 417

    HA Issues
  • 418

    HA Advanced Settings
• 420

  Zonedefense
  • 420

    Overview
  • 421

    Zonedefense Switches
  • 422

    Zonedefense Operation
    • 422

      Snmp
    • 422

      Threshold Rules
    • 422

      Manual Blocking and Exclude Lists
• 423

  A Simple Zonedefense Scenario
  • 424

    Zonedefense With Anti-Virus Scanning
  • 424

    Limitations
• 427

  Advanced Settings
  • 427

    IP Level Settings
  • 431

    TCP Level Settings
  • 436

    ICMP Level Settings
  • 437

    State Settings
  • 439

    Connection Timeout Settings
  • 441

    Length Limit Settings
  • 443

    Fragmentation Settings
  • 447

    Local Fragment Reassembly Settings
  • 448

    Miscellaneous Settings
• 450

  Subscribing to Security Updates
• 452

  IDP Signature Groups
• 456

  Verified MIME Filetypes
• 460

  The OSI Framework
• 460

  D.1. the 7 Layers of the OSI Model
• 461

  D-Link Worldwide Offices
• 463

  Alphabetical Index