Sophos XG v15.01.0 XG Firewall Administrator Guide
Pubblicità
Pubblicità
Sophos XG Firewall v 15.01.0 – Release Notes
Sophos XG Firewall
Administrator Guide v15.01.0
For Sophos and Cyberoam Customers
Document Date: November 2015
| Contents | 2
Contents
| Contents | 3
| Contents | 4
| Contents | 5
| Contents | 6
Appendix B – IPS - Custom Pattern Syntax..................................................... 600
Appendix C – Default File Type Categories...................................................... 605
| Introduction | 7
Introduction
Sophos Firewall, combines the best of both Sophos and Cyberoam technology delivering an unprecedented level of innovation to next-generation firewalls.
With all new user interface, new Security Heartbeat technology, and a powerful new unified policy model, it introduces a number of important innovations that take simplicity, protection, and performance, to a whole new level.
Sophos Firewall OS runs on all existing Sophos SG Series and Cyberoam NG Series hardware and is available for a variety of virtual platforms or as a software appliance.
Features Summary
• Control center that surfaces important information with extensive drill-down
• Intuitive navigation that gets out of the way with helpful reminders and guidance
• Policies of all types are managed together on a single screen
• Policy tools include innovative new features like types, templates, natural language descriptions, and user-identity
• User Threat Quotient that identifies user risk based on past behavior
• Discover mode that makes evals, trials, and PoCs easier
• FastPath optimized scanning
Flavors
This section provides information different flavors available.
Sophos is available in following flavors:
• Physical Devices
• Virtual Devices
• Software
Physical Devices
Sophos provides range of physical devices to cater to the needs of Enterprise to small business to Home users.
Virtual Devices
Virtual Network Security devices can be deployed as Next-Generation Firewalls or UTMs and offer industry-leading network security to virtual data-centers, “Security-in-a-Box” set-up for MSSPs/organizations, and “Office-in-a-Box” set-up. By offering comprehensive security features available in its hardware security devices, in virtualized form, these virtual devices offer Layer 8 Identity-based security on a single virtual device, which is as strong as security for the physical networks.
Sophos offers a complete virtual security solution to organizations with its virtual network security devices (Next-
Generation Firewalls/UTMs), virtual Sophos Firewall Manager (SFM) for centralized management, and Sophos iView software for centralized logging and reporting.
Administrative Interfaces
Device can be accessed and administered through:
•
: Admin Console is a web-based application that an Administrator can use to configure, monitor,
and manage the Device.
•
: Command Line Interface (CLI) console provides a collection of tools to administer,
monitor, and control certain component(s) of the device.
| Introduction | 8
•
: Distributed Sophos devices can be centrally managed using a single Sophos
Firewall Manager (SFM) Device.
Administrative Access
This section provides information on how to access Device.
An administrator can connect and access the device through HTTP, HTTPS, telnet, or SSH services. Depending on the Administrator login account profile used for access, an administrator can access number of Administrative
Interfaces and Admin Console configuration pages.
The device is shipped with one administrator account and four administrator profiles.
Administrator Type Login Credentials Console Access
Super Administrator admin/admin Admin console
CLI console
Privileges
Full privileges for both the consoles. It provides read-write permission for all the configuration performed through either of the consoles.
Note: We recommend that you change the password of the user immediately on deployment.
Admin Console
Admin Console is a web-based application that an Administrator can use to configure, monitor, and manage the
Device.
You can connect to and access Admin Console of the device using HTTP or an HTTPS connection from any management computer using web browser:
1. HTTP login: http://<LAN IP Address of the device>
2. HTTPS login: https://<LAN IP Address of the device>
For more details, refer to section
.
Command Line Interface (CLI) Console
CLI console provides a collection of tools to administer, monitor, and control certain component(s) of the device. The device can be accessed remotely using the following connections:
1. Remote login Utility – TELNET login
2. SSH Client (Serial Console)
Use CLI console for troubleshooting and diagnosing network problems in details.
Sophos Firewall Manager (SFM)
Distributed Sophos devices can be centrally managed using a single Sophos Firewall Manager (SFM) Device, enabling high levels of security for MSSPs and large enterprises. To monitor and manage devices through SFM device you must:
1. Configure SFM in Sophos device.
2. Integrate Sophos device with SFM.
Once you have added the Devices and organized them into groups, you can configure single device or groups of devices.
| Using Admin Console | 9
Using Admin Console
Sophos Firewall OS uses a Web 2.0 based easy-to-use graphical interface termed as Admin Console to configure and manage the device.
You can access the device for HTTP and HTTPS web browser-based administration from any of the interfaces.
Device when connected and powered up for the first time, it will have a following default Admin Console Access configuration for HTTP and HTTPS services.
Services
HTTP
HTTPS
Interface/Zones
LAN, WAN
WAN
Default Port
TCP Port 80
TCP Port 4444
The administrator can update the default ports for HTTP and HTTPS services from System > Administration >
Settings
Admin Console Language
The Admin Console supports multiple languages, but by default appears in English. Apart from English, Chinese-
Simplified, Chinese-Traditional, Hindi, French, German, Italian, Korean and Brazilian Portuguese languages are also supported. Administrator can choose the preferred language at the time of logging.
Listed elements of Admin Console are displayed in the configured language:
• Control Center contents
• Navigation menu
• Screen elements including field & button labels and tips
• Error messages
Administrator can also specify description for various policies, services, and various custom categories in any of the supported languages.
All the configurations done from the Admin Console take effect immediately. To assist you in configuring the device, the device includes detailed context-sensitive online help.
Log on procedure
The log on procedure authenticates the user and creates a session with the Device until the user logs-off.
To get the login window, open the browser and type LAN IP Address of the device in browser’s URL box. A dialog box appears prompting you to enter username and password.
Below are the screen elements with their description:
Username
Enter user login name.
If you are logging on for the first time after installation, use the default username.
Password
Specify user account password.
Dots are the placeholders in the password field.
If you are logging on for the first time after installation with the default username, use the default password.
Language
Select the language. The available options are:
| Using Admin Console | 10
• Chinese-Simplified
• Chinese-Traditional
• English
• French
• Hindi
• German
• Italian
• Korean
• Brazilian Portuguese
Default – English
Log on to
To administer device, select Admin Console.
To login into your account, select User Portal.
Login button
Click to log on the Admin Console.
Control Center appears as soon as you log on to the Admin Console. Control Center provides a quick and fast overview of all the important parameters of your device.
Log out procedure
To avoid un-authorized users from accessing Sophos, log off after you have finished working. This will end the session and exit from device.
To log out of the device, click located at the top right of any of the Admin Console pages.
Supported Browsers
You can connect to Admin Console of the device using HTTP or a secure HTTPS connection from any management computer using one of the following web browsers:
Latest version of Firefox (recommended), latest version of Chrome, latest version of Safari, or Microsoft Internet
Explorer 9 onwards. JavaScript must be enabled.
The minimum screen resolution for the management computer is 1280 X 768.
Menus
Navigation bar on the leftmost side provides access to various configuration pages. Menu consists of sub-menus and tabs. On clicking menu item in the navigation bar, related management functions are displayed as submenu items. On clicking submenu item, all the associated tabs are displayed. To view page associated with the tab, click the required tab.
The left navigation bar expands and contracts dynamically when clicked on without navigating to a submenu. When you click on a top-level heading in the left navigation bar, it automatically expands that heading and contracts the heading for the page you are currently on, but it does not navigate away from the current page. To navigate to a new page, first click on the heading, and then click on the submenu you want navigate to.
| Using Admin Console | 11
The navigation menu includes following modules:
• Control Center - View Control Center.
• Reports - Reports provide organizations with visibility into their networks while meeting the requirements of regulatory compliance. This allows organizations not just to view information across hundreds of users, applications and protocols; it also helps them correlate the information, giving them a comprehensive view of network activity.
• Policies
• Protection
• System
• Objects
Note:
• Use F1 key for page specific help
Each section in this guide shows the menu path to the configuration page. For example, to reach the HA page, choose the System menu, then choose System Services sub-menu in the navigation bar, and then choose HA tab. Guide mentions this path as:
System > System Services > HA
Pages
A Leaf page is a page from where all the configurations can be done. The admin tab on the upper rightmost corner of every page provides access to several commonly used functions like:
1. Support: Opens the customer login page for creating a Technical Support Ticket. It is fast, easy and puts your case right into the Technical Support queue.
2. About Product: Opens the device registration information page.
3. Wizard: Opens the Network Configuration Wizard.
4. Console: Opens the Command Line Interface (CLI) console.
| Using Admin Console | 12
5. Log Viewer: Displays logs for various modules.
6. Reboot Device: Reboots the device.
7. Shutdown Device: Shut downs the device.
8. Lock: Locks the Admin Console. Admin Console is automatically locked if the device is in inactive state for more than 3 minutes. To unlock the Admin Console you need to relogin. By default, Lock functionality is disabled.
Enable Admin Session Lock from System > Administration > Settings
9. Logout: Logs out from the Admin Console.
Clicking Help hyperlink on the upper rightmost corner of every page opens the content-sensitive help page.
List Navigation Controls
The Admin Console pages display information in the form of lists and many lists are spread across the multiple pages.
Page Navigation Controls at the bottom of the list provides navigation buttons for moving through list pages with large number of entries. It displays the current page and total number of pages.
Tool Tips
To view the additional configuration information, use tool tip. Tool tip is provided for many configurable fields.
Move the pointer over the icon to view the brief configuration summary.
Notification pop-ups
A notification pop-up will be displayed at the top of the every page for error messages or action status. You can click the icon to close the pop-up.
Common Operations
Adding an Entity
| Using Admin Console | 13
You can add a new entity like policy, group, user, rule, or host by clicking the Add button available on most of the configuration pages. Clicking the Add button either opens a new page or pop-up window.
You can add new items for a entity by clicking the Add New Item button. Select items by clicking the check box and apply to add the selected items. You can also update/delete the items added.
Editing an Entity
All the editable entities are hyperlinked. You can edit any entity by clicking either the hyperlink or the icon under the Manage column.
Deleting an Entity
You can delete an entity by selecting the check box and clicking the Delete button or icon.
To delete multiple entities, select individual entity and click the Delete button.
To delete all the entities, select the check box in the heading column and click the Delete button.
Sorting Lists
To organize the list spread over multiple pages, sort the list in ascending or descending order of a column attribute.
You can sort a list by clicking a column heading.
• Ascending Order icon in a column heading indicates that the list is sorted in ascending order of the column attribute.
• Descending Order icon in a column heading indicates that the list is sorted in descending order of the column attribute.
Filtering Lists
To search specific information within the long list spread over multiple pages, filter the lists. Filtering criteria vary depending on a column data and can be a number or an IP address or part of an address, or any text string combination.
To create filter, click the Filter icon in a column heading. When a filter is applied to a column, the Filter icon changes to .
Show additional properties
By default on every page all columnar information is displayed but on certain pages where a large number of columnar information is available, all the columns cannot be displayed. It is also possible that some content may not be of use to everyone. Using Show additional properties, you can configure to display only those numbers of columns which are important to you.
Click Show additional properties and select the check box against the columns you want to display and clear the check box against the columns which you do not want to display. All the default columns are grayed and not selectable. You can also drag to reorder.
Reordering Lists
You can reorder Security Policies/Groups by dragging and dropping. On successful reordering, a status message will be displayed. Following Policies can also be reordered:
• IPS Policy Rules
• Application Filter Policy Rules
| Control Center | 14
Control Center
The Control Center appears as soon as you logon to the Admin Console.
Control Center provides a single screen snapshot of the state and health of the security system, which is easy to explore and drill.
System Panel
System panel displays the real-time state of device services, VPN connections, WAN links and performance as well as number of days since the device is up and running. Status is displayed as an icon and colored icons are used to differentiate statuses. On clicking the icon, detailed information of the services is displayed.
The icons and their various status are:
Performance Widget
IconStatus
Normal
Load Average of the Device is less than 2 units.
Warning
Load Average is between 2 to 5 units.
Alert
Load Average more than 5 units.
Unknown
On clicking the icon, the Load Average Graph of the device is displayed.
Services Widget
IconStatus
Normal
All the services are running.
Warning
One or more services has been explicitly stopped by the administrator. You can restart services from System >
Diagnostics > Services.
Alert
One or more services is not running.
You can restart services from System > Diagnostics > Services.
Unknown
On clicking the icon, the services that are stopped or dead are displayed.
Connections Widget
| Control Center | 15
IconStatus
Normal
All the WAN links are UP.
Warning
50% or less WAN links are DOWN.
Alert
50% or more WAN links are DOWN.
Unknown
On clicking the icon, details of WAN Links are displayed.
VPN Connections Widget
IconStatus
Normal
All the VPN tunnels are UP.
Warning
50% or less VPN tunnels are DOWN.
Alert
50% or more VPN tunnels are DOWN.
Unknown
On clicking the icon, details of VPN tunnels are displayed.
CPU Widget
CPU graphs allow administrator to monitor the CPU usage by the Users and System components. Maximum and
Average CPU usage is also displayed when clicked on the widget.
X-axis –Hours/Weeks/Months/Year (depending on the option selected)
Y-axis – % use
Click the widget to view details. Clicking any of the hyperlinks under System Tools and Network Utilities will redirect you to the respective page.
Memory Widget
Memory graphs allow administrator to monitor the memory usage in percentage. Graphs displays the memory used, free memory and total memory available. In addition, shows maximum and average memory usage.
X-axis – selected)
Y-axis – % use
Click the widget to view details. Clicking any of the hyperlinks under System Tools and System Tools and Network
Utilities will redirect you to the respective page.
Bandwidth Widget
Graph displays total data transfer through WAN Zone. In addition, shows maximum and average data transfer.
X axis – Hours/Days/Months/Year (depending on the option selected)
| Control Center | 16
Y-axis – Total data transfer in KBits/Second
Click the widget to view details. Clicking any of the hyperlinks under System Tools and Network Utilities will redirect you to the respective page.
Sessions Widget
Graph displays current sessions of the device. It also displays the maximum and average live connections.
Click the widget to view details. Clicking any of the hyperlinks under System Tools and Network Utilities will redirect you to the respective page.
High Availability (HA) Details
Displays HA mode configured as below:
A-A : When device is configured in Active-Active mode.
A-P (M) : When device is configured in Active-Passive mode and is acting as a Master.
A-P (S) : When device is configured in Active-Passive mode and is acting as a Slave.
Traffic Insight Panel
The section provides statistics related to network traffic processed by your device in the last 24 hours. The at a glance information helps find out who is consuming the most bandwidth, unusual traffic patterns, and most-visited websites and applications.
The statistics is displayed as bar graphs:
• Web Activity - The graph provides the user data transfer information over the last 24 hours, which helps in understanding the web surfing trend. It also displays the maximum and average amount of data transferred, in bytes, over the last 24 hours, which helps you spot unusual traffic patterns, if any. For example, if the graph displays a peak level at a certain point of time, it means the maximum amount of data transfer was done over that time period.
• Allowed App Categories - The graph displays the amount of data transferred, in bytes, for top five application categories. This information provides an administrator at a glance view of the most-used applications in the last 24 hours, which in turn helps you identify which applications consume the most bandwidth.
• Network Attacks - The graph lists top five hosts that were denied access to the network due to health reasons.
• Allowed Web Categories - The graph displays the amount of data transferred, in bytes, for top five web categories.
This information provides an administrator at a glance view of the most-visited websites in the last 24 hours, which in turn helps you identify which websites consume the most bandwidth.
• Blocked App Categories - The graph displays top five denied application categories along with number of hits per category. This way an administrator gets to know about the applications with the most number of failed access attempts.
User & Device Insights Panel
Security Heartbeat Widget
Security Heartbeat widget provides the health status of all endpoint devices. An endpoint device is an Internet-capable computer hardware device connected to Sophos Firewall OS via Sophos Cloud. The endpoint sends a heartbeat signal at regular intervals and also informs about potential threats to the Sophos Firewall OS.
If not already configured, Control Center provides
The health status of endpoint can be red, yellow or green:
• Red - Active malware detected.
• Yellow - Inactive malware detected.
• Green - No malware detected.
button to configure Security Heartbeat.
| Control Center | 17
Once Security Heartbeat is configured, all the endpoints are classified in either of the 3 status. The Security Heartbeat
Widget shows the total number of endpoints in each status.
Click the widget to view the list of all endpoints with information like hostname/IP of the source, user and state changed. Endpoints can also be veiwed based on their health status.
Advanced Threat Protection Widget
Advanced Threat Protection widget provides a snapshot of advanced threats detected in your network. ATP can help rapidly detect infected or compromised clients inside the network and raise an alert or drop the respective traffic.
•
If not already configured, Control Center provides
Once configured, the widget will have either of the two status:
button to configure ATP.
- Normal - No threats detected.
•
- Alert - It displays number of sources blocked. Clicking on it gives details like hostname/IP of the source, threat and count.
User Threat Quotient Widget
Widget displays the User Threat Quotient (UTQ) status of an organization aggregated for the last 7 days. This helps an administrator to get quick visibility of risky users, if any, who are posing security threats to the organization’s network.
•
Possible UTQ statuses:
- There are no users with risky web surfing behaviour or using infected hosts that are part of botnet.
•
- There are 13 users who are accounting for 80% of overall risk posed to the organization’s network.
Note that the number 13 here is just an example and may vary from case to case. For example, there may be a case where single user is accounting for 80% of overall risk posed to the organization’s network! Click on this icon to view the User Threat Quotient (UTQ) reports for last 7 days.
RED Widget
Widget displays number of RED tunnels established and total number of RED tunnels configured in the form of 4/8.
Click the widget to view list of RED tunnels.
Wireless APs Widget
Widget displays Active APs and total number of APs configured in the form of 2/3. Pending APs, if any will be displayed separately in a bracket in red color. Clicking the widget will redirect you to the Access Points page.
Connected Remote Users Widget
Widget displays total number of users connected remotely through SSL VPN. Clicking the widget, will redirect you to the SSL VPN Users page.
Live Users Widget
Widget displays total live users count. Clicking the widget, will redirect you to the Live Users page.
| Control Center | 18
Active Policies Panel
Active Polices panel displays information which can be used by the administrator to visualize and quantify (in terms of data volume) the security policies configured on the device. Using this information, the administrator can fine-tune the deployed policies to troubleshoot or enhance network performance. All active policies will be visible irrespective of the rights pertaining to the logged-on administrator profile.
Policy Types
Active Policies widget displays the number of policies which are being used to process the network traffic, based on the following policy types:
• Business - Displays the number of active Business Application Policies
• User - Displays the number of active User Application Policies
• Network - Displays the number of active Network Policies
Total - Displays the total number of active policies
The chart displays the volume of data (in Bytes) processed by each active policy type, in the last 24 hours. Hover over the chart area to see the volume of data processed by the active policy type. Policy type is easily recognisable, based on the following legends:
Business - Represented by Blue area on the chart
User - Represented by Red area on the chart
Network - Represented by Green area on the chart
Use the information in the chart area to determine the network saturation status and identify specific policy type causing this.
Policy Status
The number of policies, as per their current statuses are also displayed within the same widget. This is mainly for admin housekeeping purposes, also useful, where multiple administrators are working on the same device. The current statuses are based on the following categories or filters:
• Unused - Displays the number of policies which does not process any traffic on the device. The administrator may want to revise unused policies or delete them completely.
• Disabled - Displays the number of policies which are configured on the device, but disabled by the administrator.
• Changed - Displays the number of policies which have been updated recently.
• New - Displays the number of newly created policies.
Clicking any of the Policy Types or Policy Status redirect to the Policies page displaying the relevant policies.
Reports Panel
Not applicable to - CR15iNG, CR15wiNG, CR15i and CR15wi models
Depending on the Modules subscribed, at most five critical reports from the below mentioned table are displayed:
Report Name
High Risk Applications
Objectionable Websites
Web Users
Number / Data Displayed
<number of> Risky Apps seen yesterday
<number of> Objectionable websites seen yesterday
<data transfer> (in bytes) used by top
10 users yesterday
Subscription Module
Web Protection
Web Protection
Web Protection
| Control Center | 19
Report Name
Intrusion Attacks
Web Server Protection
Email Usage
Email Protection
Traffic Dashboard
Security Dashboard -
Number / Data Displayed
<number of> Intrusion attacks yesterday
<number of>Web server attacks yesterday
<data transfer> (in bytes) used
-
<number of> Spam mails yesterday
Subscription Module
Network Protection
Web Server Protection
Email Protection
Email Protection
Either Web Protection or Network
Protection
Either Web Protection or Network
Protection
Prevalent Malware Panel
Applicable to CR15iNG, CR15wiNG, CR15i and CR15wi models only
Displays lists top five malware identified by the Device, in addition to the number of occurrence per malware.
Messages Panel
Panel displays information which allows administrator to monitor and track the system events of the device. Each message displays the date and time that the event occurred.
Displays following alerts:
1. The default password for the user "admin" has not been changed. We highly recommend you to change the password. – This alert is displayed when default password for super administrator is not changed.
2. The default Admin Console password has not been changed.
3. HTTPS, SSH based management is allowed from the WAN. This is not a secure configuration. We recommend using a good password.
4. HTTP, Telnet based management is allowed from the WAN. This is not a secure configuration. We recommend using a good password.
5. Your Device is not registered.
6. The modules expired.
Symbolic representations are used for easier identification of messages.
: Indicates Alert messages.
: Indicates warnings.
: Indicates firmware download notifications.
Policies
Policies are security rule-sets to implement control over users, applications or network objects in an organization.
Using policies, you can create blanket or specialized traffic transit rules based on the requirement. Policies provide centralized management for the entire set of device security policies. Sophos Firewall implements single pane of management to secure all enterprise applications using configuration templates for various types of policies.
Following sections provide more information on the Policies menu.
•
•
•
•
•
Understanding List of Policies
Introduction
Policies are based on the following configurable templates to define the policy rules:
1.
2.
Managing Policies
You can see the entire list of added security policies from the Policies menu. Using the same menu, you can update existing policies or add new policies. To change the processing order, you can re-order policies by drag and drop action.
Note: All custom policies can be re-ordered. The order of processing is top to bottom.
On the Policies page, the following action buttons can be found.
• IPv4: Select to filter only IPv4 policies
• IPv6: Select to filter only IPv6 policies
• Enable Filter: Select to open filter view and apply the following filters for IPv4 or IPv6 policies:
1. Rule Type - Select to filter policies based on Business, User or Network
2. Source Zone - Select to filter policies based on LAN, WAN, DMZ, LOCAL, VPN or WiFi
3. Destination Zone - Select to filter policies based on LAN, WAN, DMZ, LOCAL, VPN or WiFi
4. State - Select to filter policies based on Unused, Disabled, Changed, New
5. Rule ID - Specify Rule ID to see the specific policy.
• Reset Filter (Available if filter is enabled) - Select to reset all filters
• Disable Filter (Available if filter is enabled) - Select to close filter view
• + Add Firewall Rule - Select to add a new rule among Business Application Rule, or User/Network Rule.
Default Policies
The following default policies are created with the Network Configuration Wizard during first time deployment.
1. #Default_User_Policy
2. #Default_Network_Policy
Note: Default policies cannot be disabled, deleted or re-ordered. However, you can edit default policies or insert new policies above them.
| Policies | 20
Understanding Icons
There are various action icons as well as symbolic icons on the Policies page. Meanings and associated actions of all icons are shown below.
Icons
Icons in Collapsed view
Meaning
Business Application Rule
User Rule
Network Rule
Rule ID
Traffic Shaping
Schedule
IPS
Security Heartbeat inactive
Security Heartbeat Red required. No restriction on endpoints.
Policy enabled. Click to disable the policy.
Policy disabled. Click to enable the policy.
Expand policy for more information
Icons in Expanded view
Policy ID
Edit policy
Delete policy (not applicable for default policies)
Insert a new policy above
Insert a new policy below
Move policy. To move the policy, click the icon and drag-and-drop at the required position (not applicable for default policies).
| Policies | 21
| Policies | 22
Icons Meaning
Collapse policy
Understanding the List of Policies
All added policies are available in the form of a list. Each policy in the list presents a quick snapshot of the policy.
To view policy details, click to expand the view. Which items are available in the collapsed or expanded view is shown below.
Items in collapsed view:
• Policy Name: name of the policy
• In/Out: amount of traffic (in bytes) coming in or going out using the particular policy
• Policy features: status of Schedule, heartbeat, IPS and traffic shaping
• Source: source zone
• Destination: destination zone
• What: shows protected domains/services
• Action: status of protected servers, status of web and application protection for user
Additional items in expanded view:
• ID: policy ID
• User's Policy Applied: status of application filter, web filter, AV and AS scanning, NAT policy and route through gateway, if configured
• Policy Summary: summary of the added policy
User / Network Rule
User/Network Rule is used to define access rights and protection to the network objects/hosts. In a nutshell, if you want to control traffic by source, service, destination, zone, then use a Network Rule. Additionally, the administrator has the option to attach user identity to a rule in order to customize access of assorted hosts/servers. Such an identity based rule is considered a User Rule.
You can view or add a User/Network Rule for IPv4 and IPv6 traffic.
1.
Add User / Network Rule (IPv4)
2.
Add User / Network Rule (IPv6)
Add User / Network Rule (IPv4)
This page is used to define access rights and protection to the network objects/hosts.
1. Click Policies and select IPv4. using the filter switch. Now, click on +Add Firewall Rule and User / Network
Rule.
2. Enter policy introduction for About This Rule.
Rule Position
Specify the position of the rule from the available options.
Available Options:
Top Bottom
Rule Name
Specify a name to identify the policy.
Description
Specify a policy description.
Figure 1: About This Rule
3. Specify identity details. Follow this step if you want to configure a User Rule.
Match rule based on user identity
Click to enable a policy based on the user identity.
User or Groups.(Applicable only when Match rule based on user identity is enabled)
Select the user(s) or group(s) from the list of available options.
Exclude this user activity from data accounting. (Applicable only when Match rule based on user identity is
enabled)
Click to enable/disable user traffic activity from data accounting.
By default, user’s network traffic is considered in data accounting. Select to exclude certain traffic user data accounting. The traffic allowed through this policy will not be accounted towards data transfer for the user.
Figure 2: Identity
4. Specify source details.
Zone
Select the source zone(s) allowed to the user.
Networks
Select the source network(s) allowed to the user.
A new network host can be created directly from this page itself or from the Objects > Hosts and Services >
IP Host page.
Services
Select the services(s) allowed to the user.
A new service can be created directly from this page itself or from the Objects > Hosts and Services >
Services page.
Schedule
Select the schedule allowed to the user.
A new schedule can be created directly from this page itself or from the Objects > Policies > Schedule page.
| Policies | 23
Figure 3: Source
5. Specify destination details.
Zone
Select the destination zone(s) allowed to the user.
Networks
Select the destination network(s) allowed to the user.
A new network host can be created directly from this page itself or from the Objects > Hosts and Services >
IP Host page.
Figure 4: Desctination
6. Specify the action for the network traffic.
Action
Specify an action for the rule traffic from the available options. Accept – Allow accessDrop – Silently discardReject – Deny access (“ICMP port unreachable” message is sent to the source)
When sending a response it might be possible that the response is sent using a different interface than the one on which the request was received. This may happen depending on the routing configuration done on the device.
| Policies | 24
For example: If the request is received on the LAN port using a spoofed IP address (public IP address or the
IP address not in the LAN zone network) and no specific route is defined, the device will send a response to these hosts using the default route. Hence, the response will be sent through the WAN port.
| Policies | 25
Figure 5: Action
7. Specify routing details. (Applicable only when Action for the traffic is Accept)
Rewrite source address (Masquerading)
Enable or disable to re-write the source address or specify a NAT policy.
Use Gateway Specific Default NAT Policy (Applicable only if Masquerading is enabled and Destination Zone
is selected as WAN)_
Click to override the default NAT policy with a gateway specific policy.
Override default NAT policy for specific Gateway (Applicable only if Use Gateway Specific Default NAT
Policy is enabled )
Enable to specify gateway and corresponding NAT policy. Multiple gateways and NAT policies can be added.
Use Outbound Address (Applicable when Rewrite source address is enabled)
Select the NAT policy to be applied from the list of available NAT policies.
A new NAT policy can be created directly from this page itself or from the Objects > Policies > Network
Address Translation page.
Default NAT policy is Masquerade.
Primary Gateway
Specify the primary gateway. This is applicable only if more than one gateway is defined.
Backup Gateway
Specify the backup gateway. This is applicable only if more than one gateway is defined.
DSCP Marking
Select the DSCP Marking.
DSCP (DiffServ Code Point) classifies flow of packets as they enter the local network depending upon QoS.
Flow is defined by 5 elements; source IP address, destination IP address, source port, destination port and the transport protocol.
For available options, refer to
Figure 6: Routing
8. Specify malware scanning details.
Scan FTP/HTTP
Click to enable FTP/HTTP for the traffic.
Decrypt & Scan HTTPS
Click to enable decryption and scanning for the traffic.
| Policies | 26
Figure 7: Malware Scanning
9. Specify polices for user applications. (Applicable only when Action for the traffic is Accept)
Application Control (Applicable only if Match rule based on user identity is disabled)
Select an application filter policy for the rule. A new application filter policy can be created directly from this page itself or from the Objects > Policies > Application Filter page.
Apply Application-based Traffic Shaping Policy (Applicable only if Match rule based on user identity is
disabled)
Click to restrict bandwidth for the applications categorized under the Application category.
A three step configuration is required as follows:
1. Create a traffic shaping policy on the Objects > Policies > Traffic Shaping page. Here, specify the Policy
Association as Applications.
2. Now, on this page assign the created policy to Application Control.
3. Select to enable Apply Web based Traffic Shaping Policy.
Web Filter (Applicable only if Match rule based on user identity is disabled)
Select a web filter policy for the rule.
It controls access to application like IM and P2P, VOIP.
A new web filter policy can be created directly from this page itself or from the Objects > Policies > Web
Filter Policy page.
Apply Web Category based Traffic Shaping Policy (Applicable only if Match rule based on user identity is
disabled)
Click to restrict bandwidth for the URLs categorized under the Web category.
A three step configuration is required as follows:
1. Create a traffic shaping policy on the Objects > Policies > Traffic Shaping page. Here, specify the Policy
Association as Web Categories.
2. Now, on this page assign the created policy to Web Filter.
3. Select to enable Apply Web Category based Traffic Shaping Policy.
Intrusion Prevention
Select an IPS policy for the rule. A new web filter policy can be created directly from this page itself or from the Objects > Policies > Intrusion Prevention page.
Traffic Shaping
User's traffic shaping policy will be applied automatically.
Figure 8: Policy for User Applications
10. Define logging option for the user application traffic.
Log Firewall Traffic
Click to enable logging of permitted and denied traffic.
Figure 9: Log Traffic
11. Configure security heartbeat settings. (Applicable only when Action for the traffic is Accept)
Require Security Heartbeat
Heartbeat-capable devices can be required to send information on their health status in defined intervals - this is called a heartbeat.
Based on that information, you can restrict a device's access to certain services and networks.
Enable/disable the option to require the sending of heartbeats.
Minimum Heartbeat Permitted
Select a minimum health status that a device must have to conform to this policy. Health status can be either
Green, Yellow or No Restriction. If the health criterion is not met, access and privileges defined in this policy will not be granted to the user.
Figure 10: Security Heartbeat
Add User / Network Rule (IPv6)
Use this page to add a new policy for applications accessed by your users.
1. Click Policies and select IPv6. using the filter switch. Now, click on +Add Firewall Rule and User / Network
Rule.
2. Enter policy introduction for About This Rule.
Rule Position
Specify the position of the rule from the available options.
Available Options:
Top Bottom
| Policies | 27
Rule Name
Specify a name to identify the policy.
Description
Specify a policy description.
Figure 11: About This Rule
3. Specify identity details.
Match rule based on user identity
Click to enable a policy based on the user identity.
User or Groups.(Applicable only when Match rule based on user identity is enabled)
Select the user(s) or group(s) from the list of available options.
Exclude this user activity from data accounting. (Applicable only when Match rule based on user identity is
enabled)
Click to enable/disable user traffic activity from data accounting.
By default, user’s network traffic is considered in data accounting. Select to exclude certain traffic user data accounting. The traffic allowed through this policy will not be accounted towards data transfer for the user.
| Policies | 28
Figure 12: Identity
4. Specify source details.
Zone
Select the source zone(s) allowed to the user.
Networks
Select the source network(s) allowed to the user.
A new network host can be created directly from this page itself or from the Objects > Hosts and Services >
IP Host page.
Services
Select the services(s) allowed to the user.
A new service can be created directly from this page itself or from the Objects > Hosts and Services >
Services page.
Schedule
Select the schedule allowed to the user.
A new schedule can be created directly from this page itself or from the Objects > Policy > Schedule page.
| Policies | 29
Figure 13: Source
5. Specify destination details.
Zone
Select the destination zone(s) allowed to the user.
Networks
Select the destination network(s) allowed to the user.
A new network host can be created directly from this page itself or from the Objects > Hosts and Services >
IP Host page.
Figure 14: Destination
6. Specify the action for the network traffic.
Action
Specify action for the rule traffic from the available options.
Available Options: Accept – Allow access Drop – Silently discardReject – Deny access (“ICMP port unreachable” message is sent to the source)
When sending a response it might be possible that the response is sent using a different interface than the one on which the request was received. This may happen depending on the routing configuration done on the device.
For example: If the request is received on the LAN port using a spoofed IP address (public IP address or the
IP address not in the LAN zone network) and no specific route is defined, the device will send a response to these hosts using the default route. Hence, the response will be sent through the WAN port.
| Policies | 30
Figure 15: Action
7. Specify routing details. (Applicable only when Action for the traffic is Accept)
Rewrite source address (Masquerading)
Enable or disable to re-write the source address or specify a NAT policy.
Use Gateway Specific Default NAT Policy (Applicable only if Masquerading is enabled and Destination Zone
is selected as WAN)_
Click to override the default NAT policy with a gateway specific policy.
Override default NAT policy for specific Gateway (Applicable only if Use Gateway Specific Default NAT
Policy is enabled )
Enable to specify gateway and corresponding NAT policy. Multiple gateways and NAT policies can be added.
Use Outbound Address (Applicable when Rewrite source address is enabled)
Select the NAT policy to be applied from the list of available NAT policies.
A new NAT policy can be created directly from this page itself or from the Objects > Policies > Network
Address Translation page.
Default NAT policy is Masquerade.
Primary Gateway
Specify the primary gateway. This is applicable only if more than one gateway is defined.
Backup Gateway
Specify the backup gateway. This is applicable only if more than one gateway is defined.
DSCP Marking
Select the DSCP Marking.
DSCP (DiffServ Code Point) classifies flow of packets as they enter the local network depending upon QoS.
Flow is defined by 5 elements; Source IP Address, Destination IP Address, Source port, Destination port and the transport protocol.
For available options, refer to
| Policies | 31
Figure 16: Routing
8. Specify malware scanning details.
Scan FTP/HTTP
Click to enable FTP/HTTP for the traffic.
Decrypt & Scan HTTPS
Click to enable decryption and scanning for the traffic.
Figure 17: Malware Scanning
9. Specify polices for user applications. (Applicable only when Action for the traffic is Accept)
Application Control (Applicable only if Match rule based on user identity is disabled)
Select an application filter policy for the rule. A new application filter policy can be created directly from this page itself or from the Objects > Policies > Application Filter page.
Apply Application-based Traffic Shaping Policy (Applicable only if Match rule based on user identity is
disabled)
Click to restrict bandwidth for the applications categorized under the Application category.
A three step configuration is required as follows:
1. Create a traffic shaping policy on the Objects > Policies > Traffic Shaping page. Here, specify the Policy
Association as Applications.
2. Now, on this page assign the created policy to Application Control.
3. Select to enable Apply Web based Traffic Shaping Policy.
Web Filter (Applicable only if Match rule based on user identity is disabled)
Select a web filter policy for the rule.
It controls access to application like IM and P2P, VOIP.
A new web filter policy can be created directly from this page itself or from the Objects > Policies > Web
Filter Policy page.
Apply Web Category based Traffic Shaping Policy (Applicable only if Match rule based on user identity is
disabled)
Click to restrict bandwidth for the URLs categorized under the Web category.
A three step configuration is required as follows:
1. Create a traffic shaping policy on the Objects > Policies > Traffic Shapingpage. Here, specify the Policy
Association as Web Categories.
2. Now, on this page assign the created policy to Web Filter .
3. Select to enable Apply Web Category based Traffic Shaping Policy.
Intrusion Prevention (IPS)
Select an IPS policy for the rule. A new web filter policy can be created directly from this page itself or from the Objects > Policies > Intrusion Prevention page.
Traffic Shaping Policy
User's traffic shaping policy will be applied automatically.
| Policies | 32
Figure 18: Policy for User Applications
10. Define logging option for the user application traffic.
Log Firewall Traffic
Click to enable logging of permitted and denied traffic.
Figure 19: Log Traffic
DSCP Value
DiffServ Code Point (DSCP) uses the 6 bits, thereby giving 2^6 = 64 different values (0 to 63). describes the standard
DSCP values. Remaining DSCP values can be customized as per the QoS requirement.
Decimal
14
16
18
20
0
8
10
12
22
24
26
28
30
DSCP
AF23
CS3
AF31
AF32
AF33
Default
CS1
AF11
AF12
AF13
CS2
AF21
AF22
Description
Best Effort
Class 1 (CS1)
Class 1, Gold (AF11)
Class 1, Silver (AF12)
Class 1, Bronze (AF13)
Class 2 (CS2)
Class 2, Gold (AF21)
Class 2, Silver (AF22)
Class 2, Bronze (AF23)
Class 3 (CS3)
Class 3, Gold (AF31)
Class 3, Silver (AF32)
Class 3, Bronze (AF33)
| Policies | 33
Decimal
40
46
48
56
32
34
36
38
DSCP
CS5
EF
CS6
CS7
CS4
AF41
AF42
AF43
Description
Class 4 (CS4)
Class 4, Gold (AF41)
Class 4, Silver (AF42)
Class 4, Bronze (AF43)
Class 5 (CS5)
Expedited Forwarding (EF)
Control (CS6)
Control (CS7)
Business Application Rule
Business Application Rule
Business Application Rule is used to protect all internally or publicly hosted business applications or servers like
SalesForce, Sharepoint etc. Using Business Application Rule, the administrator can configure protection of the HTTP/
Non-HTTP/Public Non-HTTP servers from unauthorized access over the Internet. In a nutshell, if you are securing a server or service, use a Business Application Rule to allow internal or external users to access that service.
Business Application Rule provides three configurable templates:
1.
- HTTP Based policy is used to protect HTTP or generic web application servers hosted in the network. HTTP Based policy configuration is essentially WAF implementation but with additional benefit of defining WAF objects, rules, exceptions from the same page.
Sophos Firewall offers several pre-configured templates to address commonly used HTTP based applications. You can use these to create policy for the web application, that is close to your configuration, then modify it to fit your needs. Pre-defined HTTP application templates include:
•
•
•
•
•
Microsoft Remote Desktop Gateway 2008 and R2
•
Microsoft Remote Desktop Web 2008 and R2
•
Microsoft Sharepoint 2010 and 2013
2.
- Non-HTTP Based policy is used to protect Non-HTTP servers, like mail or other
servers hosted inside the network (LAN or DMZ). Using Non-HTTP Based policy, you can define access rights of such servers to users who require access over the WAN or Internet. Additionally, you can use the following Non-
HTTP application template:
•
3.
- Email Clients (POP and IMAP) policy is used to protect mail servers which are
hosted publicly (WAN) and require protection.
Adding a Business Application Rule
Click Policies and select IPv4 using the filter switch. Now, click on +Add Firewall Rule and select Business
Application Rule. In the About this Rule section, you can select the Application Template from the list of available templates.
The application template allows you to choose the rule which suits the configuration of the required business application. Once you select the template, you can see the configuration page with few fields pre-populated. The prepopulated values eliminate the need to manually specify the configuration for securing your business application, but you may customize the settings according to your network setup or other requirements.
Add Business Application Rule (HTTP- Based)
Applicable only for IPv4 policy
The Business Application Policy (HTTP-Based) page allows you to configure a policy for controlling access to
HTTP-based business applications.
1. Click Policies and select IPv4 using the filter switch. Now, click on +Add Firewall Rule and select Business
Application Rule.
2. Enter policy introduction for About This Rule.
Rule Position
Specify the position of the rule.
Available Options:
• Top
• Bottom
Application Template
Select HTTP Based Policy to define an application filter policy for HTTP based applications.
Rule Name
Specify a name to identify the policy.
Description
Specify a policy description.
| Policies | 34
Figure 20: About this Rule
3. Specify Hosted Server details.
Hosted Address
Select the interface of the hosted server to which the rule applies. It is the public IP address through which
Internet users access the internal server/host.
HTTPS
Click to enable or disable scanning of HTTPS traffic.
Redirect HTTP (Applicable when HTTPS is enabled)
Click to redirect HTTP requests.
Listening Port
Enter a port number on which the hosted web server can be reached externally, over the Internet. Default is port 80 with Plain text (HTTP) and port 443 with Encrypted (HTTPS).
HTTPS Certificate (Applicable when HTTPS is enabled)
Select the HTTPS certificate to be used for scanning.
Domains
(Applicable when HTTPS is disabled):Enter the domains the web server is responsible for as FQDN, e.g. shop.example.com. You can use an asterisk (*) as a wild card for the prefix of the domain, e.g.,*.mydomain.com. Domains with wild cards are considered as fallback settings: The hosted web server with the wild card domain entry is only used when no other hosted web server with a more specific domain name is configured. Example: A client request to a.b.c will match a.b.c before *.b.c before *.c.
(Applicable when HTTPS is enabled): According to the selected HTTPS certificate, some domains may be preselected. You can edit or delete these domains or add new ones.
| Policies | 35
Figure 21: Hosted Server
4. Specify Protected Application Server(s) details.
Enable path-specific routing
You can enable path-specific routing to define (a path) to which web servers incoming requests are forwarded.
You can define that all URLs with a specific path, for example, /products/, are sent to a specific web server.
On the other hand you can allow more than one web server for a specific request but add rules how to distribute the requests among the servers. Additionally, you can define that each session is bound to one web server throughout its lifetime (sticky session). This may be necessary if you host an online shop and want to make sure that a user sticks to one server during the shopping session. You can also configure to send all requests to one web server and use the others only as a backup.
For each hosted web server, one default site path route (with path /) is created automatically. The device automatically applies the site path routes in the most reasonable way: starting with the strictest, i.e., longest paths and ending with the default path route which is only used if no other more specific site path route
matches the incoming request. The order of the site path route list is not relevant. If no route matches an incoming request, (in case the default route was deleted), the request will be denied.
Add New Path (Applicable when path-specific routing is enabled)
Click Add Path to define a new path.
Note: Add New Path will be active only after at least one web server and one hosted web server have been created.
Web Server(Applicable when path-specific routing is disabled)
With this option, you select the web servers that are to be protected. Select a web server from the list. The selected web server is displayed on the the right side of the table under Selected Web Servers.
A new web server can be createdon the Objects > Assets > Web Servers page.
| Policies | 36
Figure 22: Protected Application Server(s)
5. Specify Access Permission details (only available if Enable path-specific routing is disabled).
Authentication
Select the Web App Authentication profile. Select Create new to create a new authentication profile. You can also create an authentication profile on the Objects > Policies > Web App Authentication page or the
Protection > Web Server Protection > Web App Authentication Policies page.
Add Web App Authentication Policies
on page 136
Allow From
Select or add the allowed networks that should be able to connect to the hosted web server.
Block From
Select or add the denied networks that should be blocked to your hosted web server.
Figure 23: Access Permission
6. Specify path Exceptions for the web servers. Click Add New Exception to specify a new exception.
Figure 24: Exceptions
7. Specify Polices for Business Applications.
Application Protection
Select an application protection for the server or create a new one. A new application protection can be created directly on this page or on the Objects > Policies > Web App Protection page. You can also choose to have None application protection.
Intrusion Prevention (IPS)
Select an IPS policy for the rule or create a new one. A new IPS policy can be created directly on this page or on the Objects > Policies > Intrusion Prevention page. You can also choose to have None intrusion prevention.
Traffic Shaping
The traffic shaping policy allocates & limits the maximum bandwidth usage of the user.
Select a traffic shaping policy for the rule or create a new one. A new traffic shaping policy can be created directly on this page or on the Objects > Policies > Traffic Shaping page. You can also choose to have None traffic shaping.
| Policies | 37
Figure 25: Policies for Buisness Applications
8. Specify Advanced settings for the added server.
Disable Compression Support
By default, this checkbox is disabled and the content is sent compressed when the client requests compressed data. Compression increases transmission speed and reduces page load time. However, in case of websites being displayed incorrectly or when users experience content-encoding errors accessing your web servers, it can be necessary to disable compression support. When the checkbox is enabled, the WAF will request uncompressed data from the web servers of this hosted web server and will pass it on uncompressed to the client, regardless of the HTTP request's encoding parameter.
Rewrite HTML
Select this option to have the device rewrite links of the returned webpages in order for the links to stay valid.
Example: One of your web server instances has the hostname yourcompany.local but the hosted web server's hostname on the device is yourcompany.com. Thus, absolute links like [a href="http://yourcompany.local/"] will be broken if the link is not rewritten to [a href="http://yourcompany.com/"] before delivery to the client.
However, you do not need to enable this option if either yourcompany.com is configured on your web server or if internal links on your webpages are always realized as relative links. It is recommended to use the option with Microsoft's Outlook web access and/or SharePoint portal server.
Note: HTML rewriting affects all files with a HTTP content type of text/* or *xml*, where * is a wildcard. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the HTML rewriting process.
Rewrite cookies (Applicable only if Rewrite HTML is enabled)
Select this option to have the device rewrite cookies of the returned webpages.
Pass Host Header
When you select this option, the host header as requested by the client will be preserved and forwarded along with the web request to the web server. Whether passing the host header is necessary in your environment depends on the configuration of your web server.
Figure 26: Advanced
9. Click Save.
| Policies | 38
The business application rule has been created and appears on the Policies page when the IPv4 filter is set.
Exchange Autodiscover
Applicable only for IPv4 policy.
This page allows you to configure a rule for Exchange Autodiscover.
1. Click Policies and select IPv4 using the filter switch. Now, click on +Add Firewall Rule and Business
Application Rule.
2. Enter policy introduction for About This Rule.
Rule Position
Specify the position of the rule.
Available Options: TopBottom
Application Template
Select Exchange Autodiscover to configure a policy for an Exchange Autodiscover environment.
Rule Name
Specify a name to identify the policy.
Description
Specify a policy description.
| Policies | 39
Figure 27: About This Rule
3. Specify Hosted Server details.
Hosted Address
Specify the address of the hosted server to which the rule applies. It is the public IP address through which
Internet users access an internal server/host.
Available Options:IP Address – Specified IP address is mapped to a corresponding mapped single IP address or a range of IP addresses. If a single IP address is mapped to a range of IP addresses, the device uses round robin algorithm to load balance the requests.IP Range – Specified IP address range is mapped to a corresponding range of mapped IP addresses. The IP range defines the start and end of an address range. The start of the range must be lower than the end of the range.Interface IP – Select when any of the device port, alias or hosted LAN (VLAN) sub-interface is required to be mapped to the destination host or network. This option is only available for the IPv4 family.
HTTPS
Click to enable or disable scanning of HTTPS traffic.
Redirect HTTP (Applicable when HTTPS is enabled)
Click to redirect HTTP requests.
Listening Port
Enter a port number on which the hosted web server can be reached externally, over the Internet. Default is port 80 with Plain text (HTTP) and port 443 with Encrypted (HTTPS).
Domains (Applicable when HTTPS is disabled)
Enter the domains the web server is responsible for as FQDN, e.g. shop.example.com, or use the Action icon to import a list of domain names. You can use an asterisk (*) as a wild card for the prefix of the domain, e.g.,*.mydomain.com. Domains with wild cards are considered as fallback settings: The hosted web server with the wild card domain entry is only used when no other hosted web server with a more specific domain name is configured. Example: A client request to a.b.c will match a.b.c before *.b.c before *.c.
HTTPS Certificate (Applicable when HTTPS is enabled)
Select the HTTPS certificate to be used for scanning.
| Policies | 40
Figure 28: Hosted Server
4. Specify Protected Application Server(s) details.
Enable path-specific routing
You can enable path-specific routing to define (path) to which Web Servers incoming requests are forwarded.
You can define that all URLs with a specific path, for example, /products/, are sent to a specific web server.
On the other hand you can allow more than one web server for a specific request but add rules how to distribute the requests among the servers. Additionally, you can define that each session is bound to one web server throughout its lifetime (sticky session). This may be necessary if you host an online shop and want to make sure that a user sticks to one server during the shopping session. You can also configure to send all requests to one web server and use the others only as a backup.
For each hosted web server, one default site path route (with path /) is created automatically. The device automatically applies the site path routes in the most reasonable way: starting with the strictest, i.e., longest paths and ending with the default path route which is only used if no other more specific site path route matches the incoming request. The order of the site path route list is not relevant. If no route matches an incoming request, (in case the default route was deleted), the request will be denied.
Default - Enabled.
Add New Path(Applicable when path-specific routing is enabled)
Click Add New Path to define a new path.
Note: Add New Path will be active only after at least one web server and one hosted web server have been created.
Default - /autodiscover, /Autodiscover, /AutoDiscover.
Web Server(Applicable when path-specific routing is disabled)
Web servers are the application servers to be protected. Select from the list of web servers or click Add New
Item to add a web server.
A new web server can be created directly from this page itself or from the Objects > Assets > Web Servers page.
| Policies | 41
Figure 29: Protected Application Server(s)
5. Specify access permission details. This step is applicable if Enable path-specific routing is disabled.
Authentication
Select the web application authentication profile from the list of available profiles. You can also create new authentication profile on the same page or from the Protection > Web Server Protection > Web App
Authentication Policies page.
Allow from
Select the allowed host(s)/network(s).
Block from
Select the blocked host(s)/network(s).
Figure 30: Access Permission
6. Specify path Exceptions for the Web Servers. Click Add New Exception to specify new exception.
Default - /autodiscover/*,/Autodiscover/*.
Figure 31: Exceptions
7. Specify Polices for Business Applications.
Application Protection
Select Application Protection for the server.
A new Application Protection can be created directly from this page itself or from Objects > Policies > Web
App Protection page.
Default - ExchangeAutoDiscover
Intrusion Prevention
Select an IPS policy for the rule. A new IPS policy can be created directly from this page itself or from the
Objects > Policies > Intrusion Prevention page.
Traffic Shaping
Select a traffic shaping policy for the rule.
A traffic shaping policy allocates & limits the maximum bandwidth usage of the user.
A new traffic shaping policy can be created directly from this page itself or from the Objects > Policies >
Traffic Shaping page.
| Policies | 42
Figure 32: Policies for Buisness Applications
8. Specify Advanced settings for the added server.
Disable Compression Support
By default, this checkbox is disabled and the content is sent compressed when the client requests compressed data. Compression increases transmission speed and reduces page load time. However, in case of websites being displayed incorrectly or when users experience content-encoding errors accessing your web servers, it can be necessary to disable compression support. When the checkbox is enabled, the WAF will request uncompressed data from the web servers of this hosted web server and will send it on uncompressed to the client, independent of the HTTP request's encoding parameter.
Default - Disabled.
Rewrite HTML
Select this option to have the device rewrite links of the returned webpages in order for the links to stay valid.
Example: One of your web server instances has the hostname yourcompany.local but the hosted web server's hostname on the device is yourcompany.com. Thus, absolute links like [a href="http://yourcompany.local/"] will be broken if the link is not rewritten to [a href="http://yourcompany.com/"] before delivery to the client.
However, you do not need to enable this option if either yourcompany.com is configured on your web server or if internal links on your webpages are always realized as relative links. It is recommended to use the option with Microsoft's Outlook web access and/or SharePoint portal server.
Note: HTML rewriting affects all files with a HTTP content type of text/* or *xml*, where * is a wild card. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the HTML rewriting feature.
Default - Disabled.
Rewrite cookies (Applicable only if Rewrite HTML is enabled)
Select this option to have the device rewrite cookies of the returned webpages.
Note: If Rewrite HTML is disabled the Rewrite cookies option will be also disabled.
Pass Host Header
When you select this option, the host header as requested by the client will be preserved and forwarded along with the web request to the web server. Whether passing the host header is necessary in your environment however depends on the configuration of your web server.
Default - Enabled.
| Policies | 43
Figure 33: Advanced
Exchange Outlook Anywhere
Applicable only for IPv4 policy.
This page allows you to configure a rule for Exchange Outlook Anywhere.
1. Click Policies and select IPv4 using the filter switch. Now, click on +Add Firewall Rule and select Business
Application Rule.
2. Enter policy introduction for About This Rule.
Rule Position
Specify the position of the rule.
Available Options: TopBottom
Application Template
Select Exchange Outlook Anywhere to configure rule for Exchange Outlook Anywhere.
Rule Name
Specify a name to identify the policy.
Description
Specify a policy description.
Figure 34: About This Rule
3. Specify Hosted Server details.
Hosted Address
Specify the address of the hosted server to which the rule applies. It is the public IP address through which
Internet users access an internal server/host.
Available Options:IP Address – Specified IP address is mapped to a corresponding mapped single IP address or a range of IP addresses. If a single IP address is mapped to a range of IP addresses, the device uses round robin algorithm to load balance the requests.IP Range – Specified IP address Range is mapped to a corresponding range of mapped IP addresses. The IP range defines the start and end of an address range. The start of the range must be lower than the end of the range.Interface IP – Select when any of the device port, alias or hosted LAN (VLAN) sub-interface is required to be mapped to the destination host or network. This option is only available for the IPv4 family.
HTTPS
Click to enable or disable scanning of HTTPS traffic.
Redirect HTTP (Applicable when HTTPS is enable)
Click to redirect HTTP requests.
Listening Port
Enter a port number on which the hosted web server can be reached externally, over the Internet. Default is port 80 with Plain text (HTTP) and port 443 with Encrypted (HTTPS).
Domains (Applicable when HTTPS is disabled)
Enter the domains the web server is responsible for as FQDN, e.g. shop.example.com, or use the Action icon to import a list of domain names. You can use an asterisk (*) as a wild card for the prefix of the domain, e.g.,*.mydomain.com. Domains with wild cards are considered as fallback settings: The hosted web server with the wild card domain entry is only used when no other hosted web server with a more specific domain name is configured. Example: A client request to a.b.c will match a.b.c before *.b.c before *.c.
HTTPS Certificate (Applicable when HTTPS is enabled)
Select the HTTPS certificate to be used for scanning.
| Policies | 44
Figure 35: Hosted Server
4. Specify Protected Application Server(s) details.
Enable path-specific routing
You can enable path-specific routing to define (path) to which web servers incoming requests are forwarded.
You can define that all URLs with a specific path, for example, /products/, are sent to a specific web server.
On the other hand you can allow more than one web server for a specific request but add rules how to distribute the requests among the servers. Additionally, you can define that each session is bound to one web server throughout its lifetime (sticky session). This may be necessary if you host an online shop and want to make sure that a user sticks to one server during the shopping session. You can also configure to send all requests to one web server and use the others only as a backup.
For each hosted web server, one default site path route (with path /) is created automatically. The device automatically applies the site path routes in the most reasonable way: starting with the strictest, i.e., longest paths and ending with the default path route which is only used if no other more specific site path route matches the incoming request. The order of the site path route list is not relevant. If no route matches an incoming request, (in case the default route was deleted), the request will be denied.
Add New Path(Applicable when path-specific routing is enabled)
Click Add New Path to define a new path.
Note: Add New Path will be active only after at least one web server and one hosted web server have been created.
Default - /rpc, /RPC.
Default paths - /rpc, /RPC.
Web Server(Applicable when path-specific routing is disabled)
Web servers are the application servers that are to be protected. Select from the list of web servers or click
Add New Item to add a web server.
A new web server can be created directly from this page itself or from the Objects > Assets > Web Servers page.
| Policies | 45
Figure 36: Protected Application Server(s)
5. Specify access permission details. This step is applicable if Enable path-specific routing is disabled.
Authentication
Select the web application Authentication profile from the list of available profiles. You can also create new authentication profile the same page or from the Protection > Web Server Protection > Web App
Authentication Policies page.
Allow from
Select the allowed host(s)/network(s).
Block from
Select the blocked host(s)/network(s).
Figure 37: Access Permission
6. Specify path Exceptions for the Web Servers. Click Add New Exception to specify new exception.
Default - /rpc/*,/RPC/*.
| Policies | 46
Figure 38: Exceptions
7. Specify Polices for Business Applications.
Application Protection
Select Application Protection for the server.
A new application protection can be created directly from this page itself or from the Objects > Policies >
Web App Protection page.
Default - Exchange Outlook Anywhere.
Intrusion Prevention
Select an IPS policy for the rule. A new IPS policy can be created directly from this page itself or from the
Objects > Policies > Intrusion Prevention page.
Traffic Shaping
Select a traffic shaping policy for the rule.
A traffic shaping policy allocates & limits the maximum bandwidth usage of the user.
A new traffic shaping policy can be created directly from this page itself or from the Objects > Policies >
Traffic Shaping page.
Figure 39: Policies for Buisness Applications
8. Specify Advanced settings for the added server.
Disable Compression Support
By default, this checkbox is disabled and the content is sent compressed when the client requests compressed data. Compression increases transmission speed and reduces page load time. However, in case of websites being displayed incorrectly or when users experience content-encoding errors accessing your web servers, it can be necessary to disable compression support. When the checkbox is enabled, the WAF will request uncompressed data from the web servers of this hosted web server and will send it on uncompressed to the client, independent of the HTTP request's encoding parameter.
Rewrite HTML
Select this option to have the device rewrite links of the returned webpages in order for the links to stay valid.
Example: One of your web server instances has the hostname yourcompany.local but the hosted web server's hostname on the device is yourcompany.com. Thus, absolute links like [a href="http://yourcompany.local/"] will be broken if the link is not rewritten to [a href="http://yourcompany.com/"] before delivery to the client.
However, you do not need to enable this option if either yourcompany.com is configured on your web server or if internal links on your webpages are always realized as relative links. It is recommended to use the option with Microsoft's Outlook web access and/or SharePoint portal server.
| Policies | 47
Note: HTML rewriting affects all files with a HTTP content type of text/* or *xml*, where * is a wildcard. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the HTML rewriting feature.
Default - Disabled.
Rewrite cookies (Applicable only if Rewrite HTML is enabled)
Select this option to have the device rewrite cookies of the returned webpages.
Note: If Rewrite HTML is disabled the Rewrite cookies option will be also disabled.
Pass Host Header
When you select this option, the host header as requested by the client will be preserved and forwarded along with the web request to the web server. Whether passing the host header is necessary in your environment however depends on the configuration of your web server.
Default - Disabled.
| Policies | 48
Figure 40: Advanced
Exchange General
Applicable only for IPv4 policy.
This page allows you to configure a rule for Exchange General.
1. Click Policies and select IPv4 using the filter switch. Now, click on +Add Firewall Rule and select Business
Application Rule.
2. Enter policy introduction for About This Rule.
Rule Position
Specify the position of the rule.
Available Options: TopBottom
Application Template
Select Exchange General to configure a rule for Exchange General.
Rule Name
Specify a name to identify the policy.
Description
Specify a policy description.
Figure 41: About This Rule
3. Specify Hosted Server details.
Hosted Address
Specify the address of the hosted server to which the rule applies. It is the public IP address through which
Internet users access an internal server/host.
Available Options:IP Address – Specified IP address is mapped to a corresponding mapped single IP address or a range of IP addresses. If a single IP address is mapped to a range of IP addresses, the device uses round robin algorithm to load balance the requests.IP Range – Specified IP address range is mapped to a corresponding range of mapped IP addresses. The IP range defines the start and end of an address range. The start of the range must be lower than the end of the range.Interface IP – Select when any of the device port, alias or hosted LAN (VLAN) sub-interface is required to be mapped to the destination host or network. This option is only available for the IPv4 family.
HTTPS
Click to enable or disable scanning of HTTPS traffic.
Redirect HTTP (Applicable when HTTPS is enable)
Click to redirect HTTP requests.
Listening Port
Enter a port number on which the hosted web server can be reached externally, over the Internet. Default is port 80 with Plain text (HTTP) and port 443 with Encrypted (HTTPS).
Domains (Applicable when HTTPS is disabled)
Enter the domains the web server is responsible for as FQDN, e.g. shop.example.com, or use the Action icon to import a list of domain names. You can use an asterisk (*) as a wild card for the prefix of the domain, e.g.,*.mydomain.com. Domains with wild cards are considered as fallback settings: The hosted web server with the wild card domain entry is only used when no other hosted web server with a more specific domain name is configured. Example: A client request to a.b.c will match a.b.c before *.b.c before *.c.
HTTPS Certificate (Applicable when HTTPS is enabled)
Select the HTTPS certificate to be used for scanning.
| Policies | 49
Figure 42: Hosted Server
4. Specify Protected Application Server(s) details.
Enable path-specific routing
You can enable path-specific routing to define (path) to which web servers incoming requests are forwarded.
You can define that all URLs with a specific path, for example, /products/, are sent to a specific web server.
On the other hand you can allow more than one web server for a specific request but add rules how to distribute the requests among the servers. Additionally, you can define that each session is bound to one web server throughout its lifetime (sticky session). This may be necessary if you host an online shop and want to make sure that a user sticks to one server during the shopping session. You can also configure to send all requests to one web server and use the others only as a backup.
For each hosted web server, one default site path route (with path /) is created automatically. The device automatically applies the site path routes in the most reasonable way: starting with the strictest, i.e., longest paths and ending with the default path route which is only used if no other more specific site path route matches the incoming request. The order of the site path route list is not relevant. If no route matches an incoming request, (in case the default route was deleted), the request will be denied.
Add New Path(Applicable when path-specific routing is enabled)
Click Add New Path to define a new path.
Note: Add New Path will be active only after at least one web server and one hosted web server have been created.
Default - /owa, /OWA, /ecp, /ECP, /oab, /OAB, /ews, /EWS, /oma, /OMA, /Microsoft-Server-ActiveSync.
Web Servers (Applicable when path-specific routing is disabled)
Web servers are the application servers that are to be protected. Select from the list of web servers or click
Add New Item to add a web server.
A new web server can be created directly from this page itself or from the Objects > Assets > Web Servers page.
| Policies | 50
Figure 43: Protected Application Server(s)
5. Specify access permission details. This step is applicable on if Enable path-specific routing is disabled.
Authentication
Select the web application authentication profile from the list of available profiles. You can also create new authentication profile the same page or from the Protection > Web Server Protection > Web App
Authentication Policies page.
Allow from
Select the allowed host(s)/network(s).
Block from
Select the blocked host(s)/network(s).
| Policies | 51
Figure 44: Access Permission
6. Specify path exceptions for the web servers.
Click Add New Exception to specify a new exception.
Default - /owa/*,/OWA/*,/ews/*,/EWS/*,/ecp/*,/ECP/*,/oab/*,/OAB/*,/oma/*,/OMA/*,/Microsoft-Server-
ActiveSync?*, /owa/ev.owa*.
Figure 45: Exceptions
7. Specify Polices for Business Applications.
Application Protection
Select Application Protection for the server.
A new application protection can be created directly from this page itself or from the Objects > Policies >
Web App Protection page.
Default - Exchange General.
Intrusion Prevention
Select an IPS policy for the rule. A new IPS policy can be created directly from this page itself or from the
Objects > Policies > Intrusion Prevention page.
Traffic Shaping
Select a traffic shaping policy for the rule.
A traffic shaping policy allocates & limits the maximum bandwidth usage of the user.
A new traffic shaping policy can be created directly from this page itself or from the Objects > Policies >
Traffic Shaping page.
| Policies | 52
| Policies | 53
Figure 46: Policies for Buisness Applications
8. Specify Advanced settings for the added server.
Disable Compression Support
By default, this checkbox is disabled and the content is sent compressed when the client requests compressed data. Compression increases transmission speed and reduces page load time. However, in case of websites being displayed incorrectly or when users experience content-encoding errors accessing your web servers, it can be necessary to disable compression support. When the checkbox is enabled, the WAF will request uncompressed data from the web servers of this hosted web server and will send it on uncompressed to the client, independent of the HTTP request's encoding parameter.
Default - Disabled.
Rewrite HTML
Select this option to have the device rewrite links of the returned webpages in order for the links to stay valid.
Example: One of your web server instances has the hostname yourcompany.local but the hosted web server's hostname on the device is yourcompany.com. Thus, absolute links like [a href="http://yourcompany.local/"] will be broken if the link is not rewritten to [a href="http://yourcompany.com/"] before delivery to the client.
However, you do not need to enable this option if either yourcompany.com is configured on your web server or if internal links on your web pages are always realized as relative links. It is recommended to use the option with Microsoft's Outlook web access and/or SharePoint portal server.
Note: HTML rewriting affects all files with a HTTP content type of text/* or *xml*, where * is a wild card. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the HTML rewriting feature.
Rewrite cookies (Applicable only if Rewrite HTML is enabled)
Select this option to have the device rewrite cookies of the returned webpages.
Note: If Rewrite HTML is disabled the Rewrite cookies option will be also disabled.
Default - Disabled.
Pass Host Header
When you select this option, the host header as requested by the client will be preserved and forwarded along with the web request to the web server. Whether passing the host header is necessary in your environment however depends on the configuration of your web server.
Default - Disabled.
Figure 47: Advanced
Microsoft Lync
Applicable only for IPv4 policy. Use Business Application (HTTP-Based) page to add a Policy for HTTP-based business applications.
The Business Application Policy (HTTP-Based) page allows you to configure policy for controlling access to Non-
HTTP-based business applications.
1. Click Policies and select IPv4 using the filter switch. Now, click on +Add New Policy and select Business
Application Policy.
2. Enter policy introduction for About This Rule.
Rule Position
Specify the position of the rule.
Available Options: TopBottom
Application Template
Select Microsoft Lync to define Application filter policy for HTTP based applications.
Rule Name
Specify a name to identify the policy.
Description
Specify Policy Description.
| Policies | 54
Figure 48: About This Rule
3. Specify Hosted Server details.
Hosted Address
Specify the address of the hosted server to which the rule applies. It is the public IP Address through which
Internet users access internal server/host.
Available Options:
IP Address – Specified IP Address is mapped to a corresponding mapped single or range of IP Address. If single IP Address is mapped to a range of IP Address, device uses round robin algorithm to load balance the
requests.IP Range – Specified IP Address Range is mapped to a corresponding range of mapped IP Address.
The IP range defines the start and end of an address range. The start of the range must be lower than the end of the range.Interface IP – Select when any of the device Port, Alias or Hosted LAN (VLAN) sub interface is required to be mapped to the destination host or network. This option is only available for IPv4 family.
HTTPS
Click to Enable or Disable scanning of HTTPS traffic.
Redirect HTTP (Applicable when HTTPS is enable)
Click to redirect HTTP requests.
Listening Port
Enter a port number on which the Hosted web server can be reached externally, over the Internet. Default is port 80 with Plaintext (HTTP) and port 443 with Encrypted (HTTPS).
Domains (Applicable when HTTPS is disabled)
Enter the domains the web server is responsible for as FQDN, e.g. shop.example.com, or use the Action icon to import a list of domain names. You can use an asterisk (*) as a wildcard for the prefix of the domain, e.g.,*.mydomain.com. Domains with wildcards are considered as fallback settings: The Hosted web server with the wildcard domain entry is only used when no other Hosted web server with a more specific domain name is configured. Example: A client request to a.b.c will match a.b.c before *.b.c before *.c.
HTTPS Certificate (Applicable when HTTPS is enabled)
Select the HTTPS Certificate to be used for scanning.
| Policies | 55
Figure 49: Hosted Server
4. Specify Protected Application Server(s) details.
Enable path-specific routing
You can enable path-specific routing to define (path) to which Web Servers incoming requests are forwarded.
You can define that all URLs with a specific path, for example, /products/, are sent to a specific web server.
On the other hand you can allow more than one web server for a specific request but add rules how to distribute the requests among the servers. Additionally, you can define that each session is bound to one web server throughout its lifetime (sticky session). This may be necessary if you host an online shop and want to make sure that a user sticks to one server during the shopping session. You can also configure to send all requests to one web server and use the others only as a backup.
For each Hosted web server, one default site path route (with path /) is created automatically. The device automatically applies the site path routes in the most reasonable way: starting with the strictest, i.e., longest paths and ending with the default path route which is only used if no other more specific site path route matches the incoming request. The order of the site path route list is not relevant. If no route matches an incoming request, (in case the default route was deleted), the request will be denied.
Add New Path(Applicable when path-specific routing is enabled)
Click Add Path to define a new path.
Note: Add New Path will be active only after at least one Web Server and one Hosted web server have been created.
Hosts(Applicable when path-specific routing is disabled)
Hosts are the Web Servers that are to be protected. Select from the list of Web Servers or click Add New
Item to add a Web Server.
A new Web Server can be created directly from this page itself or from Objects > Assets > Web Servers page.
| Policies | 56
Figure 50: Protected Application Server(s)
5. Specify path Exceptions for the Web Servers. Click Add New Exception to specify new exception.
Figure 51: Exceptions
6. Specify Polices for Business Applications.
Application Protection
Select Application Protection for the server.
A new Application Protection can be created directly from this page itself or from Objects > Policies > Web
App Protection page.
Intrusion Prevention (IPS)
Select IPS Policy for the rule. A new IPS Policy can be created directly from this page itself or from
Objects > Policies > IPS page.
Traffic Shaping
Select Traffic Shaping policy for the rule.
Traffic Shaping policy allocates & limits the maximum bandwidth usage of the user.
A new Traffic Shaping Policy can be created directly from this page itself or from Objects > Policies >
Traffic Shaping page.
| Policies | 57
Figure 52: Policies for Buisness Applications
7. Specify Advanced settings for the added server.
Disable Compression Support
By default, this checkbox is disabled and the content is sent compressed when the client requests compressed data. Compression increases transmission speed and reduces page load time. However, in case of websites being displayed incorrectly or when users experience content-encoding errors accessing your web servers, it can be necessary to disable compression support. When the checkbox is enabled, the WAF will request uncompressed data from the Web Servers of this Hosted web server and will send it on uncompressed to the client, independent of the HTTP request's encoding parameter.
Rewrite HTML
Select this option to have the device rewrite links of the returned webpages in order for the links to stay valid.
Example: One of your Web Server instances has the hostname yourcompany.local but the Hosted web server's hostname on the device is yourcompany.com. Thus, absolute links like [a href="http://yourcompany.local/"] will be broken if the link is not rewritten to [a href="http://yourcompany.com/"] before delivery to the client.
However, you do not need to enable this option if either yourcompany.com is configured on your web server or if internal links on your webpages are always realized as relative links. It is recommended to use the option with Microsoft's Outlook Web Access and/or Sharepoint Portal Server.
Note: HTML rewriting affects all files with a HTTP content type of text/* or *xml*, where * is a wildcard. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the HTML rewriting feature.
Rewrite HTML Cookies (Applicable only if Rewrite HTML is enabled)
Select this option to have the device rewrite cookies of the returned webpages.
Note: If Rewrite HTML is disabled the Rewrite Cookie option will be also disabled.
Pass Host Header
When you select this option, the host header as requested by the client will be preserved and forwarded along with the web request to the web server. Whether passing the host header is necessary in your environment however depends on the configuration of your web server.
Figure 53: Advanced
Microsoft Remote Desktop Gateway 2008 and R2
Applicable only for IPv4 policy.
This page allows you to configure a rule for Microsoft Remote Desktop Gateway 2008 and R2.
1. Click Policies and select IPv4 using the filter switch. Now, click on +Add Firewall Rule and select Business
Application Rule.
2. Enter policy introduction for About This Rule.
Rule Position
Specify the position of the rule.
Available Options: TopBottom
Application Template
Select Microsoft Remote Desktop Gateway 2008 and R2 to configure a rule for Microsoft Remote Desktop
Gateway 2008 and R2
Rule Name
Specify a name to identify the policy.
Description
Specify a policy description.
| Policies | 58
Figure 54: About This Rule
3. Specify Hosted Server details.
Hosted Address
Specify the address of the hosted server to which the rule applies. It is the public IP address through which
Internet users access an internal server/host.
Available Options:IP Address – Specified IP address is mapped to a corresponding mapped single IP address or a range of IP addresses. If a single IP address is mapped to a range of IP addresses, the device uses round robin algorithm to load balance the requests.IP Range – Specified IP address range is mapped to a corresponding range of mapped IP addresses. The IP range defines the start and end of an address range. The
start of the range must be lower than the end of the range.Interface IP – Select when any of the device port, alias or hosted LAN (VLAN) sub-interface is required to be mapped to the destination host or network. This option is only available for the IPv4 family.
HTTPS
Click to enable or disable scanning of HTTPS traffic.
Redirect HTTP (Applicable when HTTPS is enable)
Click to redirect HTTP requests.
Listening Port
Enter a port number on which the hosted web server can be reached externally, over the Internet. Default is port 80 with Plain text (HTTP) and port 443 with Encrypted (HTTPS).
Domains (Applicable when HTTPS is disabled)
Enter the domains the web server is responsible for as FQDN, e.g. shop.example.com, or use the Action icon to import a list of domain names. You can use an asterisk (*) as a wild card for the prefix of the domain, e.g.,*.mydomain.com. Domains with wild cards are considered as fallback settings: The hosted web server with the wild card domain entry is only used when no other hosted web server with a more specific domain name is configured. Example: A client request to a.b.c will match a.b.c before *.b.c before *.c.
HTTPS Certificate (Applicable when HTTPS is enabled)
Select the HTTPS certificate to be used for scanning.
| Policies | 59
Figure 55: Hosted Server
4. Specify Protected Application Server(s) details.
Enable path-specific routing
You can enable path-specific routing to define (path) to which web servers incoming requests are forwarded.
You can define that all URLs with a specific path, for example, /products/, are sent to a specific web server.
On the other hand you can allow more than one web server for a specific request but add rules how to distribute the requests among the servers. Additionally, you can define that each session is bound to one web server throughout its lifetime (sticky session). This may be necessary if you host an online shop and want to make sure that a user sticks to one server during the shopping session. You can also configure to send all requests to one web server and use the others only as a backup.
| Policies | 60
For each hosted web server, one default site path route (with path /) is created automatically. The device automatically applies the site path routes in the most reasonable way: starting with the strictest, i.e., longest paths and ending with the default path route which is only used if no other more specific site path route matches the incoming request. The order of the site path route list is not relevant. If no route matches an incoming request, (in case the default route was deleted), the request will be denied.
Add New Path(Applicable when path-specific routing is enabled)
Click Add New Path to define a new path.
Note: Add New Path will be active only after at least one web server and one hosted web server have been created.
Web Server(Applicable when path-specific routing is disabled)
Web servers are the application servers that are to be protected. Select from the list of web servers or click
Add New Item to add a web server.
A new web server can be created directly from this page itself or from Objects > Assets > Web Servers page.
Figure 56: Protected Application Server(s)
5. Specify access permission details. This step is applicable on if Enable path-specific routing is disabled.
Authentication
Select the web application authentication profile from the list of available profiles. You can also create new authentication profile the same page or from Protection > Web Server Protection > Web App
Authentication Policies page.
Allow from
Select the allowed host(s)/network(s).
Block from
Select the blocked host(s)/network(s).
Figure 57: Access Permission
6. Specify path Exceptions for the Web Servers. Click Add New Exception to specify new exception.
Figure 58: Exceptions
7. Specify Polices for Business Applications.
Application Protection
Select Application Protection for the server.
A new application protection can be created directly from this page itself or from the Objects > Policies >
Web App Protection page.
Default - Microsoft RDG 2008.
Intrusion Prevention
Select an IPS policy for the rule. A new IPS policy can be created directly from this page itself or from the
Objects > Policies > Intrusion Prevention page.
Traffic Shaping
Select Traffic Shaping policy for the rule.
A traffic shaping allocates & limits the maximum bandwidth usage of the user.
A new traffic shaping policy can be created directly from this page itself or from the Objects > Policies >
Traffic Shaping page.
| Policies | 61
| Policies | 62
Figure 59: Policies for Buisness Applications
8. Specify Advanced settings for the added server.
Disable Compression Support
By default, this checkbox is disabled and the content is sent compressed when the client requests compressed data. Compression increases transmission speed and reduces page load time. However, in case of websites being displayed incorrectly or when users experience content-encoding errors accessing your web servers, it can be necessary to disable compression support. When the checkbox is enabled, the WAF will request uncompressed data from the web servers of this hosted web server and will send it on uncompressed to the client, independent of the HTTP request's encoding parameter.
Rewrite HTML
Select this option to have the device rewrite links of the returned webpages in order for the links to stay valid.
Example: One of your web server instances has the hostname yourcompany.local but the hosted web server's hostname on the device is yourcompany.com. Thus, absolute links like [a href="http://yourcompany.local/"] will be broken if the link is not rewritten to [a href="http://yourcompany.com/"] before delivery to the client.
However, you do not need to enable this option if either yourcompany.com is configured on your web server or if internal links on your web pages are always realized as relative links. It is recommended to use the option with Microsoft's Outlook web access and/or SharePoint portal server.
Note: HTML rewriting affects all files with a HTTP content type of text/* or *xml*, where * is a wild card. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the HTML rewriting feature.
Rewrite cookies (Applicable only if Rewrite HTML is enabled)
Select this option to have the device rewrite cookies of the returned web pages.
Note: If Rewrite HTML is disabled the Rewrite cookies option will be also disabled.
Pass Host Header
When you select this option, the host header as requested by the client will be preserved and forwarded along with the web request to the web server. Whether passing the host header is necessary in your environment however depends on the configuration of your web server.
Figure 60: Advanced
Microsoft Remote Desktop Web 2008 and R2
Applicable only for IPv4 policy.
This page allows you to configure a rule for Microsoft Remote Desktop Web 2008 and R2.
1. Click Policies and select IPv4 using the filter switch. Now, click on +Add Firewall Rule and select Business
Application Rule.
2. Enter policy introduction for About This Rule.
Rule Position
Specify the position of the rule.
Available Options: TopBottom
Application Template
Select Microsoft Remote Desktop Web 2008 and R2 to configure a rule for Microsoft Remote Desktop
Web 2008 and R2.
Rule Name
Specify a name to identify the policy.
Description
Specify a policy description.
| Policies | 63
Figure 61: About This Rule
3. Specify Hosted Server details.
Hosted Address
Specify the address of the hosted server to which the rule applies. It is the public IP address through which
Internet users access an internal server/host.
Available Options:IP Address – Specified IP address is mapped to a corresponding mapped single IP address or a range of IP addresses. If a single IP address is mapped to a range of IP addresses, the device uses round robin algorithm to load balance the requests.IP Range – Specified IP address range is mapped to a corresponding range of mapped IP addresses. The IP range defines the start and end of an address range. The start of the range must be lower than the end of the range.Interface IP – Select when any of the device port, alias or hosted LAN (VLAN) sub-interface is required to be mapped to the destination host or network. This option is only available for the IPv4 family.
HTTPS
Click to enable or disable scanning of HTTPS traffic.
Redirect HTTP (Applicable when HTTPS is enable)
Click to redirect HTTP requests.
Listening Port
Enter a port number on which the Hosted web server can be reached externally, over the Internet. Default is port 80 with Plain text (HTTP) and port 443 with Encrypted (HTTPS).
Domains (Applicable when HTTPS is disabled)
Enter the domains the web server is responsible for as FQDN, e.g. shop.example.com, or use the Action icon to import a list of domain names. You can use an asterisk (*) as a wild card for the prefix of the domain, e.g.,*.mydomain.com. Domains with wild cards are considered as fallback settings: The hosted web server
with the wild card domain entry is only used when no other hosted web server with a more specific domain name is configured. Example: A client request to a.b.c will match a.b.c before *.b.c before *.c.
HTTPS Certificate (Applicable when HTTPS is enabled)
Select the HTTPS certificate to be used for scanning.
| Policies | 64
Figure 62: Hosted Server
4. Specify Protected Application Server(s) details.
Enable path-specific routing
You can enable path-specific routing to define (path) to which Web Servers incoming requests are forwarded.
You can define that all URLs with a specific path, for example, /products/, are sent to a specific web server.
On the other hand you can allow more than one web server for a specific request but add rules how to distribute the requests among the servers. Additionally, you can define that each session is bound to one web server throughout its lifetime (sticky session). This may be necessary if you host an online shop and want to make sure that a user sticks to one server during the shopping session. You can also configure to send all requests to one web server and use the others only as a backup.
For each hosted web server, one default site path route (with path /) is created automatically. The device automatically applies the site path routes in the most reasonable way: starting with the strictest, i.e., longest paths and ending with the default path route which is only used if no other more specific site path route matches the incoming request. The order of the site path route list is not relevant. If no route matches an incoming request, (in case the default route was deleted), the request will be denied.
Add New Path(Applicable when path-specific routing is enabled)
Click Add New Path to define a new path.
Note: Add New Path will be active only after at least one web server and one hosted web server have been created.
Web Server(Applicable when path-specific routing is disabled)
Web servers are the application servers that are to be protected. Select from the list of web servers or click
Add New Item to add a web server.
A new web server can be created directly from this page itself or from the Objects > Assets > Web Servers page.
Figure 63: Protected Application Server(s)
5. Specify access permission details. This step is applicable if Enable path-specific routing is disabled.
Authentication
Select the web application authentication profile from the list of available profiles. You can also create new authentication profile the same page or from the Protection > Web Server Protection > Web App
Authentication Policies page.
Allow from
Select the allowed host(s)/network(s).
Block from
Select the blocked host(s)/network(s).
Figure 64: Access Permission
6. Specify path Exceptions for the Web Servers. Click Add New Exception to specify new exception.
| Policies | 65
Figure 65: Exceptions
7. Specify Polices for Business Applications.
Application Protection
Select Application Protection for the server.
A new application protection can be created directly from this page itself or from the Objects > Policies >
Web App Protection page.
Default - Microsoft RD Web 2008.
Intrusion Prevention
Select an IPS policy for the rule. A new IPS policy can be created directly from this page itself or from the
Objects > Policies > Intrusion Prevention page.
Traffic Shaping
Select a traffic shaping policy for the rule.
A traffic shaping policy allocates & limits the maximum bandwidth usage of the user.
A new traffic shaping policy can be created directly from this page itself or from the Objects > Policies >
Traffic Shaping page.
| Policies | 66
Figure 66: Policies for Buisness Application
8. Specify Advanced settings for the added server.
Disable Compression Support
By default, this checkbox is disabled and the content is sent compressed when the client requests compressed data. Compression increases transmission speed and reduces page load time. However, in case of websites being displayed incorrectly or when users experience content-encoding errors accessing your web servers, it can be necessary to disable compression support. When the checkbox is enabled, the WAF will request uncompressed data from the Web Servers of this Hosted web server and will send it on uncompressed to the client, independent of the HTTP request's encoding parameter.
Default - Disabled.
Rewrite HTML
Select this option to have the device rewrite links of the returned webpages in order for the links to stay valid.
Example: One of your web server instances has the hostname yourcompany.local but the hosted web server's hostname on the device is yourcompany.com. Thus, absolute links like [a href="http://yourcompany.local/"] will be broken if the link is not rewritten to [a href="http://yourcompany.com/"] before delivery to the client.
However, you do not need to enable this option if either yourcompany.com is configured on your web server
| Policies | 67 or if internal links on your web pages are always realized as relative links. It is recommended to use the option with Microsoft's Outlook web access and/or SharePoint portal server.
Note: HTML rewriting affects all files with a HTTP content type of text/* or *xml*, where * is a wild card. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the HTML rewriting feature.
Default - Disabled.
Rewrite cookies (Applicable only if Rewrite HTML is enabled)
Select this option to have the device rewrite cookies of the returned web pages.
Note: If Rewrite HTML is disabled the Rewrite cookies option will be also disabled.
Pass Host Header
When you select this option, the host header as requested by the client will be preserved and forwarded along with the web request to the web server. Whether passing the host header is necessary in your environment however depends on the configuration of your web server.
Default - Enabled.
Figure 67: Advanced
Microsoft Sharepoint 2010 and 2013
Applicable only for IPv4 policy.
This page allows you to configure a rule for Microsoft SharePoint 2010 and 2013.
1. Click Policies and select IPv4 using the filter switch. Now, click on +Add Firewall Rule and select Business
Application Rule.
2. Enter policy introduction for About This Rule.
Rule Position
Specify the position of the rule.
Available Options: TopBottom
Application Template
Select Microsoft Sharepoint 2010 and 2013 to configure a rule for Microsoft Sharepoint 2010 and 2013.
Rule Name
Specify a name to identify the policy.
Description
Specify a policy description.
Figure 68: About This Rule
3. Specify Hosted Server details.
Hosted Address
Specify the address of the hosted server to which the rule applies. It is the public IP address through which
Internet users access an internal server/host.
Available Options:IP Address – Specified IP address is mapped to a corresponding mapped single IP address or a range of IP addresses. If a single IP address is mapped to a range of IP addresses, the device uses round robin algorithm to load balance the requests.IP Range – Specified IP address range is mapped to a corresponding range of mapped IP addresses. The IP range defines the start and end of an address range. The start of the range must be lower than the end of the range.Interface IP – Select when any of the device port, alias or hosted LAN (VLAN) sub-interface is required to be mapped to the destination host or network. This option is only available for the IPv4 family.
HTTPS
Click to enable or disable scanning of HTTPS traffic.
Redirect HTTP (Applicable when HTTPS is enable)
Click to redirect HTTP requests.
Listening Port
Enter a port number on which the hosted web server can be reached externally, over the Internet. Default is port 80 with Plain text (HTTP) and port 443 with Encrypted (HTTPS).
Domains (Applicable when HTTPS is disabled)
Enter the domains the web server is responsible for as FQDN, e.g. shop.example.com, or use the Action icon to import a list of domain names. You can use an asterisk (*) as a wild card for the prefix of the domain, e.g.,*.mydomain.com. Domains with wild cards are considered as fallback settings: The hosted web server with the wild card domain entry is only used when no other hosted web server with a more specific domain name is configured. Example: A client request to a.b.c will match a.b.c before *.b.c before *.c.
HTTPS Certificate (Applicable when HTTPS is enabled)
Select the HTTPS certificate to be used for scanning.
| Policies | 68
Figure 69: Hosted Server
4. Specify Protected Application Server(s) details.
Enable path-specific routing
You can enable path-specific routing to define (path) to which Web Servers incoming requests are forwarded.
You can define that all URLs with a specific path, for example, /products/, are sent to a specific web server.
On the other hand you can allow more than one web server for a specific request but add rules how to distribute the requests among the servers. Additionally, you can define that each session is bound to one web server throughout its lifetime (sticky session). This may be necessary if you host an online shop and want to make sure that a user sticks to one server during the shopping session. You can also configure to send all requests to one web server and use the others only as a backup.
For each hosted web server, one default site path route (with path /) is created automatically. The device automatically applies the site path routes in the most reasonable way: starting with the strictest, i.e., longest paths and ending with the default path route which is only used if no other more specific site path route matches the incoming request. The order of the site path route list is not relevant. If no route matches an incoming request, (in case the default route was deleted), the request will be denied.
Add New Path(Applicable when path-specific routing is enabled)
Click Add New Path to define a new path.
Note: Add New Path will be active only after at least one web server and one hosted web server have been created.
Web Server(Applicable when path-specific routing is disabled)
Web servers are the application servers that are to be protected. Select from the list of web servers or click
Add New Item to add a web server.
A new web server can be created directly from this page itself or from the Objects > Assets > Web Servers page.
| Policies | 69
Figure 70: Protected Application Server(s)
5. Specify access permission details. This step is applicable if Enable path-specific routing is disabled.
Authentication
Select the web application authentication profile from the list of available profiles. You can also create new authentication profile the same page or from the Protection > Web Server Protection > Web App
Authentication Policies page.
Allow from
Select the allowed host(s)/network(s).
Block from
Select the blocked host(s)/network(s).
Figure 71: Access Permission
6. Specify path Exceptions for the Web Servers. Click Add New Exception to specify new exception.
| Policies | 70
Figure 72: Exceptions
7. Specify Polices for Business Applications.
Application Protection
Select Application Protection for the server.
A new application protection can be created directly from this page itself or from the Objects > Policies >
Web App Protection page.
Intrusion Prevention (IPS)
Select an IPS policy for the rule. A new IPS policy can be created directly from this page itself or from the
Objects > Policies > Intrusion Prevention page.
Traffic Shaping
Select a traffic shaping policy for the rule.
A traffic shaping policy allocates & limits the maximum bandwidth usage of the user.
A new traffic shaping policy can be created directly from this page itself or from the Objects > Policies >
Traffic Shaping page.
| Policies | 71
Figure 73: Policies for Buisness Applications
8. Specify Advanced settings for the added server.
Disable Compression Support
By default, this checkbox is disabled and the content is sent compressed when the client requests compressed data. Compression increases transmission speed and reduces page load time. However, in case of websites being displayed incorrectly or when users experience content-encoding errors accessing your web servers, it can be necessary to disable compression support. When the checkbox is enabled, the WAF will request uncompressed data from the web servers of this hosted web server and will send it on uncompressed to the client, independent of the HTTP request's encoding parameter.
Default - Disabled.
Rewrite HTML
Select this option to have the device rewrite links of the returned web pages in order for the links to stay valid.
Example: One of your web server instances has the hostname yourcompany.local but the Hosted web server's hostname on the device is yourcompany.com. Thus, absolute links like [a href="http://yourcompany.local/"] will be broken if the link is not rewritten to [a href="http://yourcompany.com/"] before delivery to the client.
However, you do not need to enable this option if either yourcompany.com is configured on your web server or if internal links on your web pages are always realized as relative links. It is recommended to use the option with Microsoft's Outlook web access and/or SharePoint portal server.
Note: HTML rewriting affects all files with a HTTP content type of text/* or *xml*, where * is a wild card. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the HTML rewriting feature.
Default - Disabled.
Rewrite cookies (Applicable only if Rewrite HTML is enabled)
Select this option to have the device rewrite cookies of the returned web pages.
Note: If Rewrite HTML is disabled the Rewrite cookies option will be also disabled.
Pass Host Header
When you select this option, the host header as requested by the client will be preserved and forwarded along with the web request to the web server. Whether passing the host header is necessary in your environment however depends on the configuration of your web server.
Default - Enabled.
| Policies | 72
Figure 74: Advanced
Add Path
This page is applicable for the HTTP-Based Business Application Rules.
The Add Path page allows you to define (a path) to which real web servers incoming requests are forwarded..
1. Enable path-specific routing and click Add New Path.
2. Specify the path details.
Path
Enter the path for which you want to create the site path route. Example: /products/.
Web Server
Select the web servers which are to be used for the specified path.
Authentication
Select the Web App Authentication profile. Select Create new to create a new authentication profile. You can also create an authentication profile on the Objects > Policies > Web App Authentication page or the
Protection > Web Server Protection > Web App Authentication Policies page.
Add Web App Authentication Policies
on page 136
Allow From
Select or add the allowed networks that should be able to connect to the hosted web server.
Block From
Select or add the denied networks that should be blocked to your hosted web server.
Enable sticky session cookie
Select this option to ensure that each session will be bound to one web server. If enabled, a cookie is passed to the user's browser, which provokes the Sophos Firewall to route all requests from this browser to the same real web server. If the server is not available, the cookie will be updated, and the session will switch to another web server.
Enable hot-standby mode
Select this option if you want to send all requests to the first selected web server, and use the other web servers only as a backup. The backup servers are only used in case the main server fails.
As soon as the main server starts functioning, the sessions will switch back - unless you have selected the
Enable sticky session cookie option.
| Policies | 73
Figure 75: Add New Path
3. Click Save.
Add Exception
This page is applicable for the HTTP-Based Business Application Rules.
Use the Add Exception page to specify path exceptions for the web servers.
1. Click Add Exceptions.
2. Specify exception details.
Path
Enter the path which you want to exclude.
| Policies | 74
Operation
Select the operation among AND or OR for Path and Source.
Source
Specify the source networks where the client request comes from and which are to be exempted from the selected check(s).
Skip these Checks
Cookie Signing
Click to skip cookie signing. Cookie signing protects a web server against manipulated cookies. When the web server sets a cookie, a second cookie is added to the first cookie containing a hash built of the primary cookie's name, its value and a secret, where the secret is only known by the WAF. Thus, if a request cannot provide a correct cookie pair, there has been some sort of manipulation and the cookie will be dropped.
Static URL Hardening
Protects against URL rewriting. When a client requests a website, all static URLs of the website are signed. The signing uses a similar procedure as with cookie signing. Additionally the response from the web server is analyzed in respect to the links that can be validly requested next.
Form Hardening
Click to skip form hardening. Form hardening protects against web form rewriting. Form hardening saves the original structure of a web form and signs it. Therefore, if the structure of a form has changed when it is submitted the WAF rejects the request.
Anti-virus
Select this option to protect a web server against viruses.
Block clients with bad reputation
Based on GeoIPClosed and RBLClosed information you can block clients which have a bad reputation according to their classification.
Skip these categories
Protocol Violations
Enforces adherence to the RFC standard specification of the HTTP protocol. Violating these standards usually indicates malicious intent.
Protocol Anomalies
Searches for common usage patterns. Lack of such patterns often indicates malicious requests. These patterns include, among other things, HTTP headers like 'Host' and 'User-Agent'.
Request Limits
Enforces reasonable limits on the amount and ranges of request arguments. Overloading request arguments is a typical attack vector.
HTTP Policy
Narrows down the allowed usage of the HTTP protocol. Web browsers typically use only a limited subset of all possible HTTP options. Disallowing the rarely used options protects against attackers aiming at these often less well supported options.
Bad Robots
Checks for usage patterns characteristic of bots and crawlers. By denying them access, possible vulnerabilities on your web servers are less likely to be discovered.
Generic Attacks
Searches for attempted command executions common to most attacks. After having breached a web server, an attacker usually tries to execute commands on the server like expanding privileges or manipulating data stores. By searching for these post-breach execution attempts, attacks can be detected that might otherwise have gone unnoticed, for example because they targeted a vulnerable service by the means of legitimate access.
| Policies | 75
SQL Injection Attacks
Checks for embedded SQL commands and escape characters in request arguments. Most attacks on web servers target input fields that can be used to direct embedded SQL commands to the database.
XSS Attacks
Checks for embedded script tags and code in request arguments. Typical cross-site scripting attacks aim at injecting script code into input fields on a target web server, often in a legitimate way.
Tight Security
Performs tight security checks on requests, like checking for prohibited path traversal attempts.
Trojans
Checks for usage patterns characteristic of trojans, thus searching for requests indicating trojan activity. It does not, however, prevent the installation of such trojans as this is covered by the antivirus scanners.
Outbound
Prevents web servers from leaking information to the client. This includes, among other things, error messages sent by servers which attackers can use to gather sensitive information or detect specific vulnerabilities.
Advanced
Never change HTML during static URL hardening or form hardening
If selected, no data matching the defined exception settings will be modified by the WAF engine. With this option, e.g., binary data wrongly supplied with a text/html content type by the web server will not be corrupted. On the other hand, web requests may be blocked due to activated URL hardening, HTML rewriting, or form hardening. Those three features use an HTML parser and therefore to some extent depend on the modification of web page content. To prevent undesired blocking, skip URL hardening and/ or form hardening for requests affected by blocking; you might need to do this in another/new exception to reflect dependencies between web servers and/or web pages.
Accept unhardened form data
Even though having an exception for form hardening, it is possible that form data will not be accepted if the form hardening signature is missing. With this option, unhardened form data will be accepted anyway.
Figure 76: Add New Exception
3. Click Save.
| Policies | 76
Non-HTTP Based Policy
Non-HTTP Based policy is used to protect Non-HTTP servers, like mail or other servers hosted inside the network
(LAN or DMZ). Using Non-HTTP Based policy, you can define access rights of such servers to users who require access over the WAN or Internet. Additionally, you can use the following Non-HTTP application template:
•
1. Click Policies and select among IPv4 or IPv6 using the filter switch. Now, click on +Add Firewall Rule and select Business Application Rule.
2. Enter policy introduction for About This Rule.
Rule Position
Specify the position of the rule.
Available Options: TopBottom
Application Template
Select Non-HTTP Based Policy to configure a rule for generic Non-HTTP based applications.
Rule Name
Specify a name to identify the policy.
Description
Specify a policy description.
3. Specify source details.
Host
Select the allowed host(s) or add a new one by clicking Add New Item.
Exceptions
Select or add new ones by clicking Add New Item. Exceptions are the hosts on which the policy configurations are not applicable.
4. Specify hosted server details.
Source Zone
Click to select source zone. Click Add New Item to define a new LAN or DMZ zone.
Hosted Address
Specify the address of the hosted server to which the policy applies. It is the public IP address through which users access an internal server/host over the Internet.
Available Options: IP Address – Specified IP address is mapped to a corresponding mapped single IP address or a range of IP addresses. If a single IP address is mapped to a range of IP addresses, the device uses round robin algorithm to load balance the requests.IP Range – Specified IP address range is mapped to a corresponding range of mapped IP address. The IP range defines the start and end of an address range. The start of the range must be lower than the end of the range.Interface IP – Select when any of the device port, alias or virtual LAN (VLAN) sub-interface is required to be mapped to the destination host or network. This option is only available for the IPv4 family.
5. Specify protected application server(s) details.
Protected Zone
Select the zone to which the web server rule applies.
Protected Application Server(s)
From the available options, select the application server(s) on which the web server is to be hosted.
Available options: IP Address – External IP address is mapped to the specified IP address.IP Range –
External IP address range is mapped to the specified IP address range.IP List – External IP address is mapped to the specified IP list.FQDN – External IP address is mapped to the specified FQDN. Internal mapped server can be accessed by FQDN. This option is only available for IPv4 birtual hosts.
| Policies | 77
Load Balancing (Applicable when IP Range or IP List is selected for protected server. Also, source zone for
hosted server should be WAN)
Select the method for load balancing from the available options.
Available OptionsRound Robin - In this method, requests are served in a sequential manner where the first request is forwarded to the first server, second request to the second server and so on. When a request is received, the device checks to see which was the last server that was assigned a request. It then assigns this new request to the next available server. This method can be used when equal distribution of traffic is required and there is no need for session-persistence.First Alive - In this method, all incoming requests are served by the first server (the first IP address that is configured in the IP range). This server is considered as the primary server and all others are considered as backup. Only when the first server fails, the requests are forwarded to the next server in line. This method is used for failover scenarios. Random - In this method, the requests are forwarded to the servers randomly. Nevertheless, the device makes sure that all configured servers receive equally distributed load. Hence, this method is also called uniform random distribution. This method can be used when equal distribution of traffic is required and there is no need for session-persistence or order of distribution.Sticky IP - In this method, along with Round Robin distribution of traffic, the device forwards incoming traffic according to the source IP address. All traffic from a particular source is forwarded only to its mapped server. This means that all requests for a given source IP are sent to the same application server instance. This method is useful in cases where all requests or sessions are required to be processed by the same server. For example: banking websites, E-Commerce websites.
Health Check (Applicable if Load Balancing is enabled)
Click to enable health check for failover and specify the parameters based on the description shown below.
Probe Method
Select the probe method to check the health of the server from the available options.
Available Options:TCP Probe ICMP Probe
Port (Applicable if TCP Probe Health Check Method is selected)
Specify the Port number on the server health is monitored.
Acceptable Range: 1 to 65535
Interval
Specify the time interval in seconds after which the health will be monitored.
Acceptable Range: 5 to 65535 seconds
Default: 60
Timeout
Specify the time interval in seconds within which the server must respond.
Acceptable Range: 1 to 10 seconds
Default: 2
Retries
Specify the number of tries to probe the health of the server, after which the server will be declared unreachable
Acceptable Range: 1 to 10
Default: 3
Forward all ports
Click to enable/disable the service of port forwarding. When enabled, all ports are forwarded. To enable custom port forwarding, disable this option and specify port forwarding details (in the next section).
Default - Disabled.
6. Specify port forwarding details.
Protocol
Select the protocol TCP or UDP that you want to use for forwarding packets.
| Policies | 78
External Port Type
Select the type of external port from the available options.
Available Options: PortPort RangePort List
External Port
Specify public port number for which you want to configure port forwarding.
Mapped Port Type
Select the type of mapped port from the available options.
Available Options:PortPort RangePort List
Mapped Port
Specify mapped port number on the destination network to which the public port number is mapped.
7. Specify routing details.
Rewrite source address (Masquerading)
Enable/disable to re-write the source address or specify a NAT policy.
Use Outbound Address (Applicable when Rewrite source address is enabled)
Select the NAT policy to be applied from the list of available NAT policies.
A new NAT policy can be created directly from this page itself or from the Objects > Policies > NAT page.
Default NAT policy is Masquerade.
8. Specify Identity details.
Match rule based on user identity
Match rule based on user identity allows you to check whether the specified user/user group from the selected zone is allowed to access the selected service or not.
Click to attach the user identity.
Enable check identity to apply the following policies per user.
User or Groups (Applicable if 'Match rule based on user identity' is disabled)
Select the user(s) or group(s) from the list of available options.
Exclude this user activity from data accounting (Applicable 'if Match rule based on user identity' is disabled)
Click to enable/disable user traffic activity from data accounting.
By default, user’s network traffic is considered in data accounting. Select to exclude certain traffic from user data accounting. The traffic allowed through this firewall rule will not be accounted towards data transfer for the user.
9. Specify polices for business applications.
Intrusion Prevention
Select the required IPS policy. If Match rule based on user identity is enabled, user’s IPS policy will be applied automatically, but will not be effective till the respective module is subscribed.A new IPS policy can be created directly from this page itself or from the Objects > Policies > Intrusion Prevention page.
Traffic Shaping Policy
Select the required IPS policy. If Match rule based on user identity is enabled, user’s QoS policy will be applied automatically.
A new traffic shaping policy can be created directly from this page itself or from the Objects > Policies >
Traffic Shaping page.
10. Define logging option for the user application traffic.
Log Firewall Traffic
Click to enable logging of permitted and denied traffic.
11. Specify reflexive rule options.
| Policies | 79
Create Reflexive Rule
Enable to automatically create a reflexive firewall rule for the protected host.
Reflexive rule has the same policies as those configured for the hosted server but instead of source zone to destination zone, this rule is applicable on traffic from destination zone to source zone.
By default, the reflexive rule is not created.
12. Configure security heartbeat settings. (Applicable only if IPv4 is selected.)
Require Security Heartbeat
Heartbeat-capable devices can be required to send information on their health status in defined intervals - this is called a heartbeat.
Based on that information, you can restrict a device's access to certain services and networks.
Enable the option to require the sending of heartbeats.
Minimum Heartbeat Permitted
Select a minimum health status that a device must have to conform to this policy. Health status can be either
Green, Yellow or No Restriction. If the health criterion is not met, access and privileges defined in this policy will not be granted to the user.
Email Servers (SMTP)
This page allows you to configure rule for Email Servers (SMTP).
1. Click Policies and select among IPv4 or IPv6 using the filter switch. Now, click on +Add New Policy and select
Business Application Rule.
2. Enter policy introduction for About This Rule.
Rule Position
Specify the position of the rule.
Available Options: TopBottom
Application Template
Select Email Servers (SMTP) to configure rule for SMTP based Email applications.
Rule Name
Specify a name to identify the policy.
Description
Specify Policy Description.
| Policies | 80
Figure 77: About This Rule
3. Specify Source details.
Zone
Select the allowed source zone(s).
Networks
Select the allowed source network(s) . A new network host can be created directly from this page itself or from Objects > Hosts and Services > IP Host page.
| Policies | 81
Figure 78: Source
4. Specify Hosted Server details.
Source Zone
Click to select Source Zone. Click Add New Item to define a new LAN or DMZ zone.
Hosted Address
Specify the address of the hosted server to which the policy applies. It is the public IP Address through which users access internal server/host over the Internet.
Available Options:
IP Address – Specified IP Address is mapped to a corresponding mapped single or range of IP Address. If single IP Address is mapped to a range of IP Address, device uses round robin algorithm to load balance the requests.IP Range – Specified IP Address Range is mapped to a corresponding range of mapped IP Address.
The IP range defines the start and end of an address range. The start of the range must be lower than the end of the range.Interface IP – Select when any of the device Port, Alias or Virtual LAN (VLAN) sub interface is required to be mapped to the destination host or network. This option is only available for IPv4 family.
Scan SMTP/SMTPS
Click to Enable/Disable scanning of SMTP/SMTPS traffic.
Figure 79: Hosted Server
| Policies | 82
5. Specify Protected Application Server(s) details.
Protected Zone
Select the zone to which the Web Server rule applies.
Protected Application Server(s)
Select from the available options on which the Web Server is to be hosted.
Available options: IP Address – External IP Address is mapped to the specified IP Address.IP Range –
External IP Address Range is mapped to the specified IP Address Range.IP List – External IP Address is mapped to the specified IP list.FQDN – External IP Address is mapped to the specified FQDN. Internal mapped server can be accessed by FQDN. This option is only available for IPv4 Virtual Host.
Load Balancing (Applicable when 'IP Range' or 'IP List' is selected for Protected Server. Also, Source Zone
for Hosted Server should be 'WAN')
Select the method for load balancing from the available options.
Available Options
Round Robin - In this method, requests are served in a sequential manner where the first request is forwarded to the first server, second request to the second server and so on. When a request is received, the device checks to see which the last server that was assigned a request was. It then assigns this new request to the next available server. This method is can be used when equal distribution of traffic is required and there is no need for session-persistence.
First Alive - In this method, all incoming requests are served by the first server (the first IP Address that is configured in the IP Range). This server is considered as the primary server and all others are considered as backup. Only when the first server fails, the requests are forwarded to the next server in line. This method is used for failover scenarios.
Random -In this method, the requests are forwarded to the servers randomly. Although, the device makes sure that all configured servers receive equally distributed load. Hence, this method is also called uniform random distribution. This method can be used when equal distribution of traffic is required and there is no need for session-persistence or order of distribution.
Sticky IP - In this method, Along with Round Robin distribution of traffic, the device forwards incoming traffic according to the Source IP Address. All traffic from a particular source is forwarded only to its mapped
Server. This means that all requests for a given source IP are sent to the same application server instance. This method is useful in cases where all requests or sessions are required to be processed by the same server. For example: Banking websites, E-Commerce websites.
Health Check (Applicable if Load Balancing is enabled)
Click to enable health check for failover and specify the parameters based on the description shown below.
Probe Method
Select the probe method to check the health of the server from the available options.
Available Options:
TCP Probe ICMP Probe
Port (Applicable if TCP Probe Health Check Method is selected)
Specify the Port number on the server health is monitored.
Acceptable Range - 1 to 65535
Interval
Specify the time interval in seconds after which the health will be monitored.
Acceptable Range (Seconds) - 5 to 65535
Default - 60
Timeout
Specify the time interval in seconds within which the server must respond.
Acceptable Range (Seconds) - 1 to 10
Default - 2
Retries
Specify the number of tries to probe the health of the server, after which the server will be declared unreachable
Acceptable Range - 1 to 10
Default – 3
Forward all ports
Click to enable/disable the service of port forwarding. When enabled, all ports are forwarded. To enable custom port forwarding, disable Forward all ports, and specify port forwarding details (shown in step 5).
Default - Disabled.
| Policies | 83
Figure 80: Protected Application Server(s)
6. Specify Port Forwarding details.
Protocol
Select the protocol TCP or UDP that you want the forwarded packets to use.
External Port Type
Select the type of external port from the available options.
Available Options: PortPort RangePort List
External Port
Specify public port number for which you want to configure port forwarding.
Mapped Port Type
Select the type of mapped port from the available options.
Available Options:PortPort RangePort List
Mapped Port
Specify mapped port number on the destination network to which the public port number is mapped.
Figure 81: Port Forwarding
7. Specify Routing details.
Rewrite source address (Masquerading)
Enable/Disable to re-write the source address or specify a NAT policy.
Use Outbound Address (Applicable when Rewrite source address is enabled)
Select the NAT policy to be applied the list or available NAT policies.
A new NAT policy can be created directly from this page itself or from Objects > Policies > NAT page.
Default NAT policy is Masquerade.
Figure 82: Routing
8. Specify Identity details.
Match rule based on user identity
Match rule based on user identity allows you to check whether the specified user/user group from the selected zone is allowed to access the selected service or not.
Click to attach the user identity.
Enable check identity to apply the following policies per user.
User or Groups (Applicable if 'Match rule based on user identity' is disabled)
Select the user(s) or group(s) from the list of available options.
Exclude this user activity from data accounting (Applicable 'if Match rule based on user identity' is disabled)
Click to enable/disable user traffic activity from data accounting.
By default, user’s network traffic is considered in data accounting. Select to exclude certain traffic from user data accounting. The traffic allowed through this firewall rule will not be accounted towards data transfer for the user.
Figure 83: Identity
9. Specify polices for business applications.
| Policies | 84
Intrusion Prevention
Select the required IPS policy. If Match rule based on user identity is enabled, user’s IPS policy will be applied automatically, but will not be effective till the respective module is subscribed.
A new IPS can be created directly from this page itself or from Objects > Policies > Intrusion Prevention page.
Traffic Shaping Policy
Select the required IPS policy. If Match rule based on user identity is enabled, user’s QoS policy will be applied automatically.
A new Traffic Shaping Policy can be created directly from this page itself or from Objects > Policies >
Traffic Shaping page.
| Policies | 85
Figure 84: Policies for Buisness Applications
10. Define logging option for the user application traffic.
Log Firewall Traffic
Click to enable logging of permitted and denied traffic.
Figure 85: Log Traffic
11. Specify Reflexive Rule options.
Create Reflexive Rule
Select Yes to automatically create a reflexive firewall rule for the Protected Host.
Reflexive rule has the same policies as those configured for the hosted server but instead of source zone to destination zone, this rule is applicable on traffic from destination zone to source zone.
By default, the reflexive rule is not created.
Figure 86: Reflexive Rule
12. Configure Security Heartbeat settings. (Applicable only if IPv4 is selected.)
Require Security Heartbeat
Heartbeat-capable devices can be required to send information on their health status in defined intervals - this is called a heartbeat.
Based on that information, you can restrict a device's access to certain services and networks.
Enable/disable the option to require the sending of heartbeats.
Minimum Heartbeat Permitted
Select a minimum health status that a device must have to conform to this policy. Health status can be either
Green, Yellow or No Restriction. If the health criterion is not met, access and privileges defined in this policy will not be granted to the user.
Figure 87: Secutiry Heartbeat
Email Clients (POP and IMAP)
The Business Application Policy (Public Non-HTTP-Based) page allows you to configure policy for controlling access to public Non-HTTP-based business applications.
1. Click Policies and select among IPv4 or IPv6 using the filter switch. Now, click on +Add Firewall Rule and select Business Application Policy.
2. Enter policy introduction for About This Rule.
Rule Position
Specify the position of the rule.
Available Options: TopBottom
Application Template
Select Email Clients (POP & IMAP) to define a application filter policy for POP and IMAP based email clients.
Rule Name
Specify a name to identify the policy.
Description
Specify a policy description.
| Policies | 86
Figure 88: About This Rule
3. Specify source details.
Zone
Select the allowed source zone(s).
Networks
Select the allowed source network(s) . A new network host can be created directly from this page itself or from the Objects > Hosts and Services > IP Host page.
Figure 89: Source
4. Specify destination details.
Zone
Select the zone to which the policy applies.
Networks
Select the network(s) to be protected.
A new network host can be created directly from this page itself or from the Objects > Hosts and Services >
IP Host page.
Scan IMAP/IMAPS/POP3/POP3S/SMTP/SMTPS
Click to enable/disable scanning of IMAP/IMAPS/POP3/POP3S/SMTP/SMTPS traffic.
| Policies | 87
Figure 90: Destination
5. Specify routing details.
Rewrite source address (Masquerading)
Enable/disable to re-write the source address or specify a NAT policy.
Use Outbound Address(Applicable when Rewrite source address is enabled)
Select the NAT policy to be applied the list or available NAT policies.
A new NAT policy can be created directly from this page itself or from the Objects > Policies > Network
Address Translation page.
Default NAT policy is Masquerade.
Primary Gateway (Applicable if multiple WAN links are configured.)
Select the primary gateway to route the request.
Backup Gateway (Applicable if multiple WAN links are configured.)
Select the backup gateway to route the request.
| Policies | 88
Figure 91: Routing
6. Specify Identity details.
Match rule based on user identity
Click to enable a policy based on the user identity.
User or Groups (Applicable only when Match rule based on user identity is enabled)
Select the user(s) or group(s) from the list of available options.
Exclude this user activity from data accounting (Applicable only when Match rule based on user identity is
enabled)
Click to enable/disable user traffic activity from data accounting.
By default, user’s network traffic is considered in data accounting. Select to exclude certain traffic from user data accounting. The traffic allowed through this policy will not be accounted towards data transfer for the user.
Figure 92: Identity
7. Specify polices for business applications.
Intrusion Prevention
Select an IPS policy for the rule. A new IPS policy can be created directly from this page itself or from the
Objects > Policies > Intrusion Prevention page.
Traffic Shaping Policy
Select traffic shaping policy for the rule.
A traffic shaping policy allocates & limits the maximum bandwidth usage of the user.
A new traffic shaping policy can be created directly from this page itself or from the Objects > Policies >
Traffic Shaping page.
Figure 93: Policies for Buisness Applications
8. Define logging option for the user application traffic.
Log Firewall Traffic
Click to enable logging of permitted and denied traffic.
Figure 94: Lof Traffic
| Policies | 89
9. Configure security heartbeat settings. (Applicable only if IPv4 is selected.)
Require Security Heartbeat
Heartbeat-capable devices can be required to send information on their health status in defined intervals - this is called a heartbeat.
Based on that information, you can restrict a device's access to certain services and networks.
Enable/disable the option to require the sending of heartbeats.
Minimum Heartbeat Permitted
Select a minimum health status that a device must have to conform to this policy. Health status can be either
Green, Yellow or No Restriction. If the health criterion is not met, access and privileges defined in this policy will not be granted to the user.
| Policies | 90
Figure 95: Security Heartbeat
| Protection | 91
Protection
From the Protection menu you to configure the following :
•
- The Wireless Protection menu allows you to configure wireless networks, mesh networks,
Access Point (AP) groups, Hotspots and Hotspot Voucher Definition. It also displays an overview of the APs known to the device.
•
- The Web Protection menu allows you to create and manage web filtering policies.
•
- The Application Protection menu provides facilities to control and manage the
applications shipped with the device.
•
- The Web Server Protection menu provides facilities to manage and add web servers, define protection policies for them and set-up certificates.
•
- The Email Protection menu provides facilities to configure SMTP/S, POP/S and IMAP/S
settings, Malware and Content Scanning Rules, Secure PDF eXchange (SPX) and Data Protection (DP) Policies.
Wireless Protection
Wireless Protection allows you to configurate the following:
•
: Create and manage Wireless Networks.
•
: Create and manage Mesh Networks.
•
: Provides an overview of the access points known to the device.
•
: Allows you to organize access points in groups.
•
: Add/remove Hotspots and apply filtering policies.
•
: Manage different voucher definitions for Hotspot access vouchers.
•
: Schedule scanning to discover authorized APs and rogue APs.
Wireless Networks
The page provides a list of all configured wireless networks along with their name, SSID, client traffic mode, encryption mode used and frequency band. New wireless networks can be added and existing ones deleted.
System > Network > Wireless Networks
Note: You can also view the wireless network status on the System > Current Activity > Wireless Client
List page.
For each wireless network, the list shows you:
Name
Name assigned to the network.
SSID
SSID of the wireless network.
Status
Status of the wireless network.
Client traffic
Client traffic of the wireless network.
Encryption Mode
Encryption mode of the wireless network.
Frequency Band
Frequency band of the wireless network.
| Protection | 92
Manage
Available managing options for the wireless network:
• Edit: Allows you to edit the wireless network.
• Delete: Allows you to delete the wireless network.
To add or delete a wireless network, click on the corresponding buttons.
Add a New Wireless Network
This page describes how to add a new wireless network.
The Add button on the Wireless Networks page allows you to define a new wireless network. This can then be used in definitions for access points and access point groups.
1. Navigate to System > Network > Wireless Networks or Protection > Wireless Protection > Wireless
Networks and click the Add button.
A new page General Settings opens.
2. Enter the following settings:
Name
Enter a descriptive name for the network.
Description
Enter a description for the wireless network that helps you to identify it.
SSID
Enter the Service Set Identifier (SSID) for the network which will be seen by clients and allow them to identify the wireless network. The SSID may consist of 1-32
ASCII printable characters
. It must not contain a comma and must not begin or end with a space.
Security Mode
Select a security mode from the drop-down list. The default is WPA 2 Personal.
We recommend that you use WPA2 rather than WPA, if possible. For security reasons, we recommend you not to use WEP unless there are clients using your wireless network that do not support one of the other methods.
When using an enterprise authentication method, you also need to configure a RADIUS server on the
Objects > Assets > Authentication Server page. As NAS ID of the RADIUS server enter the wireless network name.
Note: Sophos Firewall OS supports the IEEE 802.11r standard in WPA2 (PSK/Enterprise) networks to reduce roaming times. Clients also need to support the IEEE 802.11r standard.
Passphrase/PSK (Only available with the WPA Personal, WPA2Personal, and WPA2/WPA Personal
security modes)
Enter the passphrase to protect the wireless network from unauthorized access and repeat it in the
Confirm Passphrase/PSK field. The passphrase may consist of 8-63 ASCII printable characters.
Key (Only available with the WEP Open security mode)
Enter a WEP key here that consists of exactly 26 hexadecimal characters.
Client Traffic
From the dropdown list select how the wireless network is to be integrated into your local network.
Available options:
• Separate Zone
• Bridge to AP LAN
• Bridge to VLAN
The default setting is Separate Zone.
| Protection | 93
Separate Zone
The wireless network is handled as a separate network, having an IP address range of its own. Using this
option, after adding the wireless network, proceed as described in the chapter
Note: When switching an existing Separate Zone network to Bridge to AP LAN or Bridge to
VLAN, a previously configured WLAN interface will be deleted.
Zone
From the dropdown list select a zone where the wireless network should be broadcast. The default setting is WiFi.
IP Address
Assign an IP address to the wireless network.
Netmask
Select a subnet mask for the IP address.
Bridge to AP LAN
You can bridge a wireless network into the network of an access point, which means that wireless clients share the same IP address range. Using this option, after adding the wireless network, proceed as described in the chapter
Next Steps for Bridge to AP LAN Networks
.
Bridge to VLAN (Not available for local WiFi devices)
You can decide to have this wireless network's traffic bridged to a VLAN of your choice. This is useful when you want access points to be in a common network separate from the wireless clients.
Bridge to VLAN ID
Enter the VLAN ID of the network that the wireless clients should be part of.
Client VLAN ID (Only available with an enterprise security mode)
Select how the VLAN ID is defined.
• Static: Uses the VLAN ID defined in the Bridge to VLAN ID field.
• RADIUS & Static: Uses the VLAN ID delivered by your RADIUS server: When a user connects to one of your wireless networks and authenticates at your RADIUS server, the RADIUS server tells the access point what VLAN ID to use for that user. Thus, when using multiple wireless networks, you can define per user who has access to which internal networks. If a user does not have a VLAN ID attribute assigned, the VLAN ID defined in the Bridge to VLAN ID is used.
| Protection | 94
Figure 96: Add Wireless Network
3. Optionally, you can enter the following Advanced Settings:
Encryption (Only available with the WPA, WPA2, and WPA2/WPA encryption modes)
Select an encryption algorithm, which can be AES, TKIP or TKIP&AES. For security reasons, we recommend that you use AES.
Frequency Band
Access points assigned to this wireless network will transmit on the selected frequency band(s). The 5 GHz band generally has a higher performance, lower latency, and is typically less disturbed. Hence it should be preferred for e.g. VoIP communication. For an overview of which APs support the 5 GHz band, see the chapter Objects > Assets > Access Points or Protection > Wireless Protection > Access Points.
Time-based Access
Select this checkbox to enable the wireless network access according to a time schedule.
Select Active Time
Select a schedule definition which determines when the wireless network is enabled. You can add a new schedule definition by clicking on Add New Item .
Client Isolation
Clients within a network usually can communicate with one another. If you want to prevent this, for example in a guest network, select Enabled from the drop-down list.
Hide SSID
If you want to hide the wireless network's SSID, select the Enable checkbox. Please note that this is not a security feature.
Fast Transition (Only available with WPA2 Personal/Enterprise security mode)
Wireless networks with WPA2 security use the IEEE 802.11r standard. If you want to prevent this, select
Disabled from the drop-down list.
MAC Filtering
To restrict the MAC addresses allowed to connect to this wireless network, select Blacklist or Whitelist.
With Blacklist, all MAC addresses are allowed except those listed on the MAC List. With Whitelist, all
MAC addresses are prohibited except those listed on the MAC List.
MAC hosts added under Objects > Assets > MAC Host will be displayed in the MAC List.
| Protection | 95
Figure 97: Wireless Network Advanced Settings
4. Click Save.
The wireless network has been added and appears on the Wireless Networks page.
Next Steps for Separate Zone Networks
When you add a wireless network with the option Separate Zone, a new corresponding virtual hardware interface will be added automatically, e.g., wlnet1. To be able to use the wireless network, some further manual configuration steps are required. Proceed as follows:
1. Enable DHCP for the wireless clients.
For your clients to be able to connect to Sophos Firewall OS, they need to be assigned an IP address and a default gateway. Therefore, on the System > Network > DHCP page, set up a DHCP server for the interface.
2. Create a network policy on the Policies page to provide Internet access to the wireless clients.
You can now assign the wireless network to the AP at Objects > Assets > Access Points or Protection > Wireless
Protection > Access Points.
Bridge to AP LAN Networks with Local Devices
For Local Wi-Fi Devices you need to configure some extra settings to enable bridging for the AP LAN.
1. Edit the Local Wi-Fi Device on the Objects > Assets > Access Points or Protection > Wireless Protection >
Access Points page and select the wireless network.
2. Either create a new bridge interface on the System > Network > Interfaces > Add Bridge page to use the wireless interface in bridge mode or edit the interface on the on the System > Network > Interface page, select a zone and provide an IP address to use the interface in gateway mode.
3. If you want to use the interface in gateway mode, create a DHCP server on the System > Network > DHCP page so that the client can receive an IP.
Wireless clients can now connect to the wireless network.
Mesh Networks
On this page you can create or delete mesh networks. Additionally, you see an overview of existing mesh networks.
| Protection | 96
On the System > Network > Mesh Networks or Protection > Wireless Protection > Mesh Networks page you can define mesh networks and associate access points that should broadcast them. In a mesh network, multiple access points communicate with each other and broadcast a common wireless network. On the one hand, access points connected via a mesh network can broadcast the same wireless network to clients, thus working as a single access point, while covering a wider area. On the other hand, a mesh network can be used to bridge Ethernet networks without laying cables. Access points associated with a mesh network can play one of two roles: root access point or mesh access point. Both broadcast the mesh network, thus the number of other wireless networks they can broadcast is reduced by one.
• Root access point: This has a wired connection to the Sophos Firewall OS and provides a mesh network. An access point can be root access point for multiple mesh networks.
• Mesh access point: This needs a mesh network to connect to the Sophos Firewall OS via a root access point. An access point can be mesh access point for only one mesh network at a time.
A mesh newtork can be used to implement a wireless bridge or a wireless repeater:
• Wireless bridge: Using two access points, you can establish a wireless connection between two Ethernet segments. A wireless bridge is useful when you cannot lay a cable to connect those Ethernet segments. While the first Ethernet segment with your Sophos Firewall OS is connected to the Ethernet interface of the root access point, the second Ethernet segment has to be connected to the Ethernet interface of the mesh access point. Using multiple mesh access points, you can connect more Ethernet segments.
• Wireless repeater: Your Ethernet with your Sophos Firewall OS is connected to the Ethernet interface of a root access point. The root access point has a wireless connection via the mesh network to a mesh access point, which broadcasts wireless networks to wireless clients.
| Protection | 97
To create a mesh network, please refer to
on page 97.
The following details of mesh networks are displayed.
Mesh-ID
This is the identifier of the mesh network.
Status
Displays the current status of the mesh network
Frequency Band
The frequency band on which the associated access points broadcast the mesh network.
Manage
Displays the available management options:
• Edit Allows you to edit the mesh network.
• Delete Allows you to delete the mesh network.
To add or delete a mesh network, click on the corresponding buttons.
Add Mesh Network
On this page you can create mesh networks and assign access points to them.
The Add button on the Mesh Networks page allows you to define a new mesh network.
1. Navigate to System > Network > Mesh Networks or Protection > Wireless Protection > Mesh Networks and click the Add button.
A new page General Settings opens.
2. Enter the following settings:
Mesh ID
Enter a unique ID for the mesh network.
Frequency Band
Access points assigned to this network will transmit the mesh network on the selected frequency band.
Generally, it is a good idea to use a different frequency band for the mesh network than for the broadcasted wireless networks.
| Protection | 98
Description
Optionally, add a description or other information.
Access Point
Here you add one or more mesh access points.
a) Click Add to select access points that should broadcast the mesh network.
A dialog window Mesh Network Role opens: b) Enter the following settings:
Access Points
Select an access point. Note that only AP 50 access points can be used for broadcasting mesh networks at the moment.
Role
Define the access point's role for the selected mesh network. A root access point is directly connected to the Sophos Firewall OS. A mesh access point, after having received its initial configuration, once unplugged from the Sophos Firewall OS will connect to a root access point via the mesh network.
Note: An access point can be mesh access point only for one mesh network.
Figure 98: Add Mesh Network
c) Click OK.
The dialog window is closed and the access point is added to the Access Point list.
3. Click OK.
Note: It is crucial for the initial configuration to plug the mesh access point, like every other access point, into one of the Ethernet segments selected in the Allowed Zone box on the System Services >
Wireless tab.
Access Points
The Access Point page provides an overview of the access points (AP) known to the system. Access points can be temporarily disabled on this page. When an AP is physically removed from your network, you can delete it here by clicking the Delete button. As long as the AP remains connected to your network, it will automatically re-appear in the Pending state after deletion. SG "w" appliances with on-board Wi-Fi cannot be deleted from the AP list.
Protection > Wireless Protection > Access Points or Objects > Assets > Access Points
Note: You can also view access points on the System > Current Activity > Wireless Client List page.
Access Point Types
Sophos Firewall OS currently provides the following types of dedicated access points:
| Protection | 99
Table 1:
Name
AP 5
AP 10
AP 15
AP 30
AP 50
AP 55
AP 55C
AP 100
AP 100C
802.11b/g/n
802.11b/g/n
802.11b/g/n
802.11b/g/n
802.11a/b/g/n
Sophos Firewall OS also provides the following dedicated outdoor access points:
Table 2:
Name
AP 100X
Standards
802.11a/b/g/n
802.11a/b/g/n
802.11a/b/g/n/ac
802.11a/b/g/n/ac
Standards
802.11a/b/g/n/ac
Band
2.4 GHz
2.4 GHz
2.4 GHz
2.4 GHz
2.4/5 GHz dual-band/ dual-radio
2.4/5 GHz dual-band/ dual-radio
Channels 1-11
Channels 1-11,
36-48, 149-165
Channels 1-11,
36-48, 149-165
2.4/5 GHz dual-band/ dual-radio
2.4/5 GHz dual-band/ dual-radio
2.4/5 GHz dual-band/ dual-radio
FCC regulatory domain (mainly US)
ETSI regulatory domain (mainly
Europe)
Channels 1-11,
36-48, 149-165
Channels 1-11,
36-48, 149-165
Channels 1-11,
36-48, 149-165
Channels 1-13
Channels 1–13,
36-48
Channels 1-13,
36-64, 100-116,
132-140
Channels 1-13,
36-64, 100-116,
132-140
Channels 1-13,
36-64, 100-116,
132-140
Channels 1-13,
36-64, 100-116,
132-140
Band
2.4/5 GHz dual-band/ dual-radio
FCC regulatory domain (mainly US)
Channels 1-11,
36-64, 100-116,
132-140
ETSI regulatory domain (mainly
Europe)
Channels 1-13,
100-116, 132-140
Sophos Firewall OS also provides the following Local Wi-Fi Devices:
Table 3:
Name
SG 105w/115w
SG 125w/135w
Standards
802.11a/b/g/n
802.11a/b/g/n/ac
Band
2.4/5 GHz dual-band
2.4/5 GHz dual-band
Note: Because of the bandwith on the APs with ac standard there may be an automatic channel change in some cases. For example, if you select channel 36 the AP could choose channel 40 instead because it provides a better connection. The channel shown in the Access Point list represents the primary channel. This can affect all AP 100 appliances (AP 100, AP 100C and AP 100X) and all SG appliances with integrated access
(SG 105w/115w and SG 125w/135w).
| Protection | 100
Access Point Overview
The page gives an overview of the access points (AP) known to the system. Sophos Firewall OS distinguishes between active, inactive and pending APs. To make sure that only genuine APs connect to your network, APs need to be authorized first.
Protection > Wireless Protection > Access Points or Objects > Assets > Access Points
This page has the following sections:
Active/Inactive Access Points
For each access point, the list shows you:
ID
Access point ID
Label
Label of the AP, which allows it to be identified easily in the network.
Status
Status of the access point (active/inactive). Active APs are connected, configured, and running. Inactive APs have been configured in the past but are currently not connected to Sophos Firewall OS. If an AP remains in this state for more than five minutes, please check the network connectivity of the AP and the configuration of your system.
Channel
Channel the AP transmits on.
Group
Access point group the AP is assigned to.
Country
Country where the AP is located.
MAC
MAC address of the AP.
IP/Last Seen
IP address of an active AP or the last seen IP address of an inactive AP.
Type
Type of the AP
Manage
Displays the available management options for the APs:
• Edit Allows you to edit the AP.
• Delete Allows you to delete the AP.
To add or delete an access point, click on the corresponding buttons.
Pending Access Point
Here, APs are listed that are connected to the system but not yet authorized. After receiving its configuration, the authorized access point will immediately be displayed in the above section. For each access point, the list shows you:
ID
ID of the access point.
Label
Label of the AP, which allows it to be identified easily in the network.
Channel
Channel the AP transmits on.
| Protection | 101
Group
Access point group the AP is assigned to.
MAC
MAC address of the AP.
Manage
Displays the available management options for the APs:
• Edit Allows you to edit the AP.
• Delete Allows you to delete the AP.
To add or delete an access point, click on the corresponding buttons.
Rules for Assigning Networks to APs
An access point can only be assigned to a wireless network if the client traffic option of the wireless network and the
VLAN tagging option of the access point fit together. The following rules apply:
• Wireless network with client traffic Separate Zone: VLAN tagging of the access point can be enabled or disabled.
• Wireless network with client traffic Bridge to AP LAN: VLAN tagging of the access point has to be disabled.
• Wireless network with client traffic Bridge to VLAN: VLAN tagging of the access point has to be enabled.
The respective wireless clients will use the Bridge to VLAN ID specified for the wireless network, or they will receive their VLAN ID from the RADIUS server, if specified.
Note: An AP 5 can only be assigned one single wireless network with the Client traffic option Bridge to AP
LAN.
Access Point Groups
On the Protection > Wireless Protection > Access Point Groups or Objects > Assets > Access Point Groups page you can organize access points in groups. The list provides an overview of all access point groups and Local Wi-Fi
Devices.
For each group, the list shows:
Name
Name of the access point group.
Status
Status of the access point (active/inactive). Use the toggle switch to enable/disable the access point group.
Wireless Networks
Wireless networks the access point group is assigned to.
Access Points
List of all the access points in this group.
Manage
Displays the available management options:
• Edit Allows you to edit the access point group.
• Delete Allows you to delete the access point group.
To add or delete an access point group, click on the corresponding buttons.
Add Access Point Group
This page describes how to add an access point group.
1. Navigate to Protection > Wireless Protection > Access Point Groups or Objects > Assets > Access Point
Groups and click Add.
2. Enter the following settings for the new access point group.
| Protection | 102
Name
Enter a descriptive name for the new access point group.
Wireless Networks
Search for wireless networks and select the wireless networks that should be broadcast by the access points of this group.
Note: For an access point to broadcast a wireless network some conditions have to be fulfilled. They are explained in the chapter Objects > Assets > Access Points, in the section Rules for Assigning
Networks to APs.
VLAN Tagging
Select Enable if you want to activate VLAN tagging.
Note: Make sure that the VLAN interface is assigned to the zone which is selected in the Allowed
Zone box on the System > System Services > Wireless page.
Access Point
Search for access points and select which you want to add to this group.
Note: Local Wi-Fi Devices cannot be grouped and do not appear in the Access Point box. Local Wi-
Fi Devices appear in the Access Point Groups list.
Figure 99: Add Access Point Group
3. Click Save.
The new access point group will be displayed in the Access Point Groups table.
Hotspots
On this page you can enable the Hotspots feature and define users who are allowed to view and distribute hotspot access information.
Protection > Wireless Protection > Hotspots
The Hotspot feature allows cafés, hotels, companies, etc. to provide time- and traffic-restricted Internet access to guests. The feature is available within the wireless subscription, but also works with wired networks.
Note: You can also view and manage the hotspot status on the System > Diagnostics > Services page.
Hotspot Generation
In the first step, the administrator creates and enables a hotspot with a specific type of access. The following types are available:
| Protection | 103
• Terms of use acceptance: The guest is presented with terms of use, which you can define, and has to select a checkbox to get access.
• Password of the day: The guest has to enter a password to get access. The password changes on a daily basis.
• Voucher: The guest gets a voucher and has to enter the voucher code to get access. The voucher can be limited in the number of devices, in time, and traffic.
Distribution of Access Information to Guests
With the access types Password of the day and Voucher, the access information has to be handed out to the guests.
Therefore you can define users who are allowed to manage and distribute access information. Those users receive and distribute the access information via the Hotspot tab of the User Portal:
• Password of the day: The current password can be sent via email and the users find the password in the User
Portal. The users forward the password to the guests. They can generate or enter a new password. The former password automatically becomes invalid and active sessions will be terminated. Other potential users will be informed of the new password, either by email or via the User Portal, depending on what is configured for them.
• Voucher: In the User Portal, users can create vouchers, each with a unique code. Different types of vouchers can be available if specified by the administrator. The vouchers can be printed or exported and given to the guests. A list of created vouchers gives an overview of their usage and helps to manage them.
Legal Information
In many countries, operating a public wireless LAN is subject to specific national laws, restricting access to websites of legally questionable content (e.g., file sharing sites, extremist websites, etc.). To meet this requirement, you can combine the hotspot with the web protection capabilities of the Sophos Firewall OS, which allow you to control web access by blocking and allowing everything from an entire website category type to a single URL. The Sophos
Firewall OS gives you complete control over what is allowed to be accessed, by whom, and when. That way you can put the hotspot under heavy restrictions, if national or corporate policies require you to do so. Using the current feature of Sophos Firewall OS also gives you advanced logging and reporting capabilities. The reporting will show who visited what site, when, and how many times, allowing you to identify inappropriate usage in case you want to operate a hotspot without any access restrictions. In addition to that, legal regulations may require you to register your hotspot at the national's regulatory body.
The page displays all existing hotspots. You can add , update or delete a hotspot. For each hotspot, the list shows:
Name
Displays the name of the hotspot.
Hotspot Type
Displays the type of the hotspot.
Manage
Displays the available management options:
• Edit: Allows you to edit the hotspot.
• Delete: Allows you to delete the hotspot.
To add or delete a hotspot, click on the corresponding buttons.
Add Hotspot
This page describes how to add a hotspot.
Note: A hotspot has to be assigned to an existing interface, typically a WLAN interface. All hosts using this interface will automatically be restricted by the hotspot. Therefore, before you create a hotspot you would typically create a wireless network with client traffic Separate Zone, then create an interface for the respective WLAN interface hardware. For more information see System > Network > Wireless Networks.
1. Go to System > Configuration > Hotspots and click Add.
| Protection | 104
2. Enter the following settings:
Name
Enter a descriptive name for hotspot.
Description (optional)
Enter a description or other information.
Interfaces
Select or add the interfaces which are to be restricted by the hotspot. An interface can only be used by one hotspot.
Note: Hotspots will work only on LAN and DMZ member interfaces of the bridge. You should not select an uplink interface here because traffic to the Internet will be completely blocked afterwards.
Additionally, we strongly advise against using interfaces used by servers which provide essential services like authentication. You may irreversibly lock yourself out of Sophos Firewall OS.
Users
Select or add users for administrative settings. Administrative users are allowed to create vouchers or change the password of the day in the User Portal. By default nobody is allowed to enter administrative settings.
Application Filter Policy (optional)
Select or add an application filter policy for the hotspot.
Web Filter Policy (optional)
Select or add a web filter policy for the hotspot.
IPS Policies (optional)
Select or add IPS policies for the hotspot.
Traffic Shaping Policy (optional)
Select or add a traffic shaping policy for the hotspot.
Redirect to HTTPS (optional)
Enable this option to redirect users to HTTPS.
Hostname Type
Select the hostname type for the hotspot.
• None (IP Address)
• Custom hostname
Hostname
(if Custom hostname is selected)
Add a hostname for the redirect.
Hotspot Type
Select a hotspot type for the selected interfaces.
• Terms of Use Acceptance Customers can access the Internet after accepting the terms of use.
Session Expires
Select the time span after which the access will expire. After that, with the hotspot type Terms of Use
Acceptance, the users have to accept the terms of use again to log in. With the hotspot type Backend
Authentication, the users have to authenticate again.
Terms of Use
Add the text to be displayed as terms of use. Simple HTML markup and hyperlinks are allowed.
• Password of the Day A new password will be created automatically once a day. This password will be available in the User Portal on the Hotspots tab which is available to all users specified for this hotspot.
Additionally it will be sent to the specified email address(es).
| Protection | 105
Password Creation Time
The assigned time of the day at which the new password will be created. At this time the former password will immediately become invalid and current sessions will be terminated.
Send Password by Email to (optional)
Add email addresses to which the password will be sent.
Synchronize Password with PSK of Wireless Networks (optional)
Select this option to synchronize the new generated/saved password with wireless PSK.
Note: With the new PSK all APs that are configured with a separate zone wireless network that is also used as a hotspot interface will be reconfigured and restarted. This means all connections will be dropped.
• Voucher With this hotspot type, in the User Portal tokens with different limitations and properties can be generated, printed and given to customers. After entering the code, the customers can then directly access the Internet.
Voucher Definitions
Add or select the voucher definitions you want to use for the hotspot. How to add a voucher definition is explained on the Voucher Definitions page.
Devices per Voucher
Enter the number of devices which are allowed to log in with one voucher during its lifetime. It is not recommended to use the "unlimited" option.
Terms of Use
(not with hotspot type Terms of Use Acceptance:
Add the text to be displayed as terms of use. Simple HTML markup and hyperlinks are allowed.
Users Have to Accept Terms of Use
(not with hotspot type Terms of Use Acceptance):
Enable this option if you want the hotspot users to accept your terms of use before accessing the Internet.
Redirect to URL After Login
Enable this so that users will be redirected automatically to a particular URL after entering password or voucher data. The URL could, for example, be your hotel's website or a webpage stating your portal system policies.
URL
Enter the URL to which the user will be redirected .
3. Optionally, customize the hotspot.
Enable Customization
Enable to use a customized HTML file with your own images and stylesheets. Additionally, you can customize the voucher layout.
Customization Type
Select the customization type.
• Basic Uses the default login page template. If required, change logo, title, and text.
Logo
Upload a logo for the login page. Supported image file types are jpg, jpeg, png and gif. A maximum image width of 300 px and height of 100 px is recommended (depending on the title length).
Scale Logo to Recommended Size
If selected, a logo exceeding the recommended width or height will be scaled down and displayed in the recommended size. If it is not selected, the logo will be displayed in the original size.
Title
Add a title for the login page. Simple HTML markup and hyperlinks are allowed.
| Protection | 106
Custom Text
Add additional text for the login page. You can, for example, enter the SSID of the wireless network to be used. Simple HTML markup and hyperlinks are allowed.
• Full Select an individual login HTML page.
Login Page Template
Select the HTML template you want to use for your individual login page. Clicking Browse... opens a window where you can select and upload the file. In this template, you can use variables that can dynamically insert information for each hotspot. For example, you can add the company name and administrator information, the terms of use and the login form. See detailed information in the chapter
Login Page Template.
Images/Stylesheet
Add files that are referenced in your login page template, e.g., images, stylesheets, or JavaScript files.
Clicking Browse... opens a window where you can select and upload the files.
Voucher Template
(only with hotspot type Voucher): Clicking Browse...opens a dialog where you can select and upload a PDF file with the voucher layout. By default, a default template is used. The voucher PDF file has to be of PDF version PDF 1.5 or lower. It may have any page size and format—both size and format will be adjusted during voucher creation in the User Portal, depending on page size and number of vouchers per page specified there.
The PDF file may contain the following variables that will be replaced with the respective values during voucher generation in the User Portal:
• Wireless network name (SSID): <?ssid0?> (and <?ssid1?>, <?ssid2?> and so on, if the WLAN has more than one SSIDs)
• Wireless network password: <?psk0?> (and <?psk1?>, <?psk2?> and so on, if the WLAN has more than one SSIDs)
• Voucher code: <?code?>
• Voucher validity time:
<?validity?>
• Voucher data limit: <?datalimit?>
• Voucher time limit: <?timelimit?>
• Comment: <?comment?>
• QR code with the hotspot access data encoded:
<?qrX?>. The upper left corner of the QR code will be placed on the lower left corner of the variable.
Note: When using variables, the PDF file must include the entire character sets of the fonts used. When a variable is replaced by its value, and one of the substitute characters is not available, it will be displayed incorrectly. We recommend that you add the string
<?
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789?> (for
English usage) to your PDF file, which will automatically be removed during voucher generation.
If you use another language, you can include any other character set you want. Additionally, we recommend that you use a separate line for the variables as the layout could get corrupted if the substituted text is too long.
4. Click Save.
The hotspot is now available and appears in the hotspot list.
You can see if the hotspot is running on the System > Diagnostics > Services page. There you can also stop or start the hotspot.
Login Page Template
This page gives an overview of possible variables of the hotspot login template.
The HTML template for the login page may contain various variables that can dynamically insert information for the hotspot login page. When the UTM processes a template in order to display a login page, it replaces any template variables with the relevant value. Valid variables are:
| Protection | 107
General variables
•
<?company_text?>: Default company text
• <?company_logo?>: Default company logo (Sophos logo). The variable will be replaced by the path of the logo file, usage e.g., <img src="<?company_logo?>">
• <?admin_contact?>: Administrator name or address as defined on System > Configuration > Notification
(Send Notifications to Email Address field)
• <?admin_message?>: Administrator information label (default: For administrative questions please contact:)
•
<?error?>: Error message that arose while trying to log in.
Variables used for all hotspot types
• <?terms?>: Terms of use (as defined on Add Hotspot page)
• <?redirect_host?>: Redirect URL that is specified for the hotspot (as defined on the Add Hotspot page)
•
<?location?>: URL the user requested
• <?location_host?>: Hostname of the URL the user requested
• <?login_form?>: Login form suitable for the respective hotspot type: Password text box, Token text box,
Username and Password text boxes, or Accept checkbox, and Login button.
Note: For creating customized login forms, see User Specific Login Form below.
• <?asset_path?> (only important for customization mode Full): Hotspot specific directory for storage of images or stylesheets (example usage: <img src="<?asset_path?>/logo.png">)
Variables only used for voucher type hotspots
• <?maclimit?> Number of allowed devices per voucher of this hotspot (as defined on the Add Hotspot page)
•
<?numdevices?>: Number of devices used for this voucher
• <?timeend?>: Validity period (as defined on the Add/Edit Voucher Definition page)
• <?time_total?>: Total time quota allowed (as defined on the Add/Edit Voucher Definition page)
• <?traffic_total?>: Total data volume allowed (as defined on the Add/Edit Voucher Definition page)
Templates can contain if variables that make up sections like the ones shown below. Each section has an opening and a closing variable. The contents of an if section is only displayed on a specific condition.
If Section Meaning
Section is displayed when the user has successfully logged in.
<?if_loggedin?>
<?if_loggedin_end?
>
<?if_notloggedin?>
<?
if_notloggedin_end?
>
Section is displayed when the user has not yet logged in, e.g., because terms of use have to be accepted or because an error occurred.
<?
if_authtype_password?
Section is displayed when hotspot type is Password of the Day.
>
<?
if_authtype_password_end?
>
<?
if_authtype_disclaimer?
>
Section is displayed when hotspot type is Terms of Use Acceptance.
| Protection | 108
If Section Meaning
<?
if_authtype_disclaimer_end?
>
<?
if_authtype_token?>
<?
if_authtype_token_end?
>
Section is displayed when hotspot type is Voucher.
<?if_location?>
<?if_location_end?>
Section is displayed when the user has been redirected.
<?if_redirect_url?>
<?
if_redirect_url_end?
>
Section is displayed when the checkbox Redirect to URL After Login is enabled.
<?
if_not_redirect_url?
>
<?
Section is displayed when the checkbox Redirect to URL After Login is disabled.
if_not_redirect_url_end?
>
Section is displayed when a validity period is set for a voucher.
<?if_timelimit?>
<?if_timelimit_end?
>
<?if_trafficlimit?>
<?
if_trafficlimit_end?>
Section is displayed when a data volume is set for a voucher.
<?if_timequota?>
<?if_timequota_end?
>
Section is displayed when a time quota is set for a voucher.
Section is displayed when a Devices per Voucher value is specified.
<?if_maclimit?>
<?if_maclimit_end?
>
<?if_terms?>
<?if_terms_end?>
Section is displayed when Terms of Use are defined and enabled.
<?if_error?>
<?if_error_end?>
Section is displayed when an error occurred while trying to log in.
User-Specific Login Form
If you want to create your own login form instead of using the pre-defined
<?login_form?> variable, consider the following:
• Enclose the form in the following tags:
| Protection | 109
<form action="?action=login" method="POST"> ... </form>
• For a Terms of Use Acceptance hotspot, add a checkbox named "accept":
<input type="checkbox" name="accept">
• For Password of the Day or Voucher hotspots, add a text box named "token":
<input type="text" name="token">
• Add a means to submit the form, e.g., a Login button:
<input type="submit" name="login" value="Login">
Hotspot Voucher Definition
On this page you can manage different voucher definitions for voucher type Hotspots.
Objects > Policies > Hotspot Voucher Definition
The page displays all existing voucher definitions. You can add new voucher definitions, update or delete them. For each voucher definition, the lis shows:
Name
Name of the voucher definition.
Manage
Displays the available management options:
• Edit: Allows you to edit the voucher definition.
• Delete: Allows you to delete the voucher definition.
To add or delete a voucher definition, click on the corresponding buttons.
Add Hotspot Voucher
This page describes how to add a voucher definition.
1. Navigate to Objects > Policies > Hotspot Voucher Definition and click Add.
2. Enter the following settings:
Name
Enter a descriptive name for the voucher definition.
Description
Enter a description or other information.
Validity Period
Enter the time span for which a voucher with this definition will be valid. Counting starts at the first login. We strongly recommend that you enter a time period.
Note: The maximum time for the Validity Period is two years.
Time Quota
Here you can restrict the allowed online time. Enter the maximum online time after which a voucher of this definition expires. Counting starts at login and stops at logout. Additionally, counting stops after 5 minutes of inactivity.
Note: The maximum time for the Time Quota is two years.
Data Volume
Here you can restrict the allowed data volume. Enter the maximum data volume to be transmitted with this voucher definition.
Note: The maximum data volume is 100 GB.
| Protection | 110
Figure 100: Add Hotspot Voucher
3. Click OK.
The voucher definition is now available and appears on the voucher list.
Rogue AP Scan
This section is applicable to Wi-Fi models only.
A Rogue Access Point (AP) is any Wi-Fi access point connected to your network without authorization. It can be a setup used by an attacker for the purpose of sniffing wireless network traffic and can be used to conduct a man-in-themiddle attack. It allows anyone with a Wi-Fi-equipped device to connect to your corporate network, leaving your IT assets wide open for the casual snooper or criminal hacker.
Device can alleviate this by recognizing rogue access points potentially attempting to gain access to your network.
General Settings
Click Schedule system-triggered scan to enable a scheduled scan to discover authorized APs and rogue APs. You can select from the pre-defined schedules or create a custom schedule from Objects > Policies > Schedule.
Discover Access Points
To increase the security capabilities and identify unauthorized APs, Sophos Wireless Devices provide scanning capability by which nearby APs can be discovered and an administrator can take countermeasures against the most common types of illicit wireless activity.
To manually scan for the automatic discovery of APs, click Scan Now.
All the Access Points discovered are regarded as unrecognized until they are identified as authorized or rogue . To authorize an access point, click the icon against it in the Unrecognized AP table. To mark an access point as rogue, click the icon against it in the Unrecognized AP table.
If you are scanning for the first time after enabling Wireless LAN, all the discovered APs will be listed in the
Unrecognized Access Points table. The scanning result is displayed in the form of 3 tables:
Unrecognized Access Points table
The table lists all the nearby APs discovered and displays the following information:
Channel
The radio channel used by the access point.
BSSID
The MAC Address of the radio interface of the detected access point.
SSID
The radio SSID of the access point.
Signal Strength
The strength of the detected radio signal
Security Mode
Mode for encrypting the wireless traffic
Wireless Mode
Wireless protocol
Action
Click the icon to mark the AP as an authorized AP and move it to the Authorized AP table. Click the icon to mark the AP as a rogue AP and move it to the Rogue AP table.
Rogue Access Points table
The table lists all the APs marked as “Rogue” and displays the following information:
Channel
The radio channel used by the access point.
BSSID
The MAC Address of the radio interface of the detected access point.
SSID
The radio SSID of the access point.
Signal Strength
The strength of the detected radio signal
Security Mode
Mode for encrypting the wireless traffic
Wireless Mode
Wireless protocol
Action
Click the icon to mark the AP as an authorized AP and move it to the Authorized AP table. Click the icon to mark the AP as an unrecognized AP and move it to the Unrecognized AP table.
Authorized Access Points table
The table lists all the APs marked as “Authorized” and displays the following information:
Channel
The radio channel used by the access point.
BSSID
The MAC Address of the radio interface of the detected access point.
SSID
The radio SSID of the access point.
Signal Strength
The strength of the detected radio signal
Security Mode
Mode for encrypting the wireless traffic
Wireless Mode
Wireless protocol
| Protection | 111
| Protection | 112
Action
Click the icon to mark the AP as an unrecognized AP and move it to the Unrecognized AP table. Click the icon to mark the AP as a rogue AP and move it to the Rogue AP table.
Web Protection
Use the pages under Protection > Web Protection to create and manage web filtering policies.
The pages under Web Protection allow you to configure:
• Web Proxy settings
• Web Content Filter settings
• Web Filter Policies
• Custom Web Categories
• URL Groups
• Surfing Quota and schedules
• Manage File Types for filtering policy
Web Proxy
Use the Web Proxy page to configure your device as web proxy port, and to enable trusted ports.
The device can act as a web proxy server. To use your device as a web proxy server, configure the LAN IP address as a proxy server IP address in the browser setting and enable access to web proxy services from the Device Access page.
Note: You can also view and manage the web proxy status on the System > Diagnostics > Services page.
Web Proxy Port(Applicable only when the device is configured as Web Proxy)
Specify the port number, which is to be used for the web proxy.
Default: 3128
Trusted Ports
The device allows the access to those sites which are hosted on the standard port, only if deployed as web proxy.
To allow access to the sites hosted on the non-standard ports, you have to define non-standard ports as trusted ports.
Click the add icon to add the HTTP trusted ports, or the cancel icon to delete the trusted ports, or the edit icon to modify the trusted ports.
| Protection | 113
Figure 101: Configure Web Proxy
Click Apply to configure Web Proxy settings.
Note:
• Web proxy enforces web and application filter policy and malware scanning rules as configured in security policies.
• IPS policy is applicable on the traffic between proxy and WAN, but not between user and proxy.
• Traffic shaping policy is not applicable on the direct proxy traffic.
Web Content Filter
The Web Content Filter page allows you to configure and manage web filtering. You can configure options for scanning HTTP/HTTPS/FTP traffic. You can also bypass HTTPS scanning from a specific source or destination.
General Configuration
Use this section to enable the Safe Search feature, caching and Pharming protection. You can also configure Custom
Denied Message.
Safe Search - This feature allows you to enforce safe searching into your search engines, thus helping you against malicious sites.
Pharming Protection - This feature allows you to stop Pharming by various attacker sites by Domain Name resolution.
Below are the screen elements with their description:
Scanning
Select the type of scanning to be applied.
Available Options:
• Single Anti-Virus (Maximum Performance): Traffic will be scanned using the Primary Anti-Virus engine.
• Dual Anti-Virus (Maximum Security): Traffic will be scanned using both Anti-Virus Engines, first by
Primary and then by the Secondary Engine. This can increase virus detection, but will impact performance.
It is recommended to use Single Anti-Virus engine for scanning for the best balance of Security and
Performance.
| Protection | 114
Enforce Safe Search
Enable safe search so that web sites containing pornography and explicit sexual content are blocked from the
Google, Yahoo, Altavista and Bing search results.
This will be applicable only when access to Porn, Adult Content and Nudity categories are denied in the Web
Filter Policy.
Enable Pharming Protection
Enable to protect against pharming attacks and direct users to the legitimate websites instead of fraudulent websites.
Pharming attacks require no additional action from the user from their regular web surfing activities. Pharming attack succeeds by redirecting the users from legitimate websites instead of similar fraudulent websites that has been created to look like the legitimate site.
Caching
Enable Caching
When enabled the Web Filter keeps a copy of frequently visited sites to improve performance and reduce bandwidth usage
Force caching for Endpoint updates
Use this option to enable caching of update data for Sophos Endpoints.
Note: If this option is disabled you may experience network congestion when many endpoints attempt to download updates from the Internet at the same time.
Denied Message
Specify default deny message to be displayed for all the web categories.
Enable Override Default Denied Message to display a customized message for all the web categories.
Denied Message Image
Specify whether the default or custom image should be displayed on the Denied message page.
Top Image
Specify the image which is to be displayed at the top of the message page.
Dimension of Image should be 125 x 70 pixels and jpg file only.
Bottom Image
Specify the image which is to be displayed at the bottom of the message page.
Dimension of Image should be 700 * 80 pixels and jpg file only.
Preview
Click to view the settings before saving the changes.
| Protection | 115
Figure 102: General Configuration
HTTP/HTTPS Configurations
The administrator can configure real-time or batch-mode scanning of HTTP traffic.
You can configure the maximum file size that can be buffered to the memory for scanning. This will also prevent the unintentional download of virus files hidden in the fragmented files.
Depending on the scanning policy set at the time of deployment through the Network configuration Wizard, the device will scan HTTP and HTTPS traffic. Enable or disable HTTP and HTTPS scanning from security policy.
Use this section to configure general restrictions for scanning and restricting all the HTTP/HTTPS traffic.
Scan Mode
Specify scanning mode to configure for real-time or batch-mode scanning for HTTP/HTTPS traffic.
In batch mode, virus scanning will start only after the complete file is downloaded. As the complete file is to be downloaded before scanning can start, if the size of the file is large it will take some time.
To avoid the delay, configure scan in real-time mode if you have to download bulky files.
File Size Threshold
Specify file size threshold (in KB). Files that exceed the configured threshold will not be scanned.
Acceptable Range - 1 to25600 KB
Default - 1024 KB
Audio & Video File Scanning
Enable Audio & Video File Scanning for scanning of video and audio streams being downloaded.
Default - Disable
HTTPS Scanning CA
Select the CA for HTTPS Scanning from the available options:
Available Options:
• SecurityAppliance_SSL_CA
• SecurityApplianceSelf Signed CA
• List of custom CAs if added
Default - SecurityAppliance_SSL_CA
Deny Unknown Protocol
Enable to deny traffic that does not follow the HTTPS protocol.
Allow Invalid Certificate
If you enable HTTPS scanning, you need to import an appliance SSL Proxy certificate in Internet Explorer,
Firefox Mozilla or any other browsers for decryption on SSL Inspection, otherwise the browser will always display a warning page when you try to access any secure site. An “Invalid Certificate error” warning appears when the site is using an invalid SSL certificate. The Device blocks all such sites.
Enable if you want to allow access to such sites.
| Protection | 116
Figure 103: HTTP/HTTPS Configurations
FTP Configurations
The administrator can define policies to take the appropriate action based on the protocols. A separate policy can be defined on how to handle SMTP, POP3, FTP and HTTP traffic if an infection is detected.
When the Device detects a virus, the file transfer is stopped and Email message is delivered without the attachment.
Files Greater Than Size
Configure the maximum file size (in KB) for scanning. The files greater than the specified size will not be scanned.
Acceptable Range - 1 to 20480KB
Default – 1024 KB
Figure 104: FTP Configurations
HTTP Scanning Rules
Viruses can infect your network through HTTP downloads . Define HTTP scanning rules to protect against this. The
HTTP Scanning Rules section displays a list of all the scanning rules. It also provides options to
a new rule, update the parameters of the existing rules, or delete a rule.
HTTPS Scanning Exceptions
The device allows you to bypass the HTTPS scanning for specified web categories. The Administrator needs to create an exception rule and include all the web categories for which HTTPS scanning is bypassed.
| Protection | 117
The section displays a list of all the configured exception rules. It also provides options to
a new exception rule, update the parameters of the existing rule, and delete the rule.
Add HTTP Rule
You can add an HTTP Scanning Rule from this page.
1. Navigate to System > System Services > Web Content Filter or Protection > Web Protection > Web Content
Filterand click Add under the HTTP Scanning Rules section.
2. Enter HTTP Rule details.
Name
Provide a name for the HTTP Rule.
Source IP Address
Specify Source IP Address.
Destination IP Address
Specify Destination IP Address.
The Scanning Rule will be applied to the mails received from the sender using the specified source IP Address and sent to the recipient with the specified destination IP Address.
URL Regex.
Provide a URL. You can use regular expressions for matching the pattern in the URL.
Action
Select whether you want to scan or bypass traffic for the specified source/destination IP Address and URL.
Figure 105: HTTP Rule Details
3. Click Save.
Add HTTPS Scanning Exception
You can add an HTTPS Scanning Exception from this page.
1. Navigate to System > System Services > Web Content Filter or Protection > Web Protection > Web Content
Filterand click Add under the HTTPS Scanning Exceptions section.
2. Enter HTTPS Scanning Exception details.
Name
Enter a name for the bypass rule.
Bypass
Select the web category for which HTTPS scanning is to be bypassed.
You can directly add a new web category from this page or from Objects > Content > Custom Web
Category
| Protection | 118
Figure 106: Add HTTPS Scanning Exception
3. Click Save.
Web Filter Policies
The Web Filter Policies page allows you to Add, Delete, or Edit web filter policies.
Use the Web Filter Policies page to create and maintain a set of Web Filter policies. You can access the Web Filter
Policies page by going to Protection > Web Protection > Web Filter Policies or Objects > Policies > Web Filter.
Each policy can filter based on a Web Category, File Type, URL Group, or Dynamic Category. Default policies are included, and you can create and maintain your own.
On this page you can view the list of Web Filter polices. The list shows details of each:
• Name: The policy name. To edit a policy, click the Name, or select the check box and click the wrench icon under
Manage.
• Default Action: Shows the default action configured for the policy.
• Reporting: Shows if reporting is Enabled or Disabled for the policy.
• Description: Provides a short description for the policy.
• Manage: Allows you to edit or delete policies.
Add Web Filter Policy
Create a new Web Filter Policy.
On the Add Web Filter Policy page you can create a new Web Filter Policy.
1. Enter a Name for the policy.
2. Enter a brief Description for the policy you want to create.
3. Under Template you can select an existing template from the dropdown list.
This will populate categories from the existing template to help create a similar policy.
4. Select the Enable Reporting check box to include this policy in generated reports.
5. Set Download File Size Restriction to the maximum file size that can be downloaded for this policy. Leave this set at zero for no restriction.
6. Under YouTube Education Filter enter your school ID for YouTube for Schools.
Note:
If enabled, users trying to open a YouTube video are restricted to videos either belonging to the subsection YouTube EDU or uploaded by your school account.
Figure 107: Add Web Filter Policy
7. Click Add to configure categories associated with this Web Filter Policy.
a) Select a Category Type from the drop down list.
b) Click Add New Item and select categories you would like included.
c) Select Allow or Deny for both HTTP Action and HTTPS Action.
d) For Web Category and URL Group you can click Exception and configure File Type Category to be excluded from the policy.
e) Select an option from the Schedule drop down list.
f) Click Add.
Figure 108: Configure Web Filter Policy Category
| Protection | 119
| Protection | 120
8. Click Save.
Web Categories
The Web Category page displays a list of existing Web Categories.
On the Web Category page you can maintain categories of sites and assign them a Classification.There are four categories that can be used in policies to control web usage. These classification are:
• Productive
• Unproductive
• Acceptable
• Objectionable
By default there is a list of web categories you can use in your policies. On this page you can edit or delete existing categories, or create and classify a category of your own.
Add Web Category
Create a new Custom Web Category.
On the Add Web Category page you can create a new Custom Web Category for use in policy decisions. To create a
Web Category:
1. Enter a Name for your new category.
2. Select a classification from the Classification drop-down menu.
Available classifications include:
• Productive
• Unproductive
• Acceptable
• Objectionable
3. Select an option for Traffic Shaping Policy.
4. Set the Configure Category option to either Local or External URL Database.
• If you selectExternal URL Database you can enter a URL in a list of custom URLs that you want to include in the category.
• If you select Local you can enter a list of domains or keywords, either by uploading a text file or by entering them in the related text box. In the Search/Add text boxes you can enter domains or keywords. The existing list will match what you type so that you can see if an entry already exists.
5. Enter a Description to describe your new Web Category.
| Protection | 121
Figure 109: Add Web Category
6. Click Advanced Settings to configure policies or override the default message for a category.
a) Next to Action, select one or more policies from the Web Filter Policy list. For each policy selected, set the desired action for both HTTP and HTTPS.
a) Next to Denied Message, select Override Default Denied Message to modify the block page shown to the user if a website is blocked by your policy.
| Protection | 122
Figure 110: Advanced Settings
7. Click Save.
URL Group
Create a collection of URLs for use in web filter policies.
Use the URL Group page to create groups of URLs. These groups can be used in your web filter policies to block or allow custom collections of sites.
On this page you can edit an existing URL Group by clicking its name under URL Group Name, or by clicking the
Manage icon on the right. To delete an existing URL Group, click the Delete icon.
Add URL Group
Add a collection of URLs for use in policies.
On the URL Group, click the Add button to open the Add URL Group page.
1. Enter a name for your group in the URL Group Name text box.
2. Enter a description for the group you are creating.
3. Add URLs for this collection.
Entries must be single domains on separate lines, such as: example.com
foo.com
| Protection | 123 bar.com
Figure 111: Add URL Group
4. Click Save.
Surfing Quota
The Surfing Quota Policy page displays the list of all default and custom surfing quota policies.
A surfing quota policy specifies for how long (in hours) a user or group of users can access the Internet.
A surfing quota policy:
• Allows you to allocate Internet access time on a cyclic or non-cyclic basis.
• Can be applied to a number of Groups or Users.
The device is shipped with the following predefined policies: Unlimited Internet Access, 1 Month Unlimited Access,
1 month 100 hours, Monthly 100 hours Cyclic, Daily 1 hour Cyclic, Weekly 7 hours Cyclic. These predefined policies are immediately available for use until configured otherwise. You can also define custom policies to specify different levels of access for different users to meet your organization’s requirements.
The page also provides options to add, update, or delete surfing quota policies.
Note: Among all the policies applied, the device takes into account the policy that first reaches its threshold limit.
Add Surfing Quota Policy
Use the Add Surfing Quota page to configure a new surfing quota policy.
The Add Surfing Quota page allows you to configure a surfing quota policy.
1. Navigate to Protection > Web Protection > Surfing Quota or Objects > Policies > Surfing Quota and click
Add.
2. Enter the details.
Name
Specify name to identify the policy. Duplicate names are not allowed.
Cycle Type
Select Cycle type.
Available Options:Cyclic - Once the cycle ends, the user is automatically registered for new cycle. Non-
Cyclic - Once the specified time limit ends, the user will be disconnected.
Cycle Hours
Specify Cycle Hours. Cycle hours define the upper limit of surfing hours for cyclic types of policies i.e. Daily,
Weekly, Monthly and Yearly.
| Protection | 124
At the end of each cycle, cycle hours are reset to zero, e.g. for the "Weekly" Cycle type, cycle hours will reset to zero every week even if cycle hours are unused.
Validity
Specify Validity in number of days. Validity defines the upper limit of total surfing days allowed, i.e. it restricts total surfing days to valid allotted days.
OR
Click Unlimited Days, if you do not want to restrict the total surfing days.
Maximum Hours
Specify Maximum Hours. Maximum hours define the upper limit of total surfing hours allowed i.e. it restricts total surfing hours to maximum hours.
OR
Click Unlimited Hours, if you do not want to restrict the total surfing hours.
Description
Provide a description for the surfing quota policy.
Figure 112: Add Surfing Quota Policy
3. Click Save.
File Type
The File Type page allows you to manage file types to be used in filtering policy.
The File Type page displays a list of both built-in and custom file types that you can control with policies. For instance, you can restrict access to certain types of files within an otherwise-permitted category.
A file type group consists of collections of files, identified by either file extenstion or MIME headers. Predefined File
Types are provided, and you can create new collections of file types using templates.
This page lists existing File Type categories. The predefined File Type categories can not be modified. File Type groups that you have added can be edited or deleted by selecting the associated icon under the Manage heading. To delete multiple File Types, select the associated checkboxes under the Name heading and click Delete at the top of the page.
Click Add at the top to create a new File Type.
Add File Type Category
Create a File Type category to be used in protection policies.
Navigate to Protection > Web Protection > File Type or Object > Content > File Type and click Addto create a new File Type category:
1. Enter a Name for the new category.
2. Enter Description
3. Under Template, either choose Blank or an option from the drop-down menu.
Drop-down lists all the predefined as well as custom defined file type categories.
4. Specify File Extension and MIME Header text boxes to be included in your new category.
| Protection | 125
Figure 113: Add File Type Category
5. Click Save.
Application Protection
Application Protection provides facilities to control and manage the applications shipped with the device.
The following pages are accessible:
•
on page 125: displays all applications available for use
•
on page 126: enables you to control access to the applications
•
on page 417: allocates groups of applications to policies and assigns bandwidth
Application List
The Application List page displays all the applications available for use.
The device can identify and control applications which use standard port 80 and 443, non-standard ports, or port hopping, or tunnel through encrypted SSL traffic. This feature enables prioritization of applications based on user identity, time, and bandwidth, allowing great flexibility, visibility, and control. The device also provides implementation of application-based bandwidth management, accelerating critical applications while blocking malware-laden sites through web filtering. Organizations can group applications as per their requirements into business-critical, entertainment, communication, or collaboration, and can control access through security policies.
Note: You need a subscription to Web Protection before you can use this feature. Check its features by taking a free trial. (See System > Administration > Licensing)
| Protection | 126
The device is shipped with a set of predefined applications. This applications are classified based on their risk level, characteristics and technology, offering more granular controls.
The total number of application signatures included depends on the Application Signatures Database used by the device.
The application list can be filtered based on name of the application, category of the application, risk, characteristics, and technology.
Application Filter
The Application Filter page displays a list of all the predefined and custom policies.
An Application Filter Policy controls a user’s application access. It specifies which user has access to which applications and allows you to define powerful security policies based on almost limitless policy parameters like:
• Individual users
• Groups of users
• Time of day
The device is shipped with the following predefined policies for application filters:
• Allow: By default, allows access for all the groups except the specified groups. Access for the specified groups depends on the strategy defined for each group.
• Deny: By default, denies access for all the groups except the specified group. Access for the specified groups depends on the strategy defined for each group.
These two predefined policies are immediately available for use until configured otherwise. You can also define custom policies to specify different levels of access for different users to meet your organization’s requirements.
The page also provides options to add a new policy, update the parameters of an exisiting policy, delete a policy, add a filtering rule to a policy, or delete a filtering rule attached to a policy.
Add Application Filter Policy
This page lets you configure custom policies to define different levels of access for different users to meet your organization’s requirements.
The Add page allows you to manually configure policies.
1. Navigate to Protection > Application Protection > Application Filter or Objects > Policies > Application
Filter and click Add.
2. Enter the Application Filter Policy details.
Name
Enter a name to identify the Application Filter Policy.
Description
Enter description for the Application Filter Policy.
Enable Micro App Discovery
Enable to scan and classify microapps using HTTP protocol for communication. Microapps are applications that are used withing web browsers.
To allow/deny microapps, you need to specify action accordingly.
Refer Appendix D - Supported Micro-Apps for more details on supported applications.
Template
Select template for the Application Filter Policy.
| Protection | 127
Figure 114: Application Filter
3. Click Save.
4. Once the policy is added, next step is to add a rule for configuring filtering criteria.
Note:
• Rules can be added for custom policies only.
• If Micro App Discovery is enabled, one has to import SSL CA to avoid Certificate error.
Add Rule for Application Filter Policy
Use the Add New Rule page to configure a new rule for Application Filter Policy.
The Add New Rule page allows you to manually configure a new rule.
1. Navigate to Protection > Application Protection > Application Filter or Objects > Policies > Application
Filter and click .
2. Click Add under Application Filter Policy.
3. Enter the application filter details.
Category
Select Application Category from the list of available categories.
Risk
Select the level of risk from the available options.Select All1 - VERY LOW 2 - LOW3 - MEDIUM 4 -
HIGH5 - VERY HIGH
Characteristics
Select the characteristics from the available options.Select AllExcessive BandwidthProne to misuseTransfer filesTunnels other appsVulnerabilities Widely usedLoss of productivityCan bypass firewall policy
Technology
Select the technology from the available options.Select AllBrowser BasedClient ServerNetwork ProtocolP2P
| Protection | 128
Figure 115: Application Filter Criteria
4. Enter the list of matching applications.
Select All
Click to select all the Applications from the list.
Applications are available based on the Application Filter Criteria.
Select Individual Application
Click to select the Applications from the list.
Applications are available based on the Application Filter Criteria.
Search
Specify the name of the application in the textbox to be searched.
This option is available, only if option "Select Individual Application" is selected.
Name
Displays name of the Applications under the Category selected. You can also select more than one application using the checkbox.
Description
Displays description of the Application.
Category
Displays category of the Application.
Risk
Displays the risk factor involved with the Application.
Characteristics
Displays the characteristics of the Application.
| Protection | 129
Technology
Displays the technology utilized for the Application.
Figure 116: List of Matching Applications
5. Enter the action you want to perform.
Action
Select an Action for the Policy from the available options. Allow Deny
Schedule
Select schedule from the list available in the dropdown list.
Figure 117:
6. Click Save.
Traffic Shaping Defaults
Use the Traffic Shaping Defaults page to view the list of all the Application categories. This page also provides an option to edit the category or application to apply the traffic shaping policy.
The applications shipped with the device are grouped into categories. These categories can be used in filtering policy and bandwidth restriction can be applied. Bandwidth restriction can be applied to the category or to the individual application within the category.
The categories list can be filtered based on name of the category. Use the or toggle beside the category name to expand and collapse the list of applications grouped in the respective category.
Configure Traffic Shaping Policy for Category or Application
Use this page to configure traffic shaping policy.
This page allows you to configure traffic shaping policy for category or application.
1. to Protection > Application Protection > Traffic Shaping Default or Objects > Policies > Global Application
Traffic Shaping and click on
.
2. Enter the details.
| Protection | 130
Name
Name of the Application Filter Category or Application.
Traffic Shaping Policy
Click ‘Create New’ to create a new traffic shaping policy for the application/application category.
Traffic Shaping policy allocates and limits the bandwidth usage of the user, web category, application category.
3. Click Save.
Web Server Protection
Web Server Protection provides facilities to manage and add web servers, define protection policies for them and set up certificates.
The following pages are accessible:
•
on page 130: allows you to manage, add and delete settings of web servers connected to your device.
•
on page 132: let you define methods to protect your web servers against malicious attacks.
•
Web App Authentication Policies
on page 135: helps to set up authentication policies for direct access to
Sophos Firewall.
•
on page 138: sets up customized HTML login forms.
•
on page 139: manages certificates for authentication.
•
on page 143: manages certificate authorities which issue certificates.
•
on page 145: gives an overview of revoked certificates.
Web Servers
On this page you can add the web servers that are to be protected by the WAF.
Protection > Web Server Protection > Web Servers or Objects > Assets > Web Servers
The page displays all existing web servers. You can add, edit or delete web servers. For each web server, the list shows:
Name
Name of the web server.
Host
Host of the web server.
Type
Type of the web server.
Manage
Displays the available management options:
• Edit Allows you to edit the web servers.
• Delete Allows you to delete the web servers.
To add or delete a web server, click on the corresponding buttons.
Add Web Servers
This page describes how to add a web server.
1. Navigate to Protection > Web Server Protection > Web Servers or Objects > Assets > Web Servers and click
Add.
2. Enter the following settings:
| Protection | 131
Name
Enter a descriptive name for the web server.
Description
Enter a description or other information.
Host
Add or select a host, which can either be of the type IP Address or FQDN Host.
on page 565
Note: FQDN Host is recommended here because hosts listed with their IP address transmit empty host headers, which leads to problems with some browsers.
Type
Select a server type, i. e. whether you want the communication between Sophos Firewall and the web server to be encrypted (HTTPS) or plaintext (HTTP).
• Encrypted (HTTPS): Browser-based access to the web server via HTTPS.
• Plaintext (HTTP): Browser-based access to the web server via HTTP. Default.
Port
Enter a port number for the web server. By default the standard port of the selected web server type is selected.
Keep alive
Enable Keep alive to keep the connection between Sophos Firewall and the web server open instead of opening a new connection for every single request.
Note: In rare cases where the web server does not support keep alive properly, this feature can provoke reading errors or timeouts and should be disabled for the affected web server.
Timeout (only available when Keep alive is selected)
Enter a timeout for the Keep alive option. Values between 1 and 65535 seconds are allowed. Default is 300 seconds.
Figure 118: Add Webserver
3. Click Save.
The web server is created and appears in the web servers list.
| Protection | 132
Web App Protection Policies
With Web App Protection Policies you can define the modes and levels of protection for your web servers.
Objects > Policy > Web App Protection or Protection > Web Server Protection > Web App Protection Policies
The page displays all existing web application protection objects. You can add new protocol security objects, edit or delete them. For each protection object, the list shows:
Name
Name of the web app protection object.
Manage
Displays the available management options:
• Edit Allows you to edit the web app protection object.
• Delete Allows you to delete the web app protection object.
To add or delete a web app protection object, click on the corresponding buttons.
Add Application Protection Policy
This page describes how to add a web app protection object.
1. Navigate to Objects > Policy > Web App Protection or Protection > Web Server Protection > Web App
Protection Policies and click Add.
2. Enter values for the following settings:
Name
Enter a descriptive name for the web app protection object.
Description
Enter a description or other information.
Pass Outlook Anywhere
Enable this to allow external Microsoft Outlook clients to access the Microsoft Exchange Server via theWeb
Application Protection. Microsoft Outlook traffic will not be checked or protected by the Web Application
Protection.
Mode
Select a mode from the drop-down list:
• Monitor: HTTP requests are monitored and logged.
• Reject: HTTP requests are rejected.
Cookie Signing
Enable this to protect a web server against manipulated cookies. When the web server sets a cookie, a second cookie is added to the first cookie containing a hash built of the primary cookie's name, its value and a secret, where the secret is only known by the Web Application Protection. Thus, if a request cannot provide a correct cookie pair, there has been some sort of manipulation and the cookie will be dropped.
Static URL Hardening
Enable this to protect against URL rewriting. For that, when a client requests a website, all static URLs of the website are signed. The signing uses a similar procedure as with cookie signing. Additionally the response from the web server is analyzed regarding what links can be validly requested next. Static Hardened URLs can furthermore be bookmarked and visited later.
Note: Static URL hardening affects all files with a HTTP content type of text/* or *xml*, where * is a wildcard. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the URL hardening feature. It does not work for dynamic URLs created by client, for example: JavaScript.
| Protection | 133
Note: You can find more information about Static URL Hardening and Form Hardening under:
Additional Information on Static URL Hardening and Form Hardening
on page 135
Entry URLs (only applicable if Static URL Hardening is enabled)
Add URL for static URL hardening:
Form Hardening
Enable this to protect against web form rewriting. Form hardening saves the original structure of a web form and signs it. Therefore, if the structure of a form has changed when it is submitted the Web Application
Protection rejects the request.
Note: Form hardening affects all files with a HTTP content type of text/* or *xml*, where * is a wildcard. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the form hardening feature.
Note: You can find more information about static URL hardening and form hardening under:
Additional Information on Static URL Hardening and Form Hardening
on page 135
Anti-Virus
Enable this to protect a web server against viruses.
Direction
Select from the drop-down list whter to scan only uploads or downloads or both.
• Uploads
• Downloads
• Uploads and Downloads
Block unscannable content
Enable this to block files that cannot be scanned. The reason for that may be, among other things, that files are encrypted or corrupt.
Limit scan size
Enable this to enter the scan size limit into an additional field. Provide the limitation in megabytes.
Note: Please note that the scan size limit refers to an upload, not to single files. This means, if you, for example, limit to 50 MB and make an upload with multiple files (45 MB, 5 MB and 10
MB), the last file will not be scanned and a virus cannot be detected caused by the limitation.
Note: If you do not enter a limitation value it will be saved with '0' megabytes, which means the limitation is not active.
Block clients with bad reputation
Enable this to block clients which have a bad reputation according to their classification, based on
GeoIPClosed and RBLClosed information. Sophos uses the following classification providers: RBL sources:
• Commtouch IP Reputation (ctipd.org)
• http.dnsbl.sorbs.net
The GeoIP source is Maxmind. The WAF blocks clients that belong to one of the following Maxmind categories:
• A1: Anonymous proxies or VPN services used by clients to hide their IP address or their original geographical location.
• A2: Satellite providers are ISPs that use satellites to provide Internet access to users all over the world, often from high risk countries.
Skip remote lookups for clients with bad reputation (only applicable if Block clients with bad reputation is enabled)
Enable to use GeoIP-based classification which uses cached information only and is therefore much faster.
As reputation lookups include sending requests to remote classification providers, using reputation-based blocking may slow down your system.
| Protection | 134
Common Threat Filter
Enable this to protect your web servers from several threats. You can specify the threat filter categories you want to use in the Threat Filter Categories section below. All requests will be checked against the rule sets of the selected categories. Depending on the results, a notice or a warning will be shown in the live log or the request will be blocked directly.
Rigid Filtering
Enable this to tighten several of the selected rules. This may lead to false positives.
Skip Filter Rules
Some of the selected threat categories may contain rules that lead to false positives. To avoid false positives induced by a specific rule, add the rule number that you want to skip this box.
Protocol Violations
Enforces adherence to the RFC standard specification of the HTTP protocol. Violating these standards usually indicates malicious intent.
Protocol Anomalies
Searches for common usage patterns. Lack of such patterns often indicates malicious requests. These patterns include, among other things, HTTP headers like 'Host' and 'User-Agent'.
Request Limits
Enforces reasonable limits on the amount and ranges of request arguments. Overloading request arguments is a typical attack vector.
HTTP Policy
Narrows down the allowed usage of the HTTP protocol. Web browsers typically use only a limited subset of all possible HTTP options. Disallowing the rarely-used options protects against attackers aiming at these often less well-supported options.
Bad Robots
Checks for usage patterns characteristic of bots and crawlers. By denying them access, possible vulnerabilities on your web servers are less likely to be discovered.
Generic Attacks
Searches for attempted command executions common to most attacks. After having breached a webserver, an attacker usually tries to execute commands on the server like expanding privileges or manipulating data stores. By searching for these post-breach execution attempts, attacks can be detected that might otherwise have gone unnoticed, for example because they targeted a vulnerable service by the means of legitimate access.
SQL Injection Attacks
Checks for embedded SQL commands and escape characters in request arguments. Most attacks on web servers target input fields that can be used to direct embedded SQL commands to the database.
XSS Attacks
Checks for embedded script tags and code in request arguments. Typical cross-site scripting attacks aim at injecting script code into input fields on a target web server, often in a legitimate way.
Tight Security
Performs tight security checks on requests, like checking for prohibited path traversal attempts.
Trojans
Checks for usage patterns characteristic of trojans, thus searching for requests indicating trojan activity. It does not, however, prevent the installation of such trojans as this is covered by the antivirus scanners.
Outbound
Prevents web servers from leaking information to the client. This includes, among other things, error messages sent by servers which attackers can use to gather sensitive information or detect specific vulnerabilities.
| Protection | 135
Figure 119: Add Application Protection Policy
3. Click Save.
The web app protection object is created and appears in the Web App Protection page.
Additional Information on Static URL Hardening and Form Hardening
It is best practice always to enable both URL hardening and form hardening. These two functions are complementary, especially in the way that they prevent the issues you may have if you enable just one of them:
• Only form hardening is activated: When a webpage contains hyperlinks with appended queries (which is the case with certain CMSs), e.g. http://example.com/?view=article&id=1, such page requests are blocked by form hardening because it expects a signature, which is missing.
• Only URL hardening is activated: When a web browser appends form data to the action URL of the form tag of a web form (which is the case with GET requests), the form data becomes part of the request URL sent to the web server, thereby rendering the URL signature invalid.
Activating both functions solves those issues because if either form hardening or URL hardening find that a request is valid, the Web Application Protection accepts the request.
Web App Authentication Policies
You can use the Web Application Firewall (WAF) to authenticate users directly instead of leaving the authentication to the real web servers. Via authentication profiles, the reverse authentication can be used to assign specific authentication settings to each site path route.
Protection > Web Server Protection > Web App Authentication Policies or Objects > Policies > Web App
Authentication
Note: You can also view and manage the WAF status on the System > Diagnostics > Services page.
The page displays all existing web application authentication profiles. You can add, edit or delete application authentication profiles. For each authentication profile, the list shows:
Name
| Protection | 136
Name of the web app authentication profile.
Manage
Displays the available management options:
• Edit Allows you to edit the web app authentication profile.
• Delete Allows you to delete the web app authentication profile.
To add or delete a web app authentication profile, click on the corresponding buttons.
Add Web App Authentication Policies
This page describes how to add a web app authentication profile.
1. Navigate to Protection > Web Server Protection > Web App Authentication Policies or Objects > Policies >
Web App Authentication Policies and click Add.
2. Enter values for the following settings:
Name
Enter a descriptive name for the web app authentication profile.
Description
Enter a description or other information.
3. Enter the settings for the Client Authentication.
Mode
Select how the users should authenticate at the Web Application Firewall.
• Basic: Users authenticate with HTTP basic authentication, entering username and password. As the credentials are sent unencrypted with this mode, it should be used over HTTPS. In this mode, no session cookies will be generated and a dedicated logout is not possible.
• Form: Users will be presented with a form where they have to enter their credentials. In this mode, session cookies will be generated and a dedicated logout is possible. The form template to be used can be selected in the Web App Auth Template list. Besides the default form template, the list shows the forms
page
Basic Prompt
(only with Basic mode)
The realm is a unique string that provides additional information on the login page and is used for user orientation.
Note: These characters are allowed for the Basic Prompt: A-Z a-z 0-9 , ; . : - _ ' + = ) ( & % $ ! ^ <
> | @
Web App Auth Template
(only with Form mode)
Select the form template that will be presented to the users for authentication. Form templates are defined on
page.
Users or Groups
Select the users or user groups that should be assigned to this web app authentication profile or create a new one. After assigning this profile to a site path route, these users will have access to the site path with the authentication settings defined in this profile. Typically, this would be a backend user group.
You can create a new user directly on this page or on the System > Authentication > Users or Objects >
Identity > Users page.
You can create a new group directly on this page or on the System > Authentication > Groups or Objects >
Identity > Groups page.
| Protection | 137
Note: Sometimes users should be required to use the user principal name notation 'user@domain' when entering their credentials, for example when using Exchange servers in combination with
Active Directory servers.
4. Enter the settings for the Authentication Forwarding.
Mode
Select how the Web Application Firewall authenticates against the web servers. The mode has to match the web servers' authentication settings.
• Basic: Authentication works with HTTP basic authentication, providing username and password.
• None: There is no authentication between WAF and the web servers. Note that even if your web servers do not support authentication, users will be authenticated via the frontend mode.
Username affix
(only with Basic Authentication Forwarding mode)
Select an affix for the username and enter it into the concerning field. Affixes are useful when working with domains and email addresses.
• None
• Prefix
• Suffix
• Prefix & Suffix
Note: Prefix and suffix will be added automatically if the user enters their username. Prefix and suffix will not be added if the user enters it. Example: If the suffix is @testdomain.de and the user enters their username test.user the suffix will be added. If they enter [email protected] the suffix will be ignored.
Remove Basic Header
(only with None Authentication Forwarding)
Enable this if you do not want to send the basic header from Sophos Firewall OS to the web server.
5. Enter the settings for the User Session.
Session Timeout
Enable this to set a timeout for the user session, which will confirm the user's credentials by having them log in again if they do not perform any action. Default - ON
Limit to
(only if Session Timeout is enabled)
Set an interval for the session timeout. Default is 5 minutes.
Session Lifetime
Enable this to set a hard limit for how long users may remain logged in, regardless of activity in the meantime.
Default - ON
Limit to
(only if Session Lifetime is enabled)
Set a value for the session lifetime. Default is 8 hours.
| Protection | 138
Figure 120: Add Web App Authentication Policy
6. Click Save.
The Web App Authentication profile is created and appears in the Web App Authentication Policies list.
Web App Auth Templates
You can upload HTML forms for reverse authentication. A web application authentication template can be assigned to an authentication profile with frontend mode Form. The respective form will be presented when a user tries to access a site path to which the authentication profile is assigned.
Objects > Content > Web App Auth Templates or Protection > Web Server Protection > Web App Auth
Templates
The page displays all existing web application authentication templates. You can add, edit or delete templates. For each template, the list shows:
Name
Name of the template.
Template
Filename of the template.
Manage
Displays the available management options:
• Edit Allows you to edit the template.
• Delete Allows you to delete the template.
To add or delete a web app auth template, click on the corresponding buttons.
Add Web App Auth Template
This page describes how to add a web application authentication template.
| Protection | 139
1. Navigate to Objects > Content > Web App Auth Templates or Protection > Web Server Protection > Web
App Auth Templates and click Add.
2. Enter the following settings:
Name
Enter a descriptive name for the template.
Description
Enter a description or other information.
HTML template
Select and upload an HTML template.
Images/Stylesheet
Select and upload images, stylesheets, or JavaScript files that are used by the selected template.
Figure 121: Add Web App Auth Template
3. Click Save.
The web app auth template is created and appears in the Web App Auth Templates list.
Certificate
The Certificate page displays a list of available certificates.
A digital certificate is a document that guarantees the identity of a person or entity and is issued by the certificate authority (CA). Certificates are generated by third party trusted CAs. They create certificates by signing public keys and identify the information of the communicating parties with their own private keys. This way it is possible to verify that a public key really belongs to the communicating party only and has not been forged by someone with malicious intentions.
A certificate signed by a certificate authority (CA) identifies the owner of a public key. Each communicating party may be required to present its own certificate signed by a CA verifying the ownership of the corresponding private key. Additionally, the communicating parties need to have a copy of the CA’s public key. In case the private key is lost or stolen or the information is changed, CA is responsible for revoking the certificate.CA also maintains the list of valid and revoked certificates.
To use certificates for authentication, you must have a valid CA and a certificate. You need to upload a CA if you are using an external CA. You can generate a self-signed certificate if you want to use it as CA.
You can also use the device to act as a certificate authority and sign its own certificates. This eliminates the need of having your own certificate authority. If you are using the device as CA, you have to generate a self-signed certificate, which can be used in various VPN policies.
The page also provides options to generate a self-signed certificate, upload a certificate, or generate a Certificate
Signing Request (CSR).This page also provides the option to regenerate, revoke, download, or delete the certificates.
| Protection | 140
If you are using a third party CA, you have to submit a request to CA for issuing a certificate. Once CA issues a certificate, you have to upload to use it in the VPN policy.
This page provides options to:
•
•
•
Add Certificate
Use the Certificate page to add a new certificate.
The Certificate page allows you to generate a self-signed certificate, upload a certificate, or generate a Certificate
Signing Request (CSR).
1. Navigate to Protection > Web Server Protection > Certificate or System > VPN > Certificate or Objects >
Identity > Certificate and click Add.
2. Choose the action you want to perform.
Action
Select an action from the available options.
Upload CertificateGenerate Self-Signed CertificateGenerate Certificate Signing Request
Upload Certificate
Use the Certificate page to upload a certificate.
1. Enter details of the certificate to be uploaded.
Name
Specify a name of the certificate which you want to update.
Certificate File Format
Select the format of certificate file from the available options.
Available Options: PEM (.pem): Privacy Enhanced Mail (PEM) is a Base64encoded DER certificate.
It is used for encoding the certificate in ASCII code. The certificate and private key are stored in separate files. DER (.der): Distinguished Encoding Rules (DER) is a binary form of ASCII PEM format certificate used on Java platform. The certificate and private key are stored in separate files. CER (.cer): Canonical
Encoding Rules (CER) is a binary format for encoding certificates. It contains information about the owner of certificate, its public and private keys. PKCS7 (.p7b): Public Key Cryptography Standards (PKCS) is a format for encoding the certificate in ASCII code. It contains only certificates and not the private key.
PKCS12 (.pfx or .p12): Public Key Cryptography Standards (PKCS12) is a binary format for encoding certificates. It stores a private key with a public key certificate. It is used on Windows platforms.
Certificate
Select the certificate to be uploaded. Use Browse to select the complete path.
Private Key
Select the private key for the certificate. Use Browse to select the complete path.
Passphrase
Specify and re-confirm a passphrase for a certificate used for authentication. The passphrase must be at least 4 characters long.
2. Click Save.
Generate Self-Signed Certificate
Use the Certificate page to generate a self-signed certificate.
1. Enter details to generate a Self Signed Certificate (Option available only after configuring Default CA Parameters)
Name
Specify a name to identify the Certificate.
| Protection | 141
Valid From and Valid Up To
Specify certificate validity period using the Calendar . The validity period is the certificate life and indicates the period up to which the certificate will be considered as valid.
Default - 1 day
Key Length
Select key length. Key length is the number of bits used to construct the key.
Available Options:5121024153620484096
Generally, the larger the key, the less chance that it will be compromised but it takes longer to encrypt and decrypt data than smaller keys.
Default - 512
Key Encryption
Click to enable the key encryption.
Passphrase
Passphrase for a Certificate used for authentication. The passphrase must be at least 8 characters long. This option is enabled only if the Key Encryption option is selected.
Confirm Passphrase
Re-enter the passphrase for confirmation.
Certificate ID
Specify certificate ID. You can specify any one of the following options:
Available Options: DNSIP Address(IPv4/IPv6 Address) Email Address DER ASN1 DN(X.509) (Applicable when Authentication Type is Digital Certificate)
Once the certificate is created, you need to download and send this certificate to the remote peer with whom the connection is to be established.
Country Name
Select the country.
State
Specify the state within the country.
Locality Name
Specify the name of the locality.
Organization Name
Specify the name of the organization which will use this certificate and domain name. This domain will be certified to use the Certificate.
Use unique Domain name only.
Organization Unit Name
Specify the name of the department/unit which will use this certificate and domain name. This domain will be certified to use the Certificate.
Use unique Domain name only.
Common Name
Specify the common name.
A common name comprises of the host + domain name or is a fully qualified domain name that is used to resolve to SSL VPN interface. It must be same as that of the web address to be accessed when connecting to a secured site.
Email Address
Specify the Email Address of the contact person for communication.
2. Click Save.
| Protection | 142
Generate Certificate Signing Request
Use the Certificate page to generate certificate signing request.
1. On the Add Certificate page, select the action Generate Certificate Signing Request (CSR)
2. Enter certificate details.
Name
Specify a name to identify the certificate.
Valid Until
Specify certificate validity period using the calendar. Validity period is the certificate life i.e. period up to which the certificate will be considered as valid.
Minimum validity: 1 day
Key Length
Select key length. Key length is the number of bits used to construct the key.
Generally the larger the key, the less chance that it will be compromised, but it requires more time to encrypt and decrypt data than smaller keys.
Encryption
Click to enable the key encryption.
Passphrase (only applicable if Encryption is enabled)
Enter a passphrase for the certificate used for authentication. Passphrase must be at least 4 characters long.
Confirm Passphrase
Re-enter passphrase for confirmation.
Certificate ID
Specify a certificate ID. You can specify any one of the following options:
Available Options: DNS IP AddressEmail AddressDER ASN1 DN(X.509) (applicable when the authentication type is Digital Certificate)
3. Enter identification attributes of the certificate owner.
Country Name
Select the country for which the certificate will be used.
Generally, this would be the name of the country where the device is deployed.
State
Specify the state for which the certificate will be used..
Generally, this would be the name of the state where device is deployed.
Locality Name
Specify the name of the locality for which the certificate will be used.
Generally, this would be the name of the locality where device is deployed.
Organization Name
Specify the organization name, which will use this certificate.
Organization Unit Name
Specify the department/unit name, which will use this certificate.
Common Name
Specify the common name, eg. the server's hostname.
Email Address
Specify the email address of the contact person for communication.
4. Click Save.
| Protection | 143
Download Certificate
Use the Certificate page to download the certificate.
1. Navigate to Protection > Web Server Protection > Certificate or System > VPN > Certificate or Objects >
Identity > Certificate.
2.
Under the Manage column, click the download icon against the certificate you want to download.
Note:
• Only self-signed certificates and certificate signing requests can be downloaded.
• The certificate is downloaded as a .tar.gz file.
Revoke Certificate
Use the Certificate page to revoke the certificate.
1. Navigate to Protection > Web Server Protection > Certificate or System > VPN > Certificate or Objects >
Identity > Certificate.
2.
Under the Manage column, click the revoke icon to revoke a self-signed certificate if lost, stolen or updated.
The revoked certificate is automatically added to the Certificate Revocation List (CRL).
Note: You can download the revoked certificate and circulate it, if required.
Certificate Authority
The Certificate Authority page displays a list of all the certificate authorities. The list can be filtered based on the certificate authority name.
The device provides a facility to generate a local certificate authority as well as import certificates, signed by commercial providers, such as VeriSign.
A certificate signed by a certificate authority (CA) identifies the owner of a public key. Each communicating party may be required to present its own certificate signed by a CA verifying the ownership of the corresponding private key. Additionally, the communicating parties need to have a copy of the CA’s public key. In case a private key is lost or stolen or the information is changed, CA is responsible for revoking the certificate. CA also maintains the list of valid and revoked certificates.
After your CA has issued a certificate created by you or have a local certificate, you can upload it for use in VPN.
You can use a default CA, modify and re-generate it as per your requirement if you are not using any external CA.
Using this CA, you can generate a self-signed certificate and use it in the VPN policy.
Using a third party CA involves uploading:
• CA and root certificate
• Certificate
• CRL (Certificate Revocation List)
If the remote peer is using a certificate issued by the following third party CA, you are not required to upload CA:
• VeriSign
• Entrust
• Microsoft
Note: Default CA is regenerated automatically when it is updated.
The page provides option to:
•
•
| Protection | 144
•
Download Certificate Authority
Use the Certificate Authority page to download CA.
If you are using a local CA, you need to download CA and forward it to the remote peer.
1. Navigate to Protection > Web Server Protection > Certificate Authority or System > VPN > Certificate
Authority or Objects > Identity > Certificate Authority.
The Certificate Authority page displays the details of the default CA.
2.
Click the download icon to download the zip file.
Note: Default CA cannot be deleted.
Add Certificate Authority
To update and regenerate the default certificate, click on the default certificate.
•
•
Set CA Parameters
Use the Set CA Parameters page to update and regenerate any (editable) certificate.
The Set CA Parameters page allows you to manually enter details to add a new certificate authority.
1. Navigate to Protection > Web Server Protection > Certificate Authority or System > VPN > Certificate
Authority or Objects > Identity > Certificate Authority and click Add to add a new CA.
If you want to edit any other (editable) CA than the Default CA, click click the edit icon under Manage tab of the CA you want to modify.
2. Enter certificate authority details.
Name
Specify a name to identify the Certificate Authority.
Certificate File Format
Select format of the root certificate to be uploaded.
Available Options:PEM (Privacy Enhanced Mail): A format encoding the certificate in ASCII code.
The certificate, request, and private key are stored in separate files.DER: A binary format for encoding certificates. The certificate, request, and private key are stored in separate files.
Certificate
Specify full path from where the certificate is to be uploaded. Alternately, use Browse to select the path.
Private Key
Specify full path from where the Private Key is to be uploaded. Alternately, use Browse to select the path.
CA Passphrase
CA Passphrase for authentication. Passphrase must be at least 4 characters long.
Confirm CA passphrase for authentication.
3. Click Save.
Edit Default CA Parameters
Use the Edit Default CA Parameters page to update and regenerate the default certificate.
The Edit Default CA Parameters page allows you to manually enter certificate authority details.
1. Navigate to Protection > Web Server Protection > Certificate Authority or System > VPN > Certificate
Authority or Objects > Identity > Certificate Authority.
| Protection | 145
2.
Click on the icon under Manage tab of the default certificate that you want to update and regenerate.
3. Enter certificate authority details.
Name
Default. This name cannot be changed.
Country Name
Specify the name of the country where the device is installed.
State
Specify the name of the state where the device is installed.
Locality Name
Specify the name of the locality where the device is installed.
Organization Name
Specify the organization name, which will use this certificate..
Organization Unit Name
Specify the department/unit name, which will use this certificate.
Common Name
Specify the common name, e.g. the server's hostname.
Email Address
Specify the email address of the contact person for communication.
CA Passphrase
Specify a passphrase for the certificate authority. Passphrase must be at least 4 characters long.
Re-enter passphrase for confirmation.
4. Click Save.
Regenerating Certificate Authority
Use the Certificate Authority page to regenerate the default certificate.
1. Navigate to Protection > Web Server Protection > Certificate Authority or System > VPN > Certificate
Authority or Objects > Identity > Certificate Authority.
2.
Under the Manage column, click the Regenerate icon .
Note: Default CA is regenerated automatically when it is updated.
Certificate Revocation Lists
CA maintains the list of valid and revoked certificates. The page displays the list of available CRLs.
The Certificate Revocation Lists (CRL) page is a way to check the validity of an existing certificate. Certificates which are stolen, lost or updated are revoked by CA and CA publishes such revoked certificates in the revocation list.
VPN connection cannot be established using revoked certificates, hence it is necessary to update the CRL at regular intervals.
The page provides options to:
•
•
Adding a New CRL
Use the Certificate Revocation Lists page to add a new CRL.
If you are using an external certificate authority, you need to upload the CRL obtained from the external certificate authority.
| Protection | 146
1. Navigate to Protection > Web Server Protection > Certificate Revocation Lists or System > VPN >
Certificate Revocation Lists or Objects > Identity > Certificate Revocation Lists and click Add.
2. Enter certificate revocation list details.
Name
Specify a name to identify the CRL.
CRL File
Specify the CRL file to be uploaded. Browse to select the complete path.
3. Click Save.
The new CRL has been created and is added on the Certificate Revocation Lists page.
Downloading CRL
Use the Certificate Revocation List page to download the CRL.
Once a CA is generated, a default CRL is generated with name Default.tar.gz. Once you revoke the certificate, the details of the revoked certificate are added to the default file and are regenerated. You can download and distribute it, if required.
1. Navigate to Protection > Web Server Protection > Certificate Revocation Lists or System > VPN >
Certificate Revocation Lists or Objects > Identity > Certificate Revocation Lists.
2. Click Download" under the Manage column of the CRL to be downloaded.
A .zip file is downloaded.
3. Unzip the file to check the details.
Email Protection
This feature requires a subscription. It can be configured but cannot be enforced without a valid Email
Protection subscription.
From the Email Protection tab, the Administrator can configure SMTP/S, POP/S and IMAP/S settings, Malware and
Content Scanning Rules, Secure PDF eXchange (SPX) and Data Protection (DP) Policies.
The device offers comprehensive Email Security, preventing sophisticated forms of zero-hour threats and blended attacks involving spam, botnets, phishing, spyware and more. The basic email protection configuration includes:
• configuring an email threshold size for scanning
• specifying action to be taken if a virus is detected
• blocking mails based on sender or recipient
• blocking mails with certain file types.
Configuration
This feature requires a subscription. It can be configured but cannot be enforced without a valid Email
Protection subscription.
Email Configuration allows you to configure the general settings Email traffic. This page contains the following sections.
General Settings
Append Signature to All Outbound Messages
Enable to add a Signature at the end of all outgoing Email messages.
The signature is appended ONLY when SMTP and SMTPS Scanning is enabled in the relevant Business
Application Policy(s).
| Protection | 147
Email Signature
Specify a signature to be added to all outgoing Emails. Only text signatures are allowed.
Example:
This email contains confidential information. You are not authorized to copy the contents without the consent of the sender. Please do not print this email unless it is absolutely necessary. Spread environmental awareness.
Figure 122: General Settings
SMTP/S Settings
Don't Scan Emails Greater Than
Specify maximum file size (in KB) for scanning. Files exceeding this size received through SMTP/S will not be scanned.
Default - 1024 KB
Specify 0 to increase the default file size scanning restriction to 51200 KB.
Action for Oversize Email
Specify the action for Oversize Emails.
Available Options
Accept: All the oversize mails are forwarded to the recipient without scanning.Reject: All the oversize mails are rejected and sender is notified.Drop: All the oversized mails are dropped, without notifying the sender.
Bypass Spam Check for SMTP/S Authenticated Connections
Enable to bypass Spam Scanning for Email messages received over SMTP/S connections authenticated by the
Email Server.
Verify Sender's IP Reputation
Click to verify the reputation of the sender IP Address. When enabled, the Device dynamically checks the sender’s IP Address of all Emails. If the IP Address is found to be responsible for sending spam email or malicious contents, the Device takes action as per the configured Scanning Rules.
If enabled, specify an action for Confirmed Spam Emails and Probable Spam Emails.
Available Options
Accept: All the spam Emails are forwarded to the recipient after scanning as per the configuration. Reject: All the spam mails are rejected and a notification is sent to the Email sender. Drop: All the spam mails are dropped, without notifying the sender.
As it is a global option, if spam scanning is enabled, all the mails will first be subjected to IP Reputation filtering followed by filtering based on actions configured in the spam policy.
Default - Disable
SMTP DoS Settings
Enable to configure SMTP DoS Settings which protect the network from SMTP DoS Attacks.
| Protection | 148
If this is enabled, specify values for Maximum Connections, Maximum Connections/Host, Maximum Emails/
Connection, Maximum Recipients/Email, Email Rate per Minute/Host and Connections Rate per Second/Host.
Maximum Connections (Available if SMTP DoS Settings Enabled)
Specify maximum number of connections that can be established with the Email Server.
Default - 1024
Acceptable Range - 1 - 20000
Maximum Connections/Host (Available if SMTP DoS Settings Enabled)
Specify maximum number of connections allowed to the Email Server from a particular host.
Default - 64
Acceptable Range - 1 - 10000
Maximum Emails/Connection (Available if SMTP DoS Settings Enabled)
Specify maximum number of Emails that can be sent in a single connection.
Default - 512
Acceptable Range - 1 - 1000
Maximum Recipients/Email (Available if SMTP DoS Settings Enabled)
Specify maximum number of recipientsfor a single Email.
Default - 100
Acceptable Range - 1 - 256
Email Rate per Minute/Host (Available if SMTP DoS Settings Enabled)
Specify number of Emails to be sent from a particular host in one minute.
Default - 512
Acceptable Range - 1 - 20000
Connection Rate per Second/Host (Available if SMTP DoS Settings Enabled)
Specify number of connections allowed to the Email Server from a particular host in one second.
Default - 8
Acceptable Range - 1 - 20000
Figure 123: SMTP/S Settings
| Protection | 149
POP/S and IMAP/S Settings
Don't Scan Emails Greater Than
Specify maximum file size (in KB) for scanning. Files exceeding this size received through POP/IMAP will not be scanned.
Default - 1024 KB
Specify 0 to increase the default file size restriction to 10240 KB.
Recipient Headers
Specify Header value to detect recipient for POP3/IMAP.
Default - Delivered-To, Received, X-RCPT-TO
Figure 124: POP/S and IMAP/S Settings
SMTP TLS Configuration
TLS Certificate
Select the CA for scanning SMTP traffic over SSL from the available options.
Available Options
DefaultSecurityAppliance_SSL_CAList of custom CAs if added. You can create the custom CA from Objects >
Identity > Certificate Authority.
Allow Invalid Certificate
If enabled, SMTP over SSL connections will be allowed with an invalid certificate from the Email Server.
Disable this option to reject such connections.
Default - Enable
Require TLS Negotiation with Host/Net
Select the remote host (Email Server) or network from available options on whose connections TLS encryption is to be enforced. In other words, the Device will always initiate TLS-secured connections when Emails are to be sent to selected hosts/networks. If TLS is enforced but connection cannot be established, then Emails to that remote host/network are discarded.
Require TLS Negotiation with Sender Domain
Specify the Sender Domain(s) on whose Email connections TLS encryption is to be enforced.
Sender Domain is the domain of the Email sender. Emails from the specified Sender Domain will be sent over
TLS-encrypted connections only. If TLS is enforced but connection cannot be established, then Emails from that sender domain are discarded.
Skip TLS Negotiation Hosts/Nets
Select the remote host (Email Server) or network from available options on whose connections TLS encryption is to be skipped or bypassed. When configured, SMTP connections to selected hosts will be established in clear text and unencrypted.
| Protection | 150
Figure 125: SMTP TLS Configuration
POP and IMAP TLS Configuration
TLS Certificate
Select the CA for scanning POP and IMAP traffic over SSL from the available options.
Available Options
DefaultSecurityAppliance_SSL_CAList of custom CAs if added
Allow Invalid Certificate
If enabled, POP and IMAP over SSL connections will be allowed with invalid certificate from the Mail Server.
Disable to reject such connections.
Default - Enable
Figure 126: POP and IMAP TLS Configuration
Scanning Rules
This page allows configuration of malware and spam scanning rules.
This feature requires a subscription. It can be configured but cannot be enforced without a valid Email
Protection subscription.
This page contains the following sections:
•
| Protection | 151
•
POP3/S and IMAP/S Malware Scanning Rules
•
SMTP/S Malware Scanning Rules
Malware Scanning Rules allow you to define action to be taken on Emails if they are virus-infected, suspicious or contain a protected attachment. Based on the action defined in rule, such Emails can be delivered as they are, dropped, or cleaned and then delivered or quarantined.
A Malware Scanning Rule defines:
• whether to quarantine the Email
• whether sender, receiver or Administrator are to be notified
• whether to block the Email containing a specified file type
• what action is to be taken if Email is infected/suspicious/contains a protected attachment: deliver as it is, drop, clean and then deliver
A default Malware Scanning Rule is pre-configured in the Device and applied to all Email traffic as soon as you subscribe to the Email Protection Module. We recommend that you create separate rules fine-tuned to your specific network requirements to minimize the possibility of threats.
Note: You can also view the Malware Quarantine from Protection > Email Protection > Malware
Quarantine page.
The section displays the list of all SMTP/S Malware Scanning Rules. You can filter the list based on Sender and
Recipient. The page also provides options to
POP3/S and IMAP/S Malware Scanning Rules
The device applies a single policy to all POP3/S and IMAP/S traffic so that whenever a virus gets detected in an
Email, the virus-affected attachment is stripped from the Email and the Email body is replaced with a notification message.
Scanning
Specify the type of scanning to be applied.
Available Options:
Disable: No scanning appliedSingle Anti Virus: Traffic will be scanned ONLY by the Primary Anti Virus
Engine. Select the Primary Anti Virus Engine from System > System Services > Malware Protection.Dual
Anti Virus: Traffic will be scanned by both Anti Virus Engines, first by the Primary and then by the Secondary
Engine. Select the Primary Anti Virus Engine from System > System Services > Malware Protection.
Content Scanning Rules
When you subscribe to the Email Protection Module, content scanning rules can be configured for particular senders and recipients.
A rule defines the action to be taken if an Email is detected as Spam, Probable Spam, part of Virus Outbreak or
Probable Virus Outbreak.
To reduce the risk of losing legitimate messages, the Spam Quarantine repository - a storage location- provides administrators with a way to automatically quarantine Emails that are identified as spam. This helps in managing spam and probable spam quarantined mails so that the user can take appropriate actions on such emails.
Detection of Spam attributes
The device uses Content Filtering, and premium and standard RBLs - Realtime Blackhole Lists – to check for the spam attributes in SMTP/S, POP3/S and IMAP/S emails:
• Premium
• Standard
| Protection | 152
RBL is a list of IP Addresses whose owners refuse to stop the proliferation of spam, that is, owners who are responsible for spam or are hijacked for spam relay. The device checks each RBL for the connecting IP Address. If the IP Address matches one on the list, then the specified action in the policy is taken.
The Content Scanning Rules section displays a list of all the content scanning rules. You can filter the list of rules based on the email sender or recipient. It also provides options to
,
Add SMTP/S Malware Scanning Rules
This feature requires a subscription. It can be configured but cannot be enforced without a valid Email
Protection subscription.
The Add SMTP/S Malware Scanning Rules page allows you to configure scanning policy to detect malware in
Email traffic and take appropriate action.
1. Navigate to Protection > Email Protection > Scanning Rules and click Add under SMTP/S Malware Scanning
Rules.
2. Specify Name to identify the scanning rule.
3. Enter Email Address/Domain Group details.
Sender
Select the sender name from the list of users.
Select Any if the rule is to be applied on all the senders.
You can also add RBLs or list of Email addresses by clicking Create New link.
Recipient
Select the recipient name from the list of users.
Select Any if the rule is to be applied on all the recipients.
You can also add RBLs or list of Email addresses by clicking Create New link.
Figure 127: Email Address/Domain Group
4. Enter Attachment Filter details.
Block File Types
Select file types to be blocked as an attachment to remove all the files that are a potential threat and to prevent virus attacks.
More than one file type can be selected using ctrl/shift keys.
Device contains a default list of File Types, with each Type containing relevant file extensions. Refer to
Objects > Content > File Type to view the list of file extensions which can be blocked.
Select All to block Emails with any type of attachments.
Select None to allow Emails with any type of attachments.
MIME Whitelist
If one or more File Type is selected in Block File Type, this field is populated with the corresponding MIME
Headers that belong to selected File Type(s).
Select the MIME Header(s) of the selected File Type(s). Only selected headers are to be allowed while the rest in the selected File Type are to be blocked during Anti-virus scanning of Email attachments.
| Protection | 153
Figure 128: Attachment Filter
5. Specify Malware Filter details.
Scanning
Specify the type of scanning to be applied.
Available Options:
Disable: No scanning applied.
For Cyberoam Models below CR1000iNG, and Sophos UTM Models below SG105. Enable: Traffic will be scanned by the Device's Anti-virus Engine.
For Cyberoam Models CR1000iNG and above, and Sophos UTM Models SG105 and above. Single
Anti Virus: Traffic will be scanned ONLY by the Primary Anti Virus Engine. Select the Primary Anti Virus
Engine from System > System Services > Malware Protection. Dual Anti Virus: Traffic will be scanned by both Anti Virus Engines, first by Primary and then by the Secondary Engine. Select the Primary Anti
Virus Engine from System > System Services > Malware Protection.
Action (Available only if Scanning is enabled)
Enable action to be taken on the mails received, from the available options: Quarantine: If enabled, copies the
Email to the quarantine file list. Email is either delivered to recipient or dropped, as per configured Recipient
Action.You can view the Email details like sender and receiver of the Email in the Malware Quarantine.
Administrator can access the Quarantine from Protection > Email Protection > Malware Quarantine while user can access from their respective User Portal.Notify Sender: If enabled, the original message is withheld by the Device and a notification is sent to the sender informing that the Email was infected. The sender will receive the notification only if the Receiver Action is configured as Don't Deliver
Default - Disable
Delivery Option for Infected Attachment/Protected Attachment (Available only if Scanning is enabled)
Recipient Action
Select the action to be taken on the message that is detected to be Infected, Suspicious or includes a Protected
Attachment.
Available Options:
Don't Deliver: Receiver will not receive the message and will also not receive the notification regarding the infected Email.Deliver Original: Receiver receives the original Email.Remover and Deliver: Infected part of the Email is removed before delivering. Receiver will also receive the notification stating that the Email was infected and infected portion of the Email is removed. Not applicable for Blocked Attachments (Block File
Type).
Note: Protected attachments are not scanned but receiver will be notified, if not specified otherwise.
| Protection | 154
Notify Administrator
Select the action to notify the Administrator for the message detected to be Infected, Suspicious or includes a
Protected Attachment.
Available Options:
Don't Deliver: Administrator will not be notified about the infected Email.Send Original: Receiver receives the original Email.Remove Attachment: Recipient receives message without attachment and the Administrator receives the notification that the Email attachment was infected and removed before delivering Email.
Note: Protected attachments are not scanned but receiver will be notified, if not specified otherwise.
Figure 129: Malware Filter
6. Click Save.
Content Scanning Rules
This feature requires a subscription. It can be configured but cannot be enforced without a valid Email
Protection subscription.
The Add Content Scanning Rules page allows you to configure scanning policy to detect incoming and outgoing spam in Email traffic and take appropriate action.
1. Navigate to Protection > Email Protection > Scanning Rules and click Add under the Content Scanning Rules section.
2. Specify a Name for the Content Scanning Rule.
3. Enter Email Address/Domain Group details.
Sender
Specify Email Address(es) of the Sender(s). You can select from:
Contains: Specify keywords to be matched with Sender Email Addresses. The rule applies to Address(es) containing those keywords. For example, if the keyword "mail" is specified, the rule will apply to Sender
Email Addresses [email protected], [email protected], etc.
Equals: Specify the exact Email Address(es) of the Sender(s).
You can also add RBLs, a list of Email Addresses or keywords using the Create New link.
Recipient
Specify Email Address(es) of the Recipient(s). You can select from:
| Protection | 155
Contains: Specify keywords to be matched with Recipient Email Addresses. The rule applies to Address(es) containing those keywords. For example, if keyword "mail" is specified, the rule will apply to Recipient
Email Addresses [email protected], [email protected], etc.
Equals: Specify the exact Email Address(es) of the Recipient(s).
You can also add RBLs, a list of Email Addresses or keywords using Create New link.
Figure 130: Email Address/Domain Group
4. Select the Filter Criteria.
Inbound Email is
All the Emails that are received by the users in their inbox are referred to as Inbound.
If you select Inbound Spam, all the Emails received by the users are scanned for spam and viruses by the
Device.
The specified action will be taken if the Device has identified the Inbound Email to be one of the following:
Spam Probable Spam Virus Outbreak Probable Virus Outbreak
Outbound Email is
Emails that are sent by the user in the network to a remote user on another Email system, are referred as
Outbound.
If you select Outbound Spam, all the Emails sent by the local users are scanned for spam and viruses by the
Device before being delivered.
The specified action will be taken if the Device has identified the Outbound Email to be one of the following:
Spam Probable Spam Virus Outbreak Probable Virus Outbreak
Source IP/Network Address
Specify the action to be taken when the Email sender IP Address matches the specified IP Address.
Destination IP/Network Address
Specify the action to be taken when the Email recipient IP Address matches the specified IP Address.
Sender Remote Blacklist
Specify the action to be taken when the sender is listed in the specified RBL Group.
Message Size
The specified action will be taken if the Email size matches the specified size.
Message Header
The specified action will be taken if the message header equals or contains the specified text.
Contains: Specify keywords to be matched with Message Header. The rule applies to Header(s) containing those keywords.
Equals: Specify the exact Header(s) to be scanned.
You can scan message header for Spam in:
| Protection | 156
Subject: The specified action will be taken if the header contains the matching subject. From: The specified action will be taken if the header contains the matching text in the From address. To: The specified action will be taken if the header contains the matching text in the To address. Other: The specified action will be taken if the matching text is found in the headers.
Data Protection Policy
The specified action will be taken if the message contains data matching with the configured
. You can create Data Protection Policies at Protection > Email Protection > Data Protection Policy.
None
Select this to create a rule for email between a specific sender and recipient without any conditions. You can set actions for SMTP/S and POP/S-IMAP/S mails only on the basis of sender and recipient.
Figure 131: Filter Criteria
5. Select the action.
SMTP/S Action
Select action to be taken for the SMTP/S traffic.
Available Options:
Reject: Email is rejected and a rejection notification is sent to the Email sender. Accept (Not available for
Outbound Spam): Email is accepted and delivered to the intended recipient. The Administrator can bind an
SPX Template to this action so that the Email is delivered to the intended recipient after being SPX-encypted.
Change Recipient: Email is accepted but is not delivered to the intended recipient for whom the message was originally sent. Email is sent to the recipient specified in the spam policy. Prefix Subject (Not available for
| Protection | 157
Outbound Spam): Email is accepted and delivered to the intended recipient but after tagging the subject line.
The Administrator can bind an SPX Template to this action so that the Email is delivered to the intended recipient after being SPX-encypted. Tagging content is specified in the To field. You can customize subject tagging in such a way that the recipient knows that the is a spam Email. For Example, Contents to be prefixed to the original subject: ‘Spam notification from the Device –' Original subject: ‘This is a test’ Recipient will receive Email with the subject line: ‘Spam notification from the Device - This is a test’ Drop: Email is rejected but a rejection notification is not sent to the Email sender. Accept with SPX (Available only with
Data Protection Policy): Email is accepted and delivered to the intended recipient after being SPX encrypted.
Select the SPX Template to be applied to the Email. You can create
Protection > SPX Templates.
SPX Template
If the action selected is Accept, Prefix Subject or Accept with SPX, select the SPX Template to be applied
from Protection > Email Protection > SPX Templates.
Quarantine
If this is enabled, the device does not deliver Email but copies it to the quarantine file list. You can view the
Email details like the sender and recipient in the quarantined file list.
POP3/S and IMAP/S Action
Select the action to be taken for POP3/S and IMAP/S traffic. This option is not available for the parameters
Outbound Anti Spam Module Has identified Mail as, Source IP Address/Network Belongs to,
Destination IP Address/Network Belongs to and Data Protection Policy.
Accept: Email is accepted and delivered to the intended recipient. Prefix Subject: Email is accepted and delivered to the intended recipient but after tagging the subject line.Tagging content is specified in spam policy. You can customize subject tagging in such a way that the recipient knows that the Email is a spam
Email. For Example, Contents to be prefixed to the original subject: ‘Spam notification from the Device –
‘Original subject: ‘This is a test’ Recipient will receive Email with the subject line: ‘Spam notification from the Device - This is a test’
Figure 132: Action
6. Click Save.
SPX Configuration
This feature requires a subscription. It can be configured but cannot be enforced without a valid Email
Protection subscription.
This feature is available in Cyberoam Models CR25iNG and above, and all Sophos UTM Models.
SPX Global Template
Default SPX Template
Select the SPX Template to be used by default. The Default Template is used if any user explicitly SPX-encrypts an email and no template is selected in the Content Scanning Rule.
The user can SPX-encrypt an Email by:
• Manually setting the Email header X-Sophos-SPX-Encrypt to "yes".
• Installing the Sophos Outlook Add-on and clicking Encrypt before sending the Email.
If the Default SPX Template is set to None, then SPX encryption is not applied to Email.
Figure 133: SPX Global Template
Password Reset
Reset Password for
Enter the Email Address for the recipient for whom you want to reset the password. New SPX email to this address requires the recipient to obtain a new password from the sender.
Figure 134: Password Reset
SPX Portal Settings
Host Name
Specify the IP Address or Domain on which the Password Registration Portal is hosted.
Allowed Network(s)
Specify the networks from which password registration requests will be accepted.
Port
Enter the port on which the SPX Password Registration Portal should listen.
Default: 8094
| Protection | 158
Figure 135: SPX Portal Settings
SPX Expiry Settings
Keep Unused Password for
Specify the expiry time in days of an unused password.
For example, if Keep Unused Password for is set to 3 days, the password will expire at 0 o'clock 3 days after being generated if no SPX encrypted message has been sent for a specific recipient.
Default: 30 days
Allow Password Registration for
Specify the time in days after which the link to Password Registration Portal expires.
| Protection | 159
Default: 10 days
Figure 136: SPX Expiry Settings
SPX Notification Settings
Send Error Notification To
Specify whom to send a notification when an SPX error occurs. You can send the notification to the sender or you can send no notification at all. Error messages will always be listed in the SMTP log.
Figure 137: SPX Notification Settings
SPX Templates
This feature requires a subscription. It can be configured but cannot be enforced without a valid Email
Protection subscription.
This feature is available in Cyberoam Models CR25iNG and above, and all Sophos UTM Models.
SPX (Secure PDF Exchange) encryption is a next-generation version of email encryption. It is clientless and extremely easy to set up and customize in any environment. Using SPX encryption, email messages and any attachments sent to the Device are converted to a PDF document, which is then encrypted with a password. You can configure the Device to allow senders to select passwords for the recipients, or the server can generate the password for the recipient and store it for that recipient, or the server can generate one-time passwords for recipients.
When SPX encryption is enabled, there are two ways in which emails can be SPX encrypted:
• The user can download the Sophos Outlook Add-in from User Portal. After having it installed, an Encrypt button is displayed in the Microsoft Outlook user interface. To encrypt a single message, the user needs to click the
Encrypt button and then write and send the message. Only if something goes wrong, for example the sender does not enter a valid password, will a notification will be sent, if one has been configured.
Note:
If you do not use Outlook you can also trigger SPX encryption by setting the header field
X-Sophos-SPX-Encrypt to "yes".
• In the Data Protection feature, you can enforce SPX encryption of Emails containing sensitive data (see
Protection > Email Protection > Scanning Rules > Content Scanning Rules).
The encrypted message is then sent to the recipient's mail server. Using any PDF reader, the recipient can decrypt the message with the password that was used to encrypt the PDF. SPX-encrypted email messages are accessible on all popular smartphone platforms that have native or third-party PDF file support, including Blackberry and Windows
Mobile devices.
The SPX template defines the layout of the PDF file, password settings and recipient instructions. You can also define different SPX templates. So, if you are managing various customer domains, you can assign them customized SPX templates containing, for example, different company logos and texts.
| Protection | 160
Add SPX Templates
This feature requires a subscription. It can be configured but cannot be enforced without a valid Email
Protection subscription.
This feature is available in Cyberoam Models CR25iNG and above, and all Sophos UTM Models.
This page allows you to define new SPX Templates or modify existing templates.
1. Navigate to Protection > Email Protection > SPX Templates and click Add.
2. Enter parameter values for the following basic settings.
Name
Specify the name to uniquely identify the template. The name should be a string containing alphanumeric and special characters EXCEPT forward slash (/), backslash (\), comma (,), double quote (") and single quote (').
Description
Specify details of the template.
Organization Name
Specify the organization name to be displayed on notifications concerning SPX sent to the administrator or the email sender, depending on your settings.
PDF Encryption
Select the encryption standard of the PDF file.
Page Size
Select the page size of the PDF file.
Figure 138: General Settings
3. Enter Password Settings.
Password Type
Select how you want to generate the password for accessing the encrypted email message. The sender always has to take care of transferring the password in a safe way to the recipient, unless you select Specified by
recipient.
Available Options:
Specified by Sender:
If you select this, the email sender should provide the password. The sender has to enter the password into the Subject field, using the following format:
[secure:<password>]<subject text> where
<password> is the password to open the encrypted PDF file and <subject text> is the random subject. Of course, the password will be removed by the Device before the email is sent to the recipient.
Generated one-time password for every email:
| Protection | 161
The Device automatically creates a new password for each affected email. An email notification is mailed to the sender containing instructions and the one-time generated password.
The HTML content of this Email can be customized from Notification Subject and Notification Body. You can reset to the default content by clicking Reset.
Generated and stored for recipient:
The Device automatically creates a recipient-specific password when the first email is sent to a recipient.
This password will be sent to the sender. With the next email, the same password is used automatically. The password will expire when it is not used for a configured time period, and it can be reset by the administrator, see the
.
The HTML content of this Email can be customized from Notification Subject and Notification Body. You can reset to the default content by clicking Reset.
Specified by recipient:
If you select this, the email recipient should provide the password. The recipient receives an email notification containing a link leading to the Password Registration Portal to register a password and the Sender receives a failure notification. After registration, the recipient is able to view the current encrypted mail and any future encrypted mails using the same password from this or other senders from the same organization.
Note: The Recipient's password generated via Specified by recipient method and Generated and
stored for recipient are mutually exclusive. The recipient will have to use the respective password when email is received after SPX Encryption using different methods.
Figure 139: Password Settings
4. Specify Recipient Instructions:
Instructions for Recipient
The body of the email that is sent from the Device to the email recipient containing instructions concerning the encrypted email. Simple HTML markup and hyperlinks are allowed. You can also use variables, e.g.,
%%ORGANIZATION_NAME%%
Tip:
The Default SPX Template on this tab contains all available variables and gives a useful example of recipient instructions. The variables used are:
• ENVELOPE_TO: The recipient for whom the password is generated.
• PASSWORD: The password to open SPX encrypted Email
• ORGANIZATION_NAME: The name provided in the Organization Name field.
• SENDER: The sender of the email.
• REG_LINK: The link to the Registration Portal for registering the password.
| Protection | 162
Figure 140: Recipient Instructions
Data Protection Policy
This feature requires a subscription. It can be configured but cannot be enforced without a valid Email
Protection subscription.
This feature is available in Cyberoam Models CR15iNG and above, and all Sophos UTM Models.
The Data Protection (DP) feature allows you to reduce accidental data loss from workstations by monitoring and restricting the transfer of files containing sensitive data. Accidental data loss is commonly caused by employees mishandling sensitive data. For example, a user sends a file containing sensitive data home via email (SMTP). DP scans outgoing emails including subject line, message body and attachments for sensitive or confidential information.
Based on the outcome, the email can be encrypted using SPX encryption, or the email can be rejected or sent.
To configure DP, select one or more rule from the Sophos Content Control List (CCL). CCLs encrypted using SPX encryption, or the email can be rejected or sent.
To configure data protection policy, select one or more rules from the Sophos Content Control List (CCL). CCLs provide expert definitions for common financial and personally identifiable data types, for example, credit card numbers, social security numbers, postal addresses, or email addresses. Advanced techniques, such as checksums, are used in Sophos CCLs to increase the accuracy of sensitive data detection.
Add Data Protection Policy
This feature requires a subscription. It can be configured but cannot be enforced without a valid Email
Protection subscription.
This feature is available in Cyberoam Models CR15iNG and above, and all Sophos UTM Models.
The Add Data Protection Policy page is used to configure a policy to scan and detect confidential data in Email traffic and take appropriate action.
1. Go to Protection > Email Protection > Data Protection Policies and click Add.
2. Enter policy details.
Name
Specify a name to identify the Data Protection Policy.
Signatures
Select one or more Content Control signature(s) to be added to the policy.
Filter the CCL based on Type or Region.
| Protection | 163
Figure 141: Data Protection Policy
3. Click Save.
Address Group
Scanning Rules are applied on Email Addresses. To make configuration easier and simpler, the Administrator can group the addresses that require the same scanning policy. The policy applied to the address group is applicable to all the group members. Hence when the group is used in a number of rules, it becomes much easier to add or remove addresses from the group rather than updating individual rules. Hence, just with the one update, the Administrator can re-align the rules.
An Address Group is a grouping by:
• Email Address or Domain
• IP Address
• RBL (Real time black hole List) (applicable only for the spam email)
An address can be a member of multiple groups.
An RBL is a list of IP Addresses whose owners are responsible for spam or are hijacked for a spam relay. These IP
Addresses might also be used for spreading viruses. The Device checks each RBL for the connecting IP Address and the action configured in the policy is taken if the IP Address is found in any of the RBL lists. The Administrator can directly use the two default RBL groups shipped with the Device or update them as per their requirement:
• Premium RBL Services
• Standard RBL Services
The Address Group page displays a list of all the default and custom groups and provides options to add a new group, update the parameters, import addresses in the existing group, or delete the group. You can sort the list based on address group name.
| Protection | 164
Add Address Group
This page allows you to add a new Email Address Group, or edit existing groups.
1. Navigate to Protection > Email Protection > Address Group and click Add.
2. Specify the parameter values of the following Address Group Settings.
Name
Enter a name to identify the Group. A group name must be unique.
Description
Provide the description for the address group.
Group Type
Select the type of addresses you want to group from the available options.
Available Options:
RBL (IPv4) and RBL(IPv6):
An RBL is a list of IPv4 and IPv6 Addresses, respectively, whose owners refuse to stop the proliferation of spam, i.e. are responsible for spam or are hijacked for spam relay. The Device will check each RBL for the connecting IP Address. If the IP Address matches one on the list then the specified action in the policy is taken. Specify the Domain Name to be added as RBL to the Address Group.
Email Address / Domain:
Import or manually specify the Email Address or Domain Name to be added to the Address Group.
Import – Select this to browse and import a CSV file or a text file to add the Email Address/Domain to the address group.
Manual – Select this to manually add the Email Address/Domain to the address group.
Figure 142: Address Group
3. Click Save.
Email Archiver
This feature requires a subscription. It can be configured but cannot be enforced without a valid Email
Protection subscription.
| Protection | 165
Email being one of the most important communication and business tools in use by organizations, email archiving has become an integral part of every organization. An email archive is a repository used to preserve emails for compliance and operational purposes.
Using the Device's Email Archiver, the administrator can archive all incoming Emails, or Emails for a specific recipient or a group of recipients and thereby keep a close watch over data leakage.
The device can archive all Emails intended for single or multiple recipients and can forward them to a single administrator or multiple administrators.
This section displays a list of the archivers created and provides optiosn to
update the parameters of existing archiver
, or delete the archiver. You can filter the list based on recipient name.
Add Email Archiver
This feature requires a subscription. It can be configured but cannot be enforced without a valid Email
Protection subscription.
The Add Email Archiver page allows you to specify which recipient's Email you want to archive.
1. Go to Protection > Email Protection > Email Archiver and click Add.
2. Enter the following parameters.
Name
Enter a name for the Email Archiver.
Recipient
Select Any to archive all the incoming Emails or specify the Address Group for which Emails need to be archived.
Send Copy of Email To (Only for SMTP/S Protocol)
Specify the Email Address to which you want to forward the Email copy.
Figure 143: Email Archiver
3. Click Save.
Quarantine Digest Settings
This feature requires a subscription. It can be configured but cannot be enforced without a valid Email
Protection subscription.
This feature is available in Cyberoam Models CR15iNG and above, and all Sophos UTM Models.
The Quarantine Digest is an Email containing a list of quarantined Emails filtered by the Device and held in the user
Quarantine Area. If it is configured, the user receives a Quarantine Digest as per the frequency in Protection > Email
Protection > Quarantine Digest. The digest also provides a link to the User Portal from where the user can access quarantined Emails and take the required action.
The Quarantine Digest settings can be configured globally for all the users or for individual users. The user receives the Quarantine Digest as per the configured frequency.
The Quarantine Digest provides the following information for each quarantined message:
| Protection | 166
• Date and time: Date and time when the message was received
• Sender: Email address of the sender
• Recipient: Email address of the receiver
• Subject: Subject of the message
Configuring the Quarantine Digest for All Users
Enable Quarantine Digest
Enable the Quarantine Digest to configure the digest service for all the users.
Email Frequency
Specify the mailing frequency for digest.
Digests can be mailed every hour, every day at configured time, or every week on the configured day and time.
From Email Address
Specify the Email Address from which the email should be sent.
Display Name
Specify the email sender name. Digest email will be sent with this name.
Send Test Email
Click this and provide an email address to which the message is to be sent for Email Address verification.
Reference User Portal IP
Select Interface/Port IP from the ‘Reference User Portal IP’ dropdown list.
The User Portal link in the digest mail will point to this IP Address. The user can click the link to access his quarantined messages and take the required action. Users who do not come under the specified Interface will have to access the quarantine email directly from their MyAccount.
Allow Override
Enable if you want to allow the user to override the Digest Settings. If it is enabled, the user can disable the digest service.
Change User's Quarantine Digest Settings
Click to change the digest settings of the individual users.
This allows you to select the group and update the Quarantine Digest Setting of group members.
Overriding Quarantine Digest Settings for a Specific User(s)
Click Change User’s Quarantine Digest Settings to change the digest settings for individual users. This opens a new pop-up window named Manage Quarantine Digest, which allows you to search groups and users.
You can individually search for user and user groups.
Select the checkbox against a user to enable the Quarantine Digest. If it is enabled, the configured Quarantine Digest
Settings are applicable for the user.
| Protection | 167
Figure 144: Quarantine Digest Settings
Malware Quarantine
This feature requires a subscription. It can be configured but cannot be enforced without a valid Email
Protection subscription.
This feature is available in Cyberoam Models CR15iNG and above, and all Sophos UTM Models.
Note: You can also view and manage the Malware Quarantine on the System > Current Activity >
Malware Quarantine page.
Malware Quarantine page displays all the Emails quarantined by device if they are found to be virus-infected, suspicious or contains Protected Attachment.
Use Filter to search for mails from the list of Quarantined Mails.
The Filter result displays a list of all the Quarantined Emails based on the filter criteria. The Administrator can release the quarantined mails to the recipient’s inbox by clicking the Release icon against the mail.
Total Utilization displays the percentage of the Quarantine Area used by quarantined and virus infected messages.
Once the quarantine repository is full older Emails are purged.
Quarantine Digest
The Quarantine Digest is an Email containing a list of quarantined Emails filtered by Device and held in the user's
Quarantine Area. If configured, the user receives a Quarantine Digest as per the frequency set in Protection > Email
Protection > Quarantine Digest. The Digest also provides a link to the User Portal from where the user can access quarantined Emails and take the required action.
Releasing Quarantined Email
Either the Administrator or the user can release the quarantined Emails. The Administrator can release the quarantined
Emails from theQuarantine Area while the user can release them from his User Portal. Released quarantined Emails are delivered to the intended recipient’s inbox. The Administrator can access the Quarantine Area from Protection >
Email Protection > Malware Quarantine/Spam Quarantine, while the user can logon to the User Portal and access the Quarantine Area from Malware/Spam Quarantine. If the Quarantine Digest is configured, the user will receive a
Digest of the quarantined mails as per the configured frequency.
| Protection | 168
Figure 145: Malware Quarantine
Spam Quarantine
This feature requires a subscription. It can be configured but cannot be enforced without a valid Email
Protection subscription.
This feature is available in Cyberoam Models CR15iNG and above, and all Sophos UTM Models.
Note: You can also view and manage the Spam Quarantine on the System > Current Activity > Spam
Quarantine page.
Spam Quarantine page displays all the Emails quarantined by Device if identified as Spam as configured in any
Content Scanning Rule.
Use Filter to search for mails from the list of Quarantined Mails.
The Filter result displays a list of all the Quarantined Emails based on the filter criteria. The Administrator can release the quarantined mails to the recipient’s inbox by clicking the Release icon against the mail.
Total Utilization displays percentage of Quarantine Area used by quarantined Spam and virus infected messages.
Once the quarantine repository is full older Emails are purged.
Quarantine Digest
The Quarantine Digest is an Email containing a list of quarantined Emails filtered by the Device and held in the user
Quarantine Area. If configured, the user receives a Quarantine Digest as per the frequency in Protection > Email
Protection > Quarantine Digest. The Digest also provides a link to the User Portal from where user can access quarantined Emails and take the required action.
Releasing Quarantined Email
Either the Administrator or the user can release the quarantined Emails. Administrator can release the quarantined
Emails from the Quarantine Area while the user can release them from his User Portal. Released quarantined Emails are delivered to the intended recipient’s inbox. The Administrator can access the Quarantine Area from Protection >
Email Protection > Malware Quarantine/Spam Quarantine, while user can logon to the User Portal and access the
Quarantine Area from Malware/Spam Quarantine. If Quarantine Digest is configured, user will receive Digest of the quarantined mails as per the configured frequency.
| Protection | 169
Figure 146: Spam Quarantine
Trusted Domain
This feature requires a subscription. It can be configured but cannot be enforced without a valid Email
Protection subscription.
To bypass spam scanning of certain domains, define the domains as Trusted Domains. The page lists all the domains configured as trusted domains.
It also provides the options to add a new domain and delete an existing domain.
Figure 147: Trusted Domains
| System | 170
System
Use System pages to configure and administer your device, set up remote connections, set up access permissions, select services and check the system state.
Available configurations:
•
- Network menu establishes how your device connects and interacts with your network, and provides
options to configure network specific settings.
•
- Routing menu provides options to configure both static and dynamic routes.
•
- VPN menu allows you to configure required IPsec, L2TP, PPTP, SSL- VPN connections, and clientless access.
•
- Administration menu provides options to configure general settings and administrative settings
for the device. It also facilitates handling firmware versions, licensing services, updates, backup & restore and import/export.
•
- Authentication menu allows you to configure authentication servers, groups, users, clientless users, guest users, hotspots, hotspot settings and Captive Portal settings. You can also download authentication clients.
•
- System Services menu allows configuration of device components along with the associated services.
•
- Current Activity menu provides information about the live IPsec, SSL, IP, wireless and RED
connections to the device.
•
- Diagnostic menu allows checking the health of your device in a single shot. Information can be used for troubleshooting and diagnosing problems found in your device.
Network
Network allows configuration for the following:
This section covers the following topics:
•
: Configure and manage the ports/interfaces of the device.
•
: Configure custom zone and view the list of default and custom zones.
•
: Create and manage wireless networks.
•
: Create and manage mesh networks.
•
- Configure parameters of the wireless WAN connection of the device.
•
: Create and manage 6in4, 6to4, 6rd and 4in6 IP tunnels for inter-communication between IPv6 and IPv4 networks.
•
•
: Manage DNS servers to be used by the device, DNS host entries and routing of specific requests.
•
•
: View the list of configured router advertisements (RA), configure RAs.
•
: View and manage device's ARP-NDP neighbors.
•
: Integrate device with a dynamic DNS. Manage existing configuration.
Interfaces
The Interfaces page contains a list of all the interfaces of the device and displays each of their configuration.
System > Network > Interfaces
The device is shipped with a number of physical interfaces/ports and a number of virtual interfaces depending on the device model. The Interface page displays a list of physical interfaces, aliases, virtual sub-interfaces, bridge
| System | 171 interfaces, interfaces configured as LAG, interfaces configured for wireless LAN, interfaces configured for wireless
WAN, and interfaces configured as TAP.
Using this page, the physical interfaces can be configured. If a virtual sub-interface is configured for the physical interface, it is also displayed beneath the physical interface. Virtual sub-interface configuration can be updated or deleted. In addition, you can configure the following:
•
– Alias allows binding multiple IP addresses to a single physical interface.
•
– A bridge enables you to configure transparent subnet gatewaying.
•
– The Link Aggregation Group (LAG) is a method by which multiple network connections can be combined into a single connection. It is also known as trunking, NIC teaming, NIC bonding, and Ether Channel. LAG is mostly used for handling LAN traffic.
•
– A virtual LAN is a broadcast domain configured on a switch on a port-by-port basis.
•
– A wireless network is used to associate devices through a wireless distribution method and
provide a connection to the Internet through an access point.
If a wireless network is configured with “Separate Zone” for
Wireless Networks or Protection > Wireless Protection > Wireless Networks a wlnet interface of type
“Wireless Protection” is automatically created with the configured IP address and zone of the wireless network on this page. To use the interface, you need to configure a DHCP server for the interface so that the wireless clients can connect to the device. The interface will be automatically deleted once the wireless network is deleted.
•
– A wireless WAN is a wide area network (WAN) for data that is typically provided by the cellular
carriers to transmit a wireless signal over a range of several miles to a mobile device.
•
– A TAP interface enables you to deploy the device in Discover Mode. In this mode, the device can monitor all network traffic without making any changes in the existing network schema. The Discover Mode can be configured through the command line interface (CLI).
•
branch office is part of your local network. The RED device connects to the device using a RED interface. The
RED device can be configured using this interface. On factory default, all configured RED interfaces are deleted.
Interface status messages can have the following values:
Possible Status:
• Disabled - The interface is currently not bound to any zone.
• Connected - The interface is connected, configured, and running.
• Connecting (Only displayed for PPPoE and WWAN interfaces) - Displayed when a new IP address is being leased.
• Disconnected (Only displayed for PPPoE and WWAN interfaces) - Displayed after the IP address has been released.
• Disconnecting (Only displayed for PPPoE and WWAN interfaces) - Displayed during the process of the IP release.
• Unplugged - No physical connection.
• Not Available (Applicable for Flexi Ports devices) - If the Flexi Ports module has previously been inserted and the Flexi Ports have been configured, then - after removing the Flexi Ports module from the device - the Flexi
Ports will have the status "Not available".
The following list shows various icons representing different interface types:
Icons Meaning
Ethernet
Wireless
Bridge
Icons Meaning
VLAN
RED10
RED15
RED50
LAG
WWAN
Note:
• Updating interface details may affect dependent configurations including:
• Interface zone binding, DNS, gateway, interface-based hosts, VLAN interfaces, dynamic DNS.
• Prevents the DHCP server to update the details, so that a manual restart is required.
• Disconnects all tunnels and updates all VPN policies. Tunnels need to be reconnected manually.
• Deleting the virtual sub-interface will delete the security policy defined for the virtual sub-interface.
• Deleting an unbound physical interface will also delete the security policy defined for the physical interface.
• Deleting the interface will also remove all its dependent configurations including: Interface zone binding, DHCP server or relay, interface-based security policy, ARP – static and proxy, protected servers, protected server-based security policies, interface-based hosts and references from host groups, unicast and multicast routes.
Physical Interface Configuration
This page describes how to edit physical interface configuration.
1.
Navigate to System > Network > Interfaces, Click the icon followed by the Edit Interface hyperlink of the physical interface whose settings needs to be updated.
2. Enter details for the General settings.
Physical Interface
Physical interface for example, Port A, Port B.
Network Zone
Select the zone to which the interface belongs to.
Available Options:
None LAN WAN DMZ WiFi
| System | 172
Figure 148: General Settings
3. Enter IPv4 configuration details.
IP Assignment
Select the IP assignment type.
Available Options:
Static PPPoE DHCP
IPv4/Netmask
Specify the IPv4 address for the interface and select the network subnet mask.
Preferred IP (Only for PPPoE IP assignment)
Many internet service providers assign a static IP address to the PPPoE connection. The device allows the administrator to bind a static IP address to a PPPoE connection.
Note:
It is possible that IP Address other than preferred IP Address be assigned to PPPoE connection. It depends on the PPPoE Server configuration.
4. Enter IPv4 gateway details.
Gateway Detail (Only for "WA"N zone)
• For "Static" IP assignment: Specify the gateway name and IPv4 address through which the traffic is to be routed
• For "PPPoE" IP assignment: Specify the gateway name through which the traffic is to be routed.
• For “DHCP” IP assignment: Specify the gateway name through which the traffic is to be routed.
| System | 173
Figure 149: IPv4 Configuration
5. Enter details for "PPPoE" IP assignment.
Username
Specify PPPoE account username.
Password
Specify PPPoE account password.
Access Concentrator/Service Name
Specify access concentrator and service name.
The device initiates only those sessions with the access concentrator, which can provide the specified service.
LCP Echo Interval
Specify the time the system should wait before sending an echo request to check whether the link is alive or not.
Default - 20 seconds
LCP Failure
After an attempt, the device waits for the LCP echo request response for the period defined in the LCP Echo interval. After a defined number of attempts, it declares the PPPoE link as closed if it does not receive a response.
Default - 3
| System | 174
Schedule Time For Reconnect
The assigned IP address, dynamic or static (preferred), for a PPPoE connection may have a stipulated validity.
Once the validity has expired, the PPPoE connection is terminated and reconnected.
In order to avoid reconnection during the working hours, the administrator can enable the PPPoE reconnection schedule. The administrator can choose to schedule the PPPoE reconnection on daily or weekly basis with the configured time (HH:MM).
Default - Disable
Default schedule when enabled – All days of week.
Note: It is possible that after reconnection, an IP address other than the preferred IP address is assigned to the PPPoE connection, if a Preferred IP address is configured and Schedule Time For
Reconnect is enabled and configured.
Figure 150: PPPoE Configuration
6. Enter IPv6 configuration details.
IP Assignment
Select the IP assignment type.
Available Options:
Static DHCP
Mode (Only for DHCP mode)
Select the DHCP mode.
The administrator can select to configure the IPv6 addresses through stateful (DHCPv6) or stateless address assignment methods depending on the managed (M) address configuration and other (O) configuration flags advertised in the router advertisement (RA) message.
Available Options:
Auto: If selected, the IPv6 address will be configured based on the router advertisement packet through stateless address auto-configuration (SLAAC) or DHCPv6 depending on the Managed (M) Address
Configuration and Other (O) Configuration flags advertised in the Router Advertisement (RA) message.
Manual: Administrator can select to configure IPv6 address either through SLAAC or DHCPv6.
• DHCP Only: In this manual mode, client will configure IPv6 Address and other configuration parameters using DHCPv6 Server. Gateway details should be manually specified.
• Stateless: In this manual mode, client will configure IPv6 Address based on advertised RA message through SLAAC.
• Accept Other Configuration from DHCP: Select to configure other parameters using DHCPv6
Server. By default, it is enabled.
DHCP Rapid Commit
If enabled, the interface will be configured using a 2-message exchange (Solicit and Reply) rather than the 4message exchange (Solicit, Advertise, Request, and Reply). It allows for quicker client configuration.
Note: Rapid commit should also be enabled on the DHCPv6 server.
IPv6 / Prefix (Only for static IP assignment)
Specify the IPv6 address and the prefix.
Gateway Detail (Only for "WA"N zone)
For "Static" IP assignment: Specify the gateway name and IPv6 address through which the traffic is to be routed. For “DHCP” IP assignment: Specify the gateway name, if Stateless” manual mode is selected. For
DHCP only manual mode, specify the gateway name and IPv6 address.
| System | 175
Figure 151: IPv6 Configuration - DHCP
7. Enter details for the Advanced Settings.
Interface Speed
Select interface speed for synchronization.
Speed mismatch between the device and 3rd party routers and switches can result into errors or collisions on the interface, no connection or traffic latency, or slow performance.
Depending on the model deployed, the following options are available:
Auto Negotiation10 Mbps - Half Duplex10 Mbps - Full Duplex 100 Mbps - Half Duplex100 Mbps - Full
Duplex1000 Mbps - Full Duplex
Default - Auto Negotiation
MTU
Specify the MTU value (Maximum Transmission Unit).
MTU is the largest physical packet size, in bytes, that a network can transmit. This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes. Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent.
Default - 1500
Acceptable Range (For IPv4 Configuration) - 576 to 1500
Acceptable Range (For IPv6 Configuration) - 1280 to 1500
Override MSS
Select to override the default MSS.
MSS defines the amount of data that can be transmitted in a single TCP packet.
Default - 1460
Acceptable Range - 536 to 1460
Use Default MAC Address
Select this option to use the default MAC address for the interface.
By default, the first port that is included as member port becomes the default MAC address.
Override Default MAC Address
Select this option to override the default MAC address for the interface and enter the new MAC address.
On factory reset, it is set to the default MAC Address.
| System | 176
Figure 152: Advanced settings
8. Click Save.
The interface settings have now been updated.
Advanced Settings for Bridge Interface
This page allows you to edit advanced settings for the bridge interface.
1.
Navigate to System > Network > Interfaces, click the icon followed by the Edit Interface hyperlink of the bridge interface whose advanced settings needs to be updated.
2. Enter details for Advanced Settings.
Physical Interface
Displays the physical bridge member interface.
Network Zone
Displays the zone to which physical interface belongs.
Interface Speed
Select the interface speed for synchronization.
Speed mismatch between the device and 3rd party routers and switches can result into errors or collisions on the interface, no connection or traffic latency, slow performance.
Depending on the model deployed following options will be available:
• Auto Negotiation
• 10 Mbps - Half Duplex
• 10 Mbps - Full Duplex
• 100 Mbps - Half Duplex
• 100 Mbps - Full Duplex
• 1000 Mbps - Full Duplex
The default setting is Auto Negotiation.
MTU
Specify the MTU (Maximum Transmission Unit) value. MTU is the largest physical packet size, in bytes, a network can transmit.
Default: 1500
| System | 177
Override MSS
Select to override the default MSS. MSS defines the amount of data that can be transmitted in a single TCP packet.
Default: 1460
Use Default MAC Address
Click to use the default MAC address for the interface. By default, the first port that is added as a member port becomes the default MAC address.
Override Default MAC Address
Click to override the default MAC address for the interface and enter the new MAC address. On factory reset, it will be set to the default MAC address.
Figure 153: Advanced Settings - Bridge Interface
3. Click Save.
The settings for the bridge interface have been updated.
Add Bridge
This page describes how to add a bridge when the device is deployed in bridge mode / L2 Bridge mode.
This feature is not supported in virtual security devices when deployed in Microsoft Hyper-V hypervisors only.
1. Navigate to System > Network > Interfaces, click Add Interface and select Add Bridge from the drop-down list.
2. Enter details for the General Settings.
Name
Provide a name to identify the bridge.
Description
Enter a description for the bridge.
Enable routing on this bridge
Select to enable routing on this bridge.
Figure 154: General Settings
3. Enter details for Member Interfaces.
Interface
Select interfaces for the bridge. For example, Port A, Port B.
Zone
For each interface, select zone to which the interface belongs.
Figure 155: Bridge Member Interfaces
4. Enter IPv4 configuration and gateway details.
IPv4 / Netmask
Specify the IPv4 address and the network subnet mask.
Gateway Name
Specify a name to identify the gateway.
Gateway IP
Specify the IPv4 address for the gateway.
Figure 156: IPv4 Configuration and Gateway Details
5. Enter IPv6 configuration details.
IPv6 / Prefix
Specify the IPv6 address and the prefix.
Gateway Name
Specify a name to identify the gateway.
IP Address
Specify the IPv6 address for the gateway.
Figure 157: IPv6 Configuration
6. Enter details for the Advanced Settings.
MTU
Specify the MTU value (Maximum Transmission Unit).
| System | 178
MTU is the largest physical packet size, in bytes, that a network can transmit. This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes. Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent.
Default - 1500
Acceptable Range (For IPv4 Configuration) - 576 to 1500
Acceptable Range (For IPv6 Configuration) - 1280 to 1500
Override MSS
Select to override the default MSS.
MSS defines the amount of data that can be transmitted in a single TCP packet.
Default - 1460
Acceptable Range - 536 to 1460
| System | 179
Figure 158: Advanced Settings
Note: Note
• A single WAN interface is supported in a bridge.
• A single interface cannot be part of multiple bridges.
7. Click Save.
The bridge interface has been created and appears in the Interface list.
Add Alias
Alias allows binding multiple IP addresses onto a single interface. This page describes how to add/edit an Alias.
1. Navigate to System > Network > Interfaces, click Add Interface and select Add Alias from the drop-down list.
2. Enter interface details.
Physical Interface
Select the interface for which an Alias should be bound.
IP Family
Select the IP family for the Alias.
Available Options:
IPv4 (Only for physical interfaces with IPv4 configuration)
IPv6 (Only for physical interfaces with IPv6 configuration)
IPv4/Netmask (Available only for IPv4)
Specify the IPv4 address and select the network subnet mask.
IPv6/Prefix (Available only for IPv6)
Specify the IPv6 address and the prefix.
Default - 64
Figure 159: Add Alias
3. Click Save.
The Alias has been created and appears in the Interface list.
Configure Wireless WAN Settings
This page describes how to configure wireless WAN settings.
1.
Navigate to System > Network > Interfaces, click the icon followed by the Edit Interface hyperlink of the
WWAN interface whose settings needs to be updated.
2. Enter the details for the General Settings.
Interface Name
Specify the name of the interface.
IP Assignment
Select the IP assignment method from the available options:
Available Options:Dial-up (PPP)Network Adapter (DHCP)
Show Recommended Configuration
Click this button to view the modem details and the recommended configuration. The recommended configuration is displayed in two sections:
Information section:
• Modem Name
• Vendor ID
• Product ID
• SIM PIN Enabled – Yes/No
Configuration section:
Available IP Assignment Methods:
Possible Values
• Dial-up (PPP)
• Network Adapter (DHCP)
• Dial-up (PPP) & Network Adapter (DHCP)
Modem Port:
Possible Values
• Not Available
• Serial n (n= 0, 1, …9)
Secondary Modem Ports:
Possible Values
• Not Available
• Serial n (n = 0, 1, …9)
Note: This parameter displays the next promising modem port. This port must be utilized as Modem Port, if the recommended modem port fails.
| System | 180
| System | 181
APN (Access Point Name):
Possible Values
• Not Available
• <name>
DHCP Connect Command:
Possible Values
• Not Required
• Required but not available
• <AT command>
DHCP Disconnect Command:
Possible Values
• Not Required
• Required but not available
• <AT command >
Click the Load Recommended Configuration button to load the recommended configuration onto the page.
Note:
• Clicking the Load Recommended Configuration button flushes out previous configurations if any exist and replaces them with the recommended configurations.
• Values of the secondary modem ports will not be loaded on clicking the Load
Recommended Configuration button.
Connect
Select the mode for establishing a WWAN connection.
Available Options:AutoManual
Reconnect Tries
Select the number of attempts allowed to reconnect to an access point.
Available Options:Always123The default setting is Always.
Modem Port (Only for Dial-up (PPP))
Specify the serial interface on which the modem will establish a connection.
Available Options:Serial 0 to 9
Phone Number (Only for Dial-up (PPP))
Specify the phone number to be used for establishing the connection.
Username
Specify a username for the connection.
Password
Specify a password.
SIM Card PIN Code
Specify the PIN code to unlock the PIN-enabled SIM card.
Many operators lock their SIM card to prevent the use of other operator's SIM cards. These kinds of modems can be unlocked with the PIN code for establishing a connection.
APN
Specify the access point name.
The access point name (APN) is a configurable network identifier, used by the device to identify the packet data network (PDN) / GSM carrier with which the user wants to communicate.
| System | 182
DHCP Connect Command (Only for Network Adapter (DHCP))
Specify a DHCP command to connect to the wireless WAN.
DHCP Disconnect Command (Only for Network Adapter (DHCP))
Specify a DHCP command to disconnect from the wireless WAN.
Initialization String
Specify an initialization string for the specific wireless modem. There can be more than one string and in such a case, strings should be entered in the proper order.
Figure 160: General Settings - Dial-up
3. Enter details for the Gateway settings.
Gateway Name
Specify a name to identify the gateway.
Gateway IP
Specify the IP address of the gateway.
Gateway Type
Specify the type of the gateway.
Available Options:ActiveBackup
Weight (Only if the gateway type “Active” is selected)
Depending on the weight, a gateway for load balancing is selected. The device distributes traffic across links in proportion to the ratio of weights assigned to the individual links.
This weight determines how much traffic will pass through a particular link relative to the other link(s).
When more than two gateways are configured and one gateway fails, the traffic is switched over to the available gateways according to the ratio of the weights assigned to the available gateways.
Activate this gateway (Only if the gateway type “Backup” is selected)
Select the gateway activation condition.
The dropdown list shows all configured gateways. The backup gateway will take over and traffic will be routed through the backup gateway only when the selected gateway fails.
Available Options:If <Gateway Name> gateway fails - Backup gateway will take over and traffic will be routed through the backup gateway only when the <Gateway Name> gateway fails.If <Any> gateway fails -
Backup gateway will take over and traffic will be routed through the backup gateway when any of the active gateways fails.If <All> the gateways fail - Backup gateway will take over and traffic will be routed through the backup gateway when all the configured active gateways fail.
Action on Activation (Only if the gateway type “Backup” is selected)
Configure the weight for the backup gateway. The device distributes traffic across links in proportion to the ratio of weights assigned to individual links. This weight determines how much traffic will pass through a particular link relative to the other link(s).
Inherit weight of the failed active gateway
Backup gateway will inherit the parent gateway’s (active gateway) weight
Use pre-configured weight
Specify the weight.
| System | 183
Figure 161: Gateway Settings - Backup
4. Enter details for Advanced Settings.
MTU
Specify the MTU value (Maximum Transmission Unit).
MTU is the largest physical packet size, in bytes, that a network can transmit. This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes. Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent.
Default: 1500
Acceptable Range: 576 to 1500
MSS
Specify the MSS value.
MSS defines the amount of data that can be transmitted in a single TCP packet.
Default: 1460
Acceptable Range: 536 to 146
MAC Address (Only for Network Adapter (DHCP))
From the available options, select a method to provide a MAC address for the modem:
Available Options:Use Default MAC AddressOverride Default MAC Address.On selection of the option
Override Default MAC Address, provide the MAC address.
| System | 184
Figure 162: Other Settings
5. Click Save.
The wireless WAN settings have now been updated.
Virtual LAN (VLAN)
A LAN is a local area network and is defined as having all devices in the same broadcast domain. Routers stop broadcasts while switches just forward them.
A VLAN is a virtual LAN. In technical terms, a VLAN is a broadcast domain configured on a switch on a portby-port basis. Normally, it is a router that creates the broadcast domain but with VLANs, a switch can create the broadcast domain.
A VLAN allow you to segment your switched network so that broadcast domains are smaller, leaving more bandwidth for your end nodes. Devices that are in one VLAN can communicate with each other but cannot communicate with the devices in another VLAN. The communication among devices in a VLAN is independent of the physical network.
For devices in different VLANs to communicate, a layer 3 device (usually a router) must be used. A VLAN segregates devices by adding 802.1Q VLAN tags to all of the packets sent and received by the devices in the VLAN.
VLAN ID/tags are 4-byte frame extensions that contain a VLAN identifier as well as other information.
Advantages
• Increased port density
• Logical segmentation of the network irrespective of the devices' physical placement
• Granular security on heterogeneous LANs
• Improved network throughput as the VLAN confines the broadcast domain
Add VLAN Interface
You can add a VLAN interface from this page.
1. Navigate to System > Network > Interfaces, click Add Interface and select Add VLAN from the drop-down list.
2. Enter basic VLAN details.
Physical Interface
Select a parent interface for the virtual sub-interface. The virtual sub-interface will be the member of the selected physical interface/port.
Zone
Select a zone to assign to the virtual sub-interface. The virtual sub-interface will be the member of the selected zone. It can be the member of LAN, DMZ, WAN, WiFi or a custom zone.
VLAN ID
Specify the VLAN ID. The interface VLAN ID can be any number between 2 and 4094. The VLAN ID of each virtual sub-interface must match the VLAN ID of the packet. If the IDs do not match, the virtual subinterface will not receive the VLAN tagged traffic.
Note: Multiple virtual sub-interfaces added to the same physical interface cannot have the same
VLAN ID. However, you can add virtual sub-interfaces with the same VLAN ID to different physical interfaces.
| System | 185
Figure 163: VLAN Details
3. Enter IPv4 configuration details (Only for physical interfaces with IPv4 configuration).
IP Assignment
Select the IP assignment type.
Available Options:
• Static
• PPPoE
• DHCP
IPv4/Netmask
Specify an IPv4 address for the interface and select the network subnet mask.
Preferred IP (Only for PPPoE IP assignment)
Many internet service providers assign a static IP address for the PPPoE connection. The device allows the administrator to bind a static IP address for a PPPoE connection.
Specify the preferred IP address for the PPPoE connection.
Gateway Detail (For "WA"N zone)
• For Static IP assignment: Specify the gateway name and IPv4 address through which the traffic is to be routed.
• For PPPoE IP assignment: Specify the gateway name through which the traffic is to be routed.
• For DHCP IP assignment: Specify the gateway name through which the traffic is to be routed.
Figure 164: IPv4 Configuration
4. Enter the details for PPPoE IP assignment.
Username
Specify the PPPoE account username.
Password
Specify the PPPoE account password.
Access Concentrator/Service Name
Specify the access concentrator and service name.
The device initiates only those sessions with the access concentrator, which can provide the specified service.
LCP Echo Interval
Specify the time the system should wait before sending an echo request to check whether the link is alive or not.
| System | 186
Default - 20 seconds
LCP Failure
After an attempt, the device waits for the LCP echo request response for the period defined in the LCP Echo interval. After a defined number of attempts, it declares the PPPoE link as closed if it does not receive a response.
Default - 3
Schedule Time For Reconnect
The assigned IP address, dynamic or static (preferred), for a PPPoE connection may have a stipulated validity.
Once the validity has expired, the PPPoE connection is terminated and reconnected.
In order to avoid reconnection during the working hours, the administrator can enable the PPPoE reconnection schedule. The administrator can choose to schedule the PPPoE reconnection on daily or weekly basis with the configured time (HH:MM).
Default - Disable
Default schedule when enabled – All days of week
Note: It is possible that after reconnection, an IP address other than the preferred IP address is assigned to the PPPoE connection, if a Preferred IP address is configured and Schedule Time for
Reconnect is enabled and configured.
Figure 165: PPPoE Configuration
5. Enter IPv6 configuration details (Only for physical interfaces with IPv6 configuration)
IP Assignment
Select the IP assignment type.
Available Options:
• Static
• DHCP
Mode
Select DHCP mode.
Administrator can select to configure IPv6 address through Stateful (DHCPv6) or StateLess address assignment methods depending on the Managed (M) Address Configuration and Other (O) Configuration flags advertised in the Router Advertisement (RA) message .
Available Options:
Auto: If selected, IPv6 address will be configured based on the Router Advertisement packet through
Stateless Address Auto-Configuration (SLAAC) or DHCPv6 depending on the Managed (M) Address
Configuration and Other (O) Configuration flags advertised in the Router Advertisement (RA) message.
Manual: Administrator can select to configure IPv6 address either through SLAAC or DHCPv6.
| System | 187
• DHCP Only: In this manual mode, client will configure IPv6 Address and other configuration parameters using DHCPv6 Server. Gateway details should be manually specified.
• Stateless: In this manual mode, client will configure IPv6 Address based on advertised RA message through SLAAC.
• Accept Other Configuration from DHCP: Select to configure other parameters using DHCPv6
Server. By default, it is enabled.
DHCP Rapid Commit
If enabled, the interface will be configured using a 2-message exchange (Solicit and Reply) rather than the 4message exchange (Solicit, Advertise, Request, and Reply). It enables quicker client configuration.
Note: Rapid commit should also be enabled on the DHCPv6 server.
IPv6 / Prefix (Only for static IP assignment)
Specify the IPv6 address and the prefix.
Gateway Detail (Only for "WA"N zone)
• For "Static" IP assignment: Specify the gateway name and IPv6 address through which the traffic is to be routed.
• For “DHCP” IP assignment: Specify the gateway name, if Stateless manual mode is selected. For
DHCP only manual mode, specify the gateway name and the IPv6 address.
Figure 166: IPv6 Configuration
6. Click Save.
The VLAN interface has been created and appears in the Interface list.
Link Aggregation Group
This feature is not supported in Sophos virtual security devices.
The Link Aggregation Group (LAG) is a method by which multiple network connections can be combined into a single connection. It is also known as trunking, NIC teaming, NIC bonding and Ether Channel. LAG is mostly used for handling LAN traffic.
LACP
The Link Aggregation Control Protocol (LACP) is a part of IEEE specification that groups two or more physical links into a single logical link. LACP must be enabled at both ends of the link to be functional.
| System | 188
The device supports LAG to combine multiple physical links into a single logical link so that bandwidth can be increased and automatic failover is available.
LAG supports two modes:
• Active-Backup: Active Backup is the mode which provides automatic link failover. In this mode, a single slave
(member of the LAG) remains active. If the active slave fails then another slave in the LAG becomes the active slave.
• LACP (802.3ad): This mode provides load balancing and automatic failover. In this mode, all the links are used to forward traffic.
Prerequisites for LACP (802.3ad) mode
• Both switches must support LACP.
• The member interfaces in the LAG must have the same properties.
Limitations
• Only unbound static physical interfaces are supported.
• PPPoE, 3G, 4G, WWAN, WLAN and Transport mode are not supported in LAG.
Add LAG
You can configure the LAG from this page.
1. Navigate to System > Network > Interfaces, click Add Interface and select Add LAG from the drop-down list.
LAG interface properties can be configured or edited from the command line but the LAG interface cannot be added from CLI.
2. Enter details for the Global Settings.
Interface Name
Provide a name for the LAG interface.
Member Interface
The “Port List” displays all unbound ports.
Click the checkbox to select the port. All selected ports are moved to the “Selected Port” list.
Note:
• At least 2 member ports are required for creating a LAG interface.
• Maximum 4 ports can be configured on a single LAG interface.
Mode
Select the mode for the LAG.
Available Options:
Active-Backup: Select the Active-Backup mode to provide fault tolerance. 802.3ad (LACP): Select the
802.3ad (LACP) mode to load balance the traffic and provide fault tolerance.
Network Zone
Select the network zone for the interface.
Available Options:
LAN WAN DMZ WiFi
Figure 167: Global Settings
3. Enter the IPv4 configuration details.
IP Assignment
Select the IP assignment scheme for the interface from the available options.
Available Options:StaticDHCP Default - Static
IPv4 Address
Specify the IPv4 address.
Netmask
Select the network subnet mask for the interface.
4. Enter the IPv4 gateway details (Only for WAN zone)
Gateway Name
Provide the gateway name.
IPv4 Address
Provide the gateway IPv4 address.
Figure 168: IPv4 Configuration - Static
5. Enter the IPv6 configuration details.
IPv6/Prefix
Specify the IPv6 address and the prefix.
6. Enter the IPv6 gateway details (Only for WAN zone)
Gateway Name
Provide the gateway name.
IPv6 Address
Provide the gateway IPv6 address.
| System | 189
| System | 190
Figure 169: IPv6 Configuration
7. Enter details for the Advanced Settings.
Interface Speed
Specify the interface speed for synchronization.
Speed mismatch between the device and 3rd party routers and switches can result in errors or collisions on the interface, no connection or traffic latency, or slow performance.
Default - Auto Negotiation
MTU
Specify MTU value (Maximum Transmission Unit)
MTU is the largest physical packet size, in bytes, that a network can transmit. This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes. Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent.
Default - 1500
Acceptable Range (For IPv4 Configuration) - 576 to 1500
Acceptable Range (For IPv6 Configuration) - 1280 to 1500
Override MSS
Click to override the default MSS.
MSS defines the amount of data that can be transmitted in a single TCP packet.
Default - 1460
Acceptable Range - 536 to 1460
Xmit Hash Policy (Available only if LACP (802.3ad) mode is selected)
Select the Xmit hash policy to be used for the member interfaces from the available options:
Available Options:
Layer2: Select to generate the hash value using hardware MAC Addresses. Layer2+3: Select to generate the hash value using a combination of Layer 2 (MAC Address) and Layer 3 (IP Address) protocol information.
Layer3+4: Select to generate the hash value using Transport layer protocol information.
Primary Interface (Available only if Active-Backup mode is selected)
Select an interface to be the primary interface. This interface remains active as long as it is available.
The interfaces included in the member interface list are listed here.
Use Default MAC Address
Activate this option to use the default MAC address for the interface.
Override Default MAC Address
Activate this option to override the default MAC address for the interface and enter the new MAC address.
On factory reset, it will be set to the default MAC address.
Figure 170: Advanced Settings
8. Click Save.
The LAG interface has been created and appears in the Interface list.
Remote Ethernet Device
This chapter describes how to configure Sophos RED. RED is short for Remote Ethernet Device and is a means to connect remote branch offices and the like to your main office as if the branch office is part of your local network.
The setup consists of the SF appliance in your main office and a Remote Ethernet Device (RED) in your remote office. Establishing a connection between the two is utmost easy as the RED appliance itself does not need to be configured at all. As soon as the RED appliance is connected to your appliance it behaves like any other Ethernet device on your appliance. All traffic of your branch office is safely routed via your appliance which means that your branch office is as secure as your local network.
These types of RED appliances are currently available:
• RED 10: RED solution for small remote offices
• RED 15: RED solution for medium remote offices
• RED 50: RED solution for bigger remote offices which comes with two uplink interfaces.
Each RED appliance or SF appliance that is configured here is able to establish a connection to your SF appliance.
Note: For RED appliances to be able to connect, you need to enable RED support on the System > System
Services > RED page first.
RED setup example
Add RED
You can configure RED from this page.
1. Ensure that RED is activated. This can be done in System > System Services > RED.
| System | 191
| System | 192
2. Navigate to System > Network > Interfaces, click Add Interface and select Add RED.
3. Enter the RED settings.
Branch Name
Enter the name for the remote location where the RED will be set up.
Client Type
Select the client type from the drop-down list depending on the type of RED appliance you want to connect:
• RED 10
• RED 15
• RED 50
RED ID
Enter the RED ID.
The RED ID is a 15-character string printed on a sticker located on the back of the RED. If you do not want to open the package, you can also find it on the outer carton sticker.
Unlock Code
Enter the unlock code.
The unlock code is an 8-character string that is generated when a RED is added to a Sophos Firewall. If this
RED is now being deployed for the first time. If this RED has been deployed before, you will need to enter the unlock code here. The unlock code is generated during the deployment of a RED appliance, and is emailed instantly to the address you provided by activating RED. This is a security feature, which ensures that a RED appliance cannot simply be removed and installed elsewhere.
For manual deployment via USB stick and automatic deployment via Provisioning Service (see below), two separate unlock codes are generated. If you switch a RED device from one deployment method to the other, make sure to use the corresponding unlock code: For manual deployment, provide the unlock code of the last manual deployment; for automatic deployment, provide the unlock code of the last automatic deployment.
Firewall IP/Hostname
Enter the hostname of Sophos Firewall.
The hostname must be a publicly resolvable DNS name or IP address for Sophos Firewall. The RED will use this name or IP to connect back to Sophos Firewall.
2nd Firewall I/Hostname (only applicable for client types RED 15 and RED 50)
Enter the hostname of the second Sophos Firewall.
Use 2nd IP/Hostname for (only applicable for client types RED 15 and RED 50)
Select from the following options:
• Failover: Select this option if you want to use the second Sophos Firewall in case the primary Sophos
Firewall fails. The second host will then take over automatically without loss of connection.
• Load Balancing: Select this option if you want to distribute traffic equally on both, the primary and the second Sophos Firewall.
Description (optional)
Enter a description for the RED interface.
Device deployment
Select the requested deployment method:
• Automatically via Provisioning Service
• Manually via USB Stick
Note: If you select manual deployment, it is extremely important to keep the unlock code, which is sent by email. If you lose the unlock code, you can never connect the RED appliance again to another Sophos Firewall.
By default, Sophos Firewall provides the RED's configuration data automatically via Sophos' RED
Provisioning Service. In this case, the RED appliance receives its configuration via Internet. If for example
your RED does not have an Internet connection, you can provide the configuration manually, via USB stick.
If you deploy a RED device manually, you have to ensure that Sophos Firewall is acting as NTP server.
Therefore activate NTP on the Sophos Firewall and allow the correct network or at least the IP address of the
RED.
| System | 193
Figure 171: Add RED Interface
4. Enter the uplink settings.
Uplink Connection
Select the connection type for the uplink:
• DHCP: The RED pulls an IP address from a DHCP server.
• Static: Enter an IPv4 address, a corresponding netmask, a gateway and a DNS server IP.
2nd Uplink Connection (only available for client type RED 50)
Select the connection type for the uplink:
• DHCP: The RED pulls an IP address from a DHCP server.
• Static: Enter an IPv4 address, a corresponding netmask, a gateway and a DNS server IP.
2nd Uplink Mode (only available for client type RED 50)
Select an uplink mode for the 2nd host. Available options:
• Failover
• Load Balancing
3G/UMTS Failover (only available if DHCP is selected)
Enable/disable the 3G/UMTS failover function.
Note: The RED appliance offers a USB port to which you can plug in a 3G/UMTS USB stick. If selected, this stick can serve as Internet uplink failover in case of a WAN interface failure. For the necessary settings please refer to your Internet provider's data sheet.
• Mobile Network: Select the mobile network type, which is either GSM or CDMA.
• Username/Password (optional, only available for CDMA): If required, enter a username and password for the mobile network.
• PIN (optional): Enter the PIN of the SIM card if a PIN is configured.
Note: If you enter a wrong PIN, in case of a WAN interface failure, the connection via 3G/
UMTS cannot be established. Instead, the 3G/UMTS Failover checkbox of the RED appliance will automatically be unselected. Thus, the wrong PIN will only be used once. When the WAN interface comes up again, a warning will be displayed for the RED appliance: A wrong PIN
was entered for 3G/UMTS failover uplink. Please change the login data. When you open the
Edit RED dialog box, a message is displayed which tells you that the 3G/UMTS failover was automatically unselected. Correct the PIN before selecting the checkbox again. Please note that after three connection attempts with a wrong PIN, the SIM card will be locked. Unlocking cannot be done via the RED appliance or Sophos Firewall.
• APN (only available with GSM): Enter your provider's access point name information.
• Dial String (optional): If your provider uses a different dial string, enter it here. Default is *99#.
| System | 194
Figure 172: RED Uplink Settings
5. Enter the RED network settings.
RED Operation Mode
You can define how the remote network will be integrated into your local network:
• Standard/Unified: Sophos Firewall completely controls the network traffic of the remote network.
Additionally, it serves as DHCP server and as default gateway. All remote network traffic will be routed through Sophos Firewall.
• Standard/Split:
Sophos Firewall completely controls the network traffic of the remote network. Additionally, it serves as
DHCP server and as default gateway. In contrast to the Unified mode, only certain traffic will be routed through Sophos Firewall. Define local networks in the Split Networks box below which can be accessed by remote clients.
Note: VLAN tagged frames cannot be handled with this operation mode. If you use a VLAN behind your RED appliance, use the standard operation mode instead.
• Transparent/Split Sophos Firewall does not control the network traffic of the remote network, it does neither serve as DHCP server nor as default gateway. On the contrary, it pulls an IP address from the
DHCP server of the remote network to become a part of that network. However, you can enable access for remote clients to your local network. You only need to define split networks that are allowed to be accessed by the remote network. Additionally, you can define one or more split domains to be accessible.
If your local domains are not publicly resolvable, you need to define a Split DNS Server, which can be queried by remote clients.
Note: VLAN tagged frames cannot be handled with this operation mode. If you use a VLAN behind your RED appliance, use the standard operation mode instead.
RED IP
(not for Transparent/Split)
Enter the IP address of the RED appliance.
RED Netmask
(not for Transparent/Split)
Select the netmask from the drop-down menu.
Zone
Select the requested zone:
• LAN
• DMZ
• VPN
• WiFi
| System | 195
Configure DHCP
Enable if you want to configure a DHCP range for RED.
RED DHCP Range
(only if Configure DHCP is on)
Enter the DHCP range RED is allowed to use.
Split Network
(not for Standard/Unified)
Add one or more split networks.
Note: Only traffic targeted to networks listed in the Split Network box is redirected to your local
Sophos Firewall. All traffic not targeted to the defined split networks is directly routed to the
Internet.
Example: You have a branch office and you want it to have access to your local intranet or you want to route traffic of the remote network via your Sophos Firewall for security reasons, e.g. to have the traffic checked for viruses or to use an HTTP proxy.
Split Domains
(only for Transparent/Split)
Add one or more split domains.
Note: Since Sophos Firewall is only a client of the remote network, routing traffic to the split networks the same way as with the other modes is not possible. Therefore, the RED appliance intercepts all traffic: Traffic targeting to a network listed in the Split Network box or going to a domain listed in the Split Domain box is redirected to the Sophos Firewall interface. This is accomplished by replacing the default gateway's MAC address in the respective data packets with
Sophos Firewall's MAC address.
Example: There is a partner or a service provider who should have access to your intranet or a certain server in your local network. Using a RED appliance, that partner's network will stay completely independent of your network, but they can access a defined part of your network for certain purposes, as if they were connected via LAN.
MAC Filtering Type
To restrict the MAC addresses allowed to connect to this RED appliance, select Blacklist or Whitelist. With
Blacklist, all MAC addresses are allowed except those listed on the MAC address list selected below. With
Whitelist, all MAC addresses are prohibited except those listed on the MAC address list selected below.
MAC Address:The list of MAC addresses used to restrict access to the RED appliance. MAC address lists can be created on the Objects > Hosts and Services > MAC Host page. Note that for RED 10, a maximum of 200 MAC addresses is allowed, whereas for RED 50, the list may contain up to 400 MAC addresses.
Note: MAC filtering only works for RED rev. 2 or newer.
Tunnel Compression
Enabling tunnel compression will compress all traffic that is sent through the RED tunnel. Data compression might increase the throughput of the RED appliance in areas with a very slow Internet connection such as 1-2
Mbps. However, any performance increase mainly depends on the entropy of the data being sent (for example, already compressed data such as HTTPS or SSH cannot be compressed any further). In some circumstances it might therefore be possible that enabling data compression could actually reduce the throughput of the RED appliance. In that case, please disable data compression.
Note: Tunnel compression is not available for RED 10 rev.1.
| System | 196
Figure 173: RED Network Settings
6. Enter switch settings (only available for client type RED 50)
Switchport Mode
Select the switchport mode for the switch settings
• Switch RED 50 will automatically use the switch.
• VLAN:Select the LAN port and enter the LAN VID(s).
7. Click Save.
The RED interface is created and appears in the Interface list.
Manage RED Interface
This chapter describes the functions of the icon of RED interfaces on the System > Network > Interface page.
The following options are available:
Activate/deactivate
The toggle switch next to the branch name shows the status of the interface. Click it to turn it on/off.
Edit Interface
This link leads you to the page where you can edit the interface settings. Find further descriptions on the Add RED page.
Download Provisioning file
This option is only available if the RED interface is in offline provisioning mode (if Device Deployment is set to
Manually via USB Stick).
Clicking on the link will download the provisioning file for the RED device. Save the file to the root directory of a USB stick. Then plug the USB stick into the RED appliance before turning it on. The RED will fetch its configuration from the USB stick. After that the connection between your appliance and the RED appliance is going to be established.
Note: It is crucial that you keep the unlock code, which is emailed instantly to the address provided on the
RED Configuration page as soon as the RED appliance receives its configuration. (In case of switching between manual and automatic deployment, make sure to keep both unlock codes.) You need the unlock code when you want to use the RED appliance with another UTM. If you then do not have the unlock code ready,
| System | 197 the only way to unlock the RED appliance is to contact the Sophos Support. The Support however can only help you if you deployed the configuration automatically, via the RED Provisioning Service.
3G/UMTS Failover
Displays if the 3G/UMTS Failover function is enabled or disabled.
Delete Interface
With this option you can delete the interface from the list. You will get a message which configurations the deletion will affect.
TAP
Organizations looking for deploying a new security solution or replacing their existing one, usually evaluate a number of vendors. This device facilitates such evaluations by providing an easy and seamless Proof of Concept (PoC) to such organizations using its Discover Mode.
The Discover Mode, popularly known as port mirroring or SPAN (Switched Port Analyzer), in which the administrator can deploy the device at a point in the network where it can monitor all network traffic without the hassle of doing any changes in the existing network schema. The switch which the device is connected to forwards a copy of every packet that passes through it to the device to be monitored.
The device, in turn, passively monitors all the traffic across the network and uses the gathered data to generate a Security Assessment Report (SAR). This report aims to provide visibility into potential risks prevailing within the corporate network, such as application and web risks, risky users and intrusion risks, due to the absence or inefficiency of the security device deployed at the organization’s gateway.
Note:
• When deployed in Discover Mode, the device works in a listening mode and, hence, no security policy will be applied.
• The Interface page will display the zone name as Discover for the interfaces configured in Discover
Mode.
• The TAP interface cannot be updated or deleted.
• Network Protection and Web Protection modules should be subscribed for analysis of IPS, Web Filter and
Application Filter policies.
• Only unbound physical interfaces can be configured in Discover mode.
Pre-requisites for Discover Mode:
• The device must be connected to the Internet for web classification, IPS updates and SAR generation in the cloud.
• The device must be integrated with external authentication servers like Active Directory, RADIUS,
LDAP etc. to get user-specific data in the SAR report.
Enable Discover Mode
This page provides details for enabling the Discover Mode.
1. Access the CLI console by clicking admin on the upper right corner of the Admin Console screen.
2. Select the option Console.
3. Provide the admin password.
4. Select the option 4. Device Console.
5. Execute the following command to enable the discover mode: console> system discover-mode tap add <Port>
| System | 198
Figure 174: Enable Discover Mode
"Discover Interface Added Successfully" is displayed on the CLI. Additionally, the interface configured in
Discover Mode will have the "Discover, Physical (TAP)" displayed on the Interfaces page.
Zone
The Zone page displays a list of all the zones including system zones and lets you manage the zones.
A zone is a logical grouping of ports/physical interfaces and/or virtual sub-interfaces if defined.
Zones provide a flexible layer of security for the firewall. With the zone-based security, the administrator can group similar ports and apply the same policies to them instead of having to write the same policy for each interface.
Next to the name of the zone type, the list displays the members belonging to the specific zone, the zone type, the kind of device access and, optionally, a description.
Default Zone Types
LAN - Depending on the device in use and network design, you can group one to six physical ports in this zone.
Group multiple interfaces with different network subnets to manage them as a single entity. Group all the LAN networks under this zone.
By default the traffic to and from this zone is blocked and hence, it is the most secured zone. However, traffic between ports belonging to the same zone will be allowed.
DMZ (DeMilitarized Zone) – This zone is normally used for publicly accessible servers. Depending on the device in use and network design, you can group multiple physical ports in this zone.
WAN - This zone is used for Internet services. It can also be referred to as Internet zone.
VPN – This zone is used for simplifying secure, remote connectivity. It is the only zone that does not have an assigned physical port/interface. Whenever the VPN connection is established, the port/interface used by the connection is automatically added to this zone and on disconnection; the port is automatically removed from the zone.
Like all other default zones, scanning and access policies can be applied on the traffic for this zone.
WiFi - This zone is used for wireless Internet services.
The device is shipped with a single zone for LAN, WAN, DMZ, VPN and WiFi. These zones are called system zones.
Additionally, you can define LAN and DMZ zone types.
Manage
Displays the available managing options for the zone
• Edit: Allows you to edit the zone.
• Delete: Allows you to delete the zone.
To either Add or Delete a zone, click the corresponding buttons.
Add a Zone
Use the Add page to create a new zone.
The Add Zone page allows you to enter zone details.
1. Navigate to System > Network > Zone or Objects > Identity > Zone and click Add.
2. Enter the zone details.
Name
Provide a name to identify the zone.
| System | 199
Description
Provide the description for the zone.
Type
Select the type of zone from the available options. LAN - Depending on the device in use and network design, you can group one to six physical ports in this zone. Group multiple interfaces with different network subnets to manage them as a single entity. Group all the LAN networks under this zone.
By default the traffic to and from this zone is blocked and hence, it is the highest secured zone. However, traffic between ports belonging to the same zone will be allowed.
DMZ (DeMilitarized Zone) - This zone is normally used for publicly accessible servers. Depending on the device in use and network design, you can group one to five physical ports in this zone.
Note: By default, the entire traffic will be blocked except LAN to Local zone services like administration, authentication, and network.
Members
Displays all the member ports.
Click the checkbox to select the ports. All the selected ports are moved to the 'Selected port' list.
Device Access
Device access defines the type of administrative access permitted to a zone.
Admin Services - Enable administrative services that should be allowed through this zone:
• HTTP - Allow HTTP connection to the admin console through this zone
• HTTPS - Allow secure HTTPS connection to the admin console through this zone
• Telnet – Allow Telnet connection to CLI through this zone
• SSH – Allow SSH connection to CLI through this zone
Authentication Services – Enable authentication services that should be allowed through this zone:
• Client Authentication
• Captive Portal
• NTLM
• Radius SSO
Network Services - Enable network services that should be allowed through this zone:
• DNS – Allow this zone to respond to DNS requests
• Ping/Ping6 – Allow this zone to respond to pings
Other Services - Enable other services that should be allowed through this zone:
• Web Proxy
• SSL VPN Tunnel
• Wireless Protection
• User Portal
• Dynamic Routing
Figure 175: Add Zone
3. Click Save.
Note:
• If DMZ uses a private IP address, use NATing to make them publicly accessible.
• You cannot add a zone if the device is deployed as a bridge.
• Local and VPN zones cannot be updated or deleted.
The new zone has been created and appears on the Zone page.
Wireless Networks
The page provides a list of all configured wireless networks along with their name, SSID, client traffic mode, encryption mode used and frequency band. New wireless networks can be added and existing ones deleted.
System > Network > Wireless Networks
Note: You can also view the wireless network status on the System > Current Activity > Wireless Client
List page.
For each wireless network, the list shows you:
Name
Name assigned to the network.
SSID
SSID of the wireless network.
| System | 200
| System | 201
Status
Status of the wireless network.
Client traffic
Client traffic of the wireless network.
Encryption Mode
Encryption mode of the wireless network.
Frequency Band
Frequency band of the wireless network.
Manage
Available managing options for the wireless network:
• Edit: Allows you to edit the wireless network.
• Delete: Allows you to delete the wireless network.
To add or delete a wireless network, click on the corresponding buttons.
Add a New Wireless Network
This page describes how to add a new wireless network.
The Add button on the Wireless Networks page allows you to define a new wireless network. This can then be used in definitions for access points and access point groups.
1. Navigate to System > Network > Wireless Networks or Protection > Wireless Protection > Wireless
Networks and click the Add button.
A new page General Settings opens.
2. Enter the following settings:
Name
Enter a descriptive name for the network.
Description
Enter a description for the wireless network that helps you to identify it.
SSID
Enter the Service Set Identifier (SSID) for the network which will be seen by clients and allow them to identify the wireless network. The SSID may consist of 1-32
ASCII printable characters
. It must not contain a comma and must not begin or end with a space.
Security Mode
Select a security mode from the drop-down list. The default is WPA 2 Personal.
We recommend that you use WPA2 rather than WPA, if possible. For security reasons, we recommend you not to use WEP unless there are clients using your wireless network that do not support one of the other methods.
When using an enterprise authentication method, you also need to configure a RADIUS server on the
Objects > Assets > Authentication Server page. As NAS ID of the RADIUS server enter the wireless network name.
Note: Sophos Firewall OS supports the IEEE 802.11r standard in WPA2 (PSK/Enterprise) networks to reduce roaming times. Clients also need to support the IEEE 802.11r standard.
Passphrase/PSK (Only available with the WPA Personal, WPA2Personal, and WPA2/WPA Personal
security modes)
Enter the passphrase to protect the wireless network from unauthorized access and repeat it in the
Confirm Passphrase/PSK field. The passphrase may consist of 8-63 ASCII printable characters.
Key (Only available with the WEP Open security mode)
Enter a WEP key here that consists of exactly 26 hexadecimal characters.
| System | 202
Client Traffic
From the dropdown list select how the wireless network is to be integrated into your local network.
Available options:
• Separate Zone
• Bridge to AP LAN
• Bridge to VLAN
The default setting is Separate Zone.
Separate Zone
The wireless network is handled as a separate network, having an IP address range of its own. Using this
option, after adding the wireless network, proceed as described in the chapter
Note: When switching an existing Separate Zone network to Bridge to AP LAN or Bridge to
VLAN, a previously configured WLAN interface will be deleted.
Zone
From the dropdown list select a zone where the wireless network should be broadcast. The default setting is WiFi.
IP Address
Assign an IP address to the wireless network.
Netmask
Select a subnet mask for the IP address.
Bridge to AP LAN
You can bridge a wireless network into the network of an access point, which means that wireless clients share the same IP address range. Using this option, after adding the wireless network, proceed as described in the chapter
Next Steps for Bridge to AP LAN Networks
.
Bridge to VLAN (Not available for local WiFi devices)
You can decide to have this wireless network's traffic bridged to a VLAN of your choice. This is useful when you want access points to be in a common network separate from the wireless clients.
Bridge to VLAN ID
Enter the VLAN ID of the network that the wireless clients should be part of.
Client VLAN ID (Only available with an enterprise security mode)
Select how the VLAN ID is defined.
• Static: Uses the VLAN ID defined in the Bridge to VLAN ID field.
• RADIUS & Static: Uses the VLAN ID delivered by your RADIUS server: When a user connects to one of your wireless networks and authenticates at your RADIUS server, the RADIUS server tells the access point what VLAN ID to use for that user. Thus, when using multiple wireless networks, you can define per user who has access to which internal networks. If a user does not have a VLAN ID attribute assigned, the VLAN ID defined in the Bridge to VLAN ID is used.
Figure 176: Add Wireless Network
3. Optionally, you can enter the following Advanced Settings:
Encryption (Only available with the WPA, WPA2, and WPA2/WPA encryption modes)
Select an encryption algorithm, which can be AES, TKIP or TKIP&AES. For security reasons, we recommend that you use AES.
Frequency Band
Access points assigned to this wireless network will transmit on the selected frequency band(s). The 5 GHz band generally has a higher performance, lower latency, and is typically less disturbed. Hence it should be preferred for e.g. VoIP communication. For an overview of which APs support the 5 GHz band, see the chapter Objects > Assets > Access Points or Protection > Wireless Protection > Access Points.
Time-based Access
Select this checkbox to enable the wireless network access according to a time schedule.
Select Active Time
Select a schedule definition which determines when the wireless network is enabled. You can add a new schedule definition by clicking on Add New Item .
Client Isolation
Clients within a network usually can communicate with one another. If you want to prevent this, for example in a guest network, select Enabled from the drop-down list.
Hide SSID
If you want to hide the wireless network's SSID, select the Enable checkbox. Please note that this is not a security feature.
Fast Transition (Only available with WPA2 Personal/Enterprise security mode)
Wireless networks with WPA2 security use the IEEE 802.11r standard. If you want to prevent this, select
Disabled from the drop-down list.
MAC Filtering
To restrict the MAC addresses allowed to connect to this wireless network, select Blacklist or Whitelist.
With Blacklist, all MAC addresses are allowed except those listed on the MAC List. With Whitelist, all
MAC addresses are prohibited except those listed on the MAC List.
| System | 203
MAC hosts added under Objects > Assets > MAC Host will be displayed in the MAC List.
| System | 204
Figure 177: Wireless Network Advanced Settings
4. Click Save.
The wireless network has been added and appears on the Wireless Networks page.
Next Steps for Separate Zone Networks
When you add a wireless network with the option Separate Zone, a new corresponding virtual hardware interface will be added automatically, e.g., wlnet1. To be able to use the wireless network, some further manual configuration steps are required. Proceed as follows:
1. Enable DHCP for the wireless clients.
For your clients to be able to connect to Sophos Firewall OS, they need to be assigned an IP address and a default gateway. Therefore, on the System > Network > DHCP page, set up a DHCP server for the interface.
2. Create a network policy on the Policies page to provide Internet access to the wireless clients.
You can now assign the wireless network to the AP at Objects > Assets > Access Points or Protection > Wireless
Protection > Access Points.
Bridge to AP LAN Networks with Local Devices
For Local Wi-Fi Devices you need to configure some extra settings to enable bridging for the AP LAN.
1. Edit the Local Wi-Fi Device on the Objects > Assets > Access Points or Protection > Wireless Protection >
Access Points page and select the wireless network.
2. Either create a new bridge interface on the System > Network > Interfaces > Add Bridge page to use the wireless interface in bridge mode or edit the interface on the on the System > Network > Interface page, select a zone and provide an IP address to use the interface in gateway mode.
3. If you want to use the interface in gateway mode, create a DHCP server on the System > Network > DHCP page so that the client can receive an IP.
Wireless clients can now connect to the wireless network.
Mesh Networks
On this page you can create or delete mesh networks. Additionally, you see an overview of existing mesh networks.
| System | 205
On the System > Network > Mesh Networks or Protection > Wireless Protection > Mesh Networks page you can define mesh networks and associate access points that should broadcast them. In a mesh network, multiple access points communicate with each other and broadcast a common wireless network. On the one hand, access points connected via a mesh network can broadcast the same wireless network to clients, thus working as a single access point, while covering a wider area. On the other hand, a mesh network can be used to bridge Ethernet networks without laying cables. Access points associated with a mesh network can play one of two roles: root access point or mesh access point. Both broadcast the mesh network, thus the number of other wireless networks they can broadcast is reduced by one.
• Root access point: This has a wired connection to the Sophos Firewall OS and provides a mesh network. An access point can be root access point for multiple mesh networks.
• Mesh access point: This needs a mesh network to connect to the Sophos Firewall OS via a root access point. An access point can be mesh access point for only one mesh network at a time.
A mesh newtork can be used to implement a wireless bridge or a wireless repeater:
• Wireless bridge: Using two access points, you can establish a wireless connection between two Ethernet segments. A wireless bridge is useful when you cannot lay a cable to connect those Ethernet segments. While the first Ethernet segment with your Sophos Firewall OS is connected to the Ethernet interface of the root access point, the second Ethernet segment has to be connected to the Ethernet interface of the mesh access point. Using multiple mesh access points, you can connect more Ethernet segments.
• Wireless repeater: Your Ethernet with your Sophos Firewall OS is connected to the Ethernet interface of a root access point. The root access point has a wireless connection via the mesh network to a mesh access point, which broadcasts wireless networks to wireless clients.
To create a mesh network, please refer to
on page 97.
The following details of mesh networks are displayed.
Mesh-ID
This is the identifier of the mesh network.
Status
Displays the current status of the mesh network
Frequency Band
The frequency band on which the associated access points broadcast the mesh network.
Manage
Displays the available management options:
• Edit Allows you to edit the mesh network.
• Delete Allows you to delete the mesh network.
To add or delete a mesh network, click on the corresponding buttons.
Add Mesh Network
On this page you can create mesh networks and assign access points to them.
The Add button on the Mesh Networks page allows you to define a new mesh network.
1. Navigate to System > Network > Mesh Networks or Protection > Wireless Protection > Mesh Networks and click the Add button.
A new page General Settings opens.
2. Enter the following settings:
Mesh ID
Enter a unique ID for the mesh network.
Frequency Band
Access points assigned to this network will transmit the mesh network on the selected frequency band.
Generally, it is a good idea to use a different frequency band for the mesh network than for the broadcasted wireless networks.
| System | 206
Description
Optionally, add a description or other information.
Access Point
Here you add one or more mesh access points.
a) Click Add to select access points that should broadcast the mesh network.
A dialog window Mesh Network Role opens: b) Enter the following settings:
Access Points
Select an access point. Note that only AP 50 access points can be used for broadcasting mesh networks at the moment.
Role
Define the access point's role for the selected mesh network. A root access point is directly connected to the Sophos Firewall OS. A mesh access point, after having received its initial configuration, once unplugged from the Sophos Firewall OS will connect to a root access point via the mesh network.
Note: An access point can be mesh access point only for one mesh network.
| System | 207
Figure 178: Add Mesh Network
c) Click OK.
The dialog window is closed and the access point is added to the Access Point list.
3. Click OK.
Note: It is crucial for the initial configuration to plug the mesh access point, like every other access point, into one of the Ethernet segments selected in the Allowed Zone box on the System Services >
Wireless tab.
Wireless WAN
System > Network > Wireless WAN
This feature is not supported in Sophos Virtual Security Devices.
Wireless WAN is a wide area network (WAN) for data that is typically provided by the cellular carriers to transmit a wireless signal over a range of several miles to a mobile device. WWAN connectivity allows a user with a laptop and a WWAN support to use the web, or connect to a VPN from anywhere within the regional boundaries of a cellular service.
WWAN are popularly known as "wireless broadband".
To configure WWAN:
1. Enable WWAN from CLI with the command: system wwan enable
2. Re-login to the Admin console
| System | 208
3. Edit the WWAN interface and configure the WWAN initialization string and gateway from System > Network >
Interfaces page.
To configure Wireless WAN settings, please refer:
Configure Wireless WAN Settings
on page 180
Once WWAN is enabled from CLI, an interface named WWAN1 is created and it is the member of the WAN zone.
As WWAN interface is a member of WAN zone:
• All the services enabled for the WAN zone from the Device Access page are automatically applicable on
WWAN1 connection too.
• All the security policies applied on WAN zone will be applied on WWAN interface
• A default host named ##WWAN1 is created and a security policy and VPN policies can be created for the default host.
• WWAN1 gateway is added as backup gateway
• When the Wireless WAN is disabled from CLI in the Wireless WAN menu, default host ##WWAN1and WWAN gateway options will be removed from the Admin Console.
Note:
• Wireless WAN is not supported in bridge mode.
• DHCP server configuration is not supported for the WWAN interface.
• If backup of a device is taken on which WWAN is enabled and restored on a device where it is not enabled, WWAN configuration would still be visible.
Status
The WirelessWAN page displays the status of the Wireless WAN connection. Along with details of the WWAN connection, the page also provides the facility to connect and disconnect the WWAN connection. Below are the screen elements with their description:
Connect/Disconnect Button
Click to connect or disconnect the WWAN connection. This process may take some time.
Status
Displays the status of the connection. Status messages can be of the following types:
Possible Status:
• Modem not supported
• No Modem plugged-in
• Connecting…
• Reconnecting
• Connected
• Disconnected
Modem Name
Name of the modem.
IP Address
IP address assigned to the device.
Gateway IP
IP address assigned as the gateway.
Bytes Uploaded
Number of bytes uploaded (in KB).
Bytes Downloaded
Number of bytes downloaded (in KB).
Time Duration
Time period since WWAN is connected.
| System | 209
Format: HH:MM::SS
Figure 179: Status of the Wireless WAN Connection
IP Tunnel
An IP tunnel is an Internet protocol network communications path between two networks. It is used to encapsulate one network protocol as a carrier for another network protocol. It is often used by two separate networks having a router with different network addresses for communication. The device supports IPv6 tunneling. Hence, IPv6 packets can be encapsulated in IPv4 headers using the IP Tunnel feature.
This page provides a list of all configured IP tunnels. The administrator can create and manage IP tunnels from this page.
Add IP Tunnel
The Add IP Tunnel page allows you to create or edit an existing 6in4, 6to4, 6rd or 4in6 IP tunnel.
1. Go to System > Network > IP Tunnel and click Add.
2. Enter the tunnel details.
Tunnel Name
Provide a unique name to identify the tunnel.
Tunnel Type
Select the tunnel type from the available options.
Available Options:
• 6in4 – 6in4 uses tunneling to encapsulate IPv6 traffic over IPv4 links. This is used when IPv6 packets have to travel over IPv4 links with IPv6 networks at both endpoints..
• 6to4 – 6to4 allows encapsulation of an IPv6 packet in an IPv4 header to send it to an IPv4 destination.
This is used when the local endpoint is an IPv6 host while the remote endpoint is an IPv4 host.
• 6rd – 6rd is similar in implementation to the 6to4 tunnel. However, unlike 6to4, 6rd allows the administrator to use a native IPv6 prefix.
• 4in6 – 4in6 uses tunneling to encapsulate IPv4 traffic over configured IPv6 tunnels. This is used when
IPv4 traffic is to be used in a pure IPv6 network.
6rd Prefix (Only available if the tunnel type 6rd is selected)
Specify the native IPv6 prefix to be used for the tunnel.
Zone
Select the zone to create the tunnel for.
The tunnel is used for the traffic of the selected zone.
| System | 210
Available Options:
• LAN
• WAN
• DMZ
• WiFi
Local End Point
Specify the IP address of the local endpoint of the tunnel.
For:
• 6in4: Specify the IPv6 address of the local endpoint.
• 6to4: Specify the IPv6 address of the local endpoint.
• 6rd: Specify the IPv6 address of the local endpoint.
• 4in6: Specify the IPv4 address of the local endpoint.
Remote Endpoint (Only available if the tunnel types 6in4 or 4in6 are selected)
Specify the IP address of the remote endpoint of the tunnel.
For
• 6in4: Specify the IPv4 address of the remote endpoint.
• 4in6: Specify the IPv6 address of the remote endpoint.
3. Enter the Advanced Settings.
TTL
Specify the time to live (TTL) life time for the data.
The attribute TTL defines a limit regarding the number of attempts to transmit an IP packet before discarding it.
Default: 0
Acceptable Range: 0 to 255
TOS
Specify the type of service (TOS) for the data.
The attribute TOS provides the value for an IP packet depending on the service which is provided. The service mainly defines the packet priority, the type of route (latency, throughput, or reliable service).
Default: 0
Acceptable Range: 0 to 99
Figure 180: IP Tunnel
| System | 211
4. Click Save.
The IP tunnel has been created or updated and appears on the IP Tunnel page.
WAN Link Manager
A gateway routes traffic between the networks, and if the gateway fails, communication with an external network is not possible.
By default, the device supports only one gateway. However, to cope with gateway failure problems, the device provides an option to configure multiple gateways. But simply adding one more gateway is not an end to the problem.
Optimal utilization of all the gateways is also necessary. The device's WAN Link Manager provides link failure protection by detecting the dead gateway and switching over to an active link. It also offers a mechanism to balance traffic between various links.
At the time of deployment, you have configured the IP address for a default gateway through the Network
Configuration Wizard. You can change this configuration any time and configure additional gateways. You can use the WAN Link Manger to configure multiple gateways for load balancing and failover.
By default, all the gateways defined through the Network Configuration Wizard will be defined as “Active” gateway.
The device provides a powerful solution for routing and managing traffic across multiple Internet connections.
Designed to provide business continuity for an organization of any size, the WAN Link Manager optimizes the use of multiple Internet links, such as T1s, T3s, DSL and cable connections from one or multiple Internet service providers.
Capable of automatic failover in the event of link failure, it helps to assure that your network is always connected to the Internet.
It also gives you an option to configure multiple WAN interfaces to allow connecting your device to more than one
Internet service provider (ISP).
When you configure multiple external interfaces, you even have an option to control which interface an outgoing packet uses.
Load Balancing
Load balancing is a mechanism that permits to balance traffic between various links. It distributes traffic among various links, optimizing utilization of all the links to accelerate performance and cut operating costs. The device employs weighted round robin algorithm for load balancing to reach maximum utilization of the capacities across the various links.
Using link load balancing gives organizations the possibility to achieve:
• Traffic distribution that does not overburden any link
• Automatic ISP failover
• Improved user performance because of no downtime
• Increased bandwidth scalability
To achieve outbound traffic load balancing between multiple links:
• Configure links in active-active setup, defining gateways as Active
• Assign an appropriate weight to each gateway. Traffic is distributed across the links in proportion to the ratio of weights assigned to individual links.
How it works
Load balancing is determined by the load metric. The load metric is weight. Each link is assigned a relative weight and the device distributes traffic across links in proportion to the ratio of weights assigned to individual links. This weight determines how much traffic will pass through a particular link in relation to the other link(s).
The administrator can set the weight and define how the traffic will be directed to providers to best utilize their bandwidth investments. Weight can be selected based on:
• Link capacity (for links with different bandwidths)
| System | 212
• Link/Bandwidth cost (for links with varying costs)
A weighted load balancing feature enables network managers to optimize network traffic and balance the load between multiple links/interfaces.
Gateway failover
Gateway failover provides link failure protection so that when one link goes down; the traffic is switched over to the active link. This safeguard helps to provide uninterrupted, continuous Internet connectivity to users. The transition is seamless and transparent to the end user with no disruption in service and without downtime.
To achieve WAN failover between multiple links:
• Configure links in active-backup setup
• Define Active gateway/interface
• Define backup gateway/interface – Traffic through this link is routed only when the active interface is down
• Define failover rule
In the event of Internet link failure, the WAN Link Manager automatically sends traffic to available Internet connections without administrator intervention. If more than one link is configured as backup link, traffic is distributed among the links in the ratio of the weights assigned to them. On failover, the backup gateway can inherit the parent gateway’s (active gateway) weight or can be configured.
The transition from the dead link to the active link is based on the failover rule defined for the link. The failover rule specifies:
• how to check whether the link is active or dead
• what action to take when a link is not active
The failover rule has the form:
IF Condition 1 AND/OR Condition 2 then Action
Depending on the outcome of the condition, traffic is shifted to any other available gateway.
A ping rule is automatically created for every gateway. The device periodically sends the ping request to check health of the link and if link does not respond, traffic is automatically sent through another available link. The selection of the gateway and how much traffic is to be routed through each gateway depends on the number of configured active and backup gateways.
Gateway Failback
During a link failure, the device regularly checks the health of a given connection, assuring a fast reconnection as soon as the Internet service is restored. When the connection is restored and the gateway is up again, without the administrator’s intervention, traffic is again routed through the active gateway. In other words, the backup gateway fails back on the active gateway.
WAN Link Manager
The WAN Link Manager page displays a list of configured IPv4 and IPv6 gateways. The page also displays the status
Active or Deactive for each gateway and failover rule in case multiple gateways are configured. You can change the gateway parameters, change the gateway status, add or remove the failover rule, and view the data transfer passed through the gateway.
For the backup gateway, the weight is NA while for the active gateway, the configured weight is displayed.
Click the data transfer icon under the Manage column of the corresponding gateway to view the total data transferred through the gateway in graphical as well as in tabular form.
| System | 213
Gateway Failover Timeout Configuration
Gateway Failover Timeout
Configure the gateway failover timeout in seconds.
This is the time period the device waits before the gateway failover occurs.
Default: 60 seconds
Acceptable Range: 1 to 65535
Figure 181: Gateway Failover Timeout Configuration
Update Gateway Configuration
You can update the gateway configuration from this page.
1. Navigate to System > Network > WAN Link Manager, click the gateway's Name hyperlink or click the edit icon under the Manage column to edit its settings.
2. Enter the gateway details.
Name
Enter the name of the gateway.
IP Address
Enter the IP address assigned to the gateway.
Interface
Specify the IP address of the interface.
Type
Specify the type of the gateway.
Available Options: Active - Traffic will route through the active gateway(s). If more than one active gateway is configured then the traffic will be load balanced between these gateways depending on the weight assigned to the each gateway. Backup – A gateway used in an active/passive setup, where traffic is routed through the backup gateway only when the active gateway is down.
Weight
Depending on the weight, the gateway is selected for load balancing. The device distributes traffic across links in proportion to the ratio of weights assigned to individual links.
This weight determines how much traffic will pass through a particular link relative to the other link(s).
Gateways can be assigned a weight from 1 to100.
Note: When multiple gateways are configured and one gateway goes down, the traffic is switched over to the available gateways according to the ratio of the weights assigned to the available gateways.
Default NAT Policy
Select the NAT policy to be used as default for a particular gateway.
By default, the MASQ NAT policy is configured.
Select None, if NAT should not be applied on that particular gateway.
| System | 214
Figure 182: Update Active Gateway Configuration
3. Enter the backup gateway details (Only available, if the type is Backup)
Activate This Gateway
Select gateway activation condition: automatically or manually.
Automatic failover
For automatic failover, activate the option If ... Active gateway fails.
From the dropdown list, specify when the backup gateway should take over from the active gateway. This takeover process will not require the administrator’s intervention.
Available Options:
• Specific Gateway - The dropdown list displays all configured gateways. The backup gateway will take over and traffic will be routed through the backup gateway only when the selected gateway fails.
• ANY – The backup gateway will take over and traffic will be routed through the backup gateway when any of the active gateway fails.
• ALL – The backup gateway will take over and traffic will be routed through the backup gateway when all the configured active gateways fail.
Manual failover
If you select Manually, the administrator will have to change the gateway manually when the active gateway fails.
Action on Activation
Configure weight for the backup gateway. The device distributes traffic across links in proportion to the ratio of weights assigned to individual link. This weight determines how much traffic will pass through a particular link relative to the other link.
Inherit weight of the failed active gateway
If this option is selected, the backup gateway will inherit the parent gateway’s (active gateway) weight
Use configured weight
If this option is selected, the weight specified in the Weight field will be used for the backup gateway.
| System | 215
Figure 183: Backup Gateway Details
4. Click Save.
The gateway details have been updated.
5. Configure the failover rules.
IF Then Condition
From the dropdown list, select the communication protocol, such as TCP or PING (ICMP). Select the protocol depending on the service to be tested on the host.
Port: For TCP communication, specify the port number for communication.
on IP Address: Specify the IP address of the computer or the network device which is permanently running or most reliable.
Condition
• AND - All the conditions must be satisfied before the specified action is taken
• OR - At least one condition must be satisfied before the specified action is taken.
A request is sent to an IP address. If the IP address does not respond to the request, the device considers the IP address as unreachable.
Figure 184: Configure Failover Rules
6. Click Save.
The failover rule has been updated.
Add Failover Rule
You can add failover rule from this page.
1. Navigate to System > Network > WAN Link Manager, click Add under the Failover Rules section.
2. Configure the failover rules.
IF Then Condition
From the dropdown list, select the communication protocol, such as TCP or PING (ICMP). Select the protocol depending on the service to be tested on the host.
Port: For TCP communication, specify the port number for communication.
on IP Address: Specify the IP address of the computer or the network device which is permanently running or most reliable.
Condition
| System | 216
• AND - All the conditions must be satisfied before the specified action is taken
• OR - At least one condition must be satisfied before the specified action is taken.
A request is sent to an IP address. If the IP address does not respond to the request, the device considers the IP address as unreachable.
Figure 185: Configure Failover Rules
3. Click Save.
The failover rule has been added.
Network Traffic Report for Default Gateway
Click the data transfer icon under the Manage column of the corresponding gateway to view the total data transferred through the gateway in graphical as well as in tabular form.
Network Traffic Report for Default Gateway
Period
From the available options, select the period for the report of the network traffic that passed through the gateway.
Available Options:
• Weekly
• Monthly
• Custom
The graph displays the upload, download and total data transfer through the gateway.
• X-axis: Date (depending on the period selected)
• Y-axis: KB/MB/GB used
Legend
• Orange Color – Upload Network Traffic (MB)
• Purple Color – Download Network Traffic (MB)
• Green Color – Total Network Traffic (MB)
Note: When the selected period is Custom, then the user can select to view data of not more than the last six (06) months. At one time, only thirty (30) days data will be displayed.
| System | 217
Figure 186: Network Transfer Report
DNS
Use DNS page to configure the DNS settings of the device.
The DNS server is configured at the time of installation. You can add additional DNS servers to which the device can connect for name resolution. If multiple DNS are defined, they are queried in the order as they are entered.
Note: You can also view and manage the DNS server status on the System > Diagnostics > Services page.
When you want external domains names to be resolved through internal DNS servers in your network, you can add routes to such servers. This will decrease the Internet traffic over the network and speed up DNS client requests as queries will not be forwarded outside the network. Also, DNS information would be less exposed on the Internet thus enhancing security.
IPv4
Obtain DNS from DHCP
Click to override the device DNS with the DNS address received from the DHCP server.
The option is available if enabled from the Network Configuration Wizard or if a DHCP interface is configured.
Obtain DNS from PPPoE
Click to override the device DNS with the DNS address received from the PPPoE server.
The option is available if enabled from the Network Configuration Wizard or if a DHCP interface is configured.
Static DNS
Select to provide a static IPv4 DNS server address.
A maximum of three static DNS IPv4 addresses can be provided.
Figure 187: IPv4 DNS Settings
IPv6
Obtain DNS from DHCP
Click to override the device DNS with the DNS address received from the DHCP server.
The option is available if enabled from the Network Configuration Wizard or if a DHCP interface is configured.
Static DNS
Select to provide a static IPv6 DNS server address.
A maximum of three static DNS IPv6 addresses can be provided.
Figure 188: IPv6 DNS Settings
DNS Query Configuration
Choose server based on incoming requests record type
Select to choose the DNS server to be used for resolving the domain name on the basis of the incoming requests record type. Incoming request can be of A or AAAA type.
Choose IPv6 DNS server over IPv4
Select to first choose the IPv6 DNS server for resolving the DNS and then the IPv4 DNS server.
If both IPv6 and IPv4 DNS servers are configured, then it first selects the IPv6 DNS server for all requests followed by the IPv4 DNS server.
Choose IPv4 DNS server over IPv6
Select to first choose the IPv4 DNS server for resolving the DNS and then the IPv6 DNS server.
| System | 218
| System | 219
If both IPv6 and IPv4 DNS servers are configured, then it first selects the IPv4 DNS server for all requests followed by the IPv6 DNS server.
Choose IPv6 if request originator address is IPv6, else IPv4
Select to choose the IPv6 DNS server if a request is received from an IPv6 source or choose the IPv4 DNS server, if a request is received from an IPv4 source.
Apply
Click to save the configuration.
Test Name Lookup
Click and provide an IP address or host name for testing the connectivity with the DNS server.
Figure 189: DNS Query Configuration
DNS Host Entry
The DNS Host Entry section displays the list of all the configured host entries. You can filter the list based on the host/domain name. This section provides the option to add, update, or delete entries.
DNS Request Route
This section displays a list of all the configured DNS request routes. You can filter the list based on the name or the target. Additionally, you can add, update and delete routes.
Add DNS Host Entry
The Add DNS Host Enry page allows you to create and manage DNS host entries.
1. Navigate to System > Network > DNS > DNS Host Entry and click Add.
2. Enter the host entry details.
Host/Domain Name
Provide a fully qualified domain name (FQDN) for the host/domain.
Address
Enter the address details for the host entry.
Entry Type
Select the DNS host entry type.
Available Options:
• Manual – Enter the IP address for the host manually
• Interface IP – Configure an interface as host
IP Address
Specify the IP address of the host/domain or select an interface IP depending on the option selected for the entry type.
Maximum entries per host: 8
| System | 220
Time to Live (seconds)
Specify the TTL in seconds.
Default: 60 seconds
Weight
Specify the weight for load balancing the traffic. The device distributes traffic across the links in proportion to the ratio of weights assigned to individual links.
This weight determines how much traffic will pass through a particular link relative to the other link(s).
Default: 1
Publish on WAN
Enable to publish the DNS host entry on WAN.
Default: Disabled
Reverse DNS Lookup
Reverse DNS lookup is the resolution of an IP address to its designated domain name. Enable to allow reverse
DNS lookup.
Note: If there are multiple hosts resolving to the same IP address then Reverse DNS Lookup can only be configured for one of the IP addresses.
• Only A, AAAA, and PTR type of DNS records are supported.
• Address (A) record points a hostname to an IP address and returns a 32-bit IPv4 address.
• AAAA record points a hostname to an IP address and returns a 128-bit IPv6 address.
• Pointer records (PTR) are just the reverse of A records and are used for reverse lookups. They map the IP address to a hostname.
• Maximum DNS entries supported: 1024
• If the device interface is used as a DNS in the client system then a query is sent to the configured
DNS servers prior to querying the ROOT severs.
Figure 190: DNS Host Entry
3. Click Save.
The DNS host entry has been created and appears on the DNS page.
Add DNS Request Route
The Add DNS Reqeust Route page allows you to configure DNS Request routes to internal DNS servers.
Add/Edit DNS Request Route
Host/Domain Name
Specify the domain for which you want to use the internal DNS server.
Target Servers
Select a DNS server(s) to resolve the domain specified above.
You can also add IP address to the DNS from this page by entering it in the entry field. Up to eight IP addresses can be added.
| System | 221
Figure 191: Add DNS Request Route
DHCP
On a network, the dynamic host configuration protocol (DHCP) automatically assigns IP addresses to the hosts on a network, thus reducing the administrator’s configuration task. Instead of requiring administrators to assign, track and change (when necessary) IP addresses for every host on a network, DHCP settles it automatically. Furthermore,
DHCP ensures that duplicate addresses are not used.
The DHCP tab contains the following sections:
Server
The device acts as a DHCP server: it assigns a unique IP address to a host and releases the address when the host leaves and re-joins the network. Each time, when the host connects to the network, it can have another IP address. In other words, device provides a mechanism for allocating the IP address dynamically so that addresses can be re-used.
An interface having static IP assignment can also act as a DHCP server. You can disable or change this DHCP server configuration. The device cannot act as DHCP server and DHCP relay agent simultaneously. Hence, if the device is configured as DHCP server, you will not be able to configure it as a relay agent and vice-versa. You can configure
IPv4 and IPv6 DHCP servers.
Using the Server section, you can configure and manage DHCP servers on the device. It displays a list of all configured DHCP servers, and you can filter the list based on the IP family.
Relay
Deploying DHCP in a single segment network is easy. All DHCP messages are IP broadcast messages, and therefore all the computers on the segment can listen and respond to these broadcasts. But things get complicated when there is more than one subnet on the network. The reason is that the DHCP broadcast messages do not cross the router interfaces by default. The DHCP relay agent makes it possible to place DHCP clients and DHCP servers on different networks. The relay agent allows DHCP broadcast messages to be sent over routers that do not support forwarding of these types of messages. The DHCP relay agent enables DHCP clients to obtain IP addresses from a DHCP server on a remote subnet, or from a server which is not located on the local subnet. If the DHCP relay agent is not configured, clients would only be able to obtain IP addresses from the DHCP server which is on the same subnet.
Using the Relay section, you can configure and manage DHCP relay agents on the device. It displays a list of all interfaces configured as a relay agent, and you can filter the list based on the relay agent name and the IP family.
| System | 222
Lease
The device acting as a DHCP server assigns or leases an IP address from an address pool to a host DHCP client. The
IP address is leased for a determined period of time or until the client relinquishes the address. The page displays a list of all IPv4 and IPv6 addresses leased dynamically, and you can filter the list based on the leased IP, or the client's physical address.
IPv4 Lease
The following information is displayed for the leased IPv4 addresses:
• Leased IP address
• Leased start and end time
• Client physical address
• Client host name
• Lease type
IPv6 Lease (IPv6 / Prefix)
The following information is displayed for the leased IPv6 addresses:
• Leased IP address
• Leased start and end time
• Client physical address
• DUID
Configure Interface as DHCPv4 Server
You can configure the interface as DHCPv4 server from this page.
1. Navigate to System > Network > DHCP > Server, click Add and select IPv4.
2. Enter the details for the general settings.
Name
Provide a name to identify the DHCPv4 server uniquely.
Interface
Select any interface to set it as DHCPv4 server. DHCP service can be configured on a virtual sub-interface but not on an interface alias.
Dynamic IP Lease
Specify the range of IP addresses from which the DHCP server must assign an IP address to the clients and set a subnet mask for the IP address range. It is also possible to configure multiple IP ranges for the same interface. You can also provide multiple IP ranges for the DHCP server.
Use and to add or delete a range.
Static IP MAC Mapping
If you always want to assign specific IP addresses to some or all clients, you can define static MAC address to IP address mappings. To define a MAC-IP mapping, you should know the MAC address of the client’s network card. The MAC address is usually specified in hexadecimal digits separated by colons (for example,
00:08:76:16:BC:21). Specify the host name, the MAC address and the IP address. You can provide multiple
MAC-IP mappings for the DHCP server.
Use and to add or delete a MAC/IP mapping.
Subnet Mask
Select a subnet mask for the server.
Domain Name
Specify the domain name that the DHCP server will assign to the DHCP clients.
Gateway
Enable to use the interface IP as gateway.
Specify the IP address as default gateway or select Use Interface IP as Gateway.
Default Lease Time
Specify the default lease time.
Acceptable Range: 1 to 43200 minutes (30 days)
Default: 1440 minutes
Max Lease Time
Specify the maximum lease time. The DHCP client must ask the DHCP server for new settings after the specified maximum lease time has expired.
Acceptable Range: 1 to 43200 minutes (30 days)
Default: 2880 minutes
Conflict Detection
Enable IP conflict detection to check the IP address before leasing. If enabled, the already leased IP address will not be leased again.
| System | 223
Figure 192: General Settings
3. Enter the DNS Server details.
Use Device’s DNS Settings
Click to use the device's DNS server. In this case, the first two configured DNS will be used.
If not enabled, provide a primary and secondary DNS to be used.
| System | 224
Primary DNS
Specify the IP address of the primary DNS server.
Secondary DNS
Specify the IP address of the secondary DNS server.
Figure 193: DNS Server details
4. Enter the WINS server details.
Primary WINS Server
Specify the IP address of the primary WINS server.
Secondary WINS Server
Specify the IP address of the secondary WINS server.
Figure 194: WINS Server details
5. Click Save.
The DHCPv4 server has been created and appears on the DHCP page.
Configure Interface as DHCPv6 Server
You can configure the interface as DHCPv6 server from this page.
1. Navigate to System > Network > DHCP > Server, click Add and select IPv6.
2. Enter the details for the general settings.
Name
Provide a name to identify the DHCPv6 server uniquely.
Interface
Select any interface to set it as DHCPv6 server. DHCP service can be configured on a virtual sub-interface but not on an interface alias.
Dynamic IP Lease
Specify the range of IPv6 addresses from which the DHCP server must assign an IP address to the clients and set a subnet mask for the IPv6 address range. It is also possible to configure multiple IPv6 range for the same interface.
You can provide multiple IP ranged for the DHCP server. Click and to add and delete a range.
Static IP DUID Mapping
If you always want to assign specific IP addresses to some or all clients, you can define static DUID address to IP address mappings. To define DUID-IP mapping, you should know the DHCP Unique Identifier (DUID) of the client. The DUID address is usually specified in groups of two hexadecimal digits separated by colons.
| System | 225
Specify the host name, DUID and the IP address. You can provide multiple DUID-IP mappings for the DHCP server.
Use and to add or delete a DUID-IP mapping.
Preferred Time
Specify the preferred time.
Acceptable Range: 1 to 43200 minutes (30 days)
Default: 540 minutes
Note: Preferred time should be less than valid time.
Valid Time
Specify the valid time.
Acceptable Range: 1 to 43200 minutes (30 days)
Default: 720 minutes
Figure 195: General Settings
3. Enter the DNS server details.
Use Device’s DNS Settings
Click to use the device's DNS server. In this case, the first two configured DNS will be used.
If not enabled, provide a primary and secondary DNS to be used.
If not enabled, provide the primary and secondary DNS to be used.
Primary DNS
Specify the IPv6 address of the primary DNS server.
Secondary DNS
Specify the IPv6 address of the secondary DNS server.
| System | 226
Figure 196: DNS Server details
4. Click Save
The DHCPv6 server has been created and appears on the DHCP page.
Add DHCP Relay Configuration
You can configure the interface as DHCP relay agent from this page.
1. Navigate to System > Network > DHCP > Relay and click Add
2. Enter the DHCP relay configuration details.
Name
Provide a name to identify the DHCP relay agent.
IP Family
Select the IP family for the DHCP relay agent.
Available Options:
• IPv4
• IPv6
Interface
Select an interface.
Interfaces having a static IP assignment can act as a DHCP relay agent. The device cannot act as DHCP server and DHCP relay agent simultaneously. Hence, if the device is configured as DHCP relay agent, you will not be able to configure it as a server and vice-versa.
The DHCP relay agent can be configured on a virtual sub-interface but not on an interface alias.
DHCP Server IP
Specify the DHCP server IP address. You can also configure multiple DHCP servers. This facilitates deploying DHCP servers in high availability environment. The DHCP relay will forward packets to all configured DHCP servers, and the active server will serve the request. In case the active server goes down, the backup server serves the request. The DHCP server takes care of leasing the IP address to a client.
Maximum DHCP servers configurable per DHCP relay: 8
Relay through IPSec (Only availabe if IP family is IPv4)
Select to relay DHCP messages through an IPSec VPN tunnel.
| System | 227
Figure 197: Add DHCP Relay Configuration
3. Click Save.
The DHCP relay agent has been created and appears on the DHCP page.
IPv6 Router Advertisement
System > Network > IPv6 Router Advertisement
Address Assignment for IPv6 Devices
IPv6 clients are assigned an IP address through:
• DHCP for IPv6
• Stateless address auto configuration (SLAAC)
DHCP for IPv6
Similar to IPv4, IPv6 can use DHCP to assign IP addresses to any clients. The device can be configured to be a stateful DHCP server. The DHCP server is responsible for assigning the IP address to the client and for keeping a record of all clients and the IPv6 addresses assigned to them.
Stateless Address Auto Configuration
The IPv6 protocol supports address auto configuration for stateless addresses. IPv6 devices automatically create unique link-local addresses for IPv6 enabled interfaces, and clients use router advertisement messages to configure their own IP address automatically.
Router Advertisement
The device acting as a router has the ability to participate in stateless auto configuration (SLAAC) and by default provides a IPv6 address and a default gateway to the client.
When the device interface is connected to a network and enabled, the host may send out an ICMPv6 (type 135)
Router Solicitation (RS) message that requests the device to generate Router Advertisement (RA) immediately instead of waiting until their next scheduled time. On receiving the RS message, the device immediately sends an ICMPv6
(type 134) router advertisement (RA) message announcing the state of its availability. Router advertisements include information about which method to be used for address assignment, prefixes used for on-link determination and/or address configuration, hop limit value, several flag status, etc. The critical parameters can be administered centrally and if necessary, can be propagated automatically to all hosts on the network. The device advertises information about various interfaces and Internet parameters either periodically or in response to the RS message, informing all the nodes on the network about any modification regarding addressing information. Thus, Router advertisement (along
| System | 228 with prefix flags) permits simple stateless auto configuration and guides a host in generating an address using autoconfiguration.
Note: You can also view and manage the router advertisement service status on the System > Diagnostics >
Services page.
IPv6 Router Advertisement
You can configure the router advertisement settings for an interface from this page.
1. Navigate to System > Network > IPv6 Router Advertisement and click Add.
2. Enter details for the general settings.
Interface
Select an interface for router advertisement.
All IPv6 enabled physical interfaces, LAG, VLAN and bridge interfaces can be selected.
Description
Provide a description for the interface to be selected for router advertisement.
Min Advertisement Interval
Specify the minimum time interval in seconds between two consecutive unsolicited router advertisement messages sent to the clients.
Acceptable range: 3 to 1350 seconds
Default: 198 seconds
If the Max Advertisement Interval is 9 seconds or above, then the Min Advertisement Interval must be:
0.75 * maximum advertisement interval.
Max Advertisement Interval
Specify the maximum time interval in seconds between two consecutive unsolicited router advertisement messages sent to the clients.
Acceptable Range: 4 to 1800 seconds
Default: 600 seconds
Managed Flag
Select to set the managed flag. When this flag is set, IPv6 addresses are obtained from the DHCPv6 server.
By default, this flag is not selected.
Note: The option must be selected only if a DHCPv6 Server is available else IPv6 clients would not get IPv6 addresses
Other Flag
Select to set the other flag. When this flag is set, the DHCPv6 client obtains other network parameters such as
DNS server, domain name, NIS, NISP, SIP, SNTP, and BCMS servers from the DHCPv6 server.
Note: This option must be selected only if a DHCPv6 server is available.
Default Gateway
Select to use the device as default gateway for communication with the client.
Life Time
Specify the time in seconds to be used for router advertisement as a default gateway at the client end.
The value specified should be between the value specified for Max Advertisement Interval and 9000 seconds.
Default: 1800 seconds
Prefix Advertisement Configuration
Prefix Advertisement includes zero or more prefix options containing information that the default gateway advertises. This information is used by stateless address auto configuration to auto-generate a global IPv6 address. Prefix advertisement has its own list of attributes:
| System | 229
Prefix / 64
Provide the first 64 bits of the IPv6 address.
The interface uses this prefix information from the router advertisement message to determine the last 64 bits (interface identifier) of its 128-bit IPv6 address.
The first 64 bits (higher order bits) of the IPv6 address so provided, specify the network, while the remaining specify a particular address in the network. Hence, IPv6 addresses in one network have the same first 64 bits and are called “prefix”.
On-link
Select to set the prefix to be “On-link”. With the attribute On-link set, the devices with IPv6 addresses that are within this prefix are reachable on the subnet without a need of a router.
By default, this flag is set.
Autonomous
Select to set the prefix attribute Autonomous. On being set, the global IPv6 address is automatically generated by appending the 64 bit interface identifier to the prefix (prefix /64) advertised in the prefix information.
Only those prefixes that has the Autonomous flag set gets a stateless address auto configuration (SLAAC)
IPv6 address.
By default, the flag is set.
Preferred Life Time
Specify the time in minutes for a valid address to remain in the preferred state. The use of the preferred address is unlimited.
On expiry of the valid life time, the preferred address becomes deprecated. The use of the deprecated address must be avoided, however, it is not forbidden and can be continued to be used as source address for an existing communication.
The IPv6 address will continue to remain in the preferred state as long as it is refreshed by prefixes in the router advertisement or by any other means or are renewed by DHCPv6.
Acceptable range: 0 seconds to Infinite
Default: 240 seconds
Specify the attribute value as “-1” for an infinite preferred life time.
Valid Life Time
Specify the time in minutes for an address to remain in the valid state.
This value determines the time for an address to be in the valid state. Until the time expires, the prefix is considered to be on-link and auto-configured addresses using the prefix can be used.
On expiry of the valid life time, the IPv6 address becomes invalid and cannot be used to send or receive traffic.
Acceptable range: 0 seconds to Infinite
Default: 1440 minutes
Specify the attribute value as “-1” for an infinite valid life time.
Use the and icons to add or remove a prefix.
Note: The value of attribute Valid Life Time must be greater than or equal to value of Preferred
Life Time.
| System | 230
Figure 198: General Settings
3. Enter the details for the advanced settings
Using the network discovery protocol (NDP) devices on the same interface discover the presence of each other and the respective link-layer addresses, find gateway routers and maintain the reachability information about the active paths to the peers.
Link MTU
Specify the Maximum Transmission Unit (MTU) in bytes for the packets sent on this interface.
Specify the Maximum Transmission Unit (MTU) in bytes for the packets sent on this interface.
Default: 0
Acceptable range: 1280 to 1500 bytes
If Link MTU is set to zero, the information will not be advertised by the interface.
Reachable Time
Specify the reachable time in seconds that the client will use to assume a neighbor is reachable after having received a reachability confirmation message.
Default: 0
Acceptable range: 0 to 3600 seconds
Retransmit Time
Specify the retransmission time in seconds that the client will use to determine how long it should wait before retransmitting neighbor solicitation messages.
Default: 0
Acceptable range: 0 to 60 seconds
Hop Limit
Specify the hop limit value.
This value determines the number of hops that a packet is limited to. The hop value is decremented by each router along the route. On reaching zero, the packet is destroyed.
Default: 64
Acceptable range: 0 to 255 seconds
| System | 231
Figure 199: Advanced Settings
4. Click Save.
The IPv6 router advertisement settings have been updated.
Neighbors (ARP - NDP)
From the Neighbors page, view the IPv4 and IPv6 ARP-NDP neighbors, create static neighbors and flush existing neighbors.
ARP-NDP
TCP/IP uses ARP (Address Resolution Protocol) protocol to translate an IPv4 address into a MAC address (physical network address). In other words, it maps layer 3 (IPv4 addresses) to layer 2 (physical or MAC addresses) to enable communications between hosts residing on the same subnet. Similarly to translate IPv6 addresses, NDP (Neighbor
Discovery Protocol) is used.
ARP is used by hosts that are directly connected on a local network and uses either or both unicast and broadcast transmissions directly to each other. The host finds the physical address of another host on its network by sending an ARP query packet that includes the IP address of the receiver. As a broadcast protocol, it can create excessive amounts of network traffic on your network. To minimize the broadcast traffic, an ARP cache is maintained to store and reuse previously learned ARP information.
NDP in IPv6 is similar to ARP in IPv4. The main purpose of both protocols is to enable a host (node) to determine the link layer address (MAC address) of the node it wants to communicate with, in the local network and to find out the link layer address of the router through which it can access a node in an external network. Thus, the actual exchange of messages can take place between the two nodes. Apart from neighbor discovery, NDP functionality includes router discovery, neighbor presence, redirects, network options (as in DHCP options) and stateless auto-configuration.
Similar to ARP, NDP is also susceptible to flooding and poisoning attacks.
NDP has neighbor solicitations analogous to ARP request and neighbor advertisements analogous to ARP replies.
Unsolicited neighbor advertisements in IPv6 correspond to gratuitous ARP replies in IPv4. Static neighbor configuration protects the neighbor cache from trusted or vulnerable nodes in the network. Static neighbor discovery helps -to prevent solicit requests for configured entries and ignores any incoming solicit or advertised ND for configured entries.
Neighbors
ARP and NDP traffic is a vital communication on a network and is enabled on the Device interfaces by default.
A static neighbor entry allows binding the MAC address to the designated IP address and port. Once the MAC address is bound to a port and IP address, the Device will not update its neighbor table dynamically and will not respond to that IP-MAC pair on any other port. It will also remove any dynamically cached references to that IP address that might be present, and will not allow additional static mappings of that IP address.
These entries will be stored in the Static Neighbor Table, the IPv4 Neighbor Cache and the IPv6 Neighbor Cache.
The Device performs the neighbor lookup in the static neighbor table when it receives the request on a particular port.
If there is any mismatch in an IP address or MAC address, the Device considers it as a neighbor poisoning attempt and does not update its neighbor cache. If an entry is not available in the table, the Device will lookup in the IPv4 or
IPv6 neighbor cache and adds the MAC address to the neighbor cache if required.
| System | 232
Consider an example when IP1 is mapped to MAC1 and the IP1-MAC1 pair is bound to Port A. Similarly, IP2 is mapped to MAC1 and the IP2-MAC1 pair is bound to Port A
Table 4: Illustration for Neighbor Poisoning
IP Address
IP1
IP1
IP1
IP1
IP3
IP2
IP2
MAC Address
MAC1
MAC1
MAC2
MAC2
MAC1
MAC1
MAC1
Port
A
Neighbor Poisoning Attempt
No
Any other port than A Yes
A Yes
Any other port than A Yes
No static ARP No
A No
Any other port than A Yes
Neighbors (ARP-NDP)
The device maintains three types of table for neighbor entries: Static Neighbor Table, IPv4 Neighbor Cache and IPv6
Neighbor Cache.
IPv4/IPv6 Neighbor Cache table
The IPv4/IPv6 neighbor cache table stores static and dynamic neighbor entries. Static neighbor entries are defined by administrators and are permanent while dynamic neighbor entries are learned entries and are updated dynamically.
Such dynamic entries can be flushed by clicking Flush.
Go to System > Network > Neighbor (ARP-NDP) and select IPv4 Neighbor Cache or IPv6 Neighbor Cache to view the large number of neighbor entries. This page allows navigating and managing the neighbor entries in all three tables. Select the table type from the drop-down list to view the neighbor entries in the respective table. It lists IP address, MAC address, interface and type of the entry. Entry type can be static or dynamic. If everything is working properly with the neighbor, the dynamic neighbor entry will be displayed as “Complete, Dynamic”.
“Complete, Dynamic” means both MAC and IP values are there in the table while “Incomplete, Dynamic” means that the neighbor request was sent but no reply has yet been received.
Neighbor Configuration
Neighbor cache entry timeout
Specify time interval after which the entries in the cache should be flushed.
Default: 2 minutes
Input range: 1 to 500 minutes
Flush the IPv4/IPv6 neighbor cache whenever the host IP address on the network changes. As the IP address is linked to a physical address, it can change but can still be associated with the physical address in the IPv4/IPv6
Neighbor Cache. Flushing the IPv4/IPv6 Neighbor Cache allows new information to be gathered and stored in the
IPv4/IPv6 Neighbor Cache.
Log Possible Neighbor Poisoning Attempts
Enable to log the poisoning attempts.
Figure 200: Neighbor Configuration
Flushing Neighbor Table and Cache
The neighbors page displays a list of all the IP address-and-MAC address mappings and you can filter the list based on the IP address or the MAC address.
Select Static Neighbor Table or the required cache and click the Flush button to empty the cache or click Add to add a new entry.
| System | 233
Figure 201: Neighbors
| System | 234
Add Static Neighbor
The Add Static Neighbor page allows you to add an IPv4 or IPv6 neighbor.
1. Navigate to System > Network > Neighbors (ARP-NDP)and click Add under Show Static Neighbor Table.
2. Specify the details.
IP Family
Select the IP Family for the static neighbor.
Available Options:
• IPv4
• IPv6
IPv4/IPv6 Address
Specify a IPv4/IPv6 address of the host outside the firewall.
MAC Address
Specify a MAC address of the host.
Interface
Select the physical interface on which the binding is to be done.
Add as a Trusted MAC Address to prevent a spoofing attempt
On enabling this option, the IP-MAC pair is added to the Trusted MAC list. If disabled, the IP-MAC pair will not be included in the Trusted MAC list.
By default, this option is enabled.
Figure 202: Static Neighbor
3. Click Save.
The static neighbor is created and appears in the Static Neighbor Table on the Neighbors (ARP -NDP) page.
Dynamic DNS
Dynamic DNS (Domain Name Service) is a method of keeping a static domain/host name linked to a dynamically assigned IP address allowing your server to be more easily accessible from various locations on the Internet.
Powered by Dynamic Domain Name System (DDNS), you can access your device by the domain name, not the dynamic IP address. DDNS will tie a domain name (for example, mydevice.com, or mycompany.mydevice.com) to your dynamic IP address.
The device supports following Dynamic DNS providers:
1. DynDNS
2. ZoneEdit
3. EasyDNS
| System | 235
4. DynAccess
5. Sophos
The page displays a list of all the configured DDNS and also provides the option to add, update or delete the configuration.
Add Dynamic DNS
The Add Dynamic DNS page allows you to either add details of a third-party DDNS provider or to configure the
Device itself to act as a DDNS.
1. Navigate to System > Network > Dynamic DNS and click Add.
2. Enter details for DDNS parameters.
Note: For configuring a third-party service provider, you require a registered account with any of the supported Dynamic DNS service providers:
1. DynDNS
2. ZoneEdit
3. EasyDNS
4. DynAccess
Host Name
Specify a name to identify the host that you want to use on the DDNS server. It is the domain name that you registered with your DDNS service provider, for example sophos.com.
In case you are configuring DynAccess as a service provider, provide the host name in the following format:
<accountname>.dynaccess.com.
In case you are configuring Sophos as a service provider, provide the host name in the following format:
<host name>.myfirewall.co
Interface
Select the external interface. The IP address of the selected interface will be bound to the specified host name.
IPv4 Address
Select the IPv4 address source.
Available Options:
• Use Port IP: Select to use the IP address of the selected port or interface.
• NATed Public IP: Select to use the public IP address assigned to the selected port.
IP Edit Checking Interval
Specify the time interval after which the device should check and edit the IP address of your server, if changed.
Default: 20 minutes
Acceptable Range: 4 - 60 minutes
For example, if the time interval is set to 10 minutes, after every 10 minutes, the device will check for any changes in your server IP address.
| System | 236
Figure 203: Host Details
Service Provider
Select the service provider with whom you have registered your hostname. In case you are configuring
Sophos as a service provider, login name and password are not required.
Login Name
Specify your DDNS account’s username.
In case you are configuring DynAccess as a service provider, provide the host name in the following format:
<accountname>.dynaccess.com.
Provide your login name as <accountname>.
Password
Specify your DDNS account’s password.
Figure 204: Service Provider Details
3. Click Save.
The Dynamic DNS has been created and appears on the Dynamic DNS page.
Routing
Routing provides options to configure both static and dynamic routes.
Available configurations:
•
- Allows to configure parent proxy settings when the web traffic is blocked by the upstream gateway.
•
- Allows to configure packets redirection to a destination other than the configured default gateway.
•
- Allows to configure and manage RIP routes.
•
- Allows to configure and manage OSPF routes.
•
- Allows to configure and manage BGP routes.
•
- Allows to configure and manage PIM-SM routes.
| System | 237
•
- Shows information and status of dynamic routes configured using RIP, OSPF, BGP or PIM-
SM protocols.
Upstream Proxy
System > Routing > Upstream Proxy
If your enterprise contains numerous internal branches, an upstream proxy can bundle the requests from the internal network before passing the traffic on to the external network/Internet.
This page allows you to configure an upstream proxy for IPv4/IPv6.
IPv4 Parent Proxy
Parent Proxy
Click to enable the parent proxy, if the web traffic is intercepted by an upstream gateway.
If enabled, the device forwards all the HTTP requests to the parent proxy server.
Domain Name/IPv4 Address
Specify a domain name or IPv4 address for the parent proxy.
Port
Specify the port number, which is to be used for the parent proxy.
Default: 3128
Username
Specify a username for authentication.
Password
Specify a password for authentication.
Figure 205: IPv4 Parent Proxy
Click Apply.
IPv6 Parent Proxy
Parent Proxy
Click to enable the parent proxy. if the web traffic is intercepted by an upstream gateway.
If enabled, the device forwards all the HTTP requests to the parent proxy.
Domain Name/IPv6 Address
Specify a domain name or IPv6 address for the parent proxy.
Port
Specify the port number to be used for the parent proxy.
Default: 3128
| System | 238
Username
Specify a username for authentication.
Password
Specify a password for authentication.
Figure 206: IPv6 Parent Proxy
Click Apply.
Static Routing
System > Routing > Static Routing
A route provides the device with the information it needs to forward a packet to a particular destination. A static route causes packets to be forwarded to a destination other than the configured default gateway.
By specifying through which interface the packet will leave and to which device the packet should be routed, static routes control the traffic exiting the device.
IP Multicast
Internet Protocol (IP) multicast is a bandwidth-conserving technology that reduces traffic by simultaneously delivering a single stream of information to thousands of recipients and homes. IP multicast delivers source traffic to multiple receivers without adding any additional burden on the source or the receivers.
Applications like videoconferencing, corporate communications, distance learning, and distribution of software, stock quotes, and news use IP multicasting.
If IP multicast is not used, the source is required to send more than one copy of a packet or individual copy to each receiver. In such case, high-bandwidth applications like video or stock where data is to be send more frequently and simultaneously, uses large portion of the available bandwidth. In these applications, the only efficient way of sending information to more than one receiver simultaneously is by using IP multicast.
Multicast Group
Multicast is based on the concept of a group. An arbitrary group of receivers expresses an interest in receiving a particular data stream. This group does not have any physical or geographical boundaries - the hosts can be located anywhere on the Internet. Hosts that are interested in receiving data flowing to a particular group must join the group.
Hosts must be a member of the group to receive the data stream.
IP Multicast Addresses
Multicast addresses specify an arbitrary group of IP hosts that have joined the group and want to receive traffic sent to this group.
IP Class D Addresses
The Internet Assigned Numbers Authority (IANA) controls the assignment of IP multicast addresses. Multicast addresses fall in class D address space ranging from 224.0.0.0 to 239.255.255.255.
This address range is only for the group address or destination address of IP multicast traffic. The source address for multicast datagram is always the unicast source address.
| System | 239
Multicast forwarding
With multicast forwarding, a router forwards multicast traffic to networks where other multicast devices are listening.
Multicast forwarding prevents the forwarding of multicast traffic to networks where there are no nodes listening.
For multicast forwarding to work across inter-networks, nodes and routers must be multicast-capable.
A multicast-capable node must be able to:
• Send and receive multicast packets.
• Register the multicast addresses being listened to by the node with local routers, so that multicast packets can be forwarded to the network of the node.
IP multicasting applications that send multicast traffic must construct IP packets with the appropriate IP multicast address as the destination IP address. IP multicasting applications that receive multicast traffic must inform the TCP/
IP protocol that they are listening for all traffic to a specified IP multicast address.
Manage Static Routes
System > Routing > Static Routing
Static Routing menu allows configuring a unicast route, a multicast route and a source route. This page describes the available elements.
IPv4 Unicast Route
The IPv4 Unicast Route section displays a list of all the configured IPv4 unicast routes. You can filter the list based on IP address, gateway, interface, or distance. The page also provides the option to Add a route, update the route configuration and Delete the route.
IPv6 Unicast Route
The IPv6 Unicast Route section displays a list of all the configured IPv6 unicast routes. You can filter the list based on IP address, gateway, interface, or distance. The page also provides the option to Add a route, update the route configuration and Delete the route.
Multicast Forwarding Setting
| System | 240
Enable Multicast Forwarding
Enable/disable multicast forwarding. Enable and click Apply to allow the router to forward packets to other networks where other multicast devices are active and listening.
Manage Multicast Route
The Manage Multicast Route section displays a list of all the configured multicast routes. You can filter the list based on source IP, multicast IP, source interface and destination interface. The page also provides the option to Add a route, update the route configuration and Delete the route.
IPv4 Source Route
Source routing is the technique by which the sender can explicitly mention the route through which the packet travels.
The section displays a list of all the IPv4 source routes. The page provides the option to Add a route, update and
Delete the existing routes.
IPv6 Source Route
This section displays a list of all the IPv6 source routes. The page provides the option to Add a route, update and
Delete the existing routes.
Add Unicast Route
You can add a unicast route from this page.
1. For an IPv4 unicast route, navigate to System > Routing > Static Routing and click Add under IPv4 Unicast
Route. For an IPv6 unicast route, navigate to System > Routing > Static Routing and click Add under IPv6
Unicast Route.
2. Enter unicast route details.
Destination IP/Prefix
Specify the destination IPv4 or IPv6 address and select the prefix of subnet mask from the drop-down list.
Gateway
Specify the gateway IPv4 or IPv6 address. The gateway address specifies the next-hop router to which traffic will be routed.
Interface
Select an interface from the drop-down list.
Distance
Specify the distance for routing.
For IPv4
Default: 0
Acceptable Range: 0 to 255
For IPv6
Default: 1
Acceptable Range: 1 to 255
Figure 207: IPv4 Unicast Route
Figure 208: IPv6 Unicast Route
3. Click Save.
The unicast route has been created and appears on the Static Routing page.
Add Multicast Route
You can add a multicast route from this page.
1. Navigate to System > Routing > Static Routing and click Add under Manage Multicast Route.
2. Enter multicast route details.
Source IPv4 Address
Specify the source IPv4 address.
Source Interface
Select the source interface from the drop-down list.
Multicast IPv4 Address
Specify the multicast IPv4 address. For example, (224.0.2.0 - 239.255.255.255)
Destination Interface
Select destination interface(s) from the available options. You can select more than one destination interface.
| System | 241
Figure 209: Add Multicast Route
3. Click Save.
The multicast route has been created and appears on the Static Routing page.
Add Explicit Source Route
You can add IPv4 and IPv6 source routes from this page.
1. Navigate to System > Routing > Static Routing and click Add under IPv4/IPv6 Source Route.
2. Enter source route details.
Gateway
Select a gateway from the drop-down list.
| System | 242
Network ID / Prefix
Specify the network ID and select the prefix of the subnet mask from the drop-down list.
Figure 210: IPv4 Source Route
Figure 211: IPv6 Source Route
3. Click Save.
The explicit source route has been created and appears on the Static Routing page.
RIP
System > Routing > RIP
This page allows you to manage RIP routes. You can also add, update, or delete the networks/interface-specific configuration from this page.
Routing Information Protocol (RIP) is a widely used routing protocol that uses hop count to determine the best route to a destination.
RIP avoids routing loops from continuing indefinitely by limiting the number of hops permitted between the source and destination. The maximum number of hops supported is 15. Hence, if the hop count becomes 16, it is known as an infinite distance and is considered as unreachable.
With the help of the RIP protocol, the device sends routing update messages at regular intervals to the next router.
When the next router receives the changes, it updates them in the routing table and also increases the metric value for the path by 1. The sender of the message is considered as the next hop. The device maintains only the route with the least metric value to a destination.
Global Configuration
Default Metric
Specify the default metric value to be used for redistributed routes.
Metric is a property that contains a value used by a routing protocol to decide which route will be taken.
Default: 1
Acceptable Range: 1 to 16
Administrative Distance
Specify the administrative distance. It is a number used by the routers to find out the better route.
Default: 120
Acceptable Range: 1 to 255
RIP Version
Select the RIP version to be used for sending and receiving updates.
Available Options:
• Send V2 & Receive both
• V1
• V2
Timers
Update
Specify the time interval in seconds between two periodic routing updates.
Default: 30 seconds
Acceptable Range: 5 to 2147483647 seconds
Timeout
Specify the time in seconds after which the route becomes invalid.
Default: 180 seconds
Acceptable Range: 5 to 2147483647 seconds
Garbage
Specify the garbage time. It is amount of time that the device will advertise a route as being unreachable before deleting the route from the routing table.
Default: 120 seconds
Acceptable Range: 5 to 2147483647 seconds
Default Information Originate
Enable to control the distribution of the default route. It will generate and advertise a default route into the RIPenabled networks.
The default setting is disabled.
Redistribute Connected
Click to enable the redistribution of connected routes into the RIP routing table.
Specify metric for redistributed connected routes.
Acceptable Range: 0 to 16
Redistribute Static
Click to enable the redistribution of static routes into the RIP routing table
Specify metric for redistributed static routes.
Acceptable Range: 0 to 16
Redistribute OSPF
Click to enable the redistribution of OSPF routes into the RIP routing table.
Specify metric for redistributed OSPF routes.
Acceptable Range: 0 to 16
Redistribute BGP
Click to enable the redistribution of BGP routes into RIP routing table.
Specify metric for redistributed BGP routes.
Acceptable Range: 0 to 16
| System | 243
Figure 212: Global Configuration
Click Apply.
RIP Networks
This section shows a list of availble RIP networks including the corresponding netmasks.
You can
, update, or delete RIP networks from this section.
Override Interface Configuration
You can manage interface configuration from this section.
Add RIP Networks
You can add RIP networks from this page.
1. Navigate to System > Routing > RIPand click Add in the RIP Networks section.
2. Enter network details.
IPv4 / Netmask
Specify the IPv4 address of the network and select a subnet mask from the dropdown list.
Figure 213: Add RIP Network
3. Click Save.
Override Interface Configuration
You can override default interface configurations of RIP from this page.
1. Navigate to System > Routing > RIP and click Select Interface under the Override Interface Configuration section.
2. Enter interface configuration details.
| System | 244
Interface
Select the interface for which you want to override the default configuration.
RIP Version
Send
Select the RIP version(s) to be used for sending the routing updates.
You can select V1 or V2 or both, V1 and V2. The selection overrides the version selected in the Global
Configuration settings.
The default setting is V2.
Receive
Select the RIP version to be used for receiving the routing updates.
You can select V1 or V2 or both, V1 and V2. The selection overrides the version selected in the Global
Configuration settings.
The default setting is V2 and V2.
Split Horizon
Enable to prevent the routing loops.
The default setting is disabled.
Poisoned Reverse (only applicable when Split Horizon is enabled)
Enable to prevent the device from sending packets through the route that has become invalid.
The default setting is disabled.
Authentication
Click to enable authentication of RIP packets.
If enabled, provide a password to authenticate the RIP packets.
Passive Mode
Enable to prevent the interface from sending RIP advertisements.
The default setting is disabled.
| System | 245
Figure 214: Override Interface Configuration
3. Click Save.
| System | 246
OSPF
System > Routing > OSPF
This page allows you to manage OSPF routes. You can also add, update, or delete the areas/networks/interfacespecific configuration from this page.
Open Shortest Path First (OSPF) is an interior gateway protocol that multicasts the routing information to all the hosts within a single network. It sends routing information to all the routers in the network by calculating the shortest path to each router on the basis of the structure built up by each router.
OSPF allows sets of networks to be grouped together into what is known as areas. Area is a logical division of a network. Each area maintains a separate database whose information may be summarized by the connecting router.
Hence, the topology of an area is not known to the outside world. There are three types of areas:
Backbone Area
Backbone area also known as area 0, distributes information between non-backbone areas. All other areas in the network are connected to it and the routing between areas takes place using routers which are connected to the backbone area as well as to their respective areas.
Stub Area
A stub area is an area that do not receive route advertisements external to the Autonomous System (AS), which is a collection of networks under a common network operator that share same routing policy.
NSSA
A Not-so-stubby-area (NSSA) is a type of stub area that can import AS external routes in a limited amount.
Area Border Router
An Area Border Router (ABR) is a router that connects areas to the backbone network and maintains separate routing information for each area that it is connected to. It has interfaces in more than one area with at least one interface in the backbone area.
Global Configuration
Router ID
Specify a unique router ID.
Example: 12.34.5.66.
Figure 215: Global Configuration
Advanced Settings
Default Metric
Specify the default metric value to be used for redistributed routes.
Metric is a property that contains a value used by a routing protocol to decide whether a particular route should be taken or not.
Default: 1
Acceptable Range: 1 to 16777214
ABR Type
Select the type of Area Border Router (ABR).
Available Options:
• Standard
• CISCO
• IBM
• Shortcut
Auto cost reference bandwidth (Mbits/s)
Specify the cost reference to calculate the OSPF interface cost based on bandwidth.
Default: 100 Mbits/s
Acceptable Range: 1 to 4294967
Default Information Originate
Select an option to control the distribution of the default route.
Available Options:
• Never
• Regular – On selecting Regular provide the metric and select the metric type.
• Always – On selecting Always provide the metric and select the metric type.
The default setting is Never.
Redistribute Connected
Click to enable the redistribution of connected routes into the OSPF routing table.
Specify the metric and the metric type for redistributing connected routes.
Acceptable Range: 0 to 16777214
Metric Type: External Type 1 or External Type 2.
Redistribute Static
Click to enable the redistribution of static routes into the OSPF routing table.
Specify the metric and the metric type for redistributing static routes.
Acceptable Range: 0 to 16777214
Metric Type: External Type 1 or External Type 2.
Redistribute RIP
Click to enable the redistribution of OSPF routes into OSPF routing table.
Specify the metric and the metric type for redistributing RIP routes.
Acceptable Range: 0 to 16777214
Metric Type: External Type 1 or External Type 2.
Redistribute BGP
Click to enable the redistribution of BGP routes into the OSPF routing table.
Specify the metric and the metric type for redistributing BGP routes.
Acceptable Range: 0 to 16777214
Metric Type: External Type 1 or External Type 2.
| System | 247
| System | 248
Figure 216: Advanced Settings
Click Apply.
Networks and Areas
Networks
This section lists all available OSPF networks together with the corresponding netmasks and the area they belong to.
You can
, update, or delete the OSPF networks from this section.
Areas
This section lists all available OSPF areas, specifies their types and authentication type, the area cost and, if available, virtual links.
You can
, update, or delete the OSPF areas from this section.
Override Interface Configuration
You can manage the interface configuration from this section.
Add OSPF Areas
You can add OSPF Areas from this page.
1. Navigate to System > Routing > OSPF and click Add in the Areas section.
2. Enter OSPF area details.
Area
Specify an IP address for the area.
Type
Select the type of OSPF area from the options available.
Available Options: NormalStub Stub No-SummaryNSSANSSA No-Summary
Virtual Links (Available only if Normal area type is selected)
Specify a virtual link for an area that does not have a physical connection to connect to the backbone area.
Use Add icon and Remove icon to add and remove virtual links.
Authentication
Select the type of authentication from the options available.
Available Options: TextMD5
Area Cost (Not Available for Normal area type)
Specify the area cost.
Acceptable Range: 0 to 16777215
| System | 249
Figure 217: Add OSPF Area
3. Click Save.
Add OSPF Network
You can add an OSPF network from this page.
1. Navigate to System > Routing > OSPF and click Add in the Networks section.
2. Enter the network details.
IPv4 / Netmask
Specify the IPv4 address of the network and select a subnet mask from the dropdown list.
Area
Specify an OSPF area.
Figure 218: Add OSPF Network
3. Click Save.
Override Interface Configuration
You can override default interface configurations of OSPF from this page.
1. Navigate to System > Routing > OSPF and click Select Interface in the Override Interface Configuration section.
2. Enter interface configuration details.
Interface
Select the interface to be configured for OSPF.
Hello Interval
Specify the time interval after which the interface sends hello packet to the neighbor router.
Default: 10 seconds
Acceptable Range: 1 to 65353 seconds
Dead Interval
Specify the time interval after which the interface is declared as dead.
Default: 40 seconds
Acceptable Range: 1 to 65353 seconds
Retransmit Interval
Specify the time interval for retransmitting the link state advertisements (LSA) to the interface’s neighbor.
Default: 5 seconds
Acceptable Range: 3 to 65353 seconds
Transmit Delay
Specify the time in seconds needed to transmit a link state update packet to the interface.
Default: 1 second
Acceptable Range: 1 to 65353 seconds
Interface Cost
Specify the interface cost.
You can either provide the interface cost automatically by selecting Auto or specify it manually.
Acceptable Range: 1 to 65353 seconds
Authentication
Select the type of authentication for authenticating the OSPF packets.
Available Options: Text - If Text is selected, provide a password for authentication. MD5 - If MD5 is selected, provide a key ID and a key. Key ID can be from 0 to 255.
Router Priority
Specify priority for a router.
Default: 1
Acceptable Range: 0 to 255
| System | 250
| System | 251
Figure 219: Override Interface Configuration
3. Click Save.
BGP
System > Routing > BGP
This page allows you to manage BGP routes.
Border Gateway Protocol (BGP) is a path vector protocol that contains path information, enabling the routers to share routing information so that loop-free routes can be created. This protocol is generally used by ISPs.
BGP selects a single path from the multiple advertisements received from multiple sources for the same route. When the path is selected, BGP puts it in the IP routing table and passes the path to its neighbor.
Global Configuration
Router ID
Specify router ID for BGP.
Example: 12.34.5.66.
Local AS
Specify Local Autonomous System (AS) number.
Acceptable Range: 1 to 4294967295
Figure 220: Global Configuration
Neighbors
Neighbors are the routers between which a TCP connection is established. In this section, you can
, update, or delete neighbors.
Networks
This section list all available BGP networks togegher with their corresponding netmasks. You can
, update, or delete networks.
Add BGP Network
The Add Network page allows you to specify IPv4 Address network and subnet mask.
1. Navigate to System > Routing > BGP and click Add in the section Networks
2. Enter the network details
IPv4/Netmask
Specify the IPv4 address and select a subnet mask of the network.
| System | 252
Figure 221: Add BGP Network
3. Click Save.
Add BGP Neighbor
The Add Neighbor page allows you to add a BGP neighbor and specify an IPv4 address of the neighbor router and
AS number.
1. Navigate to System > Routing > BGP and click Add in the section Neighbors
2. Enter the neighbor details
IPv4 Address
Specify the IPv4 address of the neighbor router.
Remote AS
Specify the remote autonomous system (AS) number of the neighbor.
Acceptable Range: 1 to 4294967295
Figure 222: Add BGP Neighbor
3. Click Save.
PIM-SM
System > Routing > PIM-SM
This page allows you to configure PIM.
Protocol Independent Multicast (PIM) is a protocol for routing IP packets efficiently to multicast groups that may span throughout the Internet. PIM provides dynamic multicast support on the device. With dynamic multicast support, a host can join/leave a multicast group dynamically and there is no need to manually add/delete multicast routing entries on the device.
Note: The device supports PIM version2 and PIM-SM mode with Rendezvous Point (RP) selection method as BSR (Bootstrap Router)
PIM-SM Configuration
Enable PIM
Enable PIM to provide dynamic multicast support on the device.
PIM Enabled Interface
Select the physical interfaces on which PIM service needs to be enabled.
To enable PIM, at least one interface has to be selected.
Note:
• Only IPv4 bound interfaces can be selected.
• Alias, PPPoE and WWAN interfaces are not supported.
Figure 223: PIM-SM Configuration
RP Settings
Enable to configure Static RP or Candidate RP.
Static RP
RIP IP
Specify a unicast IP address for static RP. RPs can be added or deleted.
Maximum eight RP IP addresses per RP are allowed.
Multicast Group
Specify Multicast Group IP address or network address separated by comma that will be served by given RP.
Maximum eight multicast group addresses per RP are allowed
Use * in Multicast Group List to serve all the multicast groups by the defined RP.
| System | 253
Figure 224: Static RP Settings
Candidate RP
Candidate RP IP
Select interface IP that will be used as RP IP, if the router is selected as candidate RP.
Multicast Group List
Specify multicast group IP address or network address separated by a comma that will be served by given RP.
Maximum eight multicast group IP/network addresses are allowed.
Use * in Multicast Group List to serve all the multicast groups by the selected RP.
Candidate RP Priority
Specify the priority of the PIM router in the RP election process.
Default: 1
Acceptable Range: 1 to 255
Timer
Specify time in seconds after which at every specified time, RP candidate messages are generated.
Default: 60 seconds
Acceptable Range: 30 to 180 seconds
| System | 254
Figure 225: Candidate RP Settings
Routing Information
System > Routing > Routing Information
Administrator can view various information and status of any dynamic routes configured using RIP, OSPF, BGP and
PIM-SM protocols. This overview of the dynamic route information will be useful for further configurations and/or debugging.
RIP
Routes
Displays the entire routing configuration information and the routing table for an interface configured using the
RIP protocol.
Codes and Sub-codes
Shows how the destination routing information is obtained.
Codes
R – RIP, C – connected, S – Static, O – OSPF, B – BGP, K – Kernel route.
Sub-codes
(n) – normal, (s) – static, (d) – default, (r) – redistribute, (i) – interface
Network
Specifies the IP address and subnet mask of the destination.
Next Hop
Specifies an IP address of the next hop routing device.
Metric
Specifies the number of routing devices (hop count) a packet must pass through to reach the final destination.
From
Indicates the router (router IP address) from which the metric is calculated to reach the destination.
If it is directly connected it will show self.
Tag
Indicates the method used for distinguishing between internal routes (learned by RIP) and external routes learned from External Gateway Protocol (ERP) protocols.
0 indicates no tag is attached to the route.
Time
Indicates the elapsed time after which the routing entry will be flushed from the RIP table.
Status
Displays the RIP routing protocol process parameters and statistics.
Routing Protocol is "rip"
Indicates the routing protocol used.
Sending updates
Indicates the time between sending updates.
Next due
Specifies when the next update is due to be sent.
Timeout after
Indicates the timeout interval for RIP route after which it is declared invalid and removed from the routing table until the garbage-collect time expires.
Garbage collect
Indicates the time period during which the route metric is set to 16. If no updates are received for the route before the expiry of the garbage-collect timer, a route with metric 16 is deleted from the routing table.
Outgoing update
Indicates whether the outgoing filtering list has been set.
Incoming update
Indicates whether the incoming filtering list has been set.
Default redistribution metric
Metric of routes that are redistributed from other routes.
Redistributing
Indicates the information about redistribution of other protocols.
Default version control
Indicates the version of RIP packet that are sent and received.
Interface
Shows a RIP-enabled routing interface
Send
Displays the version of RIP packets sent out to the routing interface. The version is one of the following:
RIP1, RIP2
Recv
Displays the version of RIP packets accepted on the routing interface. The version is one of the following:
RIP1, RIP2 , Both
Key-chain
Displayed the authentication key-chain name for the interface, if it is configured.
Routing for Network
Indicates the networks for which the routing process is currently injecting routes.
Routing Information Sources
Indicates the routing sources used to build the routing table. For each source, the following information is displayed.
| System | 255
Gateway
Indicates an IP address of the next hop routing device.
Bad Packets
Indicates the number of bad packets received by the router.
Bad Routes
Indicates the number of invalid routes from the router.
Distance Last Update
Indicates the time when the administrative distance was last updated.
Distance
Indicates the administrative distance. The distance displayed by default is 120
OSPF
Border Routers
Displays the information about the internal OSPF routing table entries to an Area Border Router (ABR) and
Autonomous System Boundary Router (ASBR).
R
Indicates that the information for the route is provided to a particular border router.
Network IP Address
Indicates the router ID of the destination.
Metric
Specifies the cost to reach the final destination.
Area
Indicates the area identifier of the outgoing interface.
Next Hop
Specifies the management IP address of the next hop routing device.
Outgoing Interface
Routes
Indicates the name and IP address of the outgoing interface to reach the destination.
Displays the information about the internal OSPF routing table entries.
N
Indicates that the information is provided for a network.
Network IP Address
Indicates the router ID of the destination.
Metric
Specifies the cost to reach the final destination.
Area
Indicates the area identifier of the outgoing interface.
Next Hop
Specifies the management IP address of the next hop routing device.
Directly attached
Indicates a network is directly connected to the interface.
Outgoing Interface
Indicates the name and IP address of the outgoing interface to reach the destination.
| System | 256
| System | 257
Database
Database shows the list of information related to the OSPF database summary for a specific router. Each linkstate database includes link-state an advertisement from throughout the areas to which the router is attached.
Link ID
Indicates the ID of the link-state advertisement using which a router learns the route. In other words, while a link-state advertisement describes a router, the link-state ID router’s OSPF router ID.
The link-state advertisement describing a network can have one of the following two formats of link-state ID: the network's IP address or an address generated using the link-state ID.
ADV Router
Age
Indicates the advertising router ID of the destination.
Indicates the time, in seconds, since the LSA was generated.
Seq#
Link state sequence number (detects old or duplicate link-state advertisements).
CkSum
Checksum of the complete content of the link-state advertisement.
Link count
Number of interfaces detected for the router.
Net Link States
Gives information about network LSA originated by DR (designated router)
Router Link States
Gives information about router LSA originated by every router.
Summary Net Link States
Indicates the information about summary LSA originated by ABR’s.
Neighbors (ARP - NDP)
Provides neighbor information based on peer-interface relation.
Neighbor ID
Pri
Indicates the neighbor router’s ID.
Indicates the router priority assigned to that neighbor.
State
Displays the conversation between router and neighbor since the neighbor was created. It can have one of the following values:
Down
Indicates the initial state of a neighbor conversation, that is, there has been no recent information received from the neighbor.
Attempt
Init
Valid only for neighbors attached to non-broadcast networks. Indicates that there has been no recent information received from the neighbor.
Indicates a hello packet has been received recently from a neighbor although the adjacency is not two-way, that is, a bi-directional communication has not yet been established with neighbor.
2-Way
Indicates that a bi-directional communication is established between the routers and the neighbor has included the router ID in its Hello message. The DR and BDR are elected from the set of neighbors in 2way state or higher.
| System | 258
ExStart
Indicates that the two routers are going to synchronize and determine which router will be master and which the slave.
Exchange
Indicates that the two routers are describing their respective link-state database by sending database description packets.
Loading
Full
Indicates that link-state request packets are sent to the neighbor, requesting for more advertisements that have been discovered but are not yet received in Exchange state.
Indicates that both routers have accomplished the exchange of all the relevant advertisements and can now appear in router-link and neighbor-link advertisements.
Backup
Indicates that the neighbor is a backup designated router
Dead time
The waiting time in seconds to receive a hello message from OSPF neighbor before assuming the neighbor is dead.
Address
Specifies the IP address of the router’s interface with the neighbor.
Interface
Indicates the IP address of neighbor interface
RXmtL
Indicates the link-state retransmit count.
RqstL
Indicates the link-state request count.
DBsmL
Indicates the link-state summary count.
Interface
Displays OSPF interface information.
Interface Value
Indicates the status of the physical interface, that is, whether the interface is up or down.
IfIndex
Indicates the value of interface index (IfIndex). It is an identification unique number associated with an interface.
MTU
BW
Indicates the Maximum Transmission Unit (MTU) value of the interface.
MTU is the largest physical packet size, in bytes, that a network can transmit. This parameter becomes an issue when networks are interconnected and the networks have different MTU sizes. Any packets larger than the MTU value are divided (fragmented) into smaller packets before being sent.
Indicates the bandwidth of the interface.
Internet Address
Displays the IP address of the interface.
Network Type/IP Address
Indicates the type of the network along with the IP address.
| System | 259
Area
Indicates the IP address of the area identifier.
MTU mismatch detection
Indicates whether the MTU mismatch detection is enabled or disabled. If it is enabled, it would match the
MTU of both the interfaces participating in neighborship establishment.
Router ID
Indicates the identification number of the OSPF router selected at the start of the OSPF process. The router ID is unique within the OSPF domain and does not change unless OSPF restarts or is manually modified.
Network Type
Indicates the type of network to which the OSPF interface is connected. A network can be one of the following types:
Point-to-point
A point-to-point network can connect only two routers.
Point-to-Multipoint (non-broadcast)
A point-to-multipoint network connects one router to several other routers.
Broadcast
Indicates a network that supports broadcast. In a broadcast network a single packet sent (broadcasted) by a router is received by all the routers within the network.
Non Broadcast Multiple Access (NBMA)
Indicates that the network does not have the capability to broadcast or multicast. It is used to accurate model X.25 and frame-relay environment in multiple-access network.
Cost
Displays the OSPF metric. It is calculated using formula: 10
8
/ bandwidth (in bits per seconds [bps]) where
• 10
8
: is the reference bandwidth
• bandwidth: is the bandwidth of the interface in bps
Transmit delay
Indicates the time in seconds which the OSPF router waits before flooding a link-state advertisement (LSA) over the link. The link state age is incremented by this value, before transmitting an LSA.
The default value of transmit delay is 1 second.
State
Indicates the current state of the specified interface. The state can be one of the following:
DR
The router is a designated router (DR) on the network.
BDR
The router is a backup designated router (BDR) on the network.
DROTHER
The router is neither a DR nor a BDR on the network and it establishes adjacencies only with the DR and the BDR.
Waiting
The interface router is in waiting to announce the state of the link as DR.
Note: This state is normal in case of non broadcast multi access network.
Point-to-Point
The interface in point-to-point state is fully functional and starts exchanging hello packets with all its neighbors.
| System | 260
Point-to-Multipoint
Indicates the interface to be point-to multipoint for OSPF.
Priority
Indicates the priority of the interface router. It assists in electing the DR and BDR on the network to which the interface is connected.
Default: 1
Note: A router with priority value 0 can never be a DR/BDR.
Designated Router ID
Indicates the DR router ID for the respective network.
Backup Designated Router ID
Indicates the BDR router ID for the respective network
Saved Network-LSA sequence number
Indicates the network's link-state sequence number. It is used to calculate shortest path first (SPF).
Multicast group membership
Indicates the multicast group in which the router is a member.
Timer intervals configured
Displays the value of following OSPF timers:
Hello
Time interval in seconds that a router sends a hello packet.
Dead
Indicates the waiting time in seconds before declaring a neighbor dead.
Wait
Displays the time interval that leads the interface to terminate the waiting period and elect the DR on the network.
Retransmit
Displays the waiting time before re-transmitting a database description (DBD) packet if it has not been acknowledged earlier.
Hello Due In
Specifies when the next hello packet is due to be sent.
Neighbor Count
Indicates the total number of discovered neighbors on the interface.
Adjacent neighbor count
Indicates the total number of adjacent neighbors that are fully adjacent to the interface.
BGP
Neighbors (ARP - NDP)
Displays the information about the BGP and its peer connections and shows the number of routes advertised/ neighbors to/from that peer.
BGP Neighbor
Indicates the IP address of the BGP neighbor.
Remote AS
Indicates the AS number of the neighbor router.
Local AS
Indicates the value of the configured local autonomous systems (AS).
| System | 261
Internal/External Link
Displays internal links for internal BGP (iBGP) neighbors and external link for external BGP (eBGP).
BGP Version
Indicates BGP version used for communication with remote router.
Remote Router ID
Indicates router ID of the neighbor router.
BGP State
Indicates the finite state machine (FSM) stage. It describes what action should be taken by the BGP routing engine and when for session negotiation.
Last Read
Displays the time, since BGP router last received a message from the neighbor. The time is displayed in
HH:MM:SS format.
Hold Time
Displays the time in seconds, until which the BGP will maintain the session with the neighbor without receiving any message from it.
Keepalive Interval
Displays the time interval in seconds specifying how often the BGP router sends the keep-alive message to the neighbor.
Message Statistics
Displays the statistics organized by message type.
InQ
Indicates the number of messages that are in queue, pending to be processed from the neighbor.
OutQ
Indicates the number of messages that are in queue, pending to be sent to the neighbor.
Sent
Indicates the number of messages sent to the neighbor.
Received
Indicates the number of messages received from the neighbor.
Opens
Indicates the total number of open messages sent and received.
Notifications
Indicates the total number of error notification messages sent and received.
Updates
Indicates the total number of update messages sent and received.
Keepalives
Indicates the total number of keep-alive messages sent and received.
Route Refresh
Indicates the total number of route refresh messages sent and received.
Capability
Indicates the total number of BGP capabilities advertised and received from the neighbor.
Total
Indicates the total number of messages sent and received.
Minimum Time between advertisement runs
Displays the time in seconds between the sent advertisements.
| System | 262
For Address Family
Indicates the IP address family.
Community attribute sent to this neighbor
Indicates the numerical value of the BGP community.
This numerical value is assigned to a specific prefix and advertised to the neighbor, based on which it decides whether to filter or modify attributes.
Accepted Prefix
Indicates the number of accepted prefixes that can participate in a BGP peer session.
Connections established
Indicates the number of times a TCP and a BGP connection has been established successfully.
Dropped
Indicates the number of times a valid session failed or has been taken down.
Last reset
Displays the time since when the previously established session with the neighbor ended.
Local host and Local port
Displays the IP address and port number of the local BGP router.
Foreign host and Foreign port
Displays the IP address of neighbor and BGP destination port number.
Next hop
Indicates the management IP address of the next hop routing device.
Next connect timer due in
Specifies when the next hello packet is due to be sent to the BGP neighbor.
Read Thread
Indicates if the read thread is ON or Off.
Write Thread
Routes
Indicates if the write thread is ON or Off.
Displays the entire routing configuration information and the routing table for an interface configured using the
BGP protocol.
BGP Table Version
Indicates the table version number. The version number is updated with any change in the BGP table.
Local Router ID
Indicates the IP address of the router.
Status codes and Origin codes
Shows how the destination routing information is obtained.
Status Codes: A Status code indicates the status of the table entry and is displayed at the beginning of each line in the table. Status code value can be one of the following: s – suppressed, d –damped, h – history, * – valid, > – best, i – internal, r – Routing Information Base (RIB)failure, S – Stale, R – Removed.
Origin codes: An Origin code indicates the origin of the entry and is displayed at the end of each line in the table. Origin code value can be one of the following: i – Interior Gateway Protocol (IGP), e – Exterior Gateway Protocol (EGP), ? – incomplete/path not clear.
Network
Indicates the IP address and subnet mask of the destination.
Next Hop
Indicates the management IP address of the next hop routing device.
0.0.0.0 indicates the router has noon-BGP routes to the network.
Metric
Indicates the value of inter autonomous system metric.
LocPrf
Indicates the local preference value.
Local preference is one of the methods to change the path taken by one autonomous system (AS) to reach to another AS.
Local preference value indicates to AS about the path that has local preference, and one with the highest preference being preferred.
Weight
Indicates the route weight as set via autonomous system filters. If more than one path exists to a particular IP address, then the path with the highest weight is selected.
Path
Indicates the autonomous system path to the destination network.
Total number of prefixes
Indicates the total number of prefixes/networks.
Summary
Displays the status of all the BGP connections details such as path, prefixes and attributes information about all the connections to BGP neighbors.
BGP Router Identifier
Indicates the router ID of the BGP router
Local AS Number
Indicates the local autonomous system number to which this router belongs.
RIB entries
Indicates the number of routing information entries in RIB
Memory
Indicates the memory used by RIB entry/ies.
Peer
Indicates the number of neighbors with which the connection is established.
Memory
Indicates the memory used by neighbor entries.
Neighbor
Indicates the IP address of the neighbor.
V
Indicates BGP version number provided to the neighbor.
LocPrf
Indicates local preference value.
Local preference is one of the methods to change the path taken by one autonomous system (AS) to reach to another AS.
Local preference value indicates to AS about the path that has local preference, and one with the highest preference being preferred.
AS
Indicates the autonomous system number.
MsgRcvd
Indicates the number of messages received from the neighbor.
| System | 263
| System | 264
MsgSent
Indicates the number of messages sent to the neighbor.
TblVer
InQ
Indicates the last version of the BGP database that was sent to the neighbor.
Indicates the number of messages that are in queue, pending to be processed from the neighbor.
OutQ
Indicates the number of messages that are in queue, pending to be sent to the neighbor.
Up/Down
Indicates the total time of a BGP session to remain in established state, or gives the current status of BGP session, if it is not in established state.
State/PfxRcd
Indicates the state of the neighbor and the number of prefixes received.
Total number of neighbors
Indicates the total number of neighbors.
PIM-SM
Interface Table
Displays all the PIM enabled interfaces and the neighbor information of each interface.
Multicasting Routing Table
Displays the information of the multicast groups joined. The information includes the source address, multicast group address, the incoming interface from which packets are accepted, list of outgoing interfaces to which packets are sent, PIM timers, flag bits etc.
RP SET
Displays RP set information which is a collection of group-to-RP mappings. This information is used to determine the RP for a multicast group and is maintained by a PIM router.
VPN
VPN section allows you to configure required IPsec, L2TP, PPTP and SSL VPN connections and connections with a
CISCO
™
VPN Client. Also, the section allows certificate and bookmark management required in the configured VPN connections.
A virtual private network (VPN) is a tunnel that carries private network traffic from one endpoint system to another over a public network such as the Internet without the traffic, being aware that there are intermediate hops between the endpoints or the intermediate hops being aware they are carrying the network packets that are traversing the tunnel. The tunnel may optionally compress and/or encrypt the data, providing enhanced performance and some measure of security. VPN allows you to pretend you are using a leased line or a direct telephone call to communicate between the endpoints. VPNs allow users and telecommuters to connect to their corporate intranets or extranets.
VPNs are cost-effective because users can connect to the Internet locally and tunnel back to connect to corporate resources. This not only reduces overhead costs associated with traditional remote access methods, but also improves flexibility and scalability. For all business people traveling or working from home, connecting securely to the corporate network is essential. With the device, setting up a VPN is almost effortless.
The two endpoints in deevice VPN are referred to as:
• Local - First endpoint is the local machine itself.
• Remote - Second endpoint is the remote peer - the machine you are trying to establish a VPN connection to, or the machine which is trying to establish a VPN connection with you.
Device VPN automatically encrypts the data and sends it to the remote site over the Internet, where it is automatically decrypted and forwarded to the intended destination. By encrypting, the integrity and confidentiality of data is
| System | 265 protected even when transmitted over the un-trusted public network. Device uses IPsec standard i.e. IPsec protocol to protect traffic. In IPsec, the identity of communicating users is checked with the user authentication based on digital certificates, public keys or preshared keys.
Device ensures that all the VPN traffic passing through the VPN tunnels is threat free. All the firewall rules and policies are applicable to the traffic going into the VPN tunnels and coming out of the VPN tunnels. Device inspects all the traffic passing through the VPN tunnels and makes sure that there are no viruses, worms, spam, and inappropriate content or intrusion attempts in the VPN traffic. As VPN traffic is by default subjected to the DoS inspection, the device provides a facility by which one can bypass scanning of traffic coming from certain hosts from a VPN zone. The above functionality is achieved by adding one additional zone called VPN zone. VPN traffic passes through the VPN zone and a firewall rule can be applied to the VPN zone.
Device can be used to establish VPN connection between sites, LAN-to-LAN and client-to-LAN connection. VPN is the bridge between local & remote networks/subnets.
Device supports following protocols to authenticate and encrypt traffic:
• Internet Protocol Security (IPsec)
• Layer Two Tunneling Protocol (L2TP)
• Point-to-Point Tunneling Protocol (PPTP)
• Secure Socket Layer (SSL)
IPsec
IPsec page allows you to create and manage IPsec Connections and Failover Groups.
This page contains two (2) sections:
1.
2.
IP Security (IPsec) is a suite of protocols designed for cryptographically secure communication at the IP layer (layer
3).
IPsec protocols:
• Authentication Header (AH) – Used for the authentication of packet senders and for ensuring the integrity of packet data. The authentication header protocol (AH) checks the authenticity and integrity of packet data.
In addition, it checks that the sender and receiver IP addresses have not been changed in transmission. Packets are authenticated using a checksum created by using a hash-based message authentication code (HMAC) in connection with a key.
• Encapsulating Security Payload (ESP) – Used for encrypting the entire packet and for authenticating its contents. In addition to encryption, the ESP offers the ability to authenticate senders and verify packet contents.
IPsec Connections
The IPsec Connections page displays a list of all the IPsec connections. You can filter the list based on name, group name, policy name, connection type, and status of the connection. The page also provides the option to add a new connection, update the parameters of the existing policy, or delete a policy. The page also provides the option to create a connection manually or through the connection wizard. In case of a remote access connection export the connection configuration by clicking the Export icon under the Manage column.
Note: You can also view and manage active IPsec connections on the System > Current Activity > IPsec
Connections page.
The page displays status of each connection as follows:
Connection Status
Active Connection
Description
Connection is active but not connected. Click to initiate the connection.
| System | 266
Connection Status Description
Connection is active and connected. Click to disconnect the connection.
When you disconnect, connection will be deactivated and to re-establish the connection, activate connection.
Connection is active but partially connected. Click to disconnect the connection. When multiple subnets are configured for LAN and/or remote network, Device creates sub-connection for each subnet. This status indicates that one of the sub-connections is not active.
Connection is deactive. Click to activate the connection.
Failover Group
Connection Failover
Connection Failover is a feature that enables you to provide an automatic backup connection for VPN traffic and provide “Always ON” VPN connectivity for IPsec connection. If the primary connection fails, the subsequent connection in the group will take over without manual intervention and keep traffic moving. The entire process is transparent to users.
Connection Failback
During a connection failure, the device checks the health of a primary connection every 60 seconds. When the primary connection is restored without the administrator’s intervention, the secondary connection fails back to the primary connection.
Connection Failover Group
To configure connection failover, you have to:
• Create connections.
• Create a failover group. A failover group is created by grouping all the connections that are to be used for failover.
The order of connections in the group defines the failover priority of the connection.
• Define a failover condition.
A VPN group is a grouping of IPsec connections. The phase 1 and phase 2 security parameters for each connection in a group can be different or identical except for the IP address of the remote gateway. The order of connections in the group defines the failover priority of the connection. Failover to the next connection will not occur if the group is manually deactivated.
The failover group containing the connection must be activated for the first time before participating in the failover.
Failover to the next connection will not occur if the group is manually disconnected.
When the primary connection fails, the subsequent active connection in the group takes over without manual intervention and keeps traffic moving. For example, if the connection established using the 4th connection in the group is lost then the 5th connection will take over. Once the 4th connection is re-stored, the 5th connection will automatically fail back on the 4th connection.
The device considers a Site to Site and Host to Host connection as failed connection if the remote peer does not reply.
Connections that are not a part of the connection group do not participate in failover/failback process and such connections will not be re-established automatically if lost.
Prerequisites
• Packets of the protocol specified in the failover condition must be allowed from local server to remote server and its reply on both local and remote server
• One connection can be member of single group only
• Connection must be ACTIVE to participate in failover
Behavior
| System | 267
1. Once the connection is added as a member of the group, DPD is configured as “Disable”, Key Negotiation Tries as 3, and Action on VPN Restart as “Disable”.
2. Once the connection is removed from the group, the original policy and connection configuration will be considered.
3. If the connection is already established at the time of adding it in the failover group, it will get disconnected.
4. On factory reset, failover configuration will not be retained.
The Failover Group section displays list of groups created. You can filter or sort the groups based on group name.
You can add a new failover group, update, or delete the group. The list additionally displays the status of the group as:
indicates activate while indicates deactive group.
IPsec
The IPsec allows you to set up an IPsec connection and control the connection behaviour.
System > VPN > IPsec
In order to set-up the connection, you must select the connection type. Th device supports the following IPsec connections types:
•
– This type of VPN is a user-to-internal network connection via a public or shared network. Many
large companies have employees that need to connect to the internal network from the field. These field agents access the internal network by using remote computers and laptops without a static IP address.
•
– A Site to Site VPN connects an entire network (such as a LAN or WAN) to a remote network via a
network-to-network connection. A network-to-network connection requires routers on each side of the connecting networks to transparently process and route information from one node on a LAN to another node on a remote
LAN.
•
– Host to Host VPN connects one desktop or workstation to another by way of a host-to-host connection. This type of connection uses the network to which each host is connected to create a secure tunnel with each other.
Select to
•
Add IPsec Remote Access Connection
•
Add IPsec Site to Site Connection
•
Add IPsec Host to Host Connection
on page 272
Add IPsec Remote Access Connection
This page describes how you can create an IPsec remote access connection.
1. Navigate to System > VPN > IPsec and click Add in the section General Settings. In the field Connection Type select Remote Access.
2. Enter details for the general settings.
Name
Specify a unique name to identify the IPsec connection.
Description
Provide a description for the IPsec VPN connection.
Connection Type
Select Remote Access.
Policy
Select the policy to be used for connection.
Policy can also be added by clicking on Create New link.
Action on VPN Restart
Select the action to be taken on the connection when VPN services or the device restarts.
Available OptionsRespond Only: Keeps connection ready to respond to any incoming request. Disable:
Keeps connection disabled till the user activates.
| System | 268
3. Enter the authentication details.
Authentication Type
Select the authentication type. Authentication of the user depends on the type of connection.
Available Options:Preshared Key
Preshared Key authentication is a mechanism whereby a single key is used for encryption and decryption.
Both the peers should possess the preshared key. Remote peer uses the preshared key for decryption. On selecting this option the user shall require to provide the following details:
• Preshared Key – Specify the preshared key to be used. Preshared key should be of minimum 5 characters.
• Confirm Preshared Key – Provide the same preshared key to confirm it.
This preshared key will have to be shared or communicated to the peer at the remote end. At the remote end, the client will have to specify this key for authentication.
If there is a mismatch in the key, user will not be able to establish the connection.
Digital Certificate
Digital certificate authentication is a mechanism whereby sender and receiver both use a digital certificate issued by the certificate authority. Both sender and receiver must have each other’s certificate authority.
Local Certificate – Select the local certificate that should be used for authentication by the device.
Remote Certificate – Select the remote certificate that should be used for authentication by remote peer.
4. Enter the endpoint details.
Local
Select local WAN port from the list.
IP aliases created for WAN interfaces will be listed along with the default WAN interfaces.
Remote
Specify an IP address or domain name of the remote peer.
5. Enter the network details.
IP Family
IP family will be enabled automatically according to the IP selected in local WAN port.
Local Subnet
Select local LAN address.
Add and remove LAN address using Add button and Remove button.
Local ID
For preshared key, select any type of ID from the available options and specify its value.
Available Options: DNSIP AddressEmail Address DER ASN1 DN(X.509)
Note: In case of Local Certificate, the ID and its value are displayed automatically as specified in the certificate.
Allow NAT Traversal
Enable NAT traversal if a NAT device is located between your VPN endpoints i.e. when the remote peer has private/non-routable IP address.
At a time only one connection can be established behind one NAT box.
Remote LAN Network
Select IP hosts from the list of available IP hosts. You can also add a new IP host and include it in the list by clicking on Add New Item.
Remote ID
For preshared key, select any type of ID from the available options and specify its value.
Available Options: DNSIP AddressEmail Address
| System | 269
DER ASN1 DN(X.509)
Note: In case of Local Certificate, the ID and its value are displayed automatically as specified in the certificate.
6. Enter details for user authentication.
User Authentication Mode
Select whether user authentication is required at the time of connection or not from the available options.
Available Options:Disabled: Click if user authentication is not required. Enable as Client: If enabled as client, specify username and password.Enable as Server: If enabled as server, add all the users which are to be allowed to connect.
7. Enter details for quick mode selectors.
Protocol
Select all the protocols that are to be allowed for negotiations.
Tunnel will pass only that data which uses the specified protocol.
Available Options:AllICMPUDPTCP
Local Port
Specify local port number that the local VPN peer uses to transport the traffic related to TCP or UDP protocol.
Local port range: 1 – 65535
To specify any local port, enter *.
Remote Port
Specify remote port number that the remote VPN peer uses to transport the traffic related to TCP or UDP protocol.
Local port range: 1 – 65535
To specify any local port, enter *.
8. Enter details for advanced settings.
Disconnect when tunnel is idle
Click this option to allow the device to delete an idle VPN session if it exceeds the specified idle session time interval.
The default setting is disabled.
Idle session time interval (Only available if Disconnect when tunnel is idle option is Enabled)
Specify the time limit after which an idle VPN session will be deleted by the device.
Acceptable Range: 120 to 999
9. Click Save.
The IPsec connection has been created and appears on the IPsec page with the connection type Remote Access.
Add IPsec Site to Site Connection
This page describes how you can create an IPsec Site to Site connection.
1. Navigate to System > VPN > IPsec and click Add in the section General Settings. In the field Connection Type select Site to Site.
2. Enter the details for the general settings.
Name
Specify a unique name to identify the IPsec connection.
Description
Provide a description for the IPsec VPN connection.
| System | 270
Connection Type
Select Site to Site.
Policy
Select the policy to be used for connection.
Policy can also be added by clicking on Create New link.
Action on VPN Restart
Select the action to be taken on the connection when VPN services or the device restarts.
Available OptionsRespond Only: Keeps connection ready to respond to any incoming request. Disable:
Keeps connection disabled till the user activates.Initiate: Activates connection on system/service start so that the connection can be established whenever required.
3. Enter the authentication details.
Authentication Type
Select the authentication type. Authentication of the user depends on the type of connection.
Available Options:Preshared Key
Preshared Key authentication is a mechanism whereby a single key is used for encryption and decryption.
Both the peers should possess the preshared key. Remote peer uses the preshared key for decryption. On selecting this option the user shall require to provide the following details:
• Preshared Key – Specify the preshared key to be used. Preshared key should be of minimum 5 characters.
• Confirm Preshared Key – Provide the same preshared key to confirm it.
This preshared key will have to be shared or communicated to the peer at the remote end. At the remote end, the client will have to specify this key for authentication.
If there is a mismatch in the key, user will not be able to establish the connection.
Digital Certificate
Digital certificate authentication is a mechanism whereby sender and receiver both use a digital certificate issued by the certificate authority. Both sender and receiver must have each other’s certificate authority.
Local Certificate – Select the local certificate that should be used for authentication by the device.
Remote Certificate – Select the remote certificate that should be used for authentication by remote peer.
RSA Key
RSA Key authentication is a mechanism whereby two keys – local and remote RSA - are used for encryption and decryption.
Local RSA Key – It is known only to the owner and never transmitted over network. Displays automatically generated key which cannot be modified.
Remote RSA Key – It can be regenerated from CLI console. Refer to the console guide for more details.
4. Enter the endpoint details.
Local
Select local WAN port from the list.
IP aliases created for WAN interfaces will be listed along with the default WAN interfaces.
Remote
Specify an IP address or domain name of the remote peer.
Click Add icon next to the option field to add new endpoint pairs or click Remove icon to remove the endpoint pairs.
For any new endpoint pair, specify a failover group name and define the failover condition.
5. Enter the network details.
IP Family
Select IP family to configure IPsec VPN tunnels with mixed IP families.
Available Options:IPv4IPv6
By default, IPv4 will be selected.
Four types of IPsec VPN tunnels can be created:
4 in 4 (IPv4 subnets with IPv4 gateway)6 in 6 (IPv6 subnets with IPv6 gateway)4 in 6 (IPv4 subnets with
IPv6 gateway)6 in 4 (IPv6 subnets with IPv4 gateway)
Local Subnet
Select local LAN address.
Add and remove LAN address using Add button and Remove button.
Local ID
For preshared key and RSA Key, select any type of ID from the available options and specify its value.
Available Options: DNSIP AddressEmail Address DER ASN1 DN(X.509)
Note: In case of Local Certificate, the ID and its value are displayed automatically as specified in the certificate.
Allow NAT Traversal
Enable NAT traversal if a NAT device is located between your VPN endpoints i.e. when the remote peer has private/non-routable IP address.
At a time only one connection can be established behind one NAT box.
Remote LAN Network
Select IP hosts from the list of available IP hosts. You can also add a new IP host and include it in the list by clicking on Add New Item.
Remote ID
For preshared key and RSA Key, select any type of ID from the available options and specify its value.
Available Options: DNSIP AddressEmail Address
DER ASN1 DN(X.509)
Note: In case of Local Certificate, the ID and its value are displayed automatically as specified in the certificate.
6. Enter details for user authentication.
User Authentication Mode
Select whether user authentication is required at the time of connection or not from the available options.
Available Options:Disabled: Click if user authentication is not required. Enable as Client: If enabled as client, specify username and password.Enable as Server: If enabled as server, add all the users which are to be allowed to connect.
7. Enter details for quick mode selectors.
Protocol
Select all the protocols that are to be allowed for negotiations.
Tunnel will pass only that data which uses the specified protocol.
Available Options:AllICMPUDPTCP
Local Port
Specify local port number that the local VPN peer uses to transport the traffic related to TCP or UDP protocol.
Local port range: 1 – 65535
To specify any local port, enter *.
| System | 271
| System | 272
Remote Port
Specify remote port number that the remote VPN peer uses to transport the traffic related to TCP or UDP protocol.
Local port range: 1 – 65535
To specify any local port, enter *.
8. Enter details for advanced settings.
Disconnect when tunnel is idle
Click this option to allow the device to delete an idle VPN session if it exceeds the specified idle session time interval.
The default setting is disabled.
Idle session time interval (Only available if Disconnect when tunnel is idle option is Enabled)
Specify the time limit after which an idle VPN session will be deleted by the device.
Acceptable Range: 120 to 999
9. Click Save.
The IPsec connection has been created and appears on the IPsec page with the connection type Site to Site.
Add IPsec Host to Host Connection
This page describes how you can create an IPsec Host to Host connection
1. Navigate to System > VPN > IPsec and click Add in the section General Settings. In the field Connection Type select Host to Host.
2. Enter the details for the general settings.
Name
Specify a unique name to identify the IPsec connection.
Description
Provide a description for the IPsec VPN connection.
Connection Type
Select Host to Host.
Policy
Select the policy to be used for connection.
Policy can also be added by clicking on Create New link.
Action on VPN Restart
Select the action to be taken on the connection when VPN services or the device restarts.
Available OptionsRespond Only: Keeps connection ready to respond to any incoming request. Disable:
Keeps connection disabled till the user activates.Initiate: Activates connection on system/service start so that the connection can be established whenever required.
3. Enter the authentication details.
Authentication Type
Select the authentication type. Authentication of the user depends on the type of connection.
Available Options:Preshared Key
Preshared Key authentication is a mechanism whereby a single key is used for encryption and decryption.
Both the peers should possess the preshared key. Remote peer uses the preshared key for decryption. On selecting this option the user shall require to provide the following details:
• Preshared Key – Specify the preshared key to be used. Preshared key should be of minimum 5 characters.
• Confirm Preshared Key – Provide the same preshared key to confirm it.
This preshared key will have to be shared or communicated to the peer at the remote end. At the remote end, the client will have to specify this key for authentication.
| System | 273
If there is a mismatch in the key, user will not be able to establish the connection.
Digital Certificate
Digital certificate authentication is a mechanism whereby sender and receiver both use a digital certificate issued by the certificate authority. Both sender and receiver must have each other’s certificate authority.
Local Certificate – Select the local certificate that should be used for authentication by the device.
Remote Certificate – Select the remote certificate that should be used for authentication by remote peer.
RSA Key
RSA Key authentication is a mechanism whereby two keys – local and remote RSA - are used for encryption and decryption.
Local RSA Key – It is known only to the owner and never transmitted over network. Displays automatically generated key which cannot be modified.
Remote RSA Key – It can be regenerated from CLI console. Refer to the console guide for more details.
4. Enter the endpoint details.
Local
Select local WAN port from the list.
IP aliases created for WAN interfaces will be listed along with the default WAN interfaces.
Remote
Specify an IP address or domain name of the remote peer.
Click Add icon next to the option field to add new endpoint pairs or click Remove icon to remove the endpoint pairs.
For any new endpoint pair, specify a failover group name and define the failover condition.
5. Enter the network details.
IP Family
Select IP family to configure IPsec VPN tunnels with mixed IP families.
Available Options:IPv4IPv6
By default, IPv4 will be selected.
Four types of IPsec VPN tunnels can be created:
4 in 4 (IPv4 subnets with IPv4 gateway)6 in 6 (IPv6 subnets with IPv6 gateway)4 in 6 (IPv4 subnets with
IPv6 gateway)6 in 4 (IPv6 subnets with IPv4 gateway)
Local ID
For preshared key and RSA Key, select any type of ID from the available options and specify its value.
Available Options: DNSIP AddressEmail Address DER ASN1 DN(X.509)
Note: In case of Local Certificate, the ID and its value are displayed automatically as specified in the certificate.
Allow NAT Traversal
Enable NAT traversal if a NAT device is located between your VPN endpoints i.e. when the remote peer has private/non-routable IP address.
At a time only one connection can be established behind one NAT box.
Remote LAN Network
Select IP hosts from the list of available IP hosts. You can also add a new IP host and include it in the list by clicking on Add New Item.
| System | 274
Remote ID
For preshared key and RSA Key, select any type of ID from the available options and specify its value.
Available Options: DNSIP AddressEmail Address
DER ASN1 DN(X.509)
Note: In case of Local Certificate, the ID and its value are displayed automatically as specified in the certificate.
6. Enter details for user authentication.
User Authentication Mode
Select whether user authentication is required at the time of connection or not from the available options.
Available Options:Disabled: Click if user authentication is not required. Enable as Client: If enabled as client, specify username and password.Enable as Server: If enabled as server, add all the users which are to be allowed to connect.
7. Enter details for quick mode selectors.
Protocol
Select all the protocols that are to be allowed for negotiations.
Tunnel will pass only that data which uses the specified protocol.
Available Options:AllICMPUDPTCP
Local Port
Specify local port number that the local VPN peer uses to transport the traffic related to TCP or UDP protocol.
Local port range: 1 – 65535
To specify any local port, enter *.
Remote Port
Specify remote port number that the remote VPN peer uses to transport the traffic related to TCP or UDP protocol.
Local port range: 1 – 65535
To specify any local port, enter *.
8. Enter details for advanced settings.
Disconnect when tunnel is idle
Click this option to allow the device to delete an idle VPN session if it exceeds the specified idle session time interval.
The default setting is disabled.
Idle session time interval (Only available if Disconnect when tunnel is idle option is Enabled)
Specify the time limit after which an idle VPN session will be deleted by the device.
Acceptable Range: 120 to 999
9. Click Save.
The IPsec connection has been created and appears on the IPsec page with the connection type Host to Host.
IPsec Connection Wizard
The wizard is not available if you are managing the device through Sophos Firewall Manager.
The VPN Connection Wizard takes you step-by-step through the configuration of a VPN connection on the device.
After the configuration is completed, the wizard creates a new VPN connection.
Wizard is divided into two panels – Configuration panel and Help panel. Configuration parameters are to be entered in the Configuration panel while the Help panel on left-most side provides the help on the configuration parameters.
First screen of the wizard provides an overview of the configuration steps. You can create three types of connections through wizard:
| System | 275
•
•
•
Creating Remote Access Connection Using VPN Wizard
Go to System > VPN > IPsec. Click Wizard and follow the steps given below
Specify name and description (if required) for a VPN connection and click Start. The Help panel on left-most side provides an overview of each configuration step.
On the Select a Connection Type page
1. Select the connection type Remote Access.
2. Select VPN policy to be applied to the connection traffic. Default policies as well as custom policies applicable to connection will be displayed.
3. Select action to be taken on the connection when VPN services or the device restart.
Available Options:
• Disable – Connection will be disabled till the user activates it.
• Respond Only – Connection in ready state to respond to any incoming request.
Click > icon to continue.
On the Authentication Details page
Select authentication type
Available Options:
Preshared Key
Specify the preshared key of minimum 5 characters. This preshared key will have to be shared or communicated to the peer at the remote end. At the remote end, the client will have to specify this key for authentication. Refer to the VPN client guide, Phase 1 Configuration.
If there is a mismatch in the key, the user will not be able to establish the connection.
Digital Certificate
Select local certificate that should be used for authentication by the device.
Select remote certificate that should be used for authentication by the remote peer.
Click > to continue.
On the Local Network Details page
Select local WAN port. Selected port acts as an end-point of the tunnel.
Select local subnet. Select the local network(s) you wish to give access to remote users via this connection.
Select local ID.
For Preshared Key and Digital Certificate, select any type of ID and enter its value. DER ASN1 DN (X.509) is not applicable.
For Local Certificate, the ID and its value configured in the local certificate are displayed automatically.
Click > to continue.
On the Remote Network Details page
In the Remote VPN Server field specify IP address or host name of the remote end-point.
To specify any IP address, enter *.
Enable NAT traversal if a NAT device exists between your VPN endpoints i.e. when remote peer has private/nonroutable IP address.
| System | 276
Select Remote Subnet. Select the remote network(s) that you wish to access via this connection. This option will be available only if NAT traversal is enabled.
Select Remote ID.
For Preshared Key and Digital Certificate, select any type of ID and enter its value. DER ASN1 DN (X.509) is not applicable.
In case of Local Certificate, the ID and its value configured in the local certificate are displayed automatically.
Click > to continue.
On the User Authentication page
Select User Authentication Mode.
Available Options:
• Disabled – Choose if authentication is not required.
• Enable as Client – Enter username and password for authentication by the remote gateway.
• Enable as Server – Select all the users that are to be allowed to connect.
Click > to continue.
On the IPsec Connection Summary page
The page displays the settings with which the IPsec connection will be created.
Click Finish to create the IPsec connection or click < to go back to the previous page and change the settings.
Creating Site to Site Connection using VPN Wizard
Go to System > VPN > IPsec. Click Wizard and follow the steps given below:
Specify name and description (if required) for a VPN connection and click Start. The Help panel on left-most side provides an overview of each configuration step.
On the Select a Connection Type page
1. Select the connection type Site to Site.
2. Select VPN policy to be applied to the connection traffic. Default policies as well as custom policies applicable to connection will be displayed.
3. Select action to be taken on the connection when VPN services or the device restart.
Available Options:
• Disable – Connection will be disabled till the user activates it.
• Respond Only – Connection in ready state to respond to any incoming request.
• Initiate – Initiate to establish the connection every time VPN services or the evice restart
Click > icon to continue.
On the Authentication Details page
Select authentication type
Available Options:
Preshared Key
Specify the preshared key of minimum 5 characters. This preshared key will have to be shared or communicated to the peer at the remote end. At the remote end, the client will have to specify this key for authentication. Refer to the VPN client guide, Phase 1 Configuration.
If there is a mismatch in the key, the user will not be able to establish the connection.
Digital Certificate
Select local certificate that should be used for authentication by the device.
| System | 277
Select remote certificate that should be used for authentication by the remote peer.
RSA Key
Local RSA key is displayed which can be re-generated from the CLI console. Refer to the console guide for more details. Specify remote RSA key.
Click > to continue.
On the Local Network Details page
Select local WAN port. Selected port acts as an end-point of the tunnel.
Select local subnet. Select the local network(s) you wish to give access to remote users via this connection.
Select local ID.
For Preshared Key and RSA Key, select any type of ID and enter its value.DER ASN1 DN (X.509) is not applicable.
For Local Certificate, the ID and its value configured in the local certificate are displayed automatically.
Click > to continue.
On the Remote Network Details page
In the Remote VPN Server field specify IP address or host name of the remote end-point.
To specify any IP address, enter *.
Enable NAT traversal if a NAT device exists between your VPN endpoints i.e. when remote peer has private/nonroutable IP address.
Select Remote Subnet. Select the remote network(s) that you wish to access via this connection. This option will be available only if NAT traversal is enabled.
Select Remote ID.
For Preshared Key and RSA Key, select any type of ID and enter its value. DER ASN1 DN (X.509) is not applicable.
In case of Local Certificate, the ID and its value configured in the local certificate are displayed automatically.
Click > to continue.
On the User Authentication page
Select User Authentication Mode.
Available Options:
• Disabled – Choose if authentication is not required.
• Enable as Client – Enter username and password for authentication by the remote gateway.
• Enable as Server – Select all the users that are to be allowed to connect.
Click > to continue.
On the IPsec Connection Summary page
The page displays the settings with which the IPsec connection will be created.
Click Finish to create the IPsec connection or click < to go back to the previous page and change the settings.
Creating Host to Host Connection using VPN Wizard
Go to System > VPN > IPsec. Click Wizard and follow the steps given below:
Specify name and description (if required) for a VPN connection and click Start. The Help panel on left-most side provides an overview of each configuration step.
On the Select a Connection Type page
| System | 278
1. Select the connection type Site to Site.
2. Select VPN policy to be applied to the connection traffic. Default policies as well as custom policies applicable to connection will be displayed.
3. Select action to be taken on the connection when VPN services or the device restart.
Available Options:
• Disable – Connection will be disabled till the user activates it.
• Respond Only – Connection in ready state to respond to any incoming request.
• Initiate – Initiate to establish the connection every time VPN services or the evice restart
Click > icon to continue.
On the Authentication Details page
Select authentication type
Available Options:
Preshared Key
Specify the preshared key of minimum 5 characters. This preshared key will have to be shared or communicated to the peer at the remote end. At the remote end, the client will have to specify this key for authentication. Refer to the VPN client guide, Phase 1 Configuration.
If there is a mismatch in the key, the user will not be able to establish the connection.
Digital Certificate
Select local certificate that should be used for authentication by the device.
Select remote certificate that should be used for authentication by the remote peer.
RSA Key
Local RSA key is displayed which can be re-generated from the CLI console. Refer to the console guide for more details. Specify remote RSA key.
Click > to continue.
On the Local Network Details page
Select local WAN port. Selected port acts as an end-point of the tunnel.
Select local ID.
For Preshared Key and RSA Key, select any type of ID and enter its value.DER ASN1 DN (X.509) is not applicable.
For Local Certificate, the ID and its value configured in the local certificate are displayed automatically.
Click > to continue.
On the Remote Network Details page
In the Remote VPN Server field specify IP address or host name of the remote end-point.
To specify any IP address, enter *.
Enable NAT traversal if a NAT device exists between your VPN endpoints i.e. when remote peer has private/nonroutable IP address.
Select Remote Subnet. Select the remote network(s) that you wish to access via this connection. This option will be available only if NAT traversal is enabled.
Select Remote ID.
For Preshared Key and RSA Key, select any type of ID and enter its value. DER ASN1 DN (X.509) is not applicable.
In case of Local Certificate, the ID and its value configured in the local certificate are displayed automatically.
Click > to continue.
| System | 279
On the User Authentication page
Select User Authentication Mode.
Available Options:
• Disabled – Choose if authentication is not required.
• Enable as Client – Enter username and password for authentication by the remote gateway.
• Enable as Server – Select all the users that are to be allowed to connect.
Click > to continue.
On the IPsec Connection Summary page
The page displays the settings with which the IPsec connection will be created.
Click Finish to create the IPsec connection or click < to go back to the previous page and change the settings.
Add VPN Failover Group
Use Failover Group section to create a VPN Failover Group which enables you to have an always on VPN connection. If the primary connection fails, the subsequent connection in the group will take over without manual intervention and keep traffic moving. The entire process is transparent to users.
1. Navigate to System > VPN > IPsec and click Add in the section Failover Group.
2. Enter details of the group.
Name
Enter a name for the connection group.
Select Connections(s)
The Available Connections list displays the list of connections that can be added to the failover group. Click on the connections to be added to the Member Connections list. The device will select the subsequent active connection from the member connections list if the primary connection fails.
Connections having endpoints of different families can also be added to the failover group.
Top down order of connections in the Member Connections list specifies the failover preference i.e. if the primary connection fails the very next connection in the list will be used by the device to keep the VPN traffic moving.
Once the connection is included in any group, it will not be displayed in the Available Connection list.
Remote access connections will not be listed in the Available Connections list.
You need to add at least two member connections in a group.
Mail Notification
Enable to receive connection failure notification in case the connection fails. Notification is mailed on the email address configured in the email settings from the Network Configuration Wizard.
| System | 280
Figure 226: Connection Group
Details
Failover Condition
Specify the failover condition. The device checks for the connection failure after every 60 seconds and if failure is detected, VPN traffic is transferred through the subsequent connection specified in the connection group. The device considers a connection as failed connection if failover conditions are not met.
Specify communication protocol as TCP or PING. Select the protocol depending on the service to be tested on the remote server or local gateway depending on type of connection.
A request on the specified port is sent and if it is not responding, the device considers the connection as failed and shifts the traffic to the subsequent connection.
Configure gateway failover timeout from System > Network > WAN Link Manager.
Failover Condition is not applicable if:
• Connection is manually disconnected from either of the ends.
• Connection is not included in any group.
Figure 227: Failover
Condition
3. Click Save.
The failover group has been created and appears on the IPsec page in the section Failover Group.
| System | 281
Cisco VPN Client
CISCO
TM
VPN Client is a software developed by CISCO that runs on Windows systems. It establishes encrypted
VPN tunnels with highly secured remote connectivity for the remote workers.
General Settings
CISCO
™
VPN Client
Select to enable CISCO
™
VPN Client.
All the fields will be available for configuration, once CISCO
™
VPN Client is enabled.
Default: disabled.
Interface
Select an interface from the list of WAN ports.
IP Aliases created for WAN interfaces will be listed along with the default WAN interfaces.
Authentication Type
Select the authentication type.
Authentication of user depends on the connection type.
Available Options:Preshared Key: Preshared key authentication is a mechanism whereby a single key is used for encryption and decryption. Both peers should possess the preshared key. The remote peer uses the preshared key for decryption. On selecting this option the user has to provide:
• Preshared Key – Specify the preshared key to be used. The preshared key should be of minimum 5 characters.
• Confirm Preshared Key – Provide the same preshared key to confirm it.
This preshared key will have to be shared or communicated to the peer at the remote end. At the remote end, the client will have to specify this key for authentication. If there is a mismatch in the key, the user will not be able to establish the connection.Digital Certificate: Digital certificate authentication is a mechanism whereby sender and receiver both use a digital certificate issued by the certificate authority. Both sender and receiver must have each other’s certificate authority.
• Local Certificate – Select the local certificate that should be used for authentication by the device
• Remote Certificate – Select the remote certificate that should be used for authentication by the remote peer.
Local ID (Only applicable if Preshared Key authentication type is selected)
Specify a value for the local ID selected.
Available Options:DNSIP AddressEmail AddressDER ASN1 DN (X.509)
Note: DER ASN1 DN(X.509) can not be used for Preshared Key authentication.
If Digital Certificate is selected, the ID and its value is displayed automatically as specified in the Local
Certificate.
Remote ID
Specify a value for the remote ID selected.
Available Options:DNSIP AddressEmail AddressDER ASN1 DN (X.509)
Note: DER ASN1 DN(X.509) can not be used for Preshared Key authentication.
Allowed User
Select all the users who are to be allowed to connect to the configured CISCO
™
VPN client.
Figure 228: General
| System | 282
Settings
Client Information
Name
Provide a name to be displayed.
Assign IP from
Specify the IP address range. The device will lease the IP address to the Cisco
™
IPsec client from the specified IP address range.
Note: Do not configure the above IP address range in L2TP or PPTP configuration.
Allow leasing IP address from Radius server for L2TP, PPTP and CISCO VPN Client
Click to lease the IP address to the L2TP, PPTP and CISCO VPN client users through the Radius server.
Radius is a protocol that allows network devices to authenticate users against a central database. It can also store technical information used by network devices.
If enabled, the configured IP address is overridden with the IP address provided by the Radius server.
Default: disabled
DNS Server 1
Provide a DNS server IP address to be pushed to CISCO VPN clients.
DNS Server 2
Provide a DNS server IP address to be pushed to CISCO VPN clients.
Figure 229: Client
Information
Advanced Settings
Disconnect when tunnel is idle
Click this option to allow the device to delete an idle VPN session if it exceeds the specified idle session time interval.
Default: disabled
Idle session time interval (Only applicable if Disconnect when tunnel is idle option is enabled)
Specify the time limit after which an idle VPN session will be deleted by the device.
Acceptable Range: 120 to 999
Apply
Click to accept and save the Cisco VPN client configuration.
Export Connection
Click to export Cisco VPN client configuration.
This option will only be enabled when Cisco VPN connection is configured.
Reset
Click to delete the entire Cisco VPN client configuration.
Figure 230: Advanced
Settings
L2TP Settings
On this page you can enable and configure settings for L2TP connections.
System > VPN > L2TP Settings
Following is a description of the settings of this page:
Enable L2TP
Click this checkbox to enable/disable L2TP settings.
| System | 283
| System | 284
General Settings
Assign IP from
Set an IP address range which is used to distribute IP addresses to L2TP clients. This should be a private IP address range.
Allow leasing IP address from RADIUS server for L2TP, PPTP and CISCO VPN Client
If this option is enabled and if the user is authenticated via a RADIUS server, the configured IP address (static or leased from the IP address range) is overridden with the IP address provided by the RADIUS server. If no IP addresses are configured on the RADIUS server, the static IP address configured for the user will be assigned, else an IP address will be leased from configured IP address range.
Client Information
Primary/Secondary DNS Server
Select the Primary and/or Secondary DNS Server to be used in L2TP connections. If there is no DNS server available in the list, i.e., configured in the device, you can select Other and enter the IP address of a DNS server into a textfield.
Primary/Secondary WINS Server
Select the Primary and/or Secondary WINS Server to be used in L2TP connections. If there is no WINS server available in the list, i.e., configured in the device, you can select Other and enter the IP address of a WINS server into a textfield.
Add L2TP Member
This page describes how to add an L2TP member.
Before you can add L2TP members, L2TP must be enabled. See chapter
on page 283.
1. Navigate to System > VPN > L2TP Settings and click Add Member(s) at the bottom of the page.
2. Select users and groups from the table who would use L2TP to connect to the device.
3. Click Add.
All selected entries will be added as LT2P members.
Show/Remove L2TP Member
This page describes how to see which users or groups are members of L2TP and how to remove L2TP members.
Before you can view L2TP members, L2TP must be enabled. See chapter
1. Navigate to System > VPN > L2TP Settings and click Show Members at the bottom of the page.
A dialog opens that shows all current members of L2TP.
2. Select users or groups from the table that should be removed as L2TP members.
3. Click Delete.
All selected entries will be removed as L2TP members.
L2TP Connections
The L2TP Connections page displays a list of all the L2TP connections and you can sort the list based on the connection name. The page also provides the option to add a new connection, update existing connections, or delete a connection. The page displays the status of each connection as follows:
Connection Status
Active Connection
Description
Connection is active but not connected.
Click to initiate the connection.
| System | 285
Connection Status Description
Connection is active and connected.
Click to disconnect the connection. When you disconnect, the connection will be deactivated and to re-establish the connection, click again to activate the connection.
Connection is inactive. Click to activate the connection.
Add L2TP Connection
This page describes how you can create an L2TP connection.
1. Navigate to System > VPN > L2TP Connections and click Add.
2. Enter the parameter values for the general settings.
Name
Specify a unique name to identify the L2TP connection.
Description
Provide a description for the L2TP connection.
Policy
Select a policy to be used for the connection.
A new policy can be added by clicking Create New.
Action on VPN Restart
Select the action to be taken on the connection when VPN services or the device restart.
Available Options:Respond Only – Keeps connection ready to respond to any incoming request. Disable –
Keeps connection disabled till the user activates it.
3. Enter the authentication details.
Authentication Type
Select the authentication type. Authentication of the user depends on the type of connection.
Available Options:Preshared Key: Preshared key authentication is a mechanism whereby a single key is used for encryption and decryption. Both peers should possess the preshared key. The remote peer uses the preshared key for decryption. On selecting this option the user shall has to provide the following details:
• Preshared Key – Specify the preshared key to be used. The preshared key should be of minimum 5 characters.
• Confirm Preshared Key – Provide the same preshared key to confirm it.
This preshared key will have to be shared or communicated to the peer at the remote end. At the remote end, the client will have to specify this key for authentication. If there is a mismatch in the key, the user will not be able to establish the connection.Digital Certificate: Digital certificate authentication is a mechanism whereby sender and receiver both use a digital dertificate issued by the certificate authority. Both sender and receiver must have each other’s certificate authority.
• Local Certificate – Select the local certificate that should be used for authentication by the device.
• Remote Certificate – Select the remote certificate that should be used for authentication by the remote peer.
4. Enter the local network details.
Local WAN Port
Specify the local port number that the local VPN peer uses to transport traffic related to TCP or UDP protocol.
| System | 286
Acceptable Range: 1 to 65535
To specify any local port, enter *.
Local ID (Only applicable if Preshared Key authentication type is selected)
Select any type of ID from the available options and specify its value.
Available Options: DNSIP AddressEmail AddressDER ASN1 DN(X.509)
Note: DER ASN1 DN(X.509) can not be used for Preshared Key authentication.
If Digital Certificate is selected, the ID and its value is displayed automatically as specified in the Local
Certificate.
5. Enter the remote network details.
Remote Host
Specify the IP address or host name of the remote end-point. Specify * for any IP address.
Allow NAT Traversal
Enable NAT traversal if a NAT device is located between your VPN endpoints i.e. when the remote peer has a private/non-routable IP address.
At a time only one connection can be established behind one NAT-box.
Default: enabled
Remote LAN Network
Select an IP addresses and netmask of the remote network which is allowed to connect to the device server through a VPN tunnel. Multiple subnets can be specified. Select IP hosts from the list of IP hosts available on the Admin console.
You can also add a new IP host by clicking Create New.
Remote ID
Select any type of ID from the available options and specify its value.
Available Options: DNSIP AddressEmail Address
DER ASN1 DN(X.509) (DER ASN1 DN (X.509) is not applicable.
Note: DER ASN1 DN(X.509) can not be used for Preshared Key authentication.
6. Enter the quick mode selector settings.
Local Port
Specify local port number that the local VPN peer uses to transport the traffic related to TCP or UDP protocol.
Default: 1701
Local port range: 1 – 65535
To specify any local port, enter *.
Remote Port
Specify remote port number that the remote VPN peer uses to transport the traffic related to TCP or UDP protocol.
Default: *
Local port range: 1 – 65535
To specify any local port, enter *.
7. Enter the advanced settings.
Disconnect when tunnel is idle
Click this option to allow the device to delete an idle VPN session if it exceeds the specified idle session time interval.
Default: disabled
| System | 287
Idle session time interval (Only if Disconnect when tunnel is idle option is enabled)
Specify the time limit after which an idle VPN session will be deleted by the device.
Acceptable Range: 120 to 999 seconds.
8. Click Save.
PPTP
Point-to-Point Tunneling Protocol allows organizations to extend their own private network through private tunnels over the public Internet.
The device supports several authentication options including Password Authentication Protocol (PAP), Challenge
Handshake Authentication Protocol (CHAP), and Microsoft Challenge Handshake Authentication Protocol (MS-
CHAPv2).
This page provides options to configure the device as PPTP server and enable/disable remote access through PPTP to various users.
Enable PPTP
Enable PPTP
Click to enable PPTP.
General Settings
Assign IP from
Specify IP address range. PPTP server will lease IP address to the PPTP client from the specified IP address range. The PPTP client uses the assigned IP address as its source address for the duration of the connection.
Do not specify the same IP address range in L2TP configuration and PPTP configuration.
Allow leasing IP Address from Radius server for L2TP, PPTP and CISCO VPN Client
Click to lease the IP address to the PPTP users through the Radius server.
Radius server is a protocol that allows network devices to authenticate users against a central database. It can also store technical information used by network devices.
If enabled, the configured IP address is overridden with the IP address provided by the Radius server.
Default: disabled
Client Information
Primary DNS Server
Specify DNS server to be used at the client end.
Secondary DNS Server
Specify alternate DNS server to be used at the client end.
Primary WINS Server
Specify WINS server to be used at the client end.
Secondary WINS Server
Specify alternate WINS server to be used at the client end.
Apply
Click to save the configuration.
Add Member(s)
Click to select users who are to be allowed remote access through PPTP.
Show Members
Click to view a list of PPTP members.
Add PPTP Members
The Add PPTP Members page allows you to select users who are to be allowed remote access through PPTP.
| System | 288
1. Navigate to System > VPN > PPTP and click Add Member(s) to add users or user groups. A new window is displayed showing a list of users and user groups.
2. Select users or user groups who are to be allowed remote access through PPTP. You can add a single or multiple users or user groups.
3. Click Apply to add these users and user groups to the PPTP members list.
Show PPTP Members
Use Show Members page to view list of PPTP members and remove members for whom remote access through
PPTP is to be disabled.
The Show Members page allows you to view list of PPTP members and remove members for whom remote access through PPTP is to be disabled.
1. Navigate to System > VPN > PPTP and click Show Members to view a list of PPTP members. A new window is displayed showing a list of PPTP users who who are allowed access through the PPTP connection.
2. Select the users for whom you want to disable PPTP access. You can select multiple users or user groups.
3. Click Delete.
SSL VPN Settings
On this page you can configure general SSL VPN settings.
System > VPN > SSL VPN Settings
SSL VPN Settings allows to define parameters requested for remote access such as protocols, server certificates and
IP addresses for SSL clients. The SSL VPN client supports most business applications such as native Outlook, native
Windows file sharing, and many more.
Following is a description of the different sections of this page:
SSL VPN Settings
Configure the following basic SSL VPN settings:
Protocol
Select the protocol to use. You can choose either TCP or UDP. UDP is recommended because it provides a better performance.
SSL Server Certificate
Select a local SSL certificate to be used by the SSL VPN server to identify itself against the clients. Default is
ApplianceCertificate.
Override Hostname
Here you can set the server IP address for client VPN connection. Usually this should be the external IP address of Sophos Firewall OS.
IPv4 Lease Range
Set an IP address range which is used to distribute IP addresses to the SSL clients. This should be a private IP address range.
Default Range - 10.81.234.5 to 10.81.234.55
Subnet Mask
Select a netmask for the IP address range above. The netmask must not be greater than 29 bits, because OpenVPN cannot handle address ranges whose netmask is /30, /31, or /32. The netmask is limited to a minimum of 16.
IPv6 Lease (IPv6 / Prefix)
If you want to lease IPv6 addresses to clients, set the IPv6 prefix in the first field and the netmask in the last field.
You then also have to select the option IPv4 and IPv6 both in parameter Lease Mode.
| System | 289
Lease Mode
Select if you want to only lease IPv4 addresses to SSL clients or both IPv4 and IPv6 addresses.
IPv4 DNS
Specify up to two IPv4 DNS servers, primary and secondary, of your organization.
IPv4 WINS
Specify up to two IPv4 WINS servers, primary and secondary, of your organization.
Windows Internet Naming Service (WINS) is Microsoft's implementation of NetBIOS Name Server (NBNS) on
Windows operating systems. Effectively, WINS is to NetBIOS names what DNS is to domain names—a central mapping of hostnames to IP addresses.
Domain Name
Enter the hostname of your Sophos Firewall as a Fully Qualified Domain Name (FQDN). The FQDN is an unambiguous domain name that specifies the node's absolute position in the DNS tree hierarchy, for example utm.example.com. A hostname may contain alphanumeric characters, dots, and hyphens. At the end of the hostname there must be a TLD (top level domain) such as com, org, or de. The hostname will be used in notification messages to identify the Sophos Firewall.
Disconnect Dead Peer After
Enter a time limit in seconds after which a dead connection will be terminated by Sophos Firewall. Default is 180 seconds.
Disconnect Idle Peer After
Enter a time limit in minutes when an idle connection will be terminated. Default is 15 minutes.
Figure 231: SSL VPN Settings
Cryptographic Settings
Make the following cryptographic settings:
Encryption Algorithm
Specifies the algorithm used for encrypting the data sent through the VPN tunnel. The following algorithms are supported and all in Cipher Block Chaining (CBC) mode:
• DES-EDE3-CBC
• AES-128-CBC (128 bit)
• AES-192-CBC (192 bit)
• AES-256-CBC (256 bit)
| System | 290
• BF-CBC (Blowfish (128 bit))
Authentication Algorithm
• SHA-1 (160 bit)
• SHA2 256 (256 bit)
• SHA2 384 (384 bit)
• SHA2 512 (512 bit)
• MD5 (128 bit)
Key Size
The key size (key length) is the length of the Diffie-Hellman key exchange. The longer this key is, the more secure the symmetric keys are. The length is specified in bits. You can choose between a key size of 1024 or 2048 bits.
Key Lifetime
Enter a time period after which the key will expire. The default is 28,800 seconds.
Figure 232: SSL VPN Cryptographic Settings
Compression Settings
Make the following compression setting:
Compress SSL VPN Traffic
If enabled, all data sent through SSL VPN tunnels will be compressed prior to encryption.
Debug Settings
Make the following debug setting:
Enable Debug Mode
When enabling debug mode, the SSL VPN log file will contain extended information useful for debugging purposes.
Click Apply.
SSL VPN (Site to Site)
Site-to-site VPN tunnels can be established via an SSL connection. SSL VPN connections have distinct roles attached. The tunnel endpoints act as either client or server. The client always initiates the connection, the server responds to client requests. Keep in mind that this contrasts IPsec where both endpoints normally can initiate a connection.
System > VPN > SSL VPN (Site to Site)
Server Connections
This section lists all existing SSL VPN site-to-site server connections. Following is a description of the table elements:
| System | 291
Status
Displays if the connection is active or not. You can activate/deactivate the connection by clicking the toggle switch.
Connection Name
Displays the name of the connection.
Local Networks
Displays the local networks that are allowed to be accessed remotely.
Remote Networks
Displays the remote networks that are allowed to connect to the local network(s).
Manage
Displays the available managing options for the connection:
• Edit: Allows you to edit the connection.
• Delete: Allows you to delete the connection.
• Download: Allows you to download the SSL server configuration.
A connection can be updated or deleted by pressing the concerning buttons.
Client Connections
This section lists all existing SSL VPN site-to-site client connections. Following is a description of the table elements:
Status
Displays if the connection is activated or not. You can activate/deactivate the connection by clicking the toggle switch.
Connection Name
Displays the name of the connection.
Use HTTP Proxy Server
Displays the HTTP proxy server which is used for the connection.
Manage
Displays the available managing options for the connection:
• Edit: Allows you to edit the connection.
• Delete: Allows you to delete the connection.
• Download: Allows you to download the SSL client configuration.
A connection can be updated or deleted by pressing the concerning buttons.
Add SSL VPN Site-to-Site Server Connection
This page describes how to add a SSL VPN site-to-site server connection.
1. Navigate to System > VPN > SSL VPN (Site to Site) and click Add in the Server section.
2. Enter values for the following settings:
Connection Name
Enter a descriptive name for the connection.
Use Static Virtual IP Address (optional)
Only select this option if the IP address pool is not compatible with the client's network environment: By default clients are assigned an IP address from a Virtual IP pool. Rarely, it may happen that such an IP address is already in use on the client's host. In that case enter a suitable IP address in the Static Peer IP field which will then be assigned to the client during tunnel setup.
Local Networks
Select or add one or more local networks to which remote network(s) would connect.
Remote Networks
Select or add one or more remote networks that are allowed to connect to the local network(s).
Description (optional)
Enter a description or other information.
| System | 292
Figure 233: Add SSL Connection
3. Click Save.
The new SSL server connection appears on the Server list.
To either edit or delete a server connection, click the corresponding buttons in the Server list.
The next step is the client configuration which has to take place on client side and not on server side. Download the client configuration file with help of the provided button in the Server list.
Note: If you want to send the file via mail it is recommended to use the encryption option which is provided in the download dialog.
How to configure the client is described in chapter System > VPN > SSL VPN Site-to-Site > Add Client Site-to-
Site.
Add SSL VPN Site-to-Site Client Connection
This page describes how to add a SSL VPN site-to-site client connection.
1. Navigate to System > VPN > SSL VPN (Site to Site) and click Add in the Client section.
2. Enter values for the following settings:
Connection Name
Enter a descriptive name for the connection.
Configuration File
Click the Browse... icon, browse for the client configuration file and click Open.
Note:
• The file has to be in .apc or .epc format.
• The file can be downloaded via the download icon in the Manage column of the Server list on
System > VPN > SSL VPN (Site to Site).
Password (optional)
If the file has been encrypted, enter the password.
| System | 293
Use HTTP Proxy Server (optional)
Activate if the client is located behind a proxy server and enter the proxy settings:
• Proxy Server: Select or add a proxy server.
• Proxy Port: Enter a proxy port.
• Proxy Requires Authentication (optional): Select the checkbox if the client needs to authenticate against the proxy and enter Username and Password.
Override Peer Host Name (optional)
Select the checkbox and add or select a hostname if the server system's regular hostname cannot be resolved from the client host.
Description (optional)
Add a description or other information.
Figure 234: Add SSL Connection
3. Click Save.
The new SSL VPN client connection appears on the Client list.
To either edit or delete a client connection, click the corresponding buttons in the Client list.
SSL VPN (Remote Access)
The remote access SSL feature of Copernicus is realized by OpenVPN, a full-featured SSL VPN solution. You can create point-to-point encrypted tunnels between remote employees and your company, requiring both SSL certificates and a username/password combination for authentication. This enables access to internal resources. In addition, a secure User Portal is offered, which can be accessed by each authorized user to download a customized SSL VPN client software bundle. This bundle includes a free SSL VPN client, SSL certificates and a configuration that can be handled by a simple one-click installation procedure. The SSL VPN client supports most business applications such as native Outlook, native Windows file sharing, and many more.
System > VPN > SSL VPN (Remote Access)
Following is a description of the table elements:
Name
Displays the name of the SSL VPN remote access policy.
Use as Default Gateway
Displays if and which default gateway is used for the policy.
Description
Displays the description which was entered for the policy.
Manage
Displays the available managing options for the policy:
• Edit: Allows you to edit the policy.
• Delete: Allows you to delete the policy.
Add SSL VPN Remote Access Policy
This page allows adding SSL VPN remote access policies.
1. Navigate to System > VPN > SSL VPN (Remote Access) and click Add.
2. Make the following settings in the General Settings section:
Name
Enter a descriptive name for the policy.
Description (optional)
Add a description or other information.
3. Make the following settings in the Identity section:
Policy Members
Click Add New Item to select available users/groups from a list or search for users/groups. Click Apply
Selected Items afterwards.
Note: You can also view and manage active SSL VPN users on the System > Current Activity >
SSL VPN Users page.
Selected items are displayed in the list. To remove an item from the list, click the Minus icon on the right of the item.
4. Make the following settings in the Tunnel Access section:
Use as Default Gateway
Activate the toggle switch if you want to use this as default gateway.
Permitted Network Resources (IPv4)
Click Add New Item to select available network resources from a list or search for network resources. Click
Apply Selected Items afterwards.
Selected items are displayed in the list. To remove an item from the list, click the Minus icon on the right of the item.
Permitted Network Resources (IPv6)
Click Add New Item to select available users/groups from a list or search for users/groups. Click Apply
Selected Items afterwards.
Selected items are displayed in the list. To remove an item from the list, click the Minus icon on the right of the item.
| System | 294
Figure 235: SSL VPN (Remote Access) Tunnel Access
| System | 295
5. Make the following settings in the Idle Timeout section:
Disconnect Idle Clients
Activate/deactivate by clicking the toggle switch. If activated, clients which are idle will be disconnected from the session after a specified time.
Override Global Timeout (Default 15 Minutes) (only if Disconnect Idle Clients is activated.
Enter a value for the idle timeout in minutes.
Note: Values between 15 and 60 minutes are valid.
Figure 236: SSL VPN (Remote Access) Idle Timeout
6. Click Apply.
New remote access policies immediately appear on the SSL VPN (Remote Access) list.
Note: For Remote Access connections to work check that LAN and WAN zones are activated for the
User Portal on the System > Administration > Device Access page.
Clientless Access
For the bookmark function you can define clientless access policies.
Note: With Safari browser on Mac OSX or iOS, users have to import the CA certificate of SF-OS first before they can use clientless access. The CA certificate can be downloaded under Objects > Identity > Certificate
Authority or System > VPN > Certificate Authority. Usually its name is "Default".
System > VPN > Clientless Access
Following is a description of the table elements:
Name
Displays the name of the clientless access policy.
Restrict Web Applications
Displays if the web application restriction is activated (Yes) or not (No).
Description
Displays the description which was entered for the policy.
Manage
Displays the available managing options for the policy:
• Edit: Allows you to edit the policy.
• Delete: Allows you to delete the policy.
Add Clientless Access Policy
The page allows adding clientless access policies.
The Add button on the Clientless Access page allows to define a new clientless access policy.
1. Navigate to System > VPN > Clientless Access and click the Add button.
2. Make the following settings in the General Settings section:
Name
Enter a descriptive name for the policy.
Description (optional)
Add a description or other information.
3. Make the following settings in the Identity section:
Policy Members
Select the requested users/groups from the list.
As soon as an item is selected it is displayed in the list.
Note: With Safari browser on Mac OSX or iOS, users have to import the CA certificate of SF-OS first before they can use clientless access. The CA certificate can be downloaded under Objects >
Identity > Certificate Authority or System > VPN > Certificate Authority. Usually its name is
"Default".
4. Make the following settings in the Clientless Portal section:
Published Bookmarks
Select the requested bookmark(s) and/or bookmark group(s) from the list.
As soon as an item is selected it is displayed in the list.
Restrict Web Applications
Click the toggle switch to activate/deactivate the restriction of web applications.
| System | 296
Figure 237: Clientless Portal
5. Click Apply.
The clientless access policy is now available and appears in the Clientless Access list.
Bookmark
Bookmarks are the resources whose access will be available through the user portal. Bookmarks are applied through the Clientless Access policy and are available to users who have web or application access.
System > VPN > Bookmark
The bookmark feature enables users from external networks to access internal resources via pre-configured connection types, using only a browser as a client, without installing plug-ins. To do so, the user has to log in to the
User Portal. On the SSL VPN tab, a list of all connections available to this user is shown. Clicking the Connect button initiates the connection to the defined internal resource. As an administrator you have to generate these connections beforehand, specifying the allowed users, the connection type and other settings. Internal resources can be accessed using different connection types: for example Remote Desktop Protocol (RDP) or Virtual Network
Computing (VNC) to access remote desktops, a browser to use web applications (HTTP/HTTPS), or Telnet/Secure
Shell (SSH) for terminal sessions. However, the portal does not permit to download content, e.g. via HTTP, to the user's local computer. Using this feature it is possible to give multiple users access to internal resources which do not support multi-user access themselves (e.g., network hardware like switches) or easily provide very granular access to just one specific service instead of giving access to entire systems or networks.
The page displays all existing bookmarks. You can add new bookmarks, update or delete them. Following is a description of the table elements:
Name
Displays the name of the bookmark.
Type
Displays the type of the bookmark.
URL
Displays the URL which is defined for the bookmark.
Description
Displays the description of the bookmark.
Manage
Displays the available managing options for the bookmark:
• Edit: Allows you to edit the bookmark.
• Delete: Allows you to delete the bookmark.
To either add or delete a bookmark, click on the corresponding buttons.
Add a Bookmark
This page describes how to add a bookmark.
1. Navigate to System > VPN > Bookmark and click Add.
2. Enter values for the following settings:
Name
Enter a descriptive name for the bookmark.
Type
Select a bookmark type. Depending on the selected connection type, different parameters are displayed. The following types are available: HTTPS
Browser-based access to web applications via HTTPS.
HTTP
Browser-based access to web applications via HTTP.
Note: The URL used for the HTTP/HTTPS connection is composed of the destination, the port and the path options for this connection.
RDP
Remote access using the Remote Desktop Protocol (RDP), e.g., to open a remote desktop session to a
Windows host.
TELNET
Terminal access using the Telnet protocol, e.g., to give access to a switch or a printer.
SSH
Terminal access using SSH.
FTP
File Transfer Protocol for exchanging files over packet-switched networks.
FTPS
Extension of FTP. Additionally supports TLS and SSL protocols.
SFTP
SSH File Transfer Protocol, or Secure File Transfer Protocol, is a separate protocol packaged with SSH that works in a similar way over a secure connection.
SMB
The Server Message Block (SMB) Protocol is a network file sharing protocol.
| System | 297
| System | 298
VNC
Remote access using Virtual Network Computing (VNC), e.g., to open a remote desktop of a Linux/Unix host.
Note: Currently only VNC classic authentication (password only) is supported. Make sure your server is set up accordingly.
Note: The default port is displayed next to the drop-down menu.
URL
Enter the URL of the website for which the bookmark is to be created.
Note: Note the examples displayed below the text box.
Port
Enter a port number for the bookmark. By default the standard port of the selected bookmark type is given.
Automatic Login
If enabled, users can log in without knowing the authentication data. In this case, you have to provide the authentication data. The displayed options depend on the selected connection type.
Username
Enter the username users should use to connect.
Password
Enter the password users should use to connect.
Note: When using the connection type Telnet, for security reasons automatic login only works when the banner length sent from the Telnet server does not exceed 4096 characters (including the password prompt). If the banner is longer, automatic login fails. In this case reduce the banner length or switch to manual login.
Referred Domains
(only with bookmark type HTTPS or HTTP)
Search/add one or more domain(s)/URL(s) which are required by the bookmark URL to render it appropriately.
Domain
(only with bookmark type RDP or SMB)
Enter a domain name.
Protocol Security
(only with bookmark type RDP)
Select the security protocol for the Remote Desktop session. You can choose between RDP, TLS and NLA
(Network Level Authentication). Your settings have to comply with the server settings.
Note: NLA requires to enable Automatic Login above.
Public Host Key
(only with bookmark type SSH, SFTP or FTPS)
Add the public key of the SSH host.
Init Remote Folder
(only with bookmark type FTP, FTPS, SFTP or SMB)
Specify the remote directory path.
Note: After successful authentication the user is redirected to the path on the remote server.
Authentication Method
(only with bookmark type SFTP)
Select the authentication method. You can either provide the Password for the selected username or add the
Private Key for the SFTP connection.
Share Session
Select this option to allow users to use the connection simultaneously and see the same screen.
Description
Enter a description or other information.
| System | 299
Figure 238: Add Bookmark
3. Click Save.
The bookmark is now available and appears in the Bookmark list.
To either edit or delete a bookmark, click the corresponding buttons.
Bookmark Group
This page displays all bookmark groups. You can update a group to include bookmarks as group members. Single bookmarks can be member of multiple groups. You are not allowed to delete groups which contain bookmarks which are part of any of the SSL VPN policies.
System > VPN > Bookmark Group
You can add new groups, update or delete them. Following is a description of the table elements:
Name
Displays the name of the bookmark group.
Description
Displays the description of the bookmark group.
Manage
Displays the available managing options for the bookmark group:
• Edit: Allows you to edit the bookmark group.
• Delete: Allows you to delete the bookmark group.
To either add or delete a bookmark group, click the corresponding buttons.
Add Bookmark Group
This page describes how to add a bookmark group.
1. Navigate to System > VPN > Bookmark Group and click Add.
2. Enter values for the following settings:
Name
Enter a descriptive name for the bookmark group.
Select Bookmark
Select the bookmark(s) you want to add to the new bookmark group from the Bookmark List.
Description
Enter a description or other information.
| System | 300
Figure 239: Add Bookmark Group
3. Click Save.
The bookmark group is saved. It appears in the Bookmark Group list.
To either edit or delete a bookmark group, click the corresponding buttons.
Certificate
The Certificate page displays a list of available certificates.
A digital certificate is a document that guarantees the identity of a person or entity and is issued by the certificate authority (CA). Certificates are generated by third party trusted CAs. They create certificates by signing public keys and identify the information of the communicating parties with their own private keys. This way it is possible to verify that a public key really belongs to the communicating party only and has not been forged by someone with malicious intentions.
A certificate signed by a certificate authority (CA) identifies the owner of a public key. Each communicating party may be required to present its own certificate signed by a CA verifying the ownership of the corresponding private key. Additionally, the communicating parties need to have a copy of the CA’s public key. In case the private key is lost or stolen or the information is changed, CA is responsible for revoking the certificate.CA also maintains the list of valid and revoked certificates.
To use certificates for authentication, you must have a valid CA and a certificate. You need to upload a CA if you are using an external CA. You can generate a self-signed certificate if you want to use it as CA.
You can also use the device to act as a certificate authority and sign its own certificates. This eliminates the need of having your own certificate authority. If you are using the device as CA, you have to generate a self-signed certificate, which can be used in various VPN policies.
The page also provides options to generate a self-signed certificate, upload a certificate, or generate a Certificate
Signing Request (CSR).This page also provides the option to regenerate, revoke, download, or delete the certificates.
If you are using a third party CA, you have to submit a request to CA for issuing a certificate. Once CA issues a certificate, you have to upload to use it in the VPN policy.
| System | 301
This page provides options to:
•
•
•
Add Certificate
Use the Certificate page to add a new certificate.
The Certificate page allows you to generate a self-signed certificate, upload a certificate, or generate a Certificate
Signing Request (CSR).
1. Navigate to Protection > Web Server Protection > Certificate or System > VPN > Certificate or Objects >
Identity > Certificate and click Add.
2. Choose the action you want to perform.
Action
Select an action from the available options.
Upload CertificateGenerate Self-Signed CertificateGenerate Certificate Signing Request
Upload Certificate
Use the Certificate page to upload a certificate.
1. Enter details of the certificate to be uploaded.
Name
Specify a name of the certificate which you want to update.
Certificate File Format
Select the format of certificate file from the available options.
Available Options: PEM (.pem): Privacy Enhanced Mail (PEM) is a Base64encoded DER certificate.
It is used for encoding the certificate in ASCII code. The certificate and private key are stored in separate files. DER (.der): Distinguished Encoding Rules (DER) is a binary form of ASCII PEM format certificate used on Java platform. The certificate and private key are stored in separate files. CER (.cer): Canonical
Encoding Rules (CER) is a binary format for encoding certificates. It contains information about the owner of certificate, its public and private keys. PKCS7 (.p7b): Public Key Cryptography Standards (PKCS) is a format for encoding the certificate in ASCII code. It contains only certificates and not the private key.
PKCS12 (.pfx or .p12): Public Key Cryptography Standards (PKCS12) is a binary format for encoding certificates. It stores a private key with a public key certificate. It is used on Windows platforms.
Certificate
Select the certificate to be uploaded. Use Browse to select the complete path.
Private Key
Select the private key for the certificate. Use Browse to select the complete path.
Passphrase
Specify and re-confirm a passphrase for a certificate used for authentication. The passphrase must be at least 4 characters long.
2. Click Save.
Generate Self-Signed Certificate
Use the Certificate page to generate a self-signed certificate.
1. Enter details to generate a Self Signed Certificate (Option available only after configuring Default CA Parameters)
Name
Specify a name to identify the Certificate.
| System | 302
Valid From and Valid Up To
Specify certificate validity period using the Calendar . The validity period is the certificate life and indicates the period up to which the certificate will be considered as valid.
Default - 1 day
Key Length
Select key length. Key length is the number of bits used to construct the key.
Available Options:5121024153620484096
Generally, the larger the key, the less chance that it will be compromised but it takes longer to encrypt and decrypt data than smaller keys.
Default - 512
Key Encryption
Click to enable the key encryption.
Passphrase
Passphrase for a Certificate used for authentication. The passphrase must be at least 8 characters long. This option is enabled only if the Key Encryption option is selected.
Confirm Passphrase
Re-enter the passphrase for confirmation.
Certificate ID
Specify certificate ID. You can specify any one of the following options:
Available Options: DNSIP Address(IPv4/IPv6 Address) Email Address DER ASN1 DN(X.509) (Applicable when Authentication Type is Digital Certificate)
Once the certificate is created, you need to download and send this certificate to the remote peer with whom the connection is to be established.
Country Name
Select the country.
State
Specify the state within the country.
Locality Name
Specify the name of the locality.
Organization Name
Specify the name of the organization which will use this certificate and domain name. This domain will be certified to use the Certificate.
Use unique Domain name only.
Organization Unit Name
Specify the name of the department/unit which will use this certificate and domain name. This domain will be certified to use the Certificate.
Use unique Domain name only.
Common Name
Specify the common name.
A common name comprises of the host + domain name or is a fully qualified domain name that is used to resolve to SSL VPN interface. It must be same as that of the web address to be accessed when connecting to a secured site.
Email Address
Specify the Email Address of the contact person for communication.
2. Click Save.
Generate Certificate Signing Request
Use the Certificate page to generate certificate signing request.
1. On the Add Certificate page, select the action Generate Certificate Signing Request (CSR)
2. Enter certificate details.
Name
Specify a name to identify the certificate.
Valid Until
Specify certificate validity period using the calendar. Validity period is the certificate life i.e. period up to which the certificate will be considered as valid.
Minimum validity: 1 day
Key Length
Select key length. Key length is the number of bits used to construct the key.
Generally the larger the key, the less chance that it will be compromised, but it requires more time to encrypt and decrypt data than smaller keys.
Encryption
Click to enable the key encryption.
Passphrase (only applicable if Encryption is enabled)
Enter a passphrase for the certificate used for authentication. Passphrase must be at least 4 characters long.
Confirm Passphrase
Re-enter passphrase for confirmation.
Certificate ID
Specify a certificate ID. You can specify any one of the following options:
Available Options: DNS IP AddressEmail AddressDER ASN1 DN(X.509) (applicable when the authentication type is Digital Certificate)
3. Enter identification attributes of the certificate owner.
Country Name
Select the country for which the certificate will be used.
Generally, this would be the name of the country where the device is deployed.
State
Specify the state for which the certificate will be used..
Generally, this would be the name of the state where device is deployed.
Locality Name
Specify the name of the locality for which the certificate will be used.
Generally, this would be the name of the locality where device is deployed.
Organization Name
Specify the organization name, which will use this certificate.
Organization Unit Name
Specify the department/unit name, which will use this certificate.
Common Name
Specify the common name, eg. the server's hostname.
Email Address
Specify the email address of the contact person for communication.
4. Click Save.
| System | 303
| System | 304
Download Certificate
Use the Certificate page to download the certificate.
1. Navigate to Protection > Web Server Protection > Certificate or System > VPN > Certificate or Objects >
Identity > Certificate.
2.
Under the Manage column, click the download icon against the certificate you want to download.
Note:
• Only self-signed certificates and certificate signing requests can be downloaded.
• The certificate is downloaded as a .tar.gz file.
Revoke Certificate
Use the Certificate page to revoke the certificate.
1. Navigate to Protection > Web Server Protection > Certificate or System > VPN > Certificate or Objects >
Identity > Certificate.
2.
Under the Manage column, click the revoke icon to revoke a self-signed certificate if lost, stolen or updated.
The revoked certificate is automatically added to the Certificate Revocation List (CRL).
Note: You can download the revoked certificate and circulate it, if required.
Certificate Authority
The Certificate Authority page displays a list of all the certificate authorities. The list can be filtered based on the certificate authority name.
The device provides a facility to generate a local certificate authority as well as import certificates, signed by commercial providers, such as VeriSign.
A certificate signed by a certificate authority (CA) identifies the owner of a public key. Each communicating party may be required to present its own certificate signed by a CA verifying the ownership of the corresponding private key. Additionally, the communicating parties need to have a copy of the CA’s public key. In case a private key is lost or stolen or the information is changed, CA is responsible for revoking the certificate. CA also maintains the list of valid and revoked certificates.
After your CA has issued a certificate created by you or have a local certificate, you can upload it for use in VPN.
You can use a default CA, modify and re-generate it as per your requirement if you are not using any external CA.
Using this CA, you can generate a self-signed certificate and use it in the VPN policy.
Using a third party CA involves uploading:
• CA and root certificate
• Certificate
• CRL (Certificate Revocation List)
If the remote peer is using a certificate issued by the following third party CA, you are not required to upload CA:
• VeriSign
• Entrust
• Microsoft
Note: Default CA is regenerated automatically when it is updated.
The page provides option to:
•
•
| System | 305
•
Download Certificate Authority
Use the Certificate Authority page to download CA.
If you are using a local CA, you need to download CA and forward it to the remote peer.
1. Navigate to Protection > Web Server Protection > Certificate Authority or System > VPN > Certificate
Authority or Objects > Identity > Certificate Authority.
The Certificate Authority page displays the details of the default CA.
2.
Click the download icon to download the zip file.
Note: Default CA cannot be deleted.
Add Certificate Authority
To update and regenerate the default certificate, click on the default certificate.
•
•
Set CA Parameters
Use the Set CA Parameters page to update and regenerate any (editable) certificate.
The Set CA Parameters page allows you to manually enter details to add a new certificate authority.
1. Navigate to Protection > Web Server Protection > Certificate Authority or System > VPN > Certificate
Authority or Objects > Identity > Certificate Authority and click Add to add a new CA.
If you want to edit any other (editable) CA than the Default CA, click click the edit icon under Manage tab of the CA you want to modify.
2. Enter certificate authority details.
Name
Specify a name to identify the Certificate Authority.
Certificate File Format
Select format of the root certificate to be uploaded.
Available Options:PEM (Privacy Enhanced Mail): A format encoding the certificate in ASCII code.
The certificate, request, and private key are stored in separate files.DER: A binary format for encoding certificates. The certificate, request, and private key are stored in separate files.
Certificate
Specify full path from where the certificate is to be uploaded. Alternately, use Browse to select the path.
Private Key
Specify full path from where the Private Key is to be uploaded. Alternately, use Browse to select the path.
CA Passphrase
CA Passphrase for authentication. Passphrase must be at least 4 characters long.
Confirm CA passphrase for authentication.
3. Click Save.
Edit Default CA Parameters
Use the Edit Default CA Parameters page to update and regenerate the default certificate.
The Edit Default CA Parameters page allows you to manually enter certificate authority details.
1. Navigate to Protection > Web Server Protection > Certificate Authority or System > VPN > Certificate
Authority or Objects > Identity > Certificate Authority.
| System | 306
2.
Click on the icon under Manage tab of the default certificate that you want to update and regenerate.
3. Enter certificate authority details.
Name
Default. This name cannot be changed.
Country Name
Specify the name of the country where the device is installed.
State
Specify the name of the state where the device is installed.
Locality Name
Specify the name of the locality where the device is installed.
Organization Name
Specify the organization name, which will use this certificate..
Organization Unit Name
Specify the department/unit name, which will use this certificate.
Common Name
Specify the common name, e.g. the server's hostname.
Email Address
Specify the email address of the contact person for communication.
CA Passphrase
Specify a passphrase for the certificate authority. Passphrase must be at least 4 characters long.
Re-enter passphrase for confirmation.
4. Click Save.
Regenerating Certificate Authority
Use the Certificate Authority page to regenerate the default certificate.
1. Navigate to Protection > Web Server Protection > Certificate Authority or System > VPN > Certificate
Authority or Objects > Identity > Certificate Authority.
2.
Under the Manage column, click the Regenerate icon .
Note: Default CA is regenerated automatically when it is updated.
Certificate Revocation Lists
CA maintains the list of valid and revoked certificates. The page displays the list of available CRLs.
The Certificate Revocation Lists (CRL) page is a way to check the validity of an existing certificate. Certificates which are stolen, lost or updated are revoked by CA and CA publishes such revoked certificates in the revocation list.
VPN connection cannot be established using revoked certificates, hence it is necessary to update the CRL at regular intervals.
The page provides options to:
•
•
Adding a New CRL
Use the Certificate Revocation Lists page to add a new CRL.
If you are using an external certificate authority, you need to upload the CRL obtained from the external certificate authority.
| System | 307
1. Navigate to Protection > Web Server Protection > Certificate Revocation Lists or System > VPN >
Certificate Revocation Lists or Objects > Identity > Certificate Revocation Lists and click Add.
2. Enter certificate revocation list details.
Name
Specify a name to identify the CRL.
CRL File
Specify the CRL file to be uploaded. Browse to select the complete path.
3. Click Save.
The new CRL has been created and is added on the Certificate Revocation Lists page.
Downloading CRL
Use the Certificate Revocation List page to download the CRL.
Once a CA is generated, a default CRL is generated with name Default.tar.gz. Once you revoke the certificate, the details of the revoked certificate are added to the default file and are regenerated. You can download and distribute it, if required.
1. Navigate to Protection > Web Server Protection > Certificate Revocation Lists or System > VPN >
Certificate Revocation Lists or Objects > Identity > Certificate Revocation Lists.
2. Click Download" under the Manage column of the CRL to be downloaded.
A .zip file is downloaded.
3. Unzip the file to check the details.
Administration
System > Administration
Administration provides options to configure general settings of the device.
Available configurations:
•
: Settings allows configuring the port settings, login security settings, language settings and Admin
Console logon settings.
•
as custom zones. It also allows changing/resetting administrator password and adding/removing local service ACL rules.
•
: Central Management allows managing and monitoring the device through Central
Management if deployed in your organization.
•
: Application Programming Interface (API) allows third party applications to communicate with the device.
•
: Allows you to upload/view firmware versions downloaded.
•
: View status of module licenses and synchronize/renew module licenses.
•
: Backup and restore system data.
•
: Import/export device configuration from/to a text file.
•
: Update patterns for various modules like Sophos AV, IPS, WAF or set auto-update interval.
•
: Configure messages to notify users about problems or for sending alerts.
•
: Configure mail server and email settings for sending/receiving alert emails.
•
: Set time and date for the device.
•
: Configure SNMP agent, and community.
•
: Configure netflow for network bandwidth monitoring.
Settings
System > Administration > Settings
Use Settings page to make modifications in the general port settings and Admin login parameters. Make changes to the login parameters for restricting the local and remote users based on the time.
Admin Port Settings
Admin Console HTTP Port
Provide the port number to configure the HTTP port for Admin Console access.
Default: 80
Admin Console HTTPS Port
Provide the port number to configure the HTTPS port for secured Admin Console access.
Default: 4444
User Portal HTTPS Port
Provide the port number to configure the HTTPS port for secured User Portal access..
Default: 443
Certificate
Certificate to be used by User Portal and Captive Portal.
| System | 308
Figure 240: Admin Port Settings
Login Security (Remote Admins)
To prevent unauthorized access to the Admin Console and CLI, configure Lock Admin Session After, Logout
Admin Session After and Block Admin Login to block the access after a number of failed login attempts.
Lock Admin Session After
Configure inactivity time (in minutes) for the administrative session after which the device will be locked automatically. This configuration will be applicable to following components:
• Admin Console
• Telnet Console
• IPsec Connection Wizard
• Network Wizard
• Group Import Wizard
Default: 3 minutes
Logout Admin Session After
Configure time of admin inactivity in minutes after which the administrator will be logged out automatically.
Default: 10 minutes
Note: Logout Admin Session After value must be greater than Lock Admin Session After value.
Block Admin Login
Enable to block login to the Admin Console and CLI after a configured number of failed attempts within the configured time span.
Configure the number of allowed failed login attempts from the same IP address within the time limit.
Specify the number of minutes for which the administrator will not be allowed to login. The administrator account will be locked for the configured minutes if the allowed failed login attempts exceeds.
Figure 241: Login Security Settings
Administrator Password Complexity Settings
Password complexity can be configured to ensure that administrators are using secure passwords.
Enable password complexity settings to enforce following constraints:
• Minimum Password length. Configure minimum characters required in the password.
Default: 8 characters
• Require minimum one upper and lower case alphabet
• Require minimum one number (0 - 9)
• Require at least one special character e.g. @, $, %
• Password cannot be same as username.
Note: All the enabled constraints are applied to the password of the administrator user only.
Figure 242: Administrator Password Complexity Settings
Login Disclaimer Settings
The login disclaimer allows setting a written message that administrators must read and agree prior to logging on to the Admin Console and CLI for device administration. If a disclaimer is set, it must be accepted before the administrator can login.
Default disclaimer can be customized as per the requirement from the Messages page under System >
Administration > Messages. One can also review the customized message before setting.
| System | 309
| System | 310
Figure 243: Login Disclaimer Settings
Sophos Adaptive Learning
The product sends information periodically to Sophos which is used for the purpose of improving stability, prioritizing feature refinements, and protection effectiveness. It includes configuration and usage information, and
Application usage and threat data.
Configuration and usage data such as device information (e.g. model, hardware version, vendor), firmware version and license information (not the owner), features in use (status, on/off, count, HA status, Central Management status), amount of configured objects (e.g. count of hosts, policies), product errors, CPU, memory and disk usage (in percentage), is collected by default.
No user-specific information or personalized information is collected. The information is transmitted to Sophos over
HTTPS.
Send App & Threat data
Following application usage and threat data is gathered:
• Unclassified applications to improve and enlarge the network visibility and application control library.
• Data for IPS alerts, virus detected (also URL for which virus found), spam, ATP threats such as threat name, threat URL/IP, source IP, and applications used.
Figure 244: Sophos Adaptive Learning
Device Access
System > Administration > Device Access
Device access allows limiting the administrative access of the following device services from various default zones,
LAN, WAN, DMZ, VPN and custom zones:
• Admin Services – HTTP, HTTPS, Telnet, SSH
• Authentication Services – Client Authentication, NTLM, Captive Portal, Radius SSO
• Network Services – DNS, Ping/Ping6
• Other Services – Wireless Protection, SSL VPN, Web Proxy, User Portal, Dynamic Routing
Default ACL
When the device is connected and powered on for the first time, it will have a default access configuration.
Admin Services – HTTP (TCP port 80), HTTPS (TCP port 4444), Telnet (TCP port 23) and SSH (TCP port 22) services will be enabled for administrative functions in LAN and WiFi zone. HTTP (TCP port 80), HTTPS (TCP port
443), Telnet (TCP port 23) and SSH (TCP port 22) services will be enabled for administrative functions in WAN zone. HTTP (TCP port 80) services will be enabled for administrative functions in DMZ zone.
Authentication Services – Client Authentication (UDP port 6060), Captive Portal Authentication (TCP port 8090) and Radius SSO will be enabled for User Authentication Services in LAN and WiFi zone. User authentication services are not required for any of the administrative functions but required to apply user based internet surfing, bandwidth, and data transfer restrictions.
| System | 311
Network Services – Ping/Ping6 and DNS services will be enabled for LAN, WAN and WiFi zone.
Other Services – Web Proxy service will be enabled for LAN and WiFi zone. SSL VPN (TCP port 8443) service will be enabled for LAN, WAN, DMZ and WiFi zone. User Portal and Dynamic Routing service will be enabled for LAN and WAN zone.
Local Service ACL
Use access control to limit the access to the device for administrative purposes from the specific authenticated/trusted networks only.
Admin Services – Enable/disable access to the device using the following services from the specified zone: HTTP,
HTTPS, Telnet and SSH.
Authentication Services – Enable/disable the following services from the specified zone: Client Authentication,
Captive Portal, NTLM, Radius SSO.
Network Services – Enable/disable the following services from the specified zone: DNS, Ping/Ping6.
Other Services – Enable/disable the following services from specified zone: Wireless Protection, SSL VPN, Web
Proxy, User Portal and Dynamic Routing.
Figure 245: Local Service ACL
Local Service ACL Exception Rule
Use Local Service ACL exception rule to allow access to the device's admin services from a specified network/host.
The section displays a list of all the configured IPv4 and IPv6 Local Service ACL rules. The page provides options to add, update and delete rules.
Default Admin Password Settings
The device is shipped with one global super admin with the credentials – username & password as “admin”. Both the consoles – Admin Console and CLI – can be accessed with the same credentials. This administrator is always authenticated locally i.e. by the device itself.
Note: We recommend to change the password for this user name immediately after deployment.
You can change the default password from this section.
Username
The default admin username is –“admin”.
Current Password
Enter the current admin password.
New Password
Password - Specify new admin password.
Confirm Password - Repeat the specified new admin password to confirm it.
Reset to Default
Click to reset the password to the factory default password.
Figure 246: Default Admin Password Settings
Add Local Service ACL Exception Rule
Use Local Service ACL Exception Rule to allow access to the device's admin services from a specified network/ host.
You can add a Local Service ACL exception rule from this page.
1. Navigate to System > Administration > Device Access and click Add under Local Service ACL Exception
Rule
2. Enter rule details.
Rule Name
Specify a name to identify the rule.
Rule Position
Specify the position of the rule.
Description
Provide a description for the rule.
IP Family
Select the type of IP Family from the options available:
Available Options:IPv4IPv6
Source Zone
Select the source zone to which the rule applies.
Network / Host
Click Add New Item to select a host or network address to which the rule applies. You can also create a new network/host from this page by clicking Create New.
Services
Click Add New Item to select admin services to which the rule applies.
Available Options:HTTPHTTPSTelnetSSHWeb ProxyDNSPing/Ping6SSL VPNUser PortalDynamic
Routing
Action
Select an action for the rule traffic from the available options.
Available Options:AcceptDrop
| System | 312
| System | 313
Figure 247: Add Local Service ACL Exception Rule
3. Click Save.
Central Management
Sophos Firewall device can be centrally managed by the Sophos Firewall Manager, if deployed in your organization.
This page offers facilities to enable and configure Central Management settings.
1. Navigate to System > Administration > Central Management and check Enable Central Management .
2. Specify the IP Address/Domain for Central Management.
3. Device Management is enabled by default. The option allows you to configure communication settings for
Central management. You can disable Device Management if you do not want to manage the device, but want to use only Content Distribution using the Central Management.
4. Specify Communication Details.
Heartbeat Protocol
Select the Heartbeat protocol from the available options.
Available Options: Syslog (Recommended) HTTPS
The selected Heartbeat protocol specifies how the information will be provided to the Central Management.
Heartbeat Port
Specify the Heartbeat port if HTTPS is selected as the Heartbeat protocol.
Central Management receives heartbeat information on the specified port.
By default, the Heartbeat ports are:
| System | 314
• Syslog: 6514
• HTTPS: 443
5. Specify Configuration Synchronization settings.
Synchronization Mode
Specify the method to be used for sending configuration updates.
Available Options:Central Management will push configuration changes to the Device – Select if the device is directly connected to the Internet. In this case the Central Management keeps on passing updates to the device if any configurations are updated. Device will fetch configuration changes from Central
Management – Select if the device is behind a NAT device. In this case the device keeps on asking for configuration updates to the Central Management.
Connection Protocol
It is the protocol through which the updates are sent.
Port
It is the port on which the configuration updates are to be sent.
By default, the port is: 443
6. Configure Content Distribution settings.
Content Distribution
Enable to receive signature updates through Firewall Manager.
Content Distribution Port
Specify the port for Central Management when Central Management is configured as an update server for the device.
The device receives the signature updates on the specified port.
Default: 80
Note: It should be same as configured in Sophos Firewall Manager (SFM) and the option “Any
Device that has this Central Console configured as an Update Server” has to be checked on the SFM.
Figure 248: Central Management Settings
API
Application Programming Interface (API) is an interface which allows third party applications to communicate with the device. This page allows the Administrator to log on and log off users.
| System | 315
API Configuration
API Configuration
Enable to allow only authorized third-party solution providers like ISP, and system integrators to use API for logon and log-off process.
Default - Disabled
IP Address
Add the IP addresses allowed to place the XML log-on and log-off requests.
You will be able to add IP Address only if API Configuration is enabled.
Figure 249: API Configuration
API Explorer
Request XML String
Specify the XML content containing the configurations to enable user log on or log off.
Parse and Apply
Click to parse the XML content and apply the configurations.
Figure 250: API Explore
Sample XML Request Code
For all the requests, XML response will be displayed in a pop-up window.
<Request><LiveUserLogin><UserName>sophos</UserName><Password>sophos</
Password><IPAddress>10.21.18.15</IPAddress><MacAddress>00:0C:29:2D:D3:AC</
MacAddress> </LiveUserLogin></Request>
<Request><LiveUserLogout><Admin><UserName>admin</UserName><Password>admin</
Password></Admin><UserName>sophos</UserName><IPAddress>10.21.18.15</
IPAddress></LiveUserLogout></Request>
| System | 316
For versions prior to 10.6.1 MR-1
<Request><LiveUserLogout><UserName>sophos</UserName><IPAddress>10.21.18.15</
IPAddress></LiveUserLogout></Request>
Please use the below link to use API: https://<Device IP>/corporate/APIController?reqxml=<Add the XML request
here>
For example: https://<DeviceIP>/corporate/APIController?
reqxml=<Request><LiveUserLogin><UserName>sophos</UserName><Password>sophos</
Password><IPAddress>10.21.18.15</IPAddress><MacAddress>00:0C:29:2D:D3:AC</
MacAddress></LiveUserLogin></Request>
Note: When the user logs on using API, the client type of the users will display API Client on the Live
Users page.
Firmware
Use Firmware page to manage the firmware versions on your device.
Firmware (Not available in SFM)
Firmware section displays the list of available firmware versions downloaded. Maximum two firmware versions are available simultaneously and one of the two firmware versions is active.
This section provides options to upload or boot firmware.
Upload firmware
The administrator can upload a new firmware. Click to specify the location of the firmware image or browse to locate the file. You can simply upload the image or upload and boot from the image. The uploaded firmware is only active after the next reboot.
In case of Upload & Boot, firmware image is uploaded and upgraded to the new version, closes all sessions, restarts, and displays the login page. This process may take few minutes since the entire configuration is also migrated in this process.
Boot from firmware
This option offers to boot from the downloaded image and activate the respective firmware.
Boot with factory default configuration
Device is rebooted and loads default configuration.
Note: The entire configuration will be lost if this option is selected.
Active
Active icon against a firmware suggests that the device is using that firmware.
Available Latest Firmware
(Not available in SFM)
Check For New Firmware
Displays if any new firmware is available.
Firmware Version
List of available firmware versions that can be downloaded.
Type
Displays the the type of the respective firmware.
Available Options:BetaGA
Actions
Click Download to download the firmware. Once the firmware is downloaded, click Install to install the firmware.
| System | 317
Figure 251: Available Latest Firmware
SFOS Hot-fix
Allow auto-install of important Hot-fixes
Hot-fixes are applied automatically if available. Disable if you do not want to apply hot-fix.
Default: enabled
Figure 252: SFOS Hot-Fix
Factory Reset and Change Language
Default Configuration Language
Select the language for configuration.
Default: English
Available Options:EnglishHindiChinese - TraditionalChinese - SimplifiedFrenchJapanese
Figure 253: Factory Reset and Change Language
Licensing
All the modules are unsubscribed when you deployment the device for the first time.
The System > Administration > Licensing page provides options to view device registration details, subscribe and synchronize module subscriptions.
Basic Information
The device consists of 2 types of modules:
• Basic module: Firewall, VPN, Wireless.
• Subscription modules:
• Essential Firewall - Includes Firewall, VPN, Wireless
• Network Protection - Includes Intrusion Prevention System, RED, Advanced Threat Protection
• Web Protection - Includes Web Categorization, Anti Virus, Application Control
• Email Protection - Includes Anti Spam, Anti Virus, Email Encryption, DLP
• Webserver Protection - Includes WAF, Anti Virus, Reverse Proxy
• Enhanced Support - 8 x 5
• Enhanced Plus Support - 24 x 7
Once registered, the device can be used for an indefinite time period. However, subscription modules need to be subscribed before use.
You can subscribe to any of the subscription modules:
• without key for free 30-days trial subscription
• with key
Device Registration Details
Model
Device model number which is registered and its device key.
Licensed Users (if applicable)
Number of user licenses purchased.
Company Name
Name of the company under which the device is registered.
Contact Person
Name of the contact person in the company.
Registered Email Address
Email address used for device registration.
Module Subscription Details
Module
Name of the Module.
Status
Indicates the status of the module.
A module can have the following status
• Active - Module is subscribed.
• Unsubscribed - Module is not subscribed.
• Grace - Module is about to get expired. This status is shown 15 days before the expiration date.
• Expired - Subscription expired.
Expiration Date
Module subscription expiry date.
Manage Module Subscription Online
Modules can be subscribed directly from your device or from Customer portal. Once you subscribe, you need to synchronize licenses with your customer account.
Click Synchronize to synchronize licenses with your account.
Figure 254: Manage Module Subscription Online
| System | 318
Backup & Restore
Backup is the essential part of data protection. No matter how well your system is treated, no matter how much it is taken care of, you cannot guarantee that your data is safe, if it exists only at one place.
Backups are necessary in order to recover data from loss due to disk failure, accidental deletion or file corruption.
There are many ways of taking backup and just as many types of media to use as well.
Backup consists of all the policies and all other user related information.
Device facilitates to take back-up only of the system data, either through scheduled automatic backup or using a manual backup.
Once the backup is taken, the file for restoring the backup must be uploaded for restoring the configuration.
Below are the screen elements with their description:
Backup
Backup Mode
Select how and to whom backup files should be sent.
Available Options:
Local - Backup is taken and stored on the Device itself.FTP - Configure FTP server IP Address (IPv4/IPv6), login credentials and FTP path. Email - Configure Email Address on which backup is to be mailed. You can configure multiple Email Addresses.
Backup Prefix
Specify backup file name (prefix). The backup file name format is as follows:
• With Prefix: <Prefix>_Backup_<Device Key>_<timestamp>
For example:
Dallas_Backup_ABCDEY190_26Nov2014_12.09.24
NY_Backup_ABCDEY190_26Nov2014_12.09.24
• Without Prefix(Default): Backup_<Device Key>_<timestamp>
For example:
Backup_ABCDEY190_26Nov2014_12.09.24
If prefix is not provided, the default format is used for backup file.
Backup Prefix will be useful in case you need to take backup from multiple devices.
Frequency
Select the system data backup frequency.
In general, it is best to schedule backup on regular basis. Schedule can be determined depending on how much information is added or modified.
Available Options:
Never - Backup will not be taken at all Daily - Backup will be taken every day Weekly - Backup will be taken every week Monthly - Backup will be taken every month
Schedule
Specify the day/date and time for Daily, Weekly and Monthly backup.
| System | 319
| System | 320
Backup Now
Click to take the backup of system data till date.
Download Now (Only for Local Backup Mode)
Click to download the latest backup that is available for uploading.
Figure 255: Backup
Backup Restore
Restore Configuration
Use Browse to select the complete path of the backup file to be restored.
Upload and Restore
Click to upload and restore the configuration.
Figure 256: Backup Restore
Note: Restoring data older than the current data results in the loss of current data.
Import Export
Import Export page allows administrator to export device configuration to a text file and import configuration from a text file to device. The contents of the text file are in human readable XML format and hence the contents could be updated offline. The updated configurations could then be imported on another compatible device.
Administrators can choose to export/import all/few of the device configurations. Also, configurations exported from one device can be imported on same/another device model.
Below are the screen elements with their description:
Import
Import File
Use Browse button to select the complete path of the tar file to be imported.
Import Type
Select import type.
Available Options:
• Preserve existing configuration - Device existing configuration will be preserved.
Note: Entities with same name in existing configuration will be updated with the imported entity configuration and new Entities will be added.
For example:
If you have a Network Traffic Quota Policy with name “Daily 10 MB” in both the existing and imported configuration then the existing policy configuration will be updated with the imported configuration. Any new policies in the imported configuration will also get added.
• Overwrite existing configuration - Device will reboot with factory default configuration and existing entity configuration will be overwritten with the entity configuration in the XML file.
Import
Click to import the configuration on the device.
| System | 321
Figure 257: Import Configuration
Export
Export full configuration
Select to export all the entities configuration to a text file.
Export selective configuration
Select to export only selected entities configuration. Click Add New Item to select entities and apply to add the selected entities.
Dependent entities for the selected entity will also be exported if Include dependent entity is selected.
Export
Click to export the configuration from the device.
Figure 258: Export Configuration
Updates
By default pattern are updated automatically. The Updates page displays the status of patterns used by various modules of your device like Sophos AV, IPS and Application Signature, WAF. The page also provides options to update patterns or set an auto-update time interval.
Updates Status
Pattern
Name of the pattern.
Current Version
Version of the pattern in use.
Available Version
Upgrade version if available
Last Successful Update
Status along with the date of the last update.
Update Pattern Now
Click to update the pattern definitions.
Figure 259:
Pattern Download/Installation
Auto Update
Enable this option to update pattern definitions automatically.
Interval (only applicable if Auto Update is set off)
Set the time limit in which you want to receive updates.
Available Options: Every hourEvery 2 hoursEvery 4 hoursEvery 12 hoursDailyEvery 2 days
Apply
Click to save the setting for the pattern download/installation.
Figure 260: Pattern download/installations
| System | 322
| System | 323
Messages
The Messages page allows the administrator to send messages to the various users. Messages help the administrator to notify users about problems and issue administrative alerts in respect to access, user sessions, incorrect password, and successful log-on and log-off etc.
Message, up to 256 characters can be sent to a single user or multiple users simultaneously, whenever an event occurs.
Click the Edit icon against the message to be customized, update the message and click the Apply icon to save the edited message or click Reset icon to reset it to the default message.
Predefined Messages
Authentication
User account blocked (AD Policy)
Login failed. Your AD Server account is locked.
User account disabled (AD Policy)
Login failed. Your account on AD server is disabled.
User account expired (AD Policy)
Login failed. Your account on AD server has expired.
Clientless User Login Not Allowed
Clientless user is not required to login.
Data Transfer Exhausted
Your data transfer has been exceeded. Please contact the administrator.
Deactive User
You have been deactivated by the administrator.
Delete User
You have been disconnected.
Disconnect User
You have been disconnected by Admin.
Guest User Validity Expired
User validity expired.
Login not allowed at this time (AD Policy)
Login failed. You are not permitted by AD server to login at this time.
Invalid Machine
Message is sent if user tries to login from an IP address not assigned to him/her
Login not allowed at this workstation (AD Policy)
Login failed. You are not permitted by AD Server to login at this workstation.
Someone else is logged in from the same IP address
Message is sent if someone else has already logged with the same IP address.
Logged Off Successful Message
Message is sent when user logs off successfully.
Logged On Successful Message
Message is sent when user logs on successfully.
Max Login Limit
Message is sent if user has reached the maximum login limit.
Not Authenticate
Message is sent if user name or password is incorrect.
Not Currently Allowed
Message is sent if user is not permitted to access at this time
Access time policy applied to the user account defines the allowed access time and blocks access at any other time.
User password expired (AD Policy)
Login failed. Your password on AD server has expired.
User needs to reset the Password (AD Policy)
Login failed. You must reset your AD server password.
Logged Off Due To Session Time Out
Message is sent when session has timed out and user is logged of automatically.
Surfing Time Exhausted
Message is sent when user is disconnected because his/her allotted surfing time is exhausted.
The surfing time is the time in hours the user is allowed Internet access that is defined in the surfing time policy.
If hours are exhausted, the user is not given access.
Surfing Time Expired
The administrator has temporarily deactivated the user and will not be able to log in because the user's surfing time policy has expired.
Logout Notification
You will be logged off automatically after sometime. If you wish to continue browsing tap this notification.
| System | 324
Figure 261: Authentication Predefined Messages
SMTP
CTIPD Rejection
Message will be sent when the administrator has blacklisted the sender’s IP address.
CTIPD Temporary Rejection
Message will be sent when the administrator has temporarily blacklisted the sender’s IP address.
Probable Spam Rejection
Message will be sent when mail is suspected as probable spam mail and is rejected.
Probable Virus Outbreak Rejection
Message will be sent when outbreak detection engine rejects mail because it seems to be a probable virus outbreak.
Spam Rejection
Message will be sent when spam mail is rejected.
Virus Outbreak Rejection
Message will be sent when outbreak detection engine rejects mail because it is identified as a virus outbreak.
| System | 325
DPP Rejection
Message will be sent when mail is rejected by Sophos Data Protection Engine.
Email Domain Rejection
Message will be sent when the administrator has blocked the mail sender domain.
Destination IP Address Rejection
Message will be sent when the administrator has blocked the destination IP.
Spam Mail Rejection
Message will be sent when the administrator has blocked the mail sender.
Mail Header Rejection
Message will be sent when a mail is rejected as it contains a restricted mime header.
Mail/Virus Rejection
Message will be sent when a virus infected mail is rejected.
IP Address Rejection
Message will be sent when the administrator has blocked the mail sender IP.
Oversized Mail Rejection
Message will be sent when a mail is rejected because the message size exceeds the maximum allowed size.
Undersized Mail Rejection
Message will be sent when a mail is rejected because the message size is less than the allowed size.
Delivery Notification (to Sender)
Message will be sent to the mail sender when a mail is successfully delivered to the receiver.
Attachment Infection
Message will be sent when a mail is rejected due to a virus infected attachment.
RBL Rejection
Message will be sent when the sender IP address is blacklisted.
Source IP Address Rejection
Message will be sent when a mail is rejected because the source IP has been blocked.
Suspected Infection
Message will be sent when a mail is suspected as virus infected mail and is rejected.
| System | 326
Figure 262: SMTP Predefined Messages
| System | 327
| System | 328
Administration
Disclaimer Message
Message will be displayed when the administrator logs on to the Admin
Message will be displayed when Administrator logs on to the Admin Console or CLI. Administrator has to accept the disclaimer to proceed further.
Figure 263: Administration Predefined Messages
SMS Customization
Default SMS Text
Display a default SMS to be sent to the guest user.
Figure 264: SMS Customization Predefined Messages
Notification
The device allows configuration of email notifications for certain system-generated events and reports (as specified by administrator). Such email notifications can be configured to inform administrator about:
• Change in gateway status
• Change in HA (high availability) link status (if HA cluster is configured)
• Change in state of IPsec tunnel(s)
The Notification page provides options to configure a mail server IP address, port, and email address for the device to send and receive alert emails.
Mail Server Settings
Mail Server IPv4 Address/ FQDN - Port
Specify the mail server IPv4 address or FQDN address and port number.
Default: 25
Authentication Required
Enable to authenticate the user before sending an email.
Specify user credentials.
Username
Specify the user name, which uniquely identifies the user and will be used for login.
Password
Specify the password.
Connection Security
Select connection security mode to be used for establishing a secured connection between an SMTP client and the
SMTP server for SMTP mail notification.
Available Options:
• None – Select if your SMTP server does not support TLS (Transport Layer Security), or a secured connection between SMTP client and the SMTP server is not required. If selected, a normal TCP connection is established, without any security.
• STARTTLS – SMTP client establishes a TCP connection with the SMTP server to learn about the TLS capabilities of the server. If the SMTP server supports STARTTLS, the connection is upgraded to TLS. If the
SMTP server does not support STARTTLS, the SMTP client continues to use the normal TCP connection.
• SSL/TLS – SMTP client establishes a TLS connection with the SMTP server. In case the SMTP server does not support TLS, no connection is established between the SMTP client and the SMTP server.
Default: None
Certificate
Select a certificate to be used for authentication by the SMTP client and the SMTP server.
Default: ApplicanceCertificate
| System | 329
Figure 265: Mail Server Settings
Email Settings
From Email Address
Specify the email address from which the notification is to be mailed.
Send Notifications to Email Address
Specify the email address to which the notification is to be mailed.
Figure 266: Email Settings
Email Notification
IPsec Tunnel UP/Down
Enable to receive an email notification if the IPsec VPN tunnel connectivity is lost.
Email alerts are sent to the administrator on the configured email address. All the IPsec tunnels follow the single configuration made from this page.
An email is sent only for Host to Host and Site to Site tunnel connections; if it flaps due to one of the following reasons:
• A peer is found dead (DPD)
• Failed to re-establish connection after Dead Peer Detection (DPD)
• IPsec Security Association (SA) is expired and is required to be re-established.
• IPsec tunnel comes up without administrator intervention after losing the connectivity.
The email has to contain following basic information:
• IPsec connection name
• IP Addresses of both participating hosts/network
• Current state of the IPsec Tunnel connection, viz, Up or Down
• Time when IPsec tunnel was disconnected
• Reason for lost of IPsec tunnel connection
• Device model number
• Firmware version and build number
• Device key (if registered)
• Device LAN IP address
• HA configuration – Primary/Auxiliary (if configured)
Note:
• An email is sent for each subnet pair in case of Site to Site connections, having multiple local/remote networks.
• An email sent with respect to IPsec tunnel coming up; do not have any reason mentioned within.
• Description of IPsec tunnel connection is included in the email, only if the information for same is provided by the administrator.
| System | 330
Figure 267: Email Notification
Test Mail
Click and provide following details to verify whether the email address is valid or not.
• From – Email address of the sender.
• To – Email address of the recipient.
• Subject – Subject stating the purpose of the email.
• Body – Message to be sent via email.
Click Send to send out the email.
Note: Mail server configuration changes automatically when changed from the Network Configuration
Wizard and vice versa.
Time
A precise time is a prerequisite for the right timing of system processes as well as for correct logging.
Device current date and time can be set according to the device’s internal clock or synchronized with an NTP server.
The device clock can be tuned to show the right time using global time servers so that logs show the precise time and device internal activities can also happen at a precise time.
The Time page provides options to set time/date of the device and synchronize it with an NTP server,
Current Time
Displays the current system time.
Time Zone
Select time zone according to the geographical region in which the device is deployed.
Use pre-defined NTP Server
Select to use the pre-defined NTP servers – asia.pool.ntp.org & in.pool.ntp.org.
NTP stands for Network Time Protocol, and it is an Internet standard protocol used to synchronize the clocks of device.
Use Custom NTP Server
Specify the NTP server IPv4 address or IPv6 address or domain name to synchronize time with it. If a custom
NTP server is defined, time is synchronized with the custom server and not with pre-defined servers.
The devices use NTP version 3 (RFC 1305). You can configure up to 10 NTP servers. At the time of synchronization, it queries each configured NTP server sequentially. When the query to the first server is not successful, the device queries a second server and so on until it gets a valid reply from one of the NTP servers configured.
Sync Now
Click to synchronize the device clock with the NTP server.
Do not use NTP Server
Select to configure the date and time for the device’s clock.
Date
Specify the date by clicking the calendar .
Time
Specify the time in HH:MM:SS format.
| System | 331
Figure 268: Setting Device's Date and Time
SNMP
Simple Network Management Protocol (SNMP) is used as the transport protocol for network management. Network management consists of a station or manager communicating with network elements such as hosts, routers, servers, or printers. The agent is the software on the network element (host, router, and printer) that runs the network management software. In other words, the agent is the network element. The agent will store information in a
Management Information Base (MIB). Management software will poll the various network elements/agents and get the information stored in them. The manager uses UDP port 161 to send requests to the agent and the agent uses UDP port 162 to send replies or messages to the manager. The manager can ask for data from the agent or set variable values in the agent. Agents can reply and report events.
| System | 332
SNMP collects information in two ways, if an SNMP agent is installed on the devices:
• The SNMP management station/manager will poll the network devices/agents.
• Network devices/agents will send trap/alert to the SNMP management station/manager.
SNMP terms
• Trap - An alert that is sent to a management station by agents.
• Agent - A program at devices that can be set to watch for some event and send a trap message to a management station if the event occurs
• SNMP community – An SNMP community is the group that devices and management stations running SNMP belong to. It helps to define where information is sent to. The community name is used to identify the group.
A SNMP device or agent may belong to more than one SNMP community. It will not respond to requests from management stations that do not belong to one of its communities.
Use SNMP to configure the agent and the community. The device supports SNMPv1& SNMPv2c protocols. The
Agent Configuration section offers facilities to configure agent name, agent port and the contact person for the program. The Community section provides options for adding, managing and deleting the communities for protocols
SNMPv1 and SNMPv2c. Apart from IPv4 addresses, SNMP now also supports IPv6 addresses.
Agent Configuration
Use Agent Configuration section to configure SNMP agents. The configuration details include name, description, location, contact person, agent port and manager port.
Enable SNMP Agent
Select to enable SNMP Agent.
Name
Specify a name to identify the agent.
Description
Specify a description for the agent.
Location
Specify the physical location of the device.
Contact Person
Specify the contact information of the person responsible for the maintenance of above specified device.
Agent Port
Specify the port which the device should use to send traps.
Default: 161
Manager Port
Remote SNMP management station/manager uses this port to connect to the device.
Default: 161
| System | 333
Figure 269: Agent Configuration
Community
Community is a group of SNMP managers. A SNMP agent may belong to one or more than one community. Agents do not respond to the requests from management stations that do not belong to its communities.
Each community can support SNMPv1, SNMPv2c or both. The device sends traps to all the communities. You must specify a trap version for each community.
The section provides a list of all the communities added and you can sort the list based on the community name. The section also provides the option to add a new community, update the parameters of the existing community, or delete the community.
Add SNMP Community
You can add an SNMP community from this page.
1. Navigate to System > Administration > SNMP > Communityand click Add.
2. Enter community details.
Name
Enter the name to identify the community.
Description
Enter the description for the community.
IP Address
Specify the IP address (IPv4/IPv6 address) of the SNMP manager.
Protocol Version
Select the required SNMP protocol version support.
SNMP v1 and v2c compliant SNMP managers have read-only access to device system information and can receive device traps.
Trap Support
Select the required version for trap support.
Traps will be sent to the SNMP managers who support the specified versions only.
| System | 334
Figure 270: Add SNMP Community
3. Click Save.
Netflow
Netflow is a flow technology used for network bandwidth monitoring. Details of the traffic passing through the security policies can be exported as Netflow records to the Netflow server. Based on the records received by the
Netflow server, data analyzing tools like Open Source Data Analyzer and PRTG software can generate reports.
The Netflow page displays a list of configured netflow servers. The page also provides options to add, update, or delete the servers.
Netflow Configuration
Server Name
Specify a unique name for the Netflow server.
Netflow Server IP/Domain
Specify the IP address (IPv4 / IPv6) or domain name of the Netflow server.
Netflow Server Port
Specify the UDP port number for communication with the Netflow server. Netflow records will be sent on the specified port.
Default: 2055
Figure 271: Netflow
Note:
• Only traffic of security policies with Log Firewall Traffic enabled will be sent to the Netflow server.
• You can configure maximum five Netflow servers.
• Sophos supports Netflow v5 and all the parameters of v5 can be exported.
| System | 335
Authentication
Authentication menu allows basic authentication settings for the device.
Use this menu to configure below details:
•
on page 335: Manage external servers for authentication
•
on page 343: Download clients from different platforms to interact with the device
•
: Define authentication servers for the administrators and end-users logging through
device, VPN, Captive Portal.
•
on page 352:Set up policies and assign them to a number of users in one step
•
on page 355: Manage user accounts for access to the device
•
on page 360: Manage user accounts for clientless access
•
on page 363: Manage users accessing the device without user account
•
: Customize Captive Portal through which users can login.
•
: Guest user settings allows configuring general parameters to provide secured Internet access
for guest user.
•
on page 102:Enable/disable hotspots
•
on page 381: Make pre-defined settings for hotspot access
Authentication Server
On this page you can manage databases and backend servers of external user authentication services. External user authentication allows you to validate user accounts against existing user databases or directory services on other servers of your network.
Objects > Assets > Authentication Server
Authentication services currently supported are:
• Novell's eDirectory
• Microsoft's Active Directory
• RADIUS
• TACACS+
• LDAP
The page displays all existing authentication servers. You can add an authentication server, update or delete them.
Following is a description of the table elements:
Name
Displays the name of the authentication server.
IP
Displays the IP address of the authentication server.
Port
Displays the port of the authentication server.
Type
Displays the type of the authentication server.
Domain/Admin
Displays the domain or admin of the authentication server.
Manage
Displays the available managing options for the authentication server:
• Edit: Allows you to edit the authentication server.
• Delete: Allows you to delete the authentication server.
| System | 336
To either add or delete a authentication server, click on the corresponding buttons.
Add External Server
On this page you can create one or more authentication servers. Follow the links to create them:
Active Directory
Active Directory (AD) is Microsoft's implementation of a directory service and is a central component of Windows
2000/2003 servers. It stores information about a broad range of resources residing on a network, including users, groups, computers, printers, applications, services, and any type of user-defined objects. As such it provides a means of centrally organizing, managing, and controlling access to these resources. The Active Directory authentication method allows you to register Sophos Firewall OS at a Windows domain, thus creating an object for Sophos Firewall
OS on the primary domain controller (DC). Sophos Firewall OS is then able to query user and group information from the domain.
Note: Sophos Firewall OS supports Active Directory 2003 and newer.
LDAP
LDAP, an abbreviation for Lightweight Directory Access Protocol, is a networking protocol for querying and modifying directory services based on the X.500 standard. Sophos Firewall OS uses the LDAP protocol to authenticate users for several of its services, allowing or denying access based on attributes or group memberships configured on the LDAP server.
RADIUS
RADIUS, the acronym of Remote Authentication Dial In User Service is a widespread protocol for allowing network devices such as routers to authenticate users against a central database. In addition to user information,
RADIUS can store technical information used by network devices, such as supported protocols, IP addresses, routing information, and so on. This information constitutes a user profile, which is stored in a file or database on the RADIUS server. The RADIUS protocol is very flexible, and servers are available for most operating systems.
The RADIUS implementation on Sophos Firewall OS allows you to configure access rights on the basis of proxies and users. Before you can use RADIUS authentication, you must have a running RADIUS server on the network.
Whereas passwords are encrypted using the RADIUS secret, the username is transmitted in plain text.
TACACS+
TACACS+ (the acronym of Terminal Access Controller Access Control System) is a proprietary protocol by Cisco
Systems, Inc. and provides detailed accounting information and administrative control over authentication and authorization processes. Whereas RADIUS combines authentication and authorization in a user profile, TACACS
+ separates these operations. Another difference is that TACACS+ utilizes the TCP protocol (port 49) while
RADIUSClosed uses the UDPClosed protocol.
eDirectory
Novell eDirectory is an X.500 compatible directory service for centrally managing access to resources on multiple servers and computers within a given network. eDirectory is a hierarchical, object-oriented database that represents all the assets in an organization in a logical tree. Those assets can include people, servers, workstations, applications, printers, services, groups, and so on.
on page 341
| System | 337
Add Active Directory Server
Use the Add External Server page to configure Active Directory server settings.
The Add External Server page provides options to configure Active Directory which in turn allows the device to map the users and groups from ADS for the purpose of authentication.
1. Navigate to Objects > Assets > Authentication Server or System > Authentication > Authentication Server and click Add.
2. On the Add External Server page, select Active Directory for Server Type. If a user is required to authenticate using AD, the device needs to communicate with the AD server for authentication.
3. Enter Active Directory details.
Server Name
Enter a descriptive name for the Active Directory server.
Server IP/Domain
Enter an IP address or domain for the Active Directory server.
Port
Enter the port of the Active Directory server. By default, this is port 389.
NetBIOS Domain
Enter a NetBIOS domain for the Active Directory server.
ADS Username
Enter a username for the admin user of the Active Directory server.
Password
Enter a password for the admin user of the Active Directory server.
Connection Security
Select the type of security to be implemented on the established connection. It provides a method to login to the external server by sending the username and password in encrypted format instead of clear text. We strongly recommend using the encryption method to protect user credentials.
• Simple: User credentials will be send unencrypted, for example, as clear text.
• SSL: Secure Sockets Layer. This is the most common method used for secured connection. The Port will then change from 389 (LDAPClosed) to 636 (ldaps = LDAP over SSL).
• TLS:
Validate Server Certificate
(not with Simple connection security)
Enable to validate the certificate on the external server.
Display Name Attribute
(optional)
Enter the name for the AD server which is displayed as AD username.
Email Address Attribute
(optional)
Enter the alias for the configured email address which is displayed to the user.
Domain Name
Specify the domain name for which the query is to be added.
Search Queries
Click Add to enter the search query. Use the Move Up and Move Down buttons to move the search queries in the list. Use Remove to remove the selected item.
If you do not know search DN, refer to NetBIOS name, FQDN and Search DN.
| System | 338
Figure 272: Add Active Directory Server
4. Click Test Connection to check the connectivity between the Active Directory server and the Sophos Firewall. It also validates Active Directory server user credentials.
5. Click Save.
The AD server is now available and appears in the Authentication Server list.
Add LDAP Server
This page describes how to add a LDAP server.
1. Navigate to System > Authentication > Authentication Server or Objects > Assets > Authentication Server and click Add.
2. Select the server type as LDAP Server.
3. Enter values for the following settings:
Server Name
Enter a descriptive name for the LDAP server.
Server IP/Domain
Enter an IP address or domain for the LDAP server.
Port
Enter the port of the LDAP server. By default, this is port 389.
| System | 339
Version
Select the version of the LDAP server. Default - 3
Anonymous Login
Enable to send anonymous requests to the LDAP server. Disable to bind user with the server.
Username
(not with Anonymous Login)
Enter a name for the bind user.
Password
(not with Anonymous Login)
Enter a password for the bind user.
Connection Security
Select the connection security for the LDAP server:
• Simple: User credentials will be send unencrypted, for example, as clear text. This connection security is selected by default.
• SSL: Secure Sockets Layer. This is the most common method used for secured connection. The Port will then change from 389 (LDAPClosed) to 636 (ldaps = LDAP over SSL).
• TLS: Transport Layer Security. Same secure connection as SSL but uses the default port.
Validate Server Certificate
(not with Simple Connection Security)
Enable to validate the certificate on the external server.
Client Certificate
Select a client certificate from the list to establish a secured connection. If you do not want a client certificate, select None. Default - Appliance Certificate
Note: You can manage client certificates under Protection > Web Server Protection > Certificate or System > VPN > Certificate or Objects > Identity > Certificate.
Base DN
Enter the Base DN for the LDAP server. The Base DN is the starting point relative to the root of the
LDAP tree where the users are included who are to be authenticated. Note that the Base DN must be specified by the Fully Distinguished Name (FDN) in LDAP notation, using commas as delimiters (e.g.,
O=Example,OU=RnD).
Get Base DN
Click Get Base DN if you are not aware about the Base DN. The Base DN is automatically retrieved from the directory.
Authentication Attribute
Enter an authentication attribute for searching the LDAP directory. The user authentication attribute contains the actual login name each user is prompted for, for example by remote access services.
Display Name Attribute
Enter the name for the LDAP server which is displayed as LDAP username.
Email Address Attribute
Enter the alias for the configured email address which is displayed to the user.
Group Name Attribute
Enter the alias for the configured group name which is displayed to the user.
Expire Date Attribute
Enter the user expire date displayed to the user. The attribute specifies how long a user account is valid.
Figure 273: Add LDAP Server
4. Click Test Connection to check the connectivity between LDAP and the Sophos Firewall OS. It also validates
LDAP user credentials.
5. Click Save.
The LDAP server is now available and appears in the Authentication Server list.
Add RADIUS Server
This page describes how to add a RADIUS server.
1. Navigate to System > Authentication > Authentication Server or Objects > Assets > Authentication Server and click Add.
2. Select the server type RADIUS Server.
3. Enter values for the following settings:
Server Name
Enter a descriptive name for the RADIUS server.
Server IP
Enter an IP address for the RADIUS server.
Authentication Port
Enter the authentication port of the RADIUS server. By default, this is port 1812.
Enable Accounting
Enable accounting on RADIUS server.
Sophos Firewall OS sends the following information to the RADIUS server as soon as the user logs in:
• Accounting start request
• User login time
Sophos Firewall OS sends the following information to the RADIUS server the moment the user logs out:
| System | 340
• Accounting stop request
• User logout time
Note: Supported client types: Windows Client, HTTP Client, Linux Client, Android, iOS, iOS
HTTP Client, Android HTTP Client, API Client.
Note: The accounting stop message is not sent to the RADIUS server when Sophos Firewall OS shuts down or reboots.
Accounting Port
(only if Enable Accounting is active)
Enter a RADIUS port number through which the Sophos Firewall OS can communicate with RADIUS.
Shared Secret
Enter the shared secret which is a text string that serves as a password between a RADIUS client and a
RADIUS server.
Group Name Attribute
Enter the alias for the configured group name which is displayed to the user.
| System | 341
Figure 274: Add RADIUS Server
4. Click Test Connection to check the connectivity between the RADIUS server and the Sophos Firewall. It also validates RADIUS server user credentials.
5. Click Save.
The RADIUS server is now available and appears in the Authentication Server list.
Add eDirectory Server
This page describes how to add a eDirectory server.
1. Navigate to Objects > Assets > Authentication Server or System > Authentication > Authentication
Serverand click Add.
2. Select the server type eDirectory.
3. Enter values for the following settings:
Server Name
Enter a descriptive name for the eDirectory server.
Server IP/Domain
Enter an IP address or domain for the eDirectory server.
Port
Enter the port of the eDirectory server. By default, this is port 389.
| System | 342
Username
Enter a username for the eDirectory server.
Password
Enter a password for the eDirecory server.
Connection Security
Select the connection security for the eDirectory server:
• Simple: User credentials will be send unencrypted, for example, as clear text.
• SSL: Secure Sockets Layer. This is the most common method used for secured connection. The Port will then change from 389 (LDAPClosed) to 636 (ldaps = LDAP over SSL).
• TLS: Transport Layer Security. Same secure connection as SSL but uses the default port.
Base DN
Enter the Base DN for the eDirectory server. The Base DN is the starting point relative to the root of the eDirectory tree where the users are included who are to be authenticated. Note that the Base DN must be specified by the Fully Distinguished Name (FDN) in LDAP notation, using commas as delimiters (e.g.,
O=Example,OU=RnD).
Get Base DN
Click Get Base DN if you are not aware about the Base DN. The Base DN is automatically retrieved from the directory.
Figure 275: Add eDirectory Server
4. Click Test Connection to check the connectivity between the eDirectory server and the Sophos Firewall. It also validates eDirectory server user credentials.
5. Click Save.
The eDirectory server is now available and appears in the Authentication Server list.
Add TACACS+ Server
This page describes how to add a TACACS+ server.
1. Navigate to Objects > Assets > Authentication Server or System > Authentication > Authentication Server and click Add.
2. Select the server type TACACS+ Server.
3. Enter values for the following settings:
Server Name
Enter a descriptive name for the TACACS+ server.
Server IPv4
Enter an IP address for the TACACS+ server.
Port
Enter the port of the TACACS+ server. By default, this is port 49.
Shared Secret
Enter the shared secret which is a text string that serves as a password between a TACACS+ client and a
TACACS+ server.
| System | 343
Figure 276: Add TACACS+ Server
4. Click Test Connection to check the connectivity between the TACACS+ server and the Sophos Firewall OS. It also validates TACACS+ server user credentials.
5. Click Save.
The TACACS+ server is now available and appears in the Authentication Server list.
Authentication Clients
Authentication Clients page contains links to download all the clients or add-ins needed to interact with Device.
Device provides various options for user authentication. All the users are authenticated before they are provided access to network resources. User authentication can be performed using a local database, Active Directory, LDAP,
RADIUS, TACACS, eDirectory, NTLM or combination of these. Device also supports Single Sign On (SSO) for transparent authentication whereby windows credentials can be used to authenticate and user has to login only once to access network resources. SSO can be used in Active Directory and Citrix or Terminal Services Environment.
Users can authenticate with Device using Captive Portal, Authentication Clients for Windows, Linux, Macintosh,
Android and iOS platforms or Single Sign On (SSO).
You can download the following clients from this page:
Single Sign-On
Sophos Single Sign-On Client - Enables Users to logon to the organization network as well as Device simultaneously. This requires client installation on the user’s machine.
Sophos Transparent Authentication Suite - Enables transparent authentication whereby windows credentials can be used to authenticate and user has to login only once to access network resources. This does NOT require client installation on the user’s machine.
Sophos Authentication for Thin Client - Enables transparent authentication for users in Citrix or Terminal Services
Environment whereby network credentials can be used to authenticate and user has to login only once to access network resources. This does NOT require client installation on the user’s machine.
Authentication Clients
Download MSI Enables Admins to install authentication clients via Microsoft Installer to multiple user devices to access network resources and the Internet as per the policies configured in the Device.
| System | 344
Download CA for MSI Download the Digital Certificate to be installed via MSI to ensure a safe connection with the
Device.
Download for Windows - Enables Users using Windows Operating System to logon to the Device to access network resources and the Internet as per the policies configured in the Device.
Download for MAC OS X - Enables Users using system with Macintosh OS X onwards to logon to the Device to access network resources and the Internet as per the policies configured in the Device.
Download for Linux 32 - Enables Users using 32-bit Linux Operating System to logon to Device to access network resources and the Internet as per the policies configured in the Device.
Download for Linux 64 - Enables Users using 64-bit Linux Operating System to logon to Device to access network resources and the Internet as per the policies configured in the Device.
Download Certificate for iOS/Android client - Download the Digital Certificate to be installed in iOS or Android system to ensure a safe connection with the Device.
SPX Add-ins
The SPX Add-in simplifies the encryption of the messages that contain sensitive or confidential information leaving the organization. The Addin integrates seamlessly with the user’s Microsoft Outlook software, making it easy for users to encrypt messages through the Sophos Firewall (SF) Email Protection.
Follow the steps given below to install the AddOn in Outlook:
1. Unzip the files to a temporary folder.
2. For an interactive install, run setup.exe (users will be prompted for input).
3. For an unattended install, please install the following pre-requisites.
a. Windows XP, Windows Vista, Windows 7, Windows 8 (both 32 and 64-bit) versions are supported.
b. Microsoft Outlook 2007 SP3, 2010 or 2013 (both 32 and 64-bit) versions are supported.
c. Microsoft .NET Framework 4 Client Profile.
d. Microsoft Visual Studio 2010 Tools for Office Runtime 4.0.
e. Now, please run the installer with the following parameters: msiexec /qr /i
SophosOutlookAddInSetupUTM.msi T=1 EC=3 C=1 I=1.
Authentication Services
This menu allows you to configure Authentication for Firewall, VPN and Admin traffic. You can also configure
Global Settings, NTLM Settings, Web Client Settings, Captive Portal parameters and Radius Client settings for Single
Sign-On Server.
Note: You can also view and manage the authentication status on the System > Diagnostics > Services page.
Once you have deployed the device, default access policy is automatically applied which will allow complete network traffic to pass through the device. This will allow you to monitor user activity in your Network based on default policy.
As device monitors and logs user activity based on IP Address, all the reports are also generated based on IP
Address. To monitor and log user activities based on usernames or logon names, you have to configure the device for integrating user information and authentication process. Integration will identify access request based on usernames and generate reports based on usernames.
When the user attempts to access, the device requests a user name and password and authenticates the user’s credentials before giving access. User level authentication can be performed using the local user database on the device, External ADS server, LDAP, RADIUS or TACACS+ server.
To set up user database
1. Integrate ADS, LDAP, RADIUS or TACACS+ if external authentication is required.
2. Configure for local authentication.
| System | 345
3. Register user
The device provides policy-based filtering that allows defining individual filtering plans for various users of your organization. You can assign individual policies to users, or a single policy to a number of users (Group).
Device detects users as they log on to a Windows domain in your network via client machines. Users are allowed or denied access based on username and password. In order to authenticate a user, you must select at least one database against which device should authenticate users.
To filter the Internet requests based on policies assigned, the device must be able to identify a user making a request.
The administrator can configure authentication based on the type of – Administrator, Firewall, VPN, and SSL VPN with multiple servers.
Below are the screen elements with their description:
Firewall Authentication Methods
Authentication Server List
Select Authentication server.
Authentication Server List displays all the configured servers while Selected Authentication Server List displays servers that will be used for authentication when the user tries to login.
In case of multiple servers, authentication request is forwarded as per the order configured in the Selected
Authentication Server List.
Default Group
Select the default group for firewall authentication.
Figure 277: Firewall Authentication Methods
VPN (IPsec/L2TP/PPTP) Authentication Methods
Set Authentication Methods Same As Firewall
Enable to use the same authentication method as configured for firewall traffic. If enabled all the authentication servers configured for the firewall traffic will be available for VPN traffic authentication configuration.
Authentication Server List displays all the configured servers while Selected Authentication Server List displays servers that will be used for authentication when user tries to login.
Override authentication method for VPN traffic by selecting or deselecting any Authentication server.
| System | 346
In case of multiple servers, authentication request will be forwarded as per the order configured in the Selected
Authentication server List.
If RADIUS server authenticates users then PPTP and L2TP connections established using MSCHAPv2 or CHAP protocol can be authenticated through RADIUS.
Figure 278: VPN (IPsec/L2TP/PPTP) Authentication Methods
Administrator Authentication Methods
Administrator can configure and manage authentication settings for all the Administrator Users except for the super administrator from this page.
Set Authentication Methods Same As Firewall
Select to use the same authentication method as configured for firewall traffic. If enabled all the authentication servers configured for the firewall traffic will be available for administrator traffic authentication configuration.
Authentication Server List displays all the configured servers while Selected Authentication Server list displays servers that will be used for authentication when user tries to login.
Override authentication method for administrator traffic by selecting or deselecting any Authentication server.
In case of multiple servers, authentication request will be forwarded as per the order configured in the Selected
Authentication server List.
Figure 279: Administrator Authentication Methods
SSL VPN Authentication Methods
Enable to use the same authentication method as configured for VPN or Firewall or configure authentication server for SSL VPN.
Authentication Server List displays all the configured servers while Selected Authentication server list displays servers that will be used for authentication when user tries to login.
Override authentication method for SSL VPN traffic by selecting or deselecting any Authentication server.
In case of multiple servers, authentication request will be forwarded as per the order configured in the Selected
Authentication server List.
| System | 347
Figure 280: SSL VPN Authentication Methods
Global Settings
Maximum Session Timeout
Specify the timeout duration in minutes.
Acceptable Range (minutes) - 3 to 1440
Authentication Session timeout is the time in minutes a user is logged into the device. Exceeding the period, the user will be logged out automatically and the user must re-authenticate. This is applicable to administrative sessions only.
Enable “Unlimited” to allow the users to remain logged in.
Simultaneous Logins
Specify the maximum number of concurrent logins allowed to the user.
Acceptable Range – 1 to 99 concurrent logins
OR
Enable “Unlimited” to allow unlimited concurrent logins to the user.
Login restriction is applicable to only those users who are added after this configuration.
| System | 348
Figure 281: Global Settings
CTAS Settings
User Inactivity
Select to enable or disable user inactivity setting.
When users logs in the Device and performs no activity, remaining idle for specific time span, they are considered inactive.
By default, User Inactivity is disabled.
Inactivity Time(Only if User Inactivity is enabled)
Specify the inactivity time in minutes.
The user inactivity timeout is the inactive/idle time in minutes after which the user will be logged out and has to re-authenticate.
Acceptable Range (Minutes) - 3 to 1440
Default - 3 minutes
Data Transfer Threshold(Only if User Inactivity is enabled)
Specify the minimum data to be transferred.
Default - 100 bytes
Figure 282: STAS Settings
NTLM Settings
Inactivity Time
Specify the inactivity time in minutes.
User Inactivity timeout is the inactive/idle time in minutes after which user will be logged out and has to reauthenticate.
Acceptable Range (Minutes) - 6 to 1440
Default – 6
Data Transfer Threshold
Specify the minimum data to be transferred.
If the minimum data is not transferred within the specified time, the user will be marked as inactive.
Default – 1024 Bytes
HTTP challenge redirect on Intranet Zone
Select to Enable or Disable the redirection of NTLM HTTP challenge on Intranet Zone.
When any site hosted on the Internet initiates the NTLM web proxy challenge for authentication, the client is transparently authenticated by the browser through device by sending credentials over the Internet.
To secure and to prevent the user credential from going out on the Internet, device will redirect NTLM authentication challenge on Intranet Zone. Client will be transparently authenticated through device's Local
Interface IP and credentials will be exchanged in Intranet zone only.
Default - Enable
Figure 283: NTLM Settings
Web Client Settings (iOS and Android and API)
Inactivity Time
Specify the inactivity time in minutes.
User Inactivity timeout is the inactive/idle time in minutes after which user will be logged out and has to reauthenticate.
Acceptable Range (Minutes) - 6 to 1440
Default – 6 minutes
| System | 349
Data Transfer Threshold
Specify the minimum data to be transferred.
If the minimum data is not transferred within the specified time, the user will be marked as inactive.
Default – 1024 Bytes
Figure 284: Web Client Settings
SSO using radius accounting request
Device can authenticate users transparently who have already authenticated on an external RADIUS server. Click to add, to delete or Edit hyperlink to edit Radius Client configurations.
Radius Client IPv4
Specify IPv4 Address of Radius Client.
Only request from specified IP Address will be considered for SSO.
Shared Secret
Provide Shared Secret for authentication.
Show Shared Secret
Click Show to view the configured Shared Secret.
| System | 350
Figure 285: SSO using radius accounting request
Captive Portal Settings
Unauthenticated users redirection
Select "Yes" to redirect the access request of unauthenticated user either to the Captive Portal or Custom Message page.
Select "No" to display "Access Denied" message to unauthorized user.
Unauthenticated users settings
Configure where the unauthenticated user access requests should be redirected.
Available Options:
• Captive Portal
• Custom Message
Select Captive Portal, if an unauthenticated user access request is to be forwarded to captive portal.
HTTPS Redirection
Enable to provide access of the Captive portal page through secure channel.
| System | 351
User Portal Link
Enable/Disable to make the “User Portal” link available on the Captive Portal page.
Default – Enable
URL Redirection after Login
Enable to redirect request to the user requested page or custom page.
URL to redirect
If request is to be redirected to the custom page, click Custom URL and specify URL, else click User
requested URL.
Preserve captive portal after login
Select “Yes” to minimize the captive portal popup, once the user is successfully authenticated.
Selecting “No” lets the Captive Portal to be displayed on system screen after successful authentication.
Keep Alive Request For Captive Portal
Keep-Alive request is constantly exchanged between the device and user to check whether user has logged out or idle. If the device does not receive the response, user is logged out automatically.
More number of concurrent HTTP Captive Portal users, more number of keep-alive requests. In case of more concurrent HTTP Captive Portal users we recommend to disable it.
Default – Enable
If disabled, user is logged out after the configured inactivity time. If disabled, specify user inactivity time and data transfer threshold.
User Inactivity Timeout
User Inactivity timeout is the inactive/idle time in minutes after which user will be logged out and has to reauthenticate.
Enable and specify timeout duration in minutes.
Acceptable Range (minutes) - 3 to 1440
Default - Disable
Data Transfer Threshold
Specify threshold value in Bytes for Data Transfer.
If the minimum data is not transferred within the specified time, the user will be marked as inactive.
Select Custom Message, if unauthenticated user is to be displayed custom message.
Windows Corporate Client Download Link
Enable to publish a link to download the Windows Corporate Client in the custom message.
Linux Corporate Client Download Link
Enable to publish a link to download the Linux Corporate Client in the custom message.
MAC Corporate Client Download Link
Enable to publish a link to download the MAC Corporate Client in the custom message.
Page Header Image
Display the default image shipped with the device at the top of the custom message page or use Browse and upload the custom image.
Supported Image format - JPG, PNG or GIF
Size - 700 X 80 pixels
Page Footer Image
Display the default image shipped with the device at the bottom of the custom message page or use Browse and upload the custom image.
Supported Image format - JPG, PNG or GIF
Size - 700 X 80 pixels
Custom Message
Specify message. You can customize the message to include client IP Address, category, and URL.
Blink Custom Message
Enable Blink Custom Message to display blinking message.
Preview
Preview and check how message will be displayed before saving the configuration.
| System | 352
Figure 286: Captive Portal Settings
Groups
The Groups page displays a list of all the default and custom groups.
A group is a collection of users having common policies that can be managed as a single unit thus providing the possibility to assign various policies to a number of users in one operation/step. Users that belong to a particular group are referred to as group users.
A group can contain default as well as custom policies.
Various policies that can be grouped are:
• Surfing quota policy which specifies the duration of surfing time and the period of subscription
• Access time policy which specifies the time period during which the user will be allowed access
• Web filter policy which controls and blocks access to inappropriate web sites
• Application filter policy which controlling access to application like IM and P2P, VOIP
• QoS policy which specifies the bandwidth usage limit of the user
• Data transfer policy which specifies the data transfer quota of the user
• SSL VPN policy which determines the access mode and controls access to private network resources.
The page also provides option to add new group, update group parameters, add new members to the existing group, view user group membership, or delete a group.
Creating a New User Group
Use the Add Group page to create a group of policies.
| System | 353
The Add Group page allows you to configure a group of policies. Once the appropriate Group is assigned, the user will automatically inherit all the policies added to the group.
1. Navigate to System > Authentication > Groups or Objects > Identity > Groups and click Add.
2. Enter user group details.
Group Name
Provide a name to identify the group.
Description
Provide group description.
Group Type
Select Group Type.
Available Options:
Normal - User of this group needs to log on using the device client to access the Internet. Clientless -
User of this group does not need to log on using the device client to access the Internet and is symbolically represented as Group name(C). Access control is placed on the IP Address.
3. Configure the policies.
Surfing Quota
Select the Surfing Quota Policy from the list.
Note: Unlimited policy is automatically applied to Clientless Group.
Access Time (Not applicable to Clientless Group)
Select the Access Time Policy from the list.
Note: Unlimited policy is automatically applied to Clientless Group.
Network Traffic (Not applicable to Clientless Group)
Select the Network Traffic Policy from the list.
Configured policy will be applicable to all the users who are member of this group.
Traffic Shaping
Select the Traffic Shaping policy from the list.
Configured policy will be applicable to all the users who are member of this group.
Remote Access
By default, the user will inherit its group policy. To override the group policy, select a policy from the list.
You can also create a new policy directly from this page itself or from System > VPN > SSL VPN (Remote
Access) page.
If user is not to be provided SSL VPN access then select No Policy Applied.
Clientless
By default, user will inherit its group policy. To override the group policy, select the policy from the list.
You can also create a new policy directly from this page itself or from System > VPN > Clientless Access page.
If user is not to be provided the SSL VPN access then select "No Policy Applied".
Quarantine Digest
Configure Quarantine Digest.
Quarantine digest is an Email containing a list of quarantined spam messages filtered by the device and held in the user quarantine area. If configured, device will mail the digest on hourly, daily or weekly basis to the user. Digest also provides a link to User Portal from where user can access and take the action on quarantined messages.
Available Options:Enable - User will receive the Quarantine Digest on configured frequency and overrides
Group setting. Disable - User will not receive Quarantine Digest and overrides Group setting.
| System | 354
MAC Binding (Not applicable to Clientless Group)
Enable/disable “MAC Binding”. By binding User to MAC Address, you are mapping user with a group of
MAC Addresses.
L2TP (Not applicable to Clientless Group)
Enable if group users can get access through L2TP connection.
PPTP (Not applicable to Clientless Group)
Enable if group users can get access through PPTP connection.
Login Restriction (Not applicable to Clientless Group)
Select the appropriate option to specify the login restriction for the user group.
Available Options: Any Node - Select to allow user to login from any of the nodes in the network.Selected
Nodes - Select to allow user to login from the specified nodes only. Specify IP Address and click Add icon
to add more nodes and remove icon to delete nodes. You can even edit the added IP Address by first clicking on the edit icon and then on the save icon .
Note: Editing and removing IP Address options are only provided for the Groups that have been already added.
Node Range - Select to allow range of IP Address. Specify IP Address range.
Only IPv4 Addresses must be provided for options “Selected Nodes” and “Node Range”.
4. Click Save.
Note: User Configuration - MAC binding and policies is given precedence over Group configuration.
Adding Users to the Existing Groups
Use Add Group Member page to add a user to the existing groups.
This page allows you to add group member to the existing groups.
1. Navigate to System > Authentication > Groups or Objects > Identity > Groups.
2.
Select the group in which you want to add the users by clicking the edit icon in the Manage column.
3. Click Add Member(s). A pop-up Add Group Member appears providing a list of all the users who can be added to the group along with some details. To search for a user filter the list based on the name and/or the current group.
4. Select the user you want to add to the group. You can select a single user or multiple users on the same page.
5. Click Add and click OK to confirm adding the member to the group.
Viewing List of Group Members
Use this page to view group members.
This page displays the list of group members.
1. Navigate to System > Authentication > Groups or Objects > Identity > Groups.
2.
4.
Click the group for which you want view the group members and click the edit icon in the Manage column.
3. Click Show Group Member(s). A pop-up Group Members appears providing the list of all the userswho are member of the selected group along with their usernames.
Click Close or Close icon to close the Group Member pop-up.
| System | 355
Users
The Users page displays the list of all the users added in the device.
Users are identified by an IP address or a username and are assigned to a user group. All the users in a group inherit the policies defined for that group.
Media Access Control (MAC) address is a unique identifier (hardware address) assigned to a host by the manufacturer for identification and is intended to be immutable. MAC addresses are 48 bit values that are expressed in 6 byte hex-notation separated by colon for example 01:23:45:67:89:AB.
To improve the security of your network and provide spoofing protection, you can enable user-MAC address binding.
By binding a user to a MAC address, you are mapping the user with a group of MAC addresses. It means a user would be able to login through a group of pre-specified machines only making it more difficult for a hacker using random MAC addresses or spoofing a MAC address to gain access to your network.
User types
The device supports five types of users:
• Normal
• Clientless
• Single Sign on
• Thin Client user
• WWAN user
A normal user has to logon to the device which requires a client (client.exe) on the user machine, or the user can use
HTTP client component and all the policy-based restriction are applied.
A clientless user does not require a client component (client.exe) on the user machine.
Users are automatically logged to the device if single sign on settings are configured.
Use the given decision matrix below to choose which type of the user should be created.
Table 5: Decision matrix for adding a user
Feature Normal User
User login required
Type of Group
Normal
Clientless
Yes
Yes
No
Apply login restriction Yes
Apply Surfing Quota policy Yes
Apply Access Time policy Yes
Apply Traffic Shaping policy
Yes
Apply Web Filter Policy Yes
Apply Application Group policy
Yes
Apply Network Traffic policy
Yes
Clientless User
No
No
Yes
Yes
No
No
Yes
Yes
Yes
No
Single Sign On User
No
Yes
No
Yes
Yes
Yes
Yes
Yes
Yes
Yes
You can filter the list of user's name, username, group, web and application filter policy applied to the user, and date on which users were added.
| System | 356
Note: You can also view and manage live users on the System > Current Activity > Live Users page.
The page also provides options to:
•
•
•
•
Add users by importing user details from the file
•
•
•
Registering a New User
Use the Add User page to enter a new user and quickly configure a related policy.
The Add User page allows you to manually enter user details and configure related policies for a user on your system.
Once a user is registered successfully, the page provides two more options:
•
- Click to reset the usage accounting i.e. internet usage time and data transfer of the user.
•
- Click to view the Internet usage and data transfer usage.
1. Navigate to System > Authentication > Users or Objects > Identity > Users and click Add.
2. Enter user details.
Username
Enter a username, which uniquely identifies the user and is to be used for login.
Name
Enter the name of the user.
Password
Enter a password and re-enter the same password for confirmation.
The password is case-sensitive.
User Type
Select the type of user from the available options.
Available Options:UserAdministrator
Profile (Only when user type Administrator is selected)
Select the administrator profile. The administrator will get access to various Admin Console menus as per the configured profile.
Create a new profile directly from this page or from the Objects > Policies > Access Profile > Add Profile page.
Specify the email address of the user.
Use comma to seperate multiple email addresses.
Description
Provide a user description.
3. Enter policies details.
Group
Select a group in which the user is to be added. User will inherit all the policies assigned to the group.
Surfing Quota
By default, the user will inherit its group policy. To override the group policy, select the policy from the list.
| System | 357
You can also create a new policy directly from this page itself or from the Objects > Policy > Surfing
Quota page.
Access Time
By default, the user will inherit its group policy. To override the group policy, select the policy from the list.
You can also create a new policy directly from this page iteself or from the Objects > Policies > Access
Time page.
Network Traffic
By default, the user will inherit its group policy. To override the group policy, select the policy from the list.
You can also create a new policy directly from this page itself or from the Objects > Policies > Network
Traffic Quota page.
Traffic Shaping
By default, user will inherit its group policy. To override the group policy, select the policy from the list.
You can also create a new policy directly from this page itself or from Objects > Policies > Traffic Shaping page.
4. Enter SSL VPN policy details.
Remote Access
By default, the user will inherit its group policy. To override the group policy, select a policy from the list.
You can also create a new policy directly from this page itself or from the System > VPN > SSL VPN
(Remote Access) page.
If the user is not to be provided SSL VPN access then select No Policy Applied.
Clientless
By default, the user will inherit its group policy. To override the group policy, select a policy from the list.
You can also create a new policy directly from this page itself or from the System > VPN > Clientless
Access page.
If the user is not to be provided clientless access then select No Policy Applied.
L2TP
By default, the user is provided remote access through L2TP. Disable if remote access is not to be provided to the user.
If enabled, provide the IP address (IPv4/IPv6) to be leased to the user for L2TP access.
PPTP
By default, the user is provided remote access through PPTP. Disable if remote access is not to be provided to the user.
If enabled, provide the IP address (IPv4/IPv6) to be leased to the user for PPTP access.
Quarantine digest is an email containing a list of quarantined spam messages filtered by the device and held in the user quarantine area. If configured, the device will mail the digest daily to the user. Digest also provides a link to the users My Account from where the user can access and take an action for quarantined messages.
CISCO
™
VPN Client
By default, the user is provided remote access through CISCO VPN client. Disable if remote access is not to be provided to the user.
If enabled, provide the IP address (IPv4/IPv6) to be leased to the user for CISCO VPN access.
Note: To use this feature, CISCO
™
VPN client needs to be configured from the System > VPN >
CISCO ™
VPN Client page.
Quarantine Digest
Configure the quarantine digest.
Quarantine digest is an email containing a list of quarantined spam messages filtered by the device and held in the user quarantine area. If configured, the device will mail the digest at the configured frequency to the
| System | 358 user. Digest also provides a link to the User Portal from where the user can access and take an action on quarantined messages.
Available Options:Enable - The user will receive the quarantine digest daily. This option overrides the group setting.Disable - User will not receive quarantine digests. This option overrides the group setting.
Simultaneous Logins
Specify the number of concurrent logins that will be allowed for the user or click Unlimited for allowing unlimited concurrent logins.
Default: 1
Acceptable Range: 1 to 99
Note: The specified setting will override the global setting specified in the client preferences.
MAC Binding
Enable/disable MAC Binding. By binding the user to a MAC address, you are mapping the user with a group of MAC addresses.
If enabled, specify MAC addresses for example 01:23:45:67:89:AB.
Once you enable MAC binding, the user will be able to login through pre-specified machines only.
Use comma to seperate multiple MAC addresses. For example 01:23:45:67:89:AB, 01:23:45:67:89:AC.
Login Restrictions
Select the appropriate option to specify the login restriction for the user.
Available Options: Any Node - User will be able to login from any of the nodes in the network. User Group
Node(s) - User will be able to login only from the nodes assigned to his group. Selected Nodes - User will be able to login from the specified nodes only.Node Range - User will be able to login from any of the IP addresses from the configured range.
Note: Only IPv4 addresses must be provided for options Selected Nodes and Node Range.
5. Select administrator advanced settings (Only applicable if the user type is Administrator)
Schedule for Device Access
Schedule the device access.
The administrator will be able to access the device only during the time configured in the schedule.
Login Restriction for Device Access
Select the appropriate option to specify the login restriction for the user.
Available Options:Any Node - Administrator will be able to login from any of the nodes in the network.Selected Nodes - Administrator will be able to login from the specified nodes only. Node Range -
Administrator will be able to login from any of the IP addresses from the configured range.
Reset User Accounting (Displayed only after the user is added)
Click to reset the usage accounting i.e. Internet usage time and network traffic of the user.
View Usage (Displayed only after the user is added)
Click to view the Internet usage and data transfer usage.
Note: User configuration is given precendence over group configuration.
6. Click Save.
Reset User Accounting
This option lets you reset the usage accounting i.e. internet usage time and data transfer of the user.
1.
Edit the user account of the user whose data accounting you want to reset by clicking Manage icon in the
Manage column.
2. Click Reset User Accounting and OK to confirm.
| System | 359
Note: You cannot reset user accounting for the liver user.
View Usage
This option lets you view the Internet usage and data transfer usage.
1.
Edit the User account of the user whose data usage you want to view by clicking Manage icon under the
Manage column.
2. Click View Usage. A pop-up displays information of policies applied on the user account, upload and download data transferred by the user.
Importing User Information
The Import Users page allows you to add new users by importing user details from the file.
Instead of creating users again in the device, if you already have users detail in a csv file, you can upload the csv file.
Navigate to System > Authentication > Users and click Import to import the csv file.
Select Browse to include the complete path for migrating user’s information file.
Please consider the csv file format requirements:
1. Header (first) row should contain field names. Format of header row:
• Compulsory field: username
• Optional fields: password, name, group, email address
2. Fields can be configured in any order.
3. Subsequent rows should contain values corresponding to the each field in header row.
4. Number of fields in each row should be same as in the header row.
5. An error will be displayed if data is not provided for any field specified in the header.
6. Blank rows will be ignored.
7. If no password field is included in the header row then it will be set the same as the username.
8. If no group name is included in the header row, the administrator will be able to configure a group at the time of migration.
Exporting Users
This page allows you to export user information.
Navigate to System > Authentication > Users and click Export to export the user details in a csv file.
The .csv file is generated with the following headers: Name, Username, Enc_password, Email Address, and Group.
Purging Active Directory Users
This page allows you to purge AD Users.
Navigate to System > Authentication > Users and click Purge AD Users to synchronize the device’s Active
Directory users with an external Active Directory server.
Note:
• The purge operation will not interrupt user login/logout and accounting events.
• If HA is configured, user details are deleted from both, the primary device and the auxiliary device.
Change Status
Navigate to System > Authentication > Users.
Select a user and click Change Status to change the status of that user.
If the current status is Active, the status of the user will change to Inactive when you click this button and vice-versa.
| System | 360
Clientless Users
The Clientless Users page displays a list of all the clientless users.
Clientless users are the users who can bypass the client login to access the Internet and are managed by the device itself. As clientless users can bypass the device login, create clientless users when your network has few Non-
Windows machines, VOIP boxes, or servers.
You can filter the list based on name or username of the user, IP address, or group of the user. The page also provides options to add a single clientless user or multiple users, delete or change the status of the user. The administrator can also reset user accounting data or view the usage statistics.
Use this page to make the following settings:The page also provides options to:
•
•
•
•
•
Changing Policies of the Clientless User
Add a Single Clientless User
Use the Add Clientless User page to add a single clientless user.
The Add Clientless User page allows you to manually enter details to add a single clientless user that can bypass the device login.
Once a user is registered successfully, the page provides two more options:
•
- Click to reset the usage accounting i.e. Internet usage time and data transfer of the user.
•
- Click to view the Internet usage and data transfer usage.
1. Navigate to System > Authentication > Clientless Users or Objects > Identity > Clientless Users and click
Add.
2. Enter clientless users details.
Username
Enter a username which uniquely identifies the user and will be used for login.
IP Address
Specify an IP address(IPv4/IPv6) for the clientless user.
Group
Select a group to which the user is to be added. User will inherit all the polices assigned to the group.
Change the policies applied to the user by editing the user details.
Name
Enter the name of the user.
Enter an email address.
Quarantine Digest
Configure quarantine digest. Quarantine digest is an email and contains a list of quarantined spam messages filtered by the device and held in the user quarantine area. If configured, the device will mail the quarantine digest every day to the user. The digest provides a link to the User Portal from where the user can access quarantined messages and take the required action.
Available Options:Enable - User will receive the quarantine digest daily. This option overrides the group setting.Disable - User will not receive quarantine digests. This option overrides the group setting. Apply
Group's Settings - User will receive quarantine digests as per configured for the group the user belongs to.
Description
Specify a user description.
3. Click Save.
Reset User Accounting
This option lets you reset the usage accounting i.e. internet usage time and data transfer of the user.
1.
Edit the user account of the user whose data accounting you want to reset by clicking Manage icon in the
Manage column.
2. Click Reset User Accounting and OK to confirm.
Note: You cannot reset user accounting for the liver user.
View Usage
This option lets you view the Internet usage and data transfer usage.
1.
Edit the User account of the user whose data usage you want to view by clicking Manage icon under the
Manage column.
2. Click View Usage. A pop-up displays information of policies applied on the user account, upload and download data transferred by the user.
Add Multiple Clientless Users
Use the Add Multiple Clientless Users page to add multiple clientless users.
The Add page allows you to enter details to add multiple clientless users.
1. Navigate to System > Authentication > Clientless Users or Objects > Identity > Clientless Users and click
Add Range.
2. Enter the required details.
From IP
Specify a starting IP address for the range.
To IP
Specify an ending IP address for the range.
Group
You can change the policies applied to the user by editing the user details. If you change the policies for the user, user specific policies will take precedence over user group policies.
| System | 361
Figure 287: Clientless User
3. Click Save.
Changing Policies of the Clientless User
This page lets you change the policies configured for a clientless user.
Change the policies applied to a user by updating the user details. If you change the policies for the user, user specific policies will take precedence over user group policies.
1. Navigate to System > Authentication > Clientless Users or Objects > Identity > Clientless Users.
2.
Select the user for which you want to change the policies by clicking the edit icon in the Manage column.
3. Update the user details.
Username
Name with which user logs in.
Name
Name of the User.
Description
Provide the clientless user description.
IP Address
IP address (IPv4/IPv6) from which the user logs in.
Group
Group to which the user is added. User will inherit all the policies assigned to the group.
Change the group, if required.
Email address of the user.
Internet Usage Time
Displays total Internet usage time information.
| System | 362
Figure 288: Edit Clientless User
4. Update the policy details.
Traffic Shaping
Traffic Shaping policy applied to the user.
Change the policy, if required.
Policy applied here will take the precedence over the group policy.
Quarantine Digest
Configure quarantine digest.
Quarantine digest is an email and contains a list of quarantined spam messages filtered by the device and held in the user quarantine area. If configured, the device will mail the quarantine digest every day to the user. The digest provides a link to the User Portal from where the user can access his quarantined messages and take the required action.
Available Options:Enable - User will receive the quarantine digest daily. This option overrides the group setting. Disable - User will not receive quarantine digests. This option overrides the group setting.
| System | 363
Figure 289: Policies
5. Click Save.
Guest Users
The Guest Users page displays the list of all the guest users added.
Users without a pre-existing user account wanting to access the Internet using a hotspot, or via a network available at the airport, hotels, hostels, etc. are called “guest users”. These users, that are otherwise considered unauthenticated and/or are denied access, are allowed to make an request to connect to the Internet for a limited period by authenticating themselves. On being authenticated, these users are authorized to access the Internet as guest user. At such locations, Internet access is secured by configuring access policies to restrict any malicious use of the network.
Sophos Firewall allows the administrator to pre-configure single or multiple guest users using the Admin Console.
The credentials of guest users configured via the Admin Console can be printed and handed over to the guest user.
Alternately, guest users can register themselves using the guest user portal. The credentials and Internet access details of guest users registered via the guest user portal can either be sent via SMS or can be printed.
In case of successful authentication the guest user is granted access according to the applicable group, or else is redirected to the Captive Portal page.
You can filter the list based on name or username of the user, cell number of the user, and validity of the user account, . The page also provides options to add single or multiple users, distributing credentials for the Internet access, update user parameters, view or reset the data transfer usage.
Resend Credential – Click the Resend Credential icon in the Manage column against a user registered via the
Guest User Portal to whom the access detail’s SMS are to be resent.
Use this page to make the following setings:
•
•
•
•
•
Update Guest User Configuration
Registering a Single Guest User
Use the Add Single page to enter a new single guest user details.
The Add Single page allows you to manually enter and configure guest user details. Before adding a guest user, one has to configure general settings from System > System Services > Guest User Settings.
Once a guest user is registered successfully, the page provides two more options:
•
- Click to reset the usage accounting i.e. Internet usage time and data transfer of the user.
•
- Click to view the Internet usage and data transfer usage.
1. Navigate to System > Authentication > Guest Users or Objects > Identity > Guest Users and click Add
Single.
2. Enter guest user details.
Username
Displays auto-generated username.
Password
Displays auto-generated password.
Name
Specify the name of the guest user.
Specify email address of the guest user.
User Validity (Duration in Days)
Specify the validity of multiple guest users in days.
Minimum number of days: 1 day
Maximum number of days: 999 days
Validity Start
Select the type from when a user's validity should be counted.
Available Options:Immediately - Validity is counted from the time a guest user is created. After First
Login - Validity is counted from the time a guest user logs into the network for the first time.
| System | 364
Figure 290: Add Guest User
3. Click Add to register the user or Add and Print to register the user and print the login credentials.
Note: Before adding a guest user, you have to configure general settings on the System System Services
Guest User Settings page.
Reset User Accounting
This option lets you reset the usage accounting i.e. internet usage time and data transfer of the user.
1.
Edit the user account of the user whose data accounting you want to reset by clicking Manage icon in the
Manage column.
2. Click Reset User Accounting and OK to confirm.
Note: You cannot reset user accounting for the liver user.
View Usage
This option lets you view the Internet usage and data transfer usage.
1.
Edit the User account of the user whose data usage you want to view by clicking Manage icon under the
Manage column.
2. Click View Usage. A pop-up displays information of policies applied on the user account, upload and download data transferred by the user.
Register Multiple Guest Users
Use the Add Multiple page to enter multiple guest users.
| System | 365
The Add Multiple User page allows you to create multiple guest user logins.
1. Navigate to System > Authentication > Guest Users or Objects > Identity > Guest Users and click Add
Multiple.
2. Enter guest user details.
Number of Users
Specify the number of guest users to be created.
User Validity (Duration in Days)
Specify the validity of multiple guest users in days.
Minimum number of day: 1 day
Maximum number of days: 999 days
Validity Start
Select the type from when a user's validity should be counted.
Available Options:Immediately - Validity is counted from the time a guest user is created.After First Login
- Validity is counted from the time a guest user logs into the network for the first time.
3. Click Add to register the users or Add and Print to register the users and print the login credentials.
Update Guest User Configuration
This page lets you change the policies configured of the guest user.
Change the policies applied to the guest user by updating the user details.
1. Navigate to System > Authentication > Guest Users or Objects > Identity > Guest Users.
2.
Select the guest user for which you want to change the policies by clicking the edit icon in the Manage column.
3. Update the guest user details.
Username
Displays the username of the guest user.
Name
Specify the name of the guest user.
Password
Displays the password in encrypted format.
You can change the password by clicking on Change Password.
If you change it, enter the new password in the Password field and re-enter it in the Confirm Password field.
Cell Phone Number
Displays the cell phone number.
Note: The cell phone number cannot be edited.
Specify the email address of the guest user.
Internet Usage Time
Displays total Internet usage time information in HH:MM format.
4. Update the policy details.
Group
Displays the group to which the user belongs. User will inherit all the policies assigned to the group.
Note: The guest user group cannot be edited.
| System | 366
Surfing Quota
Select the surfing quota policy from the list.
You can also create a new policy directly from this page and attach it to the user.
Access Time
Select the access time policy from the list.
You can also create a new policy directly from this page and attach it to the user.
Network Traffic
Select the network traffic policy from the list.
You can also create a new policy directly from this page and attach it to the user.
Traffic Shaping
Select the traffic shaping policy from the list.
You can also create a new policy directly from this page and attach it to the user.
Note: User configuration is given precedence over Group Configuration i.e. User MAC binding and policies configuration is given priority over Group configuration.
5. Enter the SSL VPN policy details.
Remote Access
Select a policy for remote access from the list or create a new one. To create a new policy, click Create New.
You can create a new policy directly from this page itself or from System > VPN > Remote Access page.
Clientless
Select a policy for clientless access from the list or create a new one. To create a new policy, click Create
New.
You can also create a new policy directly from this page itself or from System > VPN > Clientless Access page.
If a user is not to be provided SSL VPN access then select No Policy Applied.
L2TP
Enable if you are mapping user to get access through L2TP connection.
Provide the IP Address to be leased to the Guest User for L2TP access.
PPTP
Enable if you want to allow the user to get access through a PPTP connection.
If enabled, provide the IP address (IPv4/IPv6) to be leased to the guest user for PPTP access.
CISCO
™
VPN Client
By default, the user is provided remote access through the CISCO VPN client. Disable if remote access is not to be provided to the user.
If enabled, provide the IP address (IPv4/IPv6) to be leased to the user for CISCO VPN access.
Note: To use this feature, CISCO
™
VPN client needs to be configured from the System > VPN >
CISCO
™
VPN Client page.
Quarantine Digest
Configure the quarantine digest.
Quarantine digest is an email and contains a list of quarantined spam messages filtered by the device and held in the user quarantine area. If configured, device will mail the quarantine digest every day to the user. The digest provides a link to the user's My Account from where the user can access his quarantined messages and take the required action.
Available Options:Enable - User receives the quarantine digest daily. This option overrides the group setting. Disable - User does not receive quarantine digests. This option overrides the group setting.
| System | 367
Simultaneous Logins
Specify the number of concurrent logins that will be allowed to the user or click Unlimited for allowing unlimited concurrent logins.
The specified setting overrides the global setting specified in the client preferences.
MAC Binding
Enable/disable MAC Binding. By binding the user to a MAC address, you are mapping the user with a group of MAC addresses.
For Selected Nodes and Node Range only IPv4 addresses can be provided.
MAC Address List
Specify MAC addresses for example 01:23:45:67:89:AB.
Once you enable MAC binding, the user can login through pre-specified machines only.
To configure multiple MAC addresses use comma. For example 01:23:45:67:89:AB, 01:23:45:67:89:AC.
Login Restriction
Select the appropriate option to specify the login restriction for the user.
Available Options:Any Node - User can login from any of the nodes in the network.User Group Node(s) -
User can login only from the nodes assigned to the group.Selected Nodes - User can login from the specified nodes only.Node Range - User can login from any of the IP addresses from the configured range.
6. Click Save .
7. Click Reset User Accounting to restart the accounting of guest user's Internet usage.
8. Click View Usage to view the Internet usage information of that particular guest user.
Captive Portal
The Captive Portal allows customization of the Captive Portal login page.
The device provides flexibility to customize the Captive Portal login page. This page can include your organization name and logo.
The device also supports a customized page in languages other than English.
External users, who need to use authentication services, are required to log in over the Captive Portal once before they get access to the User Portal. External users can access the Captive Portal by browsing to https://<Sophos Device IP
Address>:8090. After login, external users have access to the User Portal and are listed on the Objects > Identity >
Users page. External users can access the User Portal by browsing to https://<Sophos Device IP Address> or clicking
Click here for User My Account on the Captive Portal page.
General Settings
Logo
Select Custom to upload the custom logo and specify an image file name to be uploaded, else select Default.
For Custom, click Browse to browse and select the complete path.
The image size should not exceed 125 X 70 pixels.
Logo URL
Provide an URL to be redirected to on clicking the logo.
Default:
http://www.sophos.com
Page Title
Provide a title to modify the page title.
Default: Network Authentication
Login Page Header
Provide the text to be displayed on the Captive Portal login page.
Login Page Footer
Provide a message to be displayed in the footer of the Captive Portal login page.
| System | 368
Username Caption
Provide a label for the textbox to be displayed on the Captive Portal login page.
Default: Username
Password Caption
Provide a label for the textbox to be displayed on the Captive Portal login page.
Default: Password
Login Button Caption
Provide a label for the button to be displayed on the Captive Portal login page.
Default: Login
Logout Button Caption
Provide a label for the button to be displayed on the Captive Portal login page.
Default: Logout
User Portal Link Caption
Provide a text to be displayed for the User Portal login page link. By clicking the link, the user will be directed to the User Portal login page.
Default: Click here for User Portal
Figure 291: General Settings
Color Scheme
Customize the color scheme of the Captive portal if required. Specify the color code or click the square box to pick the color.
Figure 292: Color Scheme
Custom HTML Template
Use Custom HTML Template
Select to fully customize Captive Portal using custom HTML code.
HTML Text
Provide HTML code to render the Captive Portal according to your requirement. Dynamic contents like banners from external web servers, a customizable Message of the day box and so on can be integrated in the HTML code.
By default, sample HTML will be displayed.
Note: It is essential to have one HTML div element in the HTML text. The device’s login box will be placed in this div element.
Preview
Click to view the custom settings before saving the changes.
Reset to Default
Click to revert to the default settings.
| System | 369
Figure 293: Custom HTML Template
Guest Users Settings
The Guest Users Settings page allows you to configure general settings, registration settings and SMS gateway for guest users.
Users without a pre-existing user account wanting to access the Internet using a hotspot, or via a network available at the airport, hotels, hostels, etc. are called “guest users”. These users, that are otherwise considered unauthenticated and/or denied access, are allowed to make request to connect to the Internet for a limited period by authenticating themselves. On being authenticated, these users are authorized to access Internet as guest users. At such locations,
Internet access is secured by configuring access policies to restrict any malicious use of the network.
Sophos allows administrator to pre-configure single or multiple guest users using the Admin Console. The credentials of guest users configured via the Admin Console can be printed and handed over to the guest user. Alternately, guest users can register themselves using the guest user portal. The credentials and Internet access details of guest users registered via the guest user portal can either be sent via SMS or can be printed.
In case of successful authentication the guest user is granted access according to the applicable group, or else is redirected to the Captive Portal page.
The page allows configuring general parameters to provide secured Internet access for guest users.
Guest User General Settings
Username Prefix
Enter a prefix to be used for auto-generation of a username for guest users.
Group
Select a group of policies to assign to guest users or create a new one.
You can create a new group of policies directly from this page or from the System > Authentication > Group >
Creating a New User Group page.
Password Length
Specify the length of the auto-generated password for Guest Users.
Minimum password length - 3 characters
Maximum password length - 60 characters
Default - 8 characters
The password length is a basic security parameter, the value of which affects the strength of password against brute force attack.
Password Complexity
Select a type of password from the available options to be used for complexity of an auto-generated password:
Available Options:
• Numeric Password - Password will include only numeric characters.
• Alphabetic Password - Password will include only alphabetic characters.
• Alphanumeric Password - Password will include numeric as well as alphabetic characters.
• Alphanumeric with Special Character Password - Password will include numeric, alphabets and special characters.
The password strength is a function of its length, complexity, and unpredictability. Combining password length with password complexity makes a password difficult to guess.
Disclaimer
Provide the disclaimer message to be printed below every user’s login credentials.
Disclaimer once configured can be edited but cannot be removed.
Auto Purge on Expiry
Check to enable automatic purging of user details on expiry of user validity.
Note: Details of a user who is bound to rules (like firewall, IM, etc.) will not be purged automatically.
| System | 370
Figure 294: Guest User General Settings
Guest User Registration Settings
Enable Guest Users Registration
Enable to allow secured Internet access to guest users.
SMS Gateway
Select the Gateway using which the SMS should be sent.
Alternately you may add the SMS gateway from this page itself by clicking Create New link.
Guest Username
Select the method of generating Username using the following option:
• Use Cell Number as Username
If Guest Username checkbox option is not selected, by default, the new user name will be generated with the value specified in Username Prefix.
User Validity (Duration in Days)
Specify guest user validity in days.
Default Country Code
Enable to configure a default country code on the Guest User Registration page.
Selected country is displayed as default option in Cell Number selection at Guest User registration page.
CAPTCHA Verification
Select to Enable or Disable CAPTCHA (Completely Automated Public Turing Test To Tell Computers and
Humans Apart) code verification on Guest User Registration page to ensure the request is received for human being.
By enabling CAPTCHA Verification, the user will be displayed a picture with characters that user must insert in a provided textbox below picture. The administrator can therefore protect device against attacks generated by automated programs.
Default - Enable
| System | 371
Figure 295: Guest User Registration Settings
SMS Gateway
An SMS gateway allows sending and receiving short message service (SMS) to/from a home network for guest user registration. The device supports HTTP and HTTPS protocol based SMS service.
This section displays list of all the configured SMS gateways and provides options to
gateway configuration.
Configure SMS Gateway
You can configure an SMS Gateway for guest user registration from this page.
1. Navigate to System > System Services > Guest User Settings or System > Authentication > Guest User
Settings and click Add under the SMS Gateway section.
2. Enter SMS gateway details.
Name
Enter the name of the SMS gateway.
URL
Specify the URL of the SMS gateway for sending an SMS request.
HTTP Method
Select the method for sending an SMS request to the SMS gateways from the options available:
Available Options:Get: Requests data from a specified resource.Post: Submits data to be processed to a specified resource.
Cell Number Format
Select to use country code with cell number.
Number Prefix
Specify the prefix value to be used with the cell number.
Number Prefix can include alpha-numeric and ASCII special characters.
It can be up to 4 characters long.
Request Parameters
Specify the following request parameters to configure the SMS gateway.
Name
Name is a descriptor used to describe the meaning of the value. E.g. username, password, mobile
Value
Indicates the value of a variable that are defined for the Name.
| System | 372
Response Format
Response describes the delivery status of the message such as success, failed, limit exceeded. Status message can be in various formats. Few of them are described below:
Response Format
{0} | {1} | {2}
Response Received
success | mbno | msgid/transactionid
Response Format
<status>500</status><transactionid>{0}</transactionid><reason>{1}</ reason>
Response Received
<status>500</status><transactionid>2323</transactionid><reason>Limit
Exceeded</reason>
When the response format is different for success and failure, it is recommended that the response format string should have a single content holder. E.g. {0}
Response Parameters
Response Parameter is the value presented by the content holder {0,1, 2...n} that will be displayed in the log viewer.
Parameter Index: Parameter Index is the content holder value {0,1, 2...n}.
Name: Name represents the content holder in the log viewer.
Example 1:
Parameter Index
0
Name
Status
| System | 373
Parameter Index
1
2
Example 2:
Parameter Index
0
1
Name
Recipient
SMSID
Name
SMSID - 2323
SMS Status Message – Length Exceeded
| System | 374
Figure 296: Add SMS Gateway
3. Click Save.
Testing Connectivity with SMS Gateway
Once you have configured an SMS gateway, check whether you are able to connect with the gateway or not from this page.
1. Navigate to System > System Services > Guest User Settings > SMS Gateway or System > Authentication >
Guest User Settings > SMS Gateway and click Test Connection.
2. Enter cell phone number details.
Cell Phone Number
Provide a cell phone number.
You will receive SMS through the gateway configured if you are able to connect to the gateway.
| System | 375
Figure 297: Test Connectivity
3. Click Save.
Hotspots
On this page you can enable the Hotspots feature and define users who are allowed to view and distribute hotspot access information.
Protection > Wireless Protection > Hotspots
The Hotspot feature allows cafés, hotels, companies, etc. to provide time- and traffic-restricted Internet access to guests. The feature is available within the wireless subscription, but also works with wired networks.
Note: You can also view and manage the hotspot status on the System > Diagnostics > Services page.
Hotspot Generation
In the first step, the administrator creates and enables a hotspot with a specific type of access. The following types are available:
• Terms of use acceptance: The guest is presented with terms of use, which you can define, and has to select a checkbox to get access.
• Password of the day: The guest has to enter a password to get access. The password changes on a daily basis.
• Voucher: The guest gets a voucher and has to enter the voucher code to get access. The voucher can be limited in the number of devices, in time, and traffic.
Distribution of Access Information to Guests
With the access types Password of the day and Voucher, the access information has to be handed out to the guests.
Therefore you can define users who are allowed to manage and distribute access information. Those users receive and distribute the access information via the Hotspot tab of the User Portal:
• Password of the day: The current password can be sent via email and the users find the password in the User
Portal. The users forward the password to the guests. They can generate or enter a new password. The former password automatically becomes invalid and active sessions will be terminated. Other potential users will be informed of the new password, either by email or via the User Portal, depending on what is configured for them.
• Voucher: In the User Portal, users can create vouchers, each with a unique code. Different types of vouchers can be available if specified by the administrator. The vouchers can be printed or exported and given to the guests. A list of created vouchers gives an overview of their usage and helps to manage them.
Legal Information
In many countries, operating a public wireless LAN is subject to specific national laws, restricting access to websites of legally questionable content (e.g., file sharing sites, extremist websites, etc.). To meet this requirement, you can combine the hotspot with the web protection capabilities of the Sophos Firewall OS, which allow you to control web access by blocking and allowing everything from an entire website category type to a single URL. The Sophos
Firewall OS gives you complete control over what is allowed to be accessed, by whom, and when. That way you can put the hotspot under heavy restrictions, if national or corporate policies require you to do so. Using the current feature of Sophos Firewall OS also gives you advanced logging and reporting capabilities. The reporting will show who visited what site, when, and how many times, allowing you to identify inappropriate usage in case you want to operate a hotspot without any access restrictions. In addition to that, legal regulations may require you to register your hotspot at the national's regulatory body.
The page displays all existing hotspots. You can add , update or delete a hotspot. For each hotspot, the list shows:
Name
Displays the name of the hotspot.
Hotspot Type
Displays the type of the hotspot.
Manage
Displays the available management options:
• Edit: Allows you to edit the hotspot.
• Delete: Allows you to delete the hotspot.
To add or delete a hotspot, click on the corresponding buttons.
Add Hotspot
This page describes how to add a hotspot.
Note: A hotspot has to be assigned to an existing interface, typically a WLAN interface. All hosts using this interface will automatically be restricted by the hotspot. Therefore, before you create a hotspot you would typically create a wireless network with client traffic Separate Zone, then create an interface for the respective WLAN interface hardware. For more information see System > Network > Wireless Networks.
1. Go to System > Configuration > Hotspots and click Add.
2. Enter the following settings:
Name
Enter a descriptive name for hotspot.
Description (optional)
Enter a description or other information.
Interfaces
Select or add the interfaces which are to be restricted by the hotspot. An interface can only be used by one hotspot.
Note: Hotspots will work only on LAN and DMZ member interfaces of the bridge. You should not select an uplink interface here because traffic to the Internet will be completely blocked afterwards.
Additionally, we strongly advise against using interfaces used by servers which provide essential services like authentication. You may irreversibly lock yourself out of Sophos Firewall OS.
Users
Select or add users for administrative settings. Administrative users are allowed to create vouchers or change the password of the day in the User Portal. By default nobody is allowed to enter administrative settings.
Application Filter Policy (optional)
Select or add an application filter policy for the hotspot.
Web Filter Policy (optional)
Select or add a web filter policy for the hotspot.
IPS Policies (optional)
Select or add IPS policies for the hotspot.
Traffic Shaping Policy (optional)
Select or add a traffic shaping policy for the hotspot.
Redirect to HTTPS (optional)
Enable this option to redirect users to HTTPS.
Hostname Type
Select the hostname type for the hotspot.
| System | 376
• None (IP Address)
• Custom hostname
Hostname
(if Custom hostname is selected)
Add a hostname for the redirect.
Hotspot Type
Select a hotspot type for the selected interfaces.
• Terms of Use Acceptance Customers can access the Internet after accepting the terms of use.
Session Expires
Select the time span after which the access will expire. After that, with the hotspot type Terms of Use
Acceptance, the users have to accept the terms of use again to log in. With the hotspot type Backend
Authentication, the users have to authenticate again.
Terms of Use
Add the text to be displayed as terms of use. Simple HTML markup and hyperlinks are allowed.
• Password of the Day A new password will be created automatically once a day. This password will be available in the User Portal on the Hotspots tab which is available to all users specified for this hotspot.
Additionally it will be sent to the specified email address(es).
Password Creation Time
The assigned time of the day at which the new password will be created. At this time the former password will immediately become invalid and current sessions will be terminated.
Send Password by Email to (optional)
Add email addresses to which the password will be sent.
Synchronize Password with PSK of Wireless Networks (optional)
Select this option to synchronize the new generated/saved password with wireless PSK.
Note: With the new PSK all APs that are configured with a separate zone wireless network that is also used as a hotspot interface will be reconfigured and restarted. This means all connections will be dropped.
• Voucher With this hotspot type, in the User Portal tokens with different limitations and properties can be generated, printed and given to customers. After entering the code, the customers can then directly access the Internet.
Voucher Definitions
Add or select the voucher definitions you want to use for the hotspot. How to add a voucher definition is explained on the Voucher Definitions page.
Devices per Voucher
Enter the number of devices which are allowed to log in with one voucher during its lifetime. It is not recommended to use the "unlimited" option.
Terms of Use
(not with hotspot type Terms of Use Acceptance:
Add the text to be displayed as terms of use. Simple HTML markup and hyperlinks are allowed.
Users Have to Accept Terms of Use
(not with hotspot type Terms of Use Acceptance):
Enable this option if you want the hotspot users to accept your terms of use before accessing the Internet.
Redirect to URL After Login
Enable this so that users will be redirected automatically to a particular URL after entering password or voucher data. The URL could, for example, be your hotel's website or a webpage stating your portal system policies.
| System | 377
| System | 378
URL
Enter the URL to which the user will be redirected .
3. Optionally, customize the hotspot.
Enable Customization
Enable to use a customized HTML file with your own images and stylesheets. Additionally, you can customize the voucher layout.
Customization Type
Select the customization type.
• Basic Uses the default login page template. If required, change logo, title, and text.
Logo
Upload a logo for the login page. Supported image file types are jpg, jpeg, png and gif. A maximum image width of 300 px and height of 100 px is recommended (depending on the title length).
Scale Logo to Recommended Size
If selected, a logo exceeding the recommended width or height will be scaled down and displayed in the recommended size. If it is not selected, the logo will be displayed in the original size.
Title
Add a title for the login page. Simple HTML markup and hyperlinks are allowed.
Custom Text
Add additional text for the login page. You can, for example, enter the SSID of the wireless network to be used. Simple HTML markup and hyperlinks are allowed.
• Full Select an individual login HTML page.
Login Page Template
Select the HTML template you want to use for your individual login page. Clicking Browse... opens a window where you can select and upload the file. In this template, you can use variables that can dynamically insert information for each hotspot. For example, you can add the company name and administrator information, the terms of use and the login form. See detailed information in the chapter
Login Page Template.
Images/Stylesheet
Add files that are referenced in your login page template, e.g., images, stylesheets, or JavaScript files.
Clicking Browse... opens a window where you can select and upload the files.
Voucher Template
(only with hotspot type Voucher): Clicking Browse...opens a dialog where you can select and upload a PDF file with the voucher layout. By default, a default template is used. The voucher PDF file has to be of PDF version PDF 1.5 or lower. It may have any page size and format—both size and format will be adjusted during voucher creation in the User Portal, depending on page size and number of vouchers per page specified there.
The PDF file may contain the following variables that will be replaced with the respective values during voucher generation in the User Portal:
• Wireless network name (SSID): <?ssid0?> (and <?ssid1?>, <?ssid2?> and so on, if the WLAN has more than one SSIDs)
• Wireless network password: <?psk0?> (and <?psk1?>, <?psk2?> and so on, if the WLAN has more than one SSIDs)
• Voucher code: <?code?>
• Voucher validity time:
<?validity?>
• Voucher data limit: <?datalimit?>
• Voucher time limit: <?timelimit?>
• Comment: <?comment?>
• QR code with the hotspot access data encoded:
<?qrX?>. The upper left corner of the QR code will be placed on the lower left corner of the variable.
| System | 379
Note: When using variables, the PDF file must include the entire character sets of the fonts used. When a variable is replaced by its value, and one of the substitute characters is not available, it will be displayed incorrectly. We recommend that you add the string
<?
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789?> (for
English usage) to your PDF file, which will automatically be removed during voucher generation.
If you use another language, you can include any other character set you want. Additionally, we recommend that you use a separate line for the variables as the layout could get corrupted if the substituted text is too long.
4. Click Save.
The hotspot is now available and appears in the hotspot list.
You can see if the hotspot is running on the System > Diagnostics > Services page. There you can also stop or start the hotspot.
Login Page Template
This page gives an overview of possible variables of the hotspot login template.
The HTML template for the login page may contain various variables that can dynamically insert information for the hotspot login page. When the UTM processes a template in order to display a login page, it replaces any template variables with the relevant value. Valid variables are:
General variables
•
<?company_text?>: Default company text
• <?company_logo?>: Default company logo (Sophos logo). The variable will be replaced by the path of the logo file, usage e.g., <img src="<?company_logo?>">
• <?admin_contact?>: Administrator name or address as defined on System > Configuration > Notification
(Send Notifications to Email Address field)
• <?admin_message?>: Administrator information label (default: For administrative questions please contact:)
•
<?error?>: Error message that arose while trying to log in.
Variables used for all hotspot types
• <?terms?>: Terms of use (as defined on Add Hotspot page)
• <?redirect_host?>: Redirect URL that is specified for the hotspot (as defined on the Add Hotspot page)
•
<?location?>: URL the user requested
• <?location_host?>: Hostname of the URL the user requested
• <?login_form?>: Login form suitable for the respective hotspot type: Password text box, Token text box,
Username and Password text boxes, or Accept checkbox, and Login button.
Note: For creating customized login forms, see User Specific Login Form below.
• <?asset_path?> (only important for customization mode Full): Hotspot specific directory for storage of images or stylesheets (example usage: <img src="<?asset_path?>/logo.png">)
Variables only used for voucher type hotspots
• <?maclimit?> Number of allowed devices per voucher of this hotspot (as defined on the Add Hotspot page)
•
<?numdevices?>: Number of devices used for this voucher
• <?timeend?>: Validity period (as defined on the Add/Edit Voucher Definition page)
• <?time_total?>: Total time quota allowed (as defined on the Add/Edit Voucher Definition page)
• <?traffic_total?>: Total data volume allowed (as defined on the Add/Edit Voucher Definition page)
Templates can contain if variables that make up sections like the ones shown below. Each section has an opening and a closing variable. The contents of an if section is only displayed on a specific condition.
If Section
<?if_loggedin?>
<?if_loggedin_end?
>
Meaning
Section is displayed when the user has successfully logged in.
<?if_notloggedin?>
<?
if_notloggedin_end?
>
Section is displayed when the user has not yet logged in, e.g., because terms of use have to be accepted or because an error occurred.
<?
if_authtype_password?
>
Section is displayed when hotspot type is Password of the Day.
<?
if_authtype_password_end?
>
<?
if_authtype_disclaimer?
Section is displayed when hotspot type is Terms of Use Acceptance.
>
<?
if_authtype_disclaimer_end?
>
<?
if_authtype_token?>
<?
if_authtype_token_end?
>
Section is displayed when hotspot type is Voucher.
<?if_location?>
<?if_location_end?>
Section is displayed when the user has been redirected.
Section is displayed when the checkbox Redirect to URL After Login is enabled.
<?if_redirect_url?>
<?
if_redirect_url_end?
>
<?
if_not_redirect_url?
>
<?
Section is displayed when the checkbox Redirect to URL After Login is disabled.
if_not_redirect_url_end?
>
Section is displayed when a validity period is set for a voucher.
<?if_timelimit?>
<?if_timelimit_end?
>
<?if_trafficlimit?>
<?
if_trafficlimit_end?>
Section is displayed when a data volume is set for a voucher.
| System | 380
| System | 381
If Section
<?if_timequota?>
<?if_timequota_end?
>
Meaning
Section is displayed when a time quota is set for a voucher.
Section is displayed when a Devices per Voucher value is specified.
<?if_maclimit?>
<?if_maclimit_end?
>
<?if_terms?>
<?if_terms_end?>
Section is displayed when Terms of Use are defined and enabled.
<?if_error?>
<?if_error_end?>
Section is displayed when an error occurred while trying to log in.
User-Specific Login Form
If you want to create your own login form instead of using the pre-defined
<?login_form?> variable, consider the following:
• Enclose the form in the following tags:
<form action="?action=login" method="POST"> ... </form>
• For a Terms of Use Acceptance hotspot, add a checkbox named "accept":
<input type="checkbox" name="accept">
• For Password of the Day or Voucher hotspots, add a text box named "token":
<input type="text" name="token">
• Add a means to submit the form, e.g., a Login button:
<input type="submit" name="login" value="Login">
Hotspot Settings
On this page you can make additional hotspot settings.
General Voucher Options
Here you can decide if and after which time interval you want to delete expired vouchers from the database. In the hotspot log you will still find information about deleted vouchers.
Login Page Certificate
To ensure login over HTTPS you can select certificates for the page login. You can generate and upload new certificates with on the Objects > Identity > Certificate page. Select the requested certificate from the drop-down list and click Apply to activate it.
Walled Garden
Add or select specific hosts or networks to be always accessible by all users, without entering a password or a voucher code. Hosts can be added on the Objects > Assets > IP Hosts page, networks can be added via the System >
Network menu.
| System | 382
Download Templates
Here you can download the hotspot login template and the voucher template that are used by default when adding a new hotspot. You can modify the default templates to customize your hotspot login page or the voucher design without the need to create them from scratch. You can upload the customized HTML and PDF template on the
System > System Services > Hotspots > Hotspots page.
System Services
System Services allows configuration of device components along with the associated services.
Available Configurations:
•
- Allows to configure Security Heartbeat Global Configuration.
•
- HA allows a second system to be used for redundancy or scalability.
•
- Web proxy is the engine used to enforce web protection policies.
•
- Authentication allows to configure profile attributes for Firewall, VPN and
Administration servers. You can also configure NTLM settings, Captive Portal parameters, Web Client settings,
Radius Client settings for Single Sign-On Server, global settings like Session Timeout and Simultaneous Logins.
•
- Guest User Settings allows configuring general parameters to provide secured internet
access for guest user.
•
- Configure Spoof Protection using IP-MAC trusted list and general settings for DoS
protection.
•
- Allows to configure and manage web filtering through the device, includes scanning and restricting all the HTTP/HTTPS/FTP traffic.
•
- QoS traffic shaping allows network bandwidth to be limited or guaranteed.
•
•
- Allows to configure your firewall to act as a wireless controller for Sophos access points.
•
- Allows to enable and configure ATP features to secure ingress and egress traffic.
•
- Configure Syslog servers and enable/disable logs to be sent.
•
- Enable Data Anonymization and set Authorizers.
•
- Configure Dual Anti Virus Scanning.
•
- Enable a schedule to scan and discover authorized APs and rogue APs.
Security Heartbeat
Security Heartbeat connects cryptographically secure endpoint and Sophos Firewall OS via Sophos Cloud.
This allows to exchange information between endpoint devices and Sophos Firewall. This information give a comprehensive overview of the network security. The administrator is able to define policies for network access based on the health status of the endpoint.
Endpoint devices and users need to authenticate via Sophos Cloud to connect to Sophos Firewall OS. The authentication works via a client which is available on Sophos Cloud and must be installed on the endpoint device.
After the installation the endpoint uses the Sophos Endpoint Security and Control which is an integrated suite of security software, for example, antivirus, behavior monitoring and live protection. Sophos Endpoint Security and
Control ensures that the endpoint device belongs to the system and has the permission to access the network.
Note: For more information and documentation about Sophos Endpoint Security and Control visit the
SOPHOS Website
.
The endpoint sends a heartbeat signal in regular intervals to the Sophos Firewall OS to show that it is alive.
Furthermore the endpoint also informs the Sophos Firewall OS about potential threats. If Sophos Endpoint Security
and Control detects any threats, the endpoint sends this information to Sophos Firewall OS which declares the endpoints health status. According to the user policy, which defines the permission of the different health status, the endpoint is not able to connect to networks, zones or services.
| System | 383
Note: You can enable Security Heartbeat and set the Minimum Heartbeat Permitted in the User
Application Policy which is managed on the Policies > Policies page in the Security Heartbeat section.
Note: Please find a description of the enpoints health status colors on the Health Status page.
To use security heartbeat you need to register with your Sophos Cloud account. If you do not have an account you can create a new one. You can find more information about Sophos Cloud under:
https://secure2.sophos.com/en-us/ products/cloud.aspx
.
Health Status
This topic describes the health status of endpoints.
The health status can be red, yellow or green. If you are viewing multiple devices, the color indicates the status of the device with the worst health.
Red
You should take action. One or more of the following issues occurred:
• Active malware has been detected or there might be active malware.
• Running malware has been detected.
• Malicious network traffic has been detected. This traffic might be headed to a command-and-control server involved in a botnet or other malware attack.
• Communications sent to a known bad host have been detected. This is based on the IP address or DNS resolution.
• Malware has not been cleaned up.
• Sophos security software is not working correctly. The device or devices might not be protected.
Yellow
If you are very sensitive to security issues, you should take action. One of the following issues occurred:
• Inactive malware has been detected.
• A Potentially Unwanted Application has been detected.
Green
You do not need to do anything.
• Sophos security software is working correctly.
• No active malware has been detected.
• No inactive malware has been detected.
• No Potentially Unwanted Applications have been detected.
Security Heartbeat Global Configuration
This page describes how to login with your Sophos Cloud account and enable Security Heartbeat.
1. Navigate to System > System Services > Security Heartbeat.
2. Enter Sophos Cloud login details.
Email Address
Enter the email address of your Sophos Cloud account.
Password
Enter the password of your Sophos Cloud account.
Note: You can also create a Sophos Cloud account by clicking Create Cloud Account.
3. Click Register.
You are registered with your Cloud ID to the Sophos Firewall OS. Security Heartbeat is automatically enabled. If you disable Security Heartbeat you are still registered with your Cloud account. This is a comfort function of Sophos
Firewall OS and has no network security value.
| System | 384
To clear your registration from Sophos Firewall OS, click Clear Registration.
High Availability (HA)
Hardware failure such as a failure of the power supply, hard disk, or processor is the main reason behind the failure of a Internet security system and/or a device. To provide reliable and continuous connection to the Internet and to provide security services such as firewall, VPN, intrusion detection and prevention, virus scanning, web filtering, and spam filtering services, two devices can be configured to function as a single device and provide high availability.
Clustering technology is used to ensure high availability. In a cluster, devices are grouped together and instructed to work as a single entity.
Note: This feature is not available in models: CR15i, CR 15wi, CR25wi, CR35wi, CR15wiNG,
CR25wiNG/6P and CR35wiNG/6P and on all WiFi models of SG Series devices.
How a Cluster works
The device offers high availability by using virtual MAC address shared between a primary device and an auxiliary device linked together as a “cluster”.
Devices - primary and auxiliary device, are physically connected over a dedicated HA link port.
Typically, traffic enters your network by passing through a network switch. In an HA solution, one of the devices in the cluster has a virtual MAC address and traffic is forwarded to the cluster device which has the virtual MAC address. The device which has virtual MAC address is the primary device and the other peer is the auxiliary device.
Primary device acts as a load balancer and forwards the traffic to the auxiliary device for processing. Auxiliary device can process traffic only if cluster is operating in the active-active mode.
If configured in active-passive mode, the primary device processes the entire traffic. Auxiliary device waits in a ready mode to operate as primary device, in case the primary device or any of the monitored links fail.
Auxiliary device monitors the primary device through the dedicated HA link and if it does not receive any communication within the pre-configured time, the primary device is considered to have failed. In this case, the auxiliary device takes ownership of the virtual MAC address from the primary device, and becomes the primary device temporarily. Primary device automatically takes over from the auxiliary device once it starts functioning.
HA terminology
1. HA Cluster
Group of two devices instructed to work as a single entity. Every HA cluster has one primary device and one auxiliary device. The primary device controls how the cluster operates. The roles that the primary and auxiliary devices play in the cluster depend on the configuration mode.
2. HA Configuration Modes
Active-Active
A configuration of HA cluster consists of a primary Device and an auxiliary device. In this mode, both primary device and auxiliary device process traffic while the primary unit is in charge of balancing the traffic.
Decision of load balancing is taken by the primary device. The auxiliary device can take over only in case of a primary unit failure.
Active-Passive
A configuration of HA cluster which consists of a primary device and an auxiliary device. In this mode, only the primary device processes traffic while the uxiliary device remains in stand-by mode, ready to take over if a primary device failure occurs.
3. Primary Device
The primary device also tracks the status of all cluster devices. In an active-active cluster, the primary device receives the entire network traffic and acts as load balancer to redirect traffic to the auxiliary device. In an Active-
Passive cluster, the primary device processes the network traffic while the auxiliary device does not process any traffic but remains ready to take over if the primary device fails.
| System | 385
4. Auxiliary Device
Auxiliary device always waits to become the primary device.
In an active-active cluster, the auxiliary device processes the network traffic assigned to it by the primary device.
In case the primary device fails, the auxiliary device becomes the primary device. In an active-passive cluster, the auxiliary device does not process network traffic and is in stand-by. It becomes active only when the primary device is not available to process the traffic.
5. Dedicated HA Link Port
Dedicated HA link is a direct physical link between the devices participating in HA cluster.
6. Load Balancing
The ability of HA cluster of balancing the traffic between nodes in the HA cluster.
7. Monitored Interface
Set of interfaces that are selected to be monitored. Each device monitors its own selected interface(s) and if any of them goes down, the device removes itself from the cluster and a failover occurs.
8. Virtual MAC
It is a MAC address associated with the HA cluster. This address is sent in response when any of the machines make an ARP request to HA cluster. It is not the actual MAC address and is not assigned to any interface of any unit in the cluster.
The primary device owns the MAC address and is used for routing network traffic. All external clients use this address to communicate with the HA cluster. In case of failover, the new primary device will have the same MAC address as the failed primary device. The cluster device which has a virtual MAC address acts as a primary device.
9. Primary State
In active-active mode, the device that is in charge of receiving all the traffic and load balancing is said to be in
"primary" state. A device can be in "primary" state only when the other device is in "auxiliary" state.
In active-passive mode, the device in charge of processing all the traffic is said to be in the "primary" state. A device can be in "primary" state only when the other device is in "auxiliary" state.
10. Auxiliary State
In active-active mode, the device that receives the traffic to be processed by it from the primary device is called to be in "auxiliary" state. A device can be in "auxiliary" state only when the other device is in "primary" state
In active-passive mode, the device which is not processing the traffic is called to be in "auxiliary" state. A device can be in "auxiliary" state only when the other device is in "primary" state.
11. Standalone State
A device is called to be in standalone state when it can still process network traffic and when the other device is not in position to process network traffic (i.e. in "fault" state or shut down).
12. Fault State
A device is in fault state when it cannot process network traffic if a device or link fails.
13. Peer
Once the HA cluster is configured, cluster devices are termed as peers i.e. for the primary device, the auxiliary device is its peer device and vice versa.
14. Synchronization
The process of sharing the various cluster configuration, between cluster devices (HA peers). Reports generated are not synchronized.
15. Device failover
If an device does not receive any communication within the predetermined period of time from the HA peer, the peer device is considered to have failed. This process is termed as device failover as when this occurs, the peer device is taken over.
16. Link Failover
| System | 386
Both the device in an HA cluster continuously monitor the dedicated HA link and the interfaces configured to be monitored. If any of them fails it is called link failure.
17. Session failover
Whether it is a device or link failover, session failover occurs for forwarded TCP traffic except for the virus scanned sessions that are in progress, VPN sessions, UDP, ICMP, multicast, and broadcast sessions and proxy traffic.
Device normally maintains session information for TCP traffic which is not passing through proxy service. Hence, in case of failover, the device which takes over will take care of all the sessions (TCP session not passing through proxy application). The entire process is transparent for the end users.
Configure HA
Points to be noted
• DHCP, PPPoE, WWAN, WLAN - High Availability (HA) cluster cannot be configured if any of the interfaces is dynamically configured using DHCP and PPPoE protocols or WWAN or WLAN is configured.
• Session failover is not possible for AV scanned sessions or any other IPv4 forwarded traffic like ICMP, UDP, multicast and broadcast traffic, traffic passing through the proxy subsystem : transparent, direct and parent proxy traffic, and VPN traffic.
• Session Failover is not possible for IPv6 forwarded traffic like ICMPv6, UDP, multicast and broadcast traffic.
• Masqueraded Connections - In case of the manual synchronization events from any of the HA cluster devices, all the masqueraded connections will be dropped.
• HA Load balancing - Active-Active HA cluster does not load balance VPN sessions, UDP, ICMP, multicast, and broadcast sessions, scanned FTP traffic and traffic coming through wireless RED devices and Access Points .
TCP traffic for User portal, Admin console or Telnet Console and, H323 traffic sessions are also not load balanced between the cluster devices. Control traffic for all modules will not be load balanced.
• HA Load balancing - Active-Active HA cluster will load balance normal forwarded TCP traffic, NATed (both
SNAT &virtual host) forwarded TCP traffic, TCP traffic passing through the proxy subsystem: transparent proxy, direct proxy, parent proxy and VLAN traffic.
• HA can be disabled from either of the devices. If disabled from the primary device, HA will be disabled on both the devices. If disabled from the auxiliary device, HA will not be disabled on the primary device and will act as stand-alone device.
• After disabling HA, primary device IP schema will not change.
• After disabling HA, for the auxiliary device, all the ports except the dedicated HA link port and peer administration port will be disabled. The peer HA link IP will be the assigned IP address assigned to the dedicated
HA link port while the peer administration IP will be the assigned IP address assigned to the peer administration port.
• If HA is disabled from a stand-alone machine, IP schema will not change.
• Super Administrator privileges are required to access the auxiliary device Admin console and therefore it can be accessed by “admin” user only and Live users/DHCP leases/IPsec live connections pages will not be displayed.
• After disabling HA, for the auxiliary device, for LAN zone all the administrative service – HTTP, HTTPS, Telnet,
SSH are allowed while for DMZ zone only HTTPS and SSH are allowed.
• For the auxiliary device, Deployment Wizard will not be accessible.
• Dedicated HA link port should be from any of the DMZ zone interface only. Make sure that the IP address of the
HA link port of primary and auxiliary devices are in the same subnet.
• After enabling HA if backup without HA configuration is restored then HA will be disabled and Primary Device will be accessible as per the backup configuration while Auxiliary Device will be accessible with the Auxiliary
Admin IP Address.
• In active-active mode, mails will be quarantined separately on both the devices as SMTP proxy traffic is load balanced in round robin manner.
• In active-passive mode, mails will be quarantined on the primary device only.
• If quarantine digest is configured, both the devices in the cluster will send quarantine digests.
• Administrator can release quarantined mails of all the users from both the devices.
| System | 387
• User can release quarantined mails from the User Portal. The User Portal displays mails quarantined only on the primary device. Also, the user can release them from the quarantine digest mailed from the primary device.
• HTTPS connection load-balancing is supported.
Note:
• Not available in models CR15i, CR15wi, CR25wi, CR35wi, CR15wiNG, CR25wiNG/6P, CR25wiNG/6P.
and on all WiFi models of SG series devices.
• HA will get disabled if you run the Deployment Wizard.
Before configuring HA
Before attempting to configure two devices as an HA pair for Hardware Failover, check the following requirements:
• Both devices in the HA cluster i.e. primary and auxiliary device must be registered and have the same number of interfaces. Both member devices should be of the same model.
• Both devices in the HA cluster must have the same firmware version installed on it.
• Active-Active: Two separate licenses are required, one for the primary device and other for the auxiliary device.
On both the devices, the same subscription modules should be enabled.
• Active-Passive: One license is required for the primary device. No license is needed for the auxiliary device.
• Cables to all the monitored ports on both the devices must be connected. Connect dedicated HA link port of both the devices with crossover cable.
• Dedicated HA link port should be from the DMZ zone interface only and must have a unique IP address on both the devices. SSH should be enabled for both the devices on the DMZ zone.
• DHCP, PPPoE, WWAN and WLAN configuration must be disabled before HA configuration.
Before enabling HA
Before enabling HA, you need to provide the Passphrase and Dedicated HA Link Port details on the auxiliary device by selecting Auxiliary for Initial HA Device State. If the details are not configured on the auxiliary device then the primary device will not be able to connect to the auxiliary device.
Configuring Primary Device
1. Navigate to System > System Services > HA.
2. Enter High Availability details.
Serial Number
Displays serial number.
Peer Serial Number
Displays peer’s serial number.
For the primary device, it displays the auxiliary device's serial number.
For the auxiliary device, it displays the primary device's serial number.
HA Configuration Mode
Select HA configuration mode for the cluster.
Active-Active
Select to configure a cluster for load balancing and failover HA. In active-active mode both, the primary device and the auxiliary device processes the traffic and monitors the status of the other cluster device.
The primary device controls load balancing among both the cluster devices.
Active-Passive
Select to configure a cluster for failover HA. In active-passive mode the primary device processes all connections. The auxiliary device passively monitors the cluster status and remains synchronized with the primary device.
Initial HA Device State
Select to set intital device state from the available options.
Available Options:
| System | 388
Primary Auxiliary
Passphrase
Passphrase - Specify a passphrase for communication.
Confirm Passphrase - Confirm the specified passphrase.
Note: To configure HA, both devices in the cluster must have the same passphrase.
Dedicated HA Link Port
Specify HA link port.
HA peers are physically connected using a crossover cable through this port. The same port must also be used as an HA link port on the peer device.
For example, if port E is configured as HA link port on the primary device then use port E only as HA link port on the auxiliary device. Make sure that the IP address of the HA link port for both, the primary device and auxiliary devices are in same subnet. Cluster devices use this link to communicate cluster information and to synchronize with each other.
before attempting to configure two devices as an HA pair.
Peer HA link IPv4
Specify the IP address configured on the HA link port of the peer device.
Peer Administration Port
Specify an administration port for the auxiliary device. This port can be used for administration purpose.
Peer Administration IP
Specify an administration IPv4/IPv6 address for the auxiliary device.
With this IP address, the Admin console of the auxiliary device can be accessed. Any user accessingthe
Admin console of the auxiliary device will be logged -in with an HA profile and have read-only rights.
Select Ports to be Monitored
Select the ports to be monitored.
Both devices will monitor their own ports and if any of the monitored port goes down, the device will leave the cluster and failover will occur.
Note: This feature is not supported in virtual security devices.
Figure 298: Configure HA
3. Click Enable HA to enable HA.
Note: The device from which HA is enabled, acts as a Primary Device while the peer device acts as
Auxiliary Device.
If everything is cabled and configured properly and HA is enabled successfully:
• Both devices will have the same configuration except the HA link port IP address.
• Additional options will be made available:
Primary Device
• Put on Standby (for Active-Passive mode)
•
• Sync Auxiliary (used to synchronize auxiliary device and primary device configurations)
Auxiliary Device
•
• Sync with Primary (used to synchronize auxiliary device and primary device configurations)
• By default, both the devices will synchronize automatically.
• As soon as active-active is configured, traffic load balancing is enabled. If required, it can be disabled from CLI console using the “system ha load-balancing on/off” command.
Disabling HA
HA can be disabled from this page.
Navigate to System > System Services > HA and click Disable HA.
| System | 389
| System | 390
Note:
• HA can be disabled from either of the devices. If disabled from the primary device, HA will be disabled on both the devices. If disabled from the auxiliary device, HA will not be disabled on the primary device and will act as stand-alone device.
• After disabling HA, the primary device IP schema will not change.
• If HA is disabled from a stand-alone machine, the IP schema will not change.
After disabling HA, the auxiliary device will reboot, all the ports except the dedicated HA link port and peer administration port will be disabled. The dedicated HA link port will be assigned to the peer HA link IP address and the peer administration port will be assigned to the peer administration IP address.
Switching Device to Standby Mode
Standby mode for the device can be configured only if the cluster is operating in active-passive mode. The auxiliary device takes over as primary device.
Synchronizing HA Peers
Under normal conditions, the auxiliary device is always synchronized with the primary device. However, if required, the auxiliary device can also be forcefully synchronized with the primary device.
Manual synchronization process can be initiated from either of the peers. If synchronized from the primary device, the primary device will push updates and if synchronized from the auxiliary device, the auxiliary device will pull the updates from the primary device.
Navigate to System > System Services > HA and click Sync Auxiliary to manually synchronize the auxiliary device with the primary device
From/To
Standalone
Primary
Auxiliary**
Fault
Standalone
No
Yes
Yes
No
Primary
Yes
No
No
No
Auxiliary**
Yes*
No
No
Yes
Fault
No
Yes
Yes
No
*Possible when dedicated link goes down and comes back again
**When device transits into Backup mode, it will soft boot
Manual synchronization gets the data and configuration updates except reports from the primary device.
Web Proxy
Use the Web Proxy page to configure your device as web proxy port, and to enable trusted ports.
The device can act as a web proxy server. To use your device as a web proxy server, configure the LAN IP address as a proxy server IP address in the browser setting and enable access to web proxy services from the Device Access page.
Note: You can also view and manage the web proxy status on the System > Diagnostics > Services page.
Web Proxy Port(Applicable only when the device is configured as Web Proxy)
Specify the port number, which is to be used for the web proxy.
Default: 3128
Trusted Ports
The device allows the access to those sites which are hosted on the standard port, only if deployed as web proxy.
To allow access to the sites hosted on the non-standard ports, you have to define non-standard ports as trusted ports.
Click the add icon to add the HTTP trusted ports, or the cancel icon to delete the trusted ports, or the edit icon to modify the trusted ports.
| System | 391
Figure 299: Configure Web Proxy
Click Apply to configure Web Proxy settings.
Note:
• Web proxy enforces web and application filter policy and malware scanning rules as configured in security policies.
• IPS policy is applicable on the traffic between proxy and WAN, but not between user and proxy.
• Traffic shaping policy is not applicable on the direct proxy traffic.
Authentication Services
This menu allows you to configure Authentication for Firewall, VPN and Admin traffic. You can also configure
Global Settings, NTLM Settings, Web Client Settings, Captive Portal parameters and Radius Client settings for Single
Sign-On Server.
Note: You can also view and manage the authentication status on the System > Diagnostics > Services page.
Once you have deployed the device, default access policy is automatically applied which will allow complete network traffic to pass through the device. This will allow you to monitor user activity in your Network based on default policy.
As device monitors and logs user activity based on IP Address, all the reports are also generated based on IP
Address. To monitor and log user activities based on usernames or logon names, you have to configure the device for integrating user information and authentication process. Integration will identify access request based on usernames and generate reports based on usernames.
When the user attempts to access, the device requests a user name and password and authenticates the user’s credentials before giving access. User level authentication can be performed using the local user database on the device, External ADS server, LDAP, RADIUS or TACACS+ server.
To set up user database
1. Integrate ADS, LDAP, RADIUS or TACACS+ if external authentication is required.
2. Configure for local authentication.
3. Register user
| System | 392
The device provides policy-based filtering that allows defining individual filtering plans for various users of your organization. You can assign individual policies to users, or a single policy to a number of users (Group).
Device detects users as they log on to a Windows domain in your network via client machines. Users are allowed or denied access based on username and password. In order to authenticate a user, you must select at least one database against which device should authenticate users.
To filter the Internet requests based on policies assigned, the device must be able to identify a user making a request.
The administrator can configure authentication based on the type of – Administrator, Firewall, VPN, and SSL VPN with multiple servers.
Below are the screen elements with their description:
Firewall Authentication Methods
Authentication Server List
Select Authentication server.
Authentication Server List displays all the configured servers while Selected Authentication Server List displays servers that will be used for authentication when the user tries to login.
In case of multiple servers, authentication request is forwarded as per the order configured in the Selected
Authentication Server List.
Default Group
Select the default group for firewall authentication.
Figure 300: Firewall Authentication Methods
VPN (IPsec/L2TP/PPTP) Authentication Methods
Set Authentication Methods Same As Firewall
Enable to use the same authentication method as configured for firewall traffic. If enabled all the authentication servers configured for the firewall traffic will be available for VPN traffic authentication configuration.
Authentication Server List displays all the configured servers while Selected Authentication Server List displays servers that will be used for authentication when user tries to login.
Override authentication method for VPN traffic by selecting or deselecting any Authentication server.
In case of multiple servers, authentication request will be forwarded as per the order configured in the Selected
Authentication server List.
| System | 393
If RADIUS server authenticates users then PPTP and L2TP connections established using MSCHAPv2 or CHAP protocol can be authenticated through RADIUS.
Figure 301: VPN (IPsec/L2TP/PPTP) Authentication Methods
Administrator Authentication Methods
Administrator can configure and manage authentication settings for all the Administrator Users except for the super administrator from this page.
Set Authentication Methods Same As Firewall
Select to use the same authentication method as configured for firewall traffic. If enabled all the authentication servers configured for the firewall traffic will be available for administrator traffic authentication configuration.
Authentication Server List displays all the configured servers while Selected Authentication Server list displays servers that will be used for authentication when user tries to login.
Override authentication method for administrator traffic by selecting or deselecting any Authentication server.
In case of multiple servers, authentication request will be forwarded as per the order configured in the Selected
Authentication server List.
Figure 302: Administrator Authentication Methods
SSL VPN Authentication Methods
Enable to use the same authentication method as configured for VPN or Firewall or configure authentication server for SSL VPN.
Authentication Server List displays all the configured servers while Selected Authentication server list displays servers that will be used for authentication when user tries to login.
Override authentication method for SSL VPN traffic by selecting or deselecting any Authentication server.
In case of multiple servers, authentication request will be forwarded as per the order configured in the Selected
Authentication server List.
| System | 394
Figure 303: SSL VPN Authentication Methods
Global Settings
Maximum Session Timeout
Specify the timeout duration in minutes.
Acceptable Range (minutes) - 3 to 1440
Authentication Session timeout is the time in minutes a user is logged into the device. Exceeding the period, the user will be logged out automatically and the user must re-authenticate. This is applicable to administrative sessions only.
Enable “Unlimited” to allow the users to remain logged in.
Simultaneous Logins
Specify the maximum number of concurrent logins allowed to the user.
Acceptable Range – 1 to 99 concurrent logins
OR
Enable “Unlimited” to allow unlimited concurrent logins to the user.
Login restriction is applicable to only those users who are added after this configuration.
| System | 395
Figure 304: Global Settings
CTAS Settings
User Inactivity
Select to enable or disable user inactivity setting.
When users logs in the Device and performs no activity, remaining idle for specific time span, they are considered inactive.
By default, User Inactivity is disabled.
Inactivity Time(Only if User Inactivity is enabled)
Specify the inactivity time in minutes.
The user inactivity timeout is the inactive/idle time in minutes after which the user will be logged out and has to re-authenticate.
Acceptable Range (Minutes) - 3 to 1440
Default - 3 minutes
Data Transfer Threshold(Only if User Inactivity is enabled)
Specify the minimum data to be transferred.
Default - 100 bytes
Figure 305: STAS Settings
NTLM Settings
Inactivity Time
Specify the inactivity time in minutes.
User Inactivity timeout is the inactive/idle time in minutes after which user will be logged out and has to reauthenticate.
Acceptable Range (Minutes) - 6 to 1440
Default – 6
Data Transfer Threshold
Specify the minimum data to be transferred.
If the minimum data is not transferred within the specified time, the user will be marked as inactive.
Default – 1024 Bytes
HTTP challenge redirect on Intranet Zone
Select to Enable or Disable the redirection of NTLM HTTP challenge on Intranet Zone.
When any site hosted on the Internet initiates the NTLM web proxy challenge for authentication, the client is transparently authenticated by the browser through device by sending credentials over the Internet.
To secure and to prevent the user credential from going out on the Internet, device will redirect NTLM authentication challenge on Intranet Zone. Client will be transparently authenticated through device's Local
Interface IP and credentials will be exchanged in Intranet zone only.
Default - Enable
Figure 306: NTLM Settings
Web Client Settings (iOS and Android and API)
Inactivity Time
Specify the inactivity time in minutes.
User Inactivity timeout is the inactive/idle time in minutes after which user will be logged out and has to reauthenticate.
Acceptable Range (Minutes) - 6 to 1440
Default – 6 minutes
| System | 396
Data Transfer Threshold
Specify the minimum data to be transferred.
If the minimum data is not transferred within the specified time, the user will be marked as inactive.
Default – 1024 Bytes
Figure 307: Web Client Settings
SSO using radius accounting request
Device can authenticate users transparently who have already authenticated on an external RADIUS server. Click to add, to delete or Edit hyperlink to edit Radius Client configurations.
Radius Client IPv4
Specify IPv4 Address of Radius Client.
Only request from specified IP Address will be considered for SSO.
Shared Secret
Provide Shared Secret for authentication.
Show Shared Secret
Click Show to view the configured Shared Secret.
| System | 397
Figure 308: SSO using radius accounting request
Captive Portal Settings
Unauthenticated users redirection
Select "Yes" to redirect the access request of unauthenticated user either to the Captive Portal or Custom Message page.
Select "No" to display "Access Denied" message to unauthorized user.
Unauthenticated users settings
Configure where the unauthenticated user access requests should be redirected.
Available Options:
• Captive Portal
• Custom Message
Select Captive Portal, if an unauthenticated user access request is to be forwarded to captive portal.
HTTPS Redirection
Enable to provide access of the Captive portal page through secure channel.
| System | 398
User Portal Link
Enable/Disable to make the “User Portal” link available on the Captive Portal page.
Default – Enable
URL Redirection after Login
Enable to redirect request to the user requested page or custom page.
URL to redirect
If request is to be redirected to the custom page, click Custom URL and specify URL, else click User
requested URL.
Preserve captive portal after login
Select “Yes” to minimize the captive portal popup, once the user is successfully authenticated.
Selecting “No” lets the Captive Portal to be displayed on system screen after successful authentication.
Keep Alive Request For Captive Portal
Keep-Alive request is constantly exchanged between the device and user to check whether user has logged out or idle. If the device does not receive the response, user is logged out automatically.
More number of concurrent HTTP Captive Portal users, more number of keep-alive requests. In case of more concurrent HTTP Captive Portal users we recommend to disable it.
Default – Enable
If disabled, user is logged out after the configured inactivity time. If disabled, specify user inactivity time and data transfer threshold.
User Inactivity Timeout
User Inactivity timeout is the inactive/idle time in minutes after which user will be logged out and has to reauthenticate.
Enable and specify timeout duration in minutes.
Acceptable Range (minutes) - 3 to 1440
Default - Disable
Data Transfer Threshold
Specify threshold value in Bytes for Data Transfer.
If the minimum data is not transferred within the specified time, the user will be marked as inactive.
Select Custom Message, if unauthenticated user is to be displayed custom message.
Windows Corporate Client Download Link
Enable to publish a link to download the Windows Corporate Client in the custom message.
Linux Corporate Client Download Link
Enable to publish a link to download the Linux Corporate Client in the custom message.
MAC Corporate Client Download Link
Enable to publish a link to download the MAC Corporate Client in the custom message.
Page Header Image
Display the default image shipped with the device at the top of the custom message page or use Browse and upload the custom image.
Supported Image format - JPG, PNG or GIF
Size - 700 X 80 pixels
Page Footer Image
Display the default image shipped with the device at the bottom of the custom message page or use Browse and upload the custom image.
Supported Image format - JPG, PNG or GIF
Size - 700 X 80 pixels
Custom Message
Specify message. You can customize the message to include client IP Address, category, and URL.
Blink Custom Message
Enable Blink Custom Message to display blinking message.
Preview
Preview and check how message will be displayed before saving the configuration.
| System | 399
Figure 309: Captive Portal Settings
Guest Users Settings
The Guest Users Settings page allows you to configure general settings, registration settings and SMS gateway for guest users.
Users without a pre-existing user account wanting to access the Internet using a hotspot, or via a network available at the airport, hotels, hostels, etc. are called “guest users”. These users, that are otherwise considered unauthenticated and/or denied access, are allowed to make request to connect to the Internet for a limited period by authenticating themselves. On being authenticated, these users are authorized to access Internet as guest users. At such locations,
Internet access is secured by configuring access policies to restrict any malicious use of the network.
Sophos allows administrator to pre-configure single or multiple guest users using the Admin Console. The credentials of guest users configured via the Admin Console can be printed and handed over to the guest user. Alternately, guest users can register themselves using the guest user portal. The credentials and Internet access details of guest users registered via the guest user portal can either be sent via SMS or can be printed.
In case of successful authentication the guest user is granted access according to the applicable group, or else is redirected to the Captive Portal page.
The page allows configuring general parameters to provide secured Internet access for guest users.
Guest User General Settings
Username Prefix
Enter a prefix to be used for auto-generation of a username for guest users.
Group
Select a group of policies to assign to guest users or create a new one.
You can create a new group of policies directly from this page or from the System > Authentication > Group >
Creating a New User Group page.
Password Length
Specify the length of the auto-generated password for Guest Users.
Minimum password length - 3 characters
Maximum password length - 60 characters
Default - 8 characters
The password length is a basic security parameter, the value of which affects the strength of password against brute force attack.
Password Complexity
Select a type of password from the available options to be used for complexity of an auto-generated password:
Available Options:
• Numeric Password - Password will include only numeric characters.
• Alphabetic Password - Password will include only alphabetic characters.
• Alphanumeric Password - Password will include numeric as well as alphabetic characters.
• Alphanumeric with Special Character Password - Password will include numeric, alphabets and special characters.
The password strength is a function of its length, complexity, and unpredictability. Combining password length with password complexity makes a password difficult to guess.
Disclaimer
Provide the disclaimer message to be printed below every user’s login credentials.
Disclaimer once configured can be edited but cannot be removed.
Auto Purge on Expiry
Check to enable automatic purging of user details on expiry of user validity.
Note: Details of a user who is bound to rules (like firewall, IM, etc.) will not be purged automatically.
| System | 400
Figure 310: Guest User General Settings
Guest User Registration Settings
Enable Guest Users Registration
Enable to allow secured Internet access to guest users.
SMS Gateway
Select the Gateway using which the SMS should be sent.
Alternately you may add the SMS gateway from this page itself by clicking Create New link.
Guest Username
Select the method of generating Username using the following option:
• Use Cell Number as Username
If Guest Username checkbox option is not selected, by default, the new user name will be generated with the value specified in Username Prefix.
User Validity (Duration in Days)
Specify guest user validity in days.
Default Country Code
Enable to configure a default country code on the Guest User Registration page.
Selected country is displayed as default option in Cell Number selection at Guest User registration page.
CAPTCHA Verification
Select to Enable or Disable CAPTCHA (Completely Automated Public Turing Test To Tell Computers and
Humans Apart) code verification on Guest User Registration page to ensure the request is received for human being.
By enabling CAPTCHA Verification, the user will be displayed a picture with characters that user must insert in a provided textbox below picture. The administrator can therefore protect device against attacks generated by automated programs.
Default - Enable
| System | 401
Figure 311: Guest User Registration Settings
SMS Gateway
An SMS gateway allows sending and receiving short message service (SMS) to/from a home network for guest user registration. The device supports HTTP and HTTPS protocol based SMS service.
This section displays list of all the configured SMS gateways and provides options to
gateway configuration.
Configure SMS Gateway
You can configure an SMS Gateway for guest user registration from this page.
1. Navigate to System > System Services > Guest User Settings or System > Authentication > Guest User
Settings and click Add under the SMS Gateway section.
2. Enter SMS gateway details.
Name
Enter the name of the SMS gateway.
URL
Specify the URL of the SMS gateway for sending an SMS request.
HTTP Method
Select the method for sending an SMS request to the SMS gateways from the options available:
Available Options:Get: Requests data from a specified resource.Post: Submits data to be processed to a specified resource.
Cell Number Format
Select to use country code with cell number.
Number Prefix
Specify the prefix value to be used with the cell number.
Number Prefix can include alpha-numeric and ASCII special characters.
It can be up to 4 characters long.
Request Parameters
Specify the following request parameters to configure the SMS gateway.
Name
Name is a descriptor used to describe the meaning of the value. E.g. username, password, mobile
Value
Indicates the value of a variable that are defined for the Name.
| System | 402
Response Format
Response describes the delivery status of the message such as success, failed, limit exceeded. Status message can be in various formats. Few of them are described below:
Response Format
{0} | {1} | {2}
Response Received
success | mbno | msgid/transactionid
Response Format
<status>500</status><transactionid>{0}</transactionid><reason>{1}</ reason>
Response Received
<status>500</status><transactionid>2323</transactionid><reason>Limit
Exceeded</reason>
When the response format is different for success and failure, it is recommended that the response format string should have a single content holder. E.g. {0}
Response Parameters
Response Parameter is the value presented by the content holder {0,1, 2...n} that will be displayed in the log viewer.
Parameter Index: Parameter Index is the content holder value {0,1, 2...n}.
Name: Name represents the content holder in the log viewer.
Example 1:
Parameter Index
0
1
2
Name
Status
Recipient
SMSID
Example 2:
Parameter Index
0
1
Name
SMSID - 2323
SMS Status Message – Length Exceeded
| System | 403
| System | 404
Figure 312: Add SMS Gateway
3. Click Save.
Testing Connectivity with SMS Gateway
Once you have configured an SMS gateway, check whether you are able to connect with the gateway or not from this page.
1. Navigate to System > System Services > Guest User Settings > SMS Gateway or System > Authentication >
Guest User Settings > SMS Gateway and click Test Connection.
2. Enter cell phone number details.
Cell Phone Number
Provide a cell phone number.
You will receive SMS through the gateway configured if you are able to connect to the gateway.
Figure 313: Test Connectivity
3. Click Save.
DoS & Spoof Protection
The device provides several security options that cannot be defined by the security policies. This includes protection from several kinds of “Denial of Service attacks”. These attacks disable computers and circumvent security.
A Denial of Service (DoS) attack is a method that hackers use to prevent or deny legitimate users access to a service.
| System | 405
DoS attacks are typically executed by sending many rkequest packets to a targeted server (usually Web, FTP, or Mail server), which floods the server's resources, making the system unusable. Their goal is not to steal the information but disable or deprive a device or network so that users no longer have access to the network services/resources.
All servers can handle a traffic volume up to a maximum, beyond which they become disabled. Hence, attackers send a very high volume of redundant traffic to a system so it cannot examine and allow permitted network traffic. Best way to protect against the DoS attack is to identify and block such redundant traffic. Below are some DoS settings which can be used for identifying DoS attack:
Packet rate per Source
Total number of connections or packets allowed to a particular user.
Burst rate per Source
Maximum number of packets allowed to a particular user at a given time.
Packet rate per Destination
Total number of connections or packets allowed from a particular user.
Burst rate per Destination
Maximum of packets allowed from a particular user at a given time.
How it works
When the burst rate is crossed, the device considers it as an attack. The device provides DoS attack protection by dropping all the excess packets from the particular source/destination. The device will continue to drop the packets till the attack subsides. Because the device applies threshold value per IP address, traffic from the particular source/ destination will only be dropped while the rest of the network traffic will not be dropped at all.
Time taken to re-allow traffic from the blocked source/destination = time taken to subside the attack + 30 seconds
For example:
Packet rate per source: 100 packets per second
Burst rate per source: 200 packets per second
When the user starts sending requests, initially he will be able to send 200 packets per second but once the 200 packets are received, in the next phase the user will only be able to send 100 packets per second. So in the next phase, if the user sends 150 packets per second, the device will consider it as an attack and drop 50 (150 -100) packets. The device will then only accept traffic from the user 30 seconds after having dropped the packets.
Threshold values
The device uses packet rate and burst rate values as a threshold value to detect DoS attacks. These values depend on various factors like:
• Network bandwidth
• Nature of traffic
• Capacity of servers in the network
These values are applicable to the individual source or destination requests per user/IP address and not globally to the entire network traffic. For example, if the source rate is 2500 packets/minute and the network consists of 100 users then each user is allowed a packet rate of 2500 packets per minute
Configuring high values will degrade the performance and too low values will block the regular requests. Hence it is very important to configure appropriate values for both source and destination IP address.
Spoof Protection General Settings
You can configure a MAC and/or IP address pair entry in the IP-MAC trusted list to improve the security of your network. Using MAC address filtering makes it more difficult for a hacker to guess and use a random MAC address or spoof a MAC address to gain access to your network as the traffic does not even reach your firewall.
Similarly, it is also possible to filter packets based on the IP-MAC pair. It prevents hosts which try to violate trusted
IP-MAC. To make the restriction more granular, you can enable restriction on the zones.
| System | 406
Enable Spoof Prevention
If enabled, the device provides 3 ways to prevent spoofing using an IP-MAC trusted list:
• IP Spoofing – Packets will be dropped if a matching route entry is not available.
• MAC Filter – Packets will be dropped if the MAC addresses are not configured as trusted MAC.
• IP-MAC Pair Filter – Packets will be dropped if either IP or MAC address does not match with any entry in the IP-MAC trusted list. Packets will be allowed if both IP and MAC address are not defined as an entry in the
IP-MAC trusted list.
Restrict Unknown IP on Trusted MAC (Only applicable if Spoof Prevention is enabled)
Enable the option, if you want to drop traffic from any IP address not in the trusted list for the trusted MAC address.
By default, it is disabled. When disabled, traffic from any IP address not in the trusted list will be allowed even if it is coming for the trusted MAC address.
Zone LAN WAN DMZ WiFi
IP Spoofing
Enable at least for one zone.
The device will reverse lookup for the route of the source network and, if not available, packets will be dropped and logged.
Default: disabled for all zones
MAC Filter
It restricts the access of your network to the external hosts.
As the device will drop all the requests from the
MAC address not configured in the trusted list, please make sure to include MAC addresses of all your internal devices.
If enabled, it is to be enabled for at least one zone.
Default: disabled for all zones
Note: To enable
Yes
Yes
No
Yes
Yes
Yes
Yes
Yes
Zone LAN
MAC
Filtering, you need
trusted
MAC address.
IP-MAC Pair Filter
The device will drop the request considering it as a spoofed request if:
• MAC address differs for the trusted IP address and
• IP address differs for the trusted MAC address
But, the request will be allowed if IP or MAC address does not exist at all in the list. Request is dropped if the
IP-MAC pair does not exist in the trusted list.
If enabled, it is to be enabled for at least one zone.
Default: disabled for all zones
Yes
WAN
No
DMZ
Yes
WiFi
Yes
| System | 407
Figure 314: Spoof Protection General Settings
| System | 408
Spoof Protection Trusted MAC
You can enable MAC address and/or IP address pair filtering to improve security. By enabling filtering, you define the devices that can access your network. It is also possible to import the trusted MAC list through a CSV (Comma
Separated Value) file. When a user attempts to access the network, the device checks the MAC address and/or IP address from the list. User gets access to the network only if the MAC address and/or IP address are in the trusted
MAC list, else the request is rejected.
The Spoof Prevention Trusted MAC section displays a list of all the MAC addresses configured as trusted MAC.
The page also provides options to
a new MAC address, update the existing addresses, and
the list of addresses.
DoS Settings
Attack definition can be defined both for source and destination.
SYN Flood
SYN Flood is the attack in which large numbers of connections are sent so that the backlog queue overflows. The connection is created when the victim host receives a connection request and allocates some memory resources to it. A SYN flood attack creates so many half-open connections that the system becomes overwhelmed and cannot handle incoming requests any more.
Configure packet rate (packets/minute) and burst rate (packets/second) for source and destination.
Select Apply Flag checkbox to apply the SYN flood definition and control the allowed number of packets.
Source Traffic Dropped displays number of source packets dropped in case source packet rate control is applied.
Destination Traffic Dropped displays the number of packets dropped in case destination packet rate control is applied
Click on the link Click Here to view DoS attacks status. It will redirect you to System > Current Activity >
DoS Attacks and Click SYN Flood to view the real-time updates on flooding. It displays the source IP address which was used for flooding and IP address which was targeted.
UDP Flood
User Datagram Protocol (UDP) Flood links two systems. It hooks up one system’s UDP character-generating service, with another system’s UDP echo service. Once the link is made, the two systems are tied up exchanging a flood of meaningless data.
Configure packet rate (packets/minute) and burst rate (packets/second) for source and destination.
Select Apply Flag checkbox to apply the UDP flood definition and control the allowed number of packets.
Source Traffic Dropped displays the number of source packets dropped in case source packet rate control is applied.
Destination Traffic Dropped displays the number of packets dropped in case destination packet rate control is applied
Click on the link Click Here to view DoS attacks status. It will redirect you to System > Current Activity >
DoS Attacks and Click UDP Flood to view the real-time updates on flooding. It displays the source IP address which was used for flooding and IP address which was targeted.
TCP Flood
TCP attack sends huge amount of TCP packets so that the host/victim computer cannot handle, thereby denying service to legitimate TCP users.
Configure packet rate (packets/minute) and burst rate (packets/second) for source and destination.
Select Apply Flag checkbox to apply the TCP flood definition and control the allowed number of packets.
Source Traffic Dropped displays the number of source packets dropped in case source packet rate control is applied.
Destination Traffic Dropped displays the number of packets dropped in case destination packet rate control is applied
| System | 409
ICMP/ICMPv6 Flood
ICMP/ICMPv6 attack sends huge amounts of packet/traffic so that the protocol implementation of the host/victim computer cannot handle, thereby preventing legitimate packets from getting through to their destination.
Configure packet rate (packets/minute) and burst rate (packets/second) for source and destination.
Select Apply Flag checkbox to apply the ICMP flood definition and control the allowed number of packets.
Source Traffic Dropped displays the number of source packets dropped in case source packet rate control is applied.
Destination Traffic Dropped displays the number of packets dropped in case destination packet rate control is applied
Click on the link Click Here to view DoS attacks status. It will redirect you to System > Current Activity >
DoS Attacks and Click ICMP/ICMPv6 Flood to view the real-time updates on flooding. It displays the source
IP address - which was used for flooding and IP address which was targeted.
Dropped Source Routed Packets
Select Apply Flag checkbox to enable. This will block any source routed connections and prevent any packets with an internal address from entering your network.
Disable ICMP/ICMPv6 Redirect Packet
An ICMP redirect packet is used by routers to inform the hosts what the correct route should be. If an attacker is able to forge ICMP redirect packets, he or she can alter the routing tables on the host and possibly weaken the security of the host by causing traffic to flow via another path.
Disable the option to prevent the attacker from forging ICMP redirect packets.
Default: enabled
ARP Hardening
If enabled, the device will send an ARP reply only if the destination IP address is a local address configured on the incoming interface and both the sender and destination IP address are in the same subnet.
Figure 315: DoS Settings
DoS Bypass Rule
The device allows to bypass the DoS rule in case you are sure that the specified source will not be used for flooding or the device ignores flooding coming from the specified source. By default, VPN zone traffic is also subjected to
DoS inspection. You can also bypass DoS inspection of the traffic coming from certain hosts of the VPN zone.
The DoS Bypass Rule section displays a list of all the bypass rule. You can filter the list based on the IP family. The
a new rule, update the existing rule, or delete a rule.
Add a Trusted MAC Address
You can add a trusted MAC address from this page.
1. Navigate to System > System Services > DoS & Spoof Protectionand click Add under the Spoof Protection
Trusted MAC section.
2. Enter trusted MAC address details.
MAC Address
Specify a MAC address to be added to the Trusted MAC list.
IPv4 Address
Specify an IPv4 address that is to be bound to the MAC address. Packets will be rejected if either MAC or
IPv4 address does not match.
Available Options:Static – Specify an IP Address to be bound to the MAC address. Packets will be rejected if either MAC or IP address does not match. Multiple IP addresses separated by comma can be provided.DHCP – MAC address will be bound to the IP address leased by the device DHCP server as and when the IP is leased. Entry will be updated automatically when the leased IP address is updated.
To unbind the IPv4 address, select None.
IPv6 Address
Specify an IPv6 address that is to be bound to the MAC address. Packets will be rejected if either MAC or
IPv6 address does not match.
Available Options:Static – Specify an IP Address to be bound to the MAC address. Packets will be rejected if either MAC or IP address does not match. Multiple IP addresses separated by comma can be provided.DHCP – MAC address will be bound to the IP address leased by the device DHCP server as and when the IP is leased. Entry will be updated automatically when the leased IP address is updated.
To unbind the IPv6 address, select None.
| System | 410
Figure 316: Add Trusted MAC
3. Click Save.
Import Trusted MAC Addresses
Instead of adding the trusted entries individually, the device provides a facility to import the trusted list from a CSV
(Comma Separated Value) file.
The format for the CSV file should be as follows:
1. First row of the CSV file has to be the header row: MAC address, IP association, IP address.
2. The rest of the rows are values corresponding to the header fields .
3. Blank rows will be ignored.
4. An error message is displayed only for invalid rows.
5. Format of values:
• Compulsory fields: MAC address and IP association.
| System | 411
• Optional fields: IP address.
• IP association must be Static or DHCP or None.
• For Static IP association, IP address must be available.
• For None/DHCP type of IP association, IP address is not required.
• For invalid MAC/IP address or IP association entry will be discarded.
• Use comma to insert multiple static IP addresses.
1. Navigate to System > System Services > DOS & Spoof Protectionand click Import under the Spoof Protection
Trusted MAC section to import a CSV file.
2. Browse trusted MAC address file.
Trusted MAC address File
Click Browse to locate CSV file.
3. Click Upload File to upload CSV file.
Figure 317: Import Trusted MAC Address CSV File
Create a DoS Bypass Rule
You can create a DoS bypass rule from this page.
1. Navigate to System > System Services > DOS & Spoof Protectionand click Add under the DoS Bypass Rule section.
2. Enter bypass rule details.
IP Family
Select the IP family of the traffic to be bypassed.
Source IP/Netmask (only applicable for IPv4)
Specify the source IP/Netmask.
Specify * if you want to bypass entire network.
Destination IP/Netmask (only applicable for IPv4)
Specify the destination IP/Netmask.
Specify * if you want to bypass entire network.
Source IP/Prefix (only applicable for IPv6)
Specify the source IP/prefix.
Specify * if you want to bypass entire network.
Destination IP/Prefix (only applicable for IPv6)
Specify the destination IP/prefix.
Specify * if you want to bypass entire network.
Protocol
Select the protocol whose traffic is to be bypassed if generated from the specified source to destination.
Available Options:TCPUDPICMPAll Protocols
For example, if you select TCP protocol then DoS rules will not be applied on the TCP traffic from the specified source to destination.
Source Port
Specify port number for the source.
| System | 412
Specify * if you want to bypass entire network.
Destination Port
Specify port number for the destination.
Specify * if you want to bypass entire network.
Figure 318: Add DoS Bypass Rule
3. Click Save.
Web Content Filter
The Web Content Filter page allows you to configure and manage web filtering. You can configure options for scanning HTTP/HTTPS/FTP traffic. You can also bypass HTTPS scanning from a specific source or destination.
General Configuration
Use this section to enable the Safe Search feature, caching and Pharming protection. You can also configure Custom
Denied Message.
Safe Search - This feature allows you to enforce safe searching into your search engines, thus helping you against malicious sites.
Pharming Protection - This feature allows you to stop Pharming by various attacker sites by Domain Name resolution.
Below are the screen elements with their description:
Scanning
Select the type of scanning to be applied.
Available Options:
• Single Anti-Virus (Maximum Performance): Traffic will be scanned using the Primary Anti-Virus engine.
• Dual Anti-Virus (Maximum Security): Traffic will be scanned using both Anti-Virus Engines, first by
Primary and then by the Secondary Engine. This can increase virus detection, but will impact performance.
It is recommended to use Single Anti-Virus engine for scanning for the best balance of Security and
Performance.
Enforce Safe Search
Enable safe search so that web sites containing pornography and explicit sexual content are blocked from the
Google, Yahoo, Altavista and Bing search results.
This will be applicable only when access to Porn, Adult Content and Nudity categories are denied in the Web
Filter Policy.
Enable Pharming Protection
Enable to protect against pharming attacks and direct users to the legitimate websites instead of fraudulent websites.
Pharming attacks require no additional action from the user from their regular web surfing activities. Pharming attack succeeds by redirecting the users from legitimate websites instead of similar fraudulent websites that has been created to look like the legitimate site.
Caching
Enable Caching
When enabled the Web Filter keeps a copy of frequently visited sites to improve performance and reduce bandwidth usage
Force caching for Endpoint updates
Use this option to enable caching of update data for Sophos Endpoints.
Note: If this option is disabled you may experience network congestion when many endpoints attempt to download updates from the Internet at the same time.
Denied Message
Specify default deny message to be displayed for all the web categories.
Enable Override Default Denied Message to display a customized message for all the web categories.
Denied Message Image
Specify whether the default or custom image should be displayed on the Denied message page.
Top Image
Specify the image which is to be displayed at the top of the message page.
Dimension of Image should be 125 x 70 pixels and jpg file only.
Bottom Image
Specify the image which is to be displayed at the bottom of the message page.
Dimension of Image should be 700 * 80 pixels and jpg file only.
Preview
Click to view the settings before saving the changes.
| System | 413
Figure 319: General Configuration
| System | 414
HTTP/HTTPS Configurations
The administrator can configure real-time or batch-mode scanning of HTTP traffic.
You can configure the maximum file size that can be buffered to the memory for scanning. This will also prevent the unintentional download of virus files hidden in the fragmented files.
Depending on the scanning policy set at the time of deployment through the Network configuration Wizard, the device will scan HTTP and HTTPS traffic. Enable or disable HTTP and HTTPS scanning from security policy.
Use this section to configure general restrictions for scanning and restricting all the HTTP/HTTPS traffic.
Scan Mode
Specify scanning mode to configure for real-time or batch-mode scanning for HTTP/HTTPS traffic.
In batch mode, virus scanning will start only after the complete file is downloaded. As the complete file is to be downloaded before scanning can start, if the size of the file is large it will take some time.
To avoid the delay, configure scan in real-time mode if you have to download bulky files.
File Size Threshold
Specify file size threshold (in KB). Files that exceed the configured threshold will not be scanned.
Acceptable Range - 1 to25600 KB
Default - 1024 KB
Audio & Video File Scanning
Enable Audio & Video File Scanning for scanning of video and audio streams being downloaded.
Default - Disable
HTTPS Scanning CA
Select the CA for HTTPS Scanning from the available options:
Available Options:
• SecurityAppliance_SSL_CA
• SecurityApplianceSelf Signed CA
• List of custom CAs if added
Default - SecurityAppliance_SSL_CA
Deny Unknown Protocol
Enable to deny traffic that does not follow the HTTPS protocol.
Allow Invalid Certificate
If you enable HTTPS scanning, you need to import an appliance SSL Proxy certificate in Internet Explorer,
Firefox Mozilla or any other browsers for decryption on SSL Inspection, otherwise the browser will always display a warning page when you try to access any secure site. An “Invalid Certificate error” warning appears when the site is using an invalid SSL certificate. The Device blocks all such sites.
Enable if you want to allow access to such sites.
| System | 415
Figure 320: HTTP/HTTPS Configurations
FTP Configurations
The administrator can define policies to take the appropriate action based on the protocols. A separate policy can be defined on how to handle SMTP, POP3, FTP and HTTP traffic if an infection is detected.
When the Device detects a virus, the file transfer is stopped and Email message is delivered without the attachment.
Files Greater Than Size
Configure the maximum file size (in KB) for scanning. The files greater than the specified size will not be scanned.
Acceptable Range - 1 to 20480KB
Default – 1024 KB
Figure 321: FTP Configurations
HTTP Scanning Rules
Viruses can infect your network through HTTP downloads . Define HTTP scanning rules to protect against this. The
HTTP Scanning Rules section displays a list of all the scanning rules. It also provides options to
a new rule, update the parameters of the existing rules, or delete a rule.
HTTPS Scanning Exceptions
The device allows you to bypass the HTTPS scanning for specified web categories. The Administrator needs to create an exception rule and include all the web categories for which HTTPS scanning is bypassed.
The section displays a list of all the configured exception rules. It also provides options to
a new exception rule, update the parameters of the existing rule, and delete the rule.
Add HTTP Rule
You can add an HTTP Scanning Rule from this page.
1. Navigate to System > System Services > Web Content Filter or Protection > Web Protection > Web Content
Filterand click Add under the HTTP Scanning Rules section.
2. Enter HTTP Rule details.
Name
Provide a name for the HTTP Rule.
| System | 416
Source IP Address
Specify Source IP Address.
Destination IP Address
Specify Destination IP Address.
The Scanning Rule will be applied to the mails received from the sender using the specified source IP Address and sent to the recipient with the specified destination IP Address.
URL Regex.
Provide a URL. You can use regular expressions for matching the pattern in the URL.
Action
Select whether you want to scan or bypass traffic for the specified source/destination IP Address and URL.
Figure 322: HTTP Rule Details
3. Click Save.
Add HTTPS Scanning Exception
You can add an HTTPS Scanning Exception from this page.
1. Navigate to System > System Services > Web Content Filter or Protection > Web Protection > Web Content
Filterand click Add under the HTTPS Scanning Exceptions section.
2. Enter HTTPS Scanning Exception details.
Name
Enter a name for the bypass rule.
Bypass
Select the web category for which HTTPS scanning is to be bypassed.
You can directly add a new web category from this page or from Objects > Content > Custom Web
Category
Figure 323: Add HTTPS Scanning Exception
3. Click Save.
| System | 417
Traffic Shaping Settings
Use the Traffic Shaping Settings page to configure default Traffic Shaping settings. All the bandwidth-related data are displayed only in KBps (Kilo bytes per second).
The settings are as follows:
Total Available WAN Bandwidth
Specify maximum bandwidth limit in KB. It is generally a sum of all WAN links' maximum limits.
Default - 100000 KB
Acceptable Range (KB) - 1 to 2560000
Optimize for Real-Time (VoIP)
Enable to give priority to real-time traffic like VOIP over all other traffic.
If disabled, priority will be applicable only for excess bandwidth i.e. bandwidth remaining after guaranteed bandwidth allocation.
Enforce Guaranteed Bandwidth
The Administrator can enforce the handling of all internet-bound traffic by any Traffic Shaping Policy applied to it. If there is no policy applied to the traffic, it will be handled by the Default Policy.
Enable to enforce bandwidth restriction on the traffic to which the Traffic Shaping Policy is not applied.
Disable if you do not want to enforce bandwidth restriction on the traffic to which the Traffic Shaping Policy is not applied. It will only handle traffic on which the Traffic Shaping Policy is applied.
Default Policy
The Default Policy will be applicable to the traffic which does not have any Traffic Shaping Policy applied.
Guarantee
Specify bandwidth which is the minimum guaranteed bandwidth that the user can use.
Default – 1 KBps
Acceptable Range (KBps) - 1 to 2560000
Limit
Specify bandwidth which is the maximum bandwidth that the user can use, if available.
Default – 100000 KBps
Acceptable Range (KBps) - 1 to 2560000
Priority
Set the bandwidth priority. Priority can be set from 1 (highest) to 7 (lowest) depending on the traffic required to be shaped.
Available Options:
1 – Business Critical2 to 5 – Normal6 – Bulky - FTP7 – Best Effort – e.g. P2P
Show Bandwidth Usage
Click to view Bandwidth Usage.
| System | 418
Figure 324: Traffic Shaping Settings
RED
This chapter describes how to enable RED. RED is short for Remote Ethernet Device and is a means to connect remote branch offices and the like to your main office as if the branch office is part of your local network.
System > System Services > RED
The setup consists of Sophos Firewall OS in your main office and a Remote Ethernet Device (RED) in your remote office. Establishing a connection between the two is utmost easy as the RED appliance itself does not need to be configured at all. As soon as the RED appliance is connected to Sophos Firewall OS it behaves like any other
Ethernet device on Sophos Firewall OS. All traffic of your branch office is safely routed via Sophos Firewall OS which means that your branch office is as secure as your local network.
The page shows the RED status. It is deactivated by default.
Disable RED
Disabling RED will not cause the deletion of the REDs. If you disable the RED functionality, RED devices will be deactivated and lose their connection. If you re-enable the RED functionality, the REDs will be activated again. To disable RED, click the toggle switch RED Status on the RED page and confirm it by clicking the Confirm removal
of RED configuration.
Configure RED
This page describes how to configure RED.
1. Navigate to System > System Services > RED and enable RED.
2. Make the following settings:
Organization Name
City
Enter the name of the organization.
Enter the city where the organization is located.
Country
Select the country where the organization is located.
Enter an email address.
| System | 419
Figure 325: Enable RED
3. Click Apply.
The RED status is now activated. Sophos Firewall is now registered at the RED Provisioning Service (RPS) of
Sophos to act as a RED hub. You can now continue by adding one or more RED appliances at System > Network >
Interfaces.
You can enable the Automatic Device Deauthorization.
Automatic Device Deauthorization
When RED is enabled, you can specify if disconnected RED appliances should automatically be deauthorized after a certain time span. With this feature, you can prevent stolen RED appliances from connecting to Sophos Firewall.
Note: The Automatic Device Deauthorization does not work for a RED tunnel between 2 Sophos Firewall appliances.
1. Ensure that RED is activated.
2. Select Enable next to Automatic Device Deauthorization.
3. Enter a time span for Deauthorize After.
4. Click Apply.
Automatic Device Deauthorization will now be successfully configured.
When a RED appliance reconnects after being disconnected for a time span longer than the defined time span, it will automatically be disabled.
Wireless
The page allows general configuration of wireless networks.
System > System Services > Wireless
Following is a description of the different sections of this page:
Download AP Firmware (Displayed only if AP firmware is not available on the appliance)
Click to download AP firmware.
Note: Wireless Protection can be used after AP firmware is successfully downloaded.
Global Settings
Enable Wireless Protection
Click the toggle switch to enable Wireless Protection.
| System | 420
Allowed Zone
Select network zones that are to be allowed for access point connectivity. These are the zones where access points are deployed to.
Note: If the wireless network uses WPA/WPA2 Enterprise Authentication as encryption mode then a
RADIUS server needs to be specified.
Figure 326: Global Settings
Advanced Settings
Notification Timeout
If an access point goes offline you get a notification. The Notification Timeout lets you configure a timeout for the notification. This means, if you set a delay of 2 minutes, the notification will be sent only if the access point is offline for at least 2 minutes. After the specified time, the AP will be considered inactive.
Timeout (in minutes)
The notification timeout requires an integer. The default timeout is 5 minutes.
Enterprise Authentication
For enterprise authentication, you need to provide some information of your RADIUS server. Note that access points do not communicate with the RADIUS server for authentication but only the Sophos Firewall OS. Port 414 is used for the RADIUS communication between the Sophos Firewall OS and the access points.
RADIUS Server
Select the required RADIUS server from the drop-down list. Servers can be added and configured on Objects >
Assets > Authentication Server.
Note: When your RADIUS server is connected to the Sophos Firewall OS via an IPsec tunnel, you have to configure an additional SNAT rule to ensure that the communication works correctly. On the
Objects > Policies > Network Address Translationpage, add the following SNAT rule: For traffic from the APs' network(s), using service RADIUS, and going to the RADIUS server, replace the source address with the IP address of Sophos Firewall OS used to reach the RADIUS server.
Figure 327: Advanced Settings
Wireless Client List
The Wireless Client List page displays a live snapshot of currently managed APs, broadcasted SSIDs (wireless networks), wireless clients connected through SSID to AP and mesh networks.
System > Current Activity > Wireless Client List
Show by SSID/Show by AP
The administrator can filter currently connected clients by Access Point or SSID
For each SSID/AP the list shows:
Name
Displays the name of the wireless connection.
IP Address
Displays IP address leased for the wireless connection.
MAC Address
Displays the MAC address of the wireless client.
Signal
Displays the signal strength.
Connection Time
Displays the connection time of the wireless client.
Frequency
Displays the frequency of the wireless network to which the AP is connected.
Vendor
Displays the vendor name of the client connected to the access point.
Figure 328: Wireless Client List
Advanced Threat Protection
This page allows the administrator to configure the Advanced Threat Protection feature.
ATP can help rapidly detect infected or compromised clients inside the network and raise an alert or drop the respective traffic.
The Advanced Threat Protection analyzes network traffic, e.g., DNS requests, HTTP requests, or IP packets in general, coming from and going to all networks. It also incorporates Intrusion Prevention and Antivirus data if the respective features are activated.
Note: Advanced Threat Protection module is a subscription module that needs to be subscribed before use.
General Settings
Enable Advanced Threat Protection
By default Advanced Threat Protection is disabled. To enable Advanced Threat Protection, click on the slider.
This will make several setting fields editable.
Logging
Logging is enabled. You can change the log setting by clicking Change log settings or by navigating to the
System > System Services > Log Settings page and clicking Add Syslog Server.
Policy
Select the security policy that the Advanced Threat Protection system should use if a threat has been detected.
Available Options:
• Log and Drop: The data packet will be dropped and logged.
• Log Only: The data packet will be logged.
| System | 421
| System | 422
Network/Host Exceptions
Add or select the source networks or hosts that should be exempt from being scanned for threats by Advanced
Threat Protection. How to add an IP host is explained on the Objects > Hosts and Services > IP Host page.
Threat Exceptions
Add destination IP addresses or domain names that you want to skip from being scanned for threats by Advanced
Threat Protection.
Caution: Be careful with specifying exceptions. By excluding sources or destinations you may expose your network to severe risks.
Figure 329: Advance Threat Protection
Log Settings
System > System Services > Log Settings
Device provides extensive logging capabilities for traffic, system and network protection functions. Detailed log information and reports provide historical as well as current analysis of network activity to help identify security issues and reduce network abuse. To view logs, relevant modules must be subscribed.
Device can log many different network activities and traffic including:
• Security Policies log
• Anti Virus infection and blocking
• Web filtering, URL and HTTP content blocking
• Signature and anomaly attack and prevention
• Spam filtering
• Administrator logs
• User Authentication logs
• SSL VPN logs
• WAF logs
• Advanced Threat Protection logs
• Heartbeat logs
Device can either store logs locally or send logs to external syslog servers for storage and archival purposes. Traffic
Discovery logs can be stored locally only.
| System | 423
Syslog is an industry standard protocol/method for collecting and forwarding Logs from devices to a server running a syslog daemon usually via UDP Port 514. Logging to a central syslog server helps in aggregation of logs and alerts.
If configured, device sends a detailed log to an external syslog server in addition to the standard event log. Device
Syslog support requires an external server running a syslog daemon on any of the UDP Port. When configuring logging to a syslog server, one needs to configure the facility, severity and log file format. One can also specify logging location if multiple syslog servers are defined.
Device logs all activity and includes every connection source and destination IP Address (IPv4 / IPv6), IP service, and number of bytes transferred.
A Syslog service simply accepts messages, and store them in files or prints. This form of logging is the best as it provides a central logging facility and a protected long-term storage for logs. This is useful both in routine troubleshooting and in incident handling.
Use this page to configure below settings:
• Syslog Servers - Configure Syslog server for logs storage and archival purposes.
• Log Settings - Configure logs to be sent to the Syslog server.
Syslog Servers
The Syslog Servers section displays list of configured syslog servers. You can sort the list based on server name. The page also provides option to add, update, or delete the server.
Log Settings
After configuring syslog server, configure logs to be sent to the syslog server. If multiple syslog servers are configured, you can send various logs on different servers.
To record logs you must enable the respective log and specify logging location. Administrator can choose between
On-Device (local) logging or Syslog logging. Administrator can also disable logging temporarily. Below are the different log types with their description:
Security Policy
Security Policy Log records invalid traffic, local ACL traffic, DoS attack, ICMP redirected packets, source routed and fragmented traffic.
• Policy Rules
Log records the entire traffic for Firewall.
• Invalid Traffic
Log records the dropped traffic that does not follow the protocol standards, invalid fragmented traffic and the traffic whose packets or device is not able to relate to any connection.
• Local ACLs
Log records the entire (allowed and dropped) incoming traffic.
• DoS Attack
The DoS Attack Log records attacks detected and prevented by the device i.e. dropped TCP, UDP and ICMP packets.
To generate logs, go to System > System Services > DoS & Spoof Protection and click Apply Flag against SYN
Flood, UDP Flood, TCP Flood, and ICMP/ICMPv6 Flood individually.
• Dropped ICMP Redirected Packet
Log records all the dropped ICMP redirect packets.
To generate log, go to System > System Services > DoS & Spoof Protection and click Apply Flag against
Disable ICMP/ICMPv6 Redirect Packet.
• Dropped Source Routed Packet
| System | 424
Log records all the dropped source routed packets.
To generate log, go to System > System Services > DoS & Spoof Protection and click Apply Flag against Drop
Source Routed Packets.
• Dropped Fragmented Traffic
Log records the dropped fragmented traffic.
• MAC Filtering
Log records the dropped packets when filtering is enabled from Spoof prevention.
• IP-MAC Pair Filtering
Log records the dropped packets when filtering is enabled from Spoof prevention.
• IP Spoof Prevention
Log records the dropped packets when filtering is enabled from Spoof prevention.
• SSL VPN Tunnel
Log records of SSL VPN traffic.
• Virtual Host
Log records of Virtual Host traffic.
• Heartbeat
Log records of Heartbeat traffic.
Figure 330: Security Policy
IPS
Records detected and dropped attacks based on unknown or suspicious patterns (anomaly) and signatures.
Figure 331: IPS
Anti Virus
Virus detected in HTTP, SMTP, FTP, POP3, IMAP4, HTTPS, SMTPS, IMAPS and POPS traffic.
Figure 332: Anti-Virus
Anti Spam
SMTP, POP3, IMAP4, SMTPS, POPS, IMAPS spam and probable spam mails.
Figure 333: Anti-Spam
Content Filtering
Web filtering and Application Filtering logs.
Log records of the name of applications/URLs accessed and their categories.
Note: To view the logs:
• Web Filter and Application Filter Policies should be applied in Security Policy.
• Log Firewall Traffic under Policies should be enabled.
Figure 334: Content Filtering
Events
Admin Events: Log records of configurations done through Admin Console.
Authentication Events: Log records of all authentication related events.
System Events: Log records of all system related events like Gateway Up/Down, Anti Virus updates etc.
| System | 425
| System | 426
Figure 335: Events
Web Server Protection
Web Server Protection Events.
Note: WAF logs are not available in CR10iNG, CR15i, CR15wi, CR15iNG, CR15wiNG, CR25ia, CR25wi,
CR35ia and CR35wi Sophos Devices.
Figure 336: Web Server Protection
Advanced Threat Protection
ATP Events: Log records of drop or alert event.
Figure 337: Advanced Threat Protection
Wireless
Access Points & SSID: Log records of the connected APs and SSID.
Figure 338: Wireless
Heartbeat
Endpoint Status: Log records of the health status of the endpoint.
Figure 339: Heartbeat
System Health
Usage: Log records of CPU usage, memory usage, no. of live users, interface and disk partition information.
Figure 340: System Health
Add Syslog Server
You can add syslog server from this page.
1. Navigate to System > System Services > Log Settingsand click Add under the Syslog Servers section.
2. Enter server details.
Name
Enter a unique name for the syslog server.
| System | 427
IP Address / Domain
Specify the IP address (IPv4 / IPv6) or domain name of the syslog server. Logs from the device will be sent to the server.
Port
Specify the port number for communication with the syslog server. The device will send logs using the configured port.
Facility
Select syslog facility for logs to be sent to the syslog server.
Facility indicates to the syslog server the source of a log such as operating system, the process or an application. It is defined by the syslog protocol.
The device supports several syslog facilities for received log.
Available Options:DAEMON
Daemon logs (information of services running in device as daemon).
KERNEL
Kernel log
LOCAL0 - LOCAL7
Log level information.
USER
Logging based on users who are connected to the server.
Severity Level
Specify severity levels of logs.
Severity level is the severity of the log that has been generated.
The device logs all the messages at and above the logging severity level you select. For example, select
ERROR to log all messages tagged as ERROR, as well as any messages tagged with CRITICAL, ALERT and EMERGENCY and select DEBUG to log all messages.
The device supports following severity levels:EMERGENCY - System is not usableALERT - Action must be taken immediatelyCRITCAL - Critical conditionERROR - Error conditionWARNING - Warning conditionNOTIFICATION - Normal but significant conditionINFORMATION - InformationalDEBUG -
Debug level messages.
Format
The device produces logs in the specified format. The device currently produces logs in device standard format.
Figure 341: Add Syslog Server
| System | 428
Note: You can configure maximum five syslog servers.
3. Click Save.
Once you add the server, go to the System > System Services > Log Settings page and enable all those logs, which are to be sent to the syslog server in the section Log Settings.
Settings
Use this page to enable/disable data anonymization and select authorizer administrators.
Enable data anonymization for the IT administrator to view or download user-specific activities, logs or reports. Apart from the IT administrator, at least one independent authorizer with the administrative privileges is required.
Once enabled:
1. All the user identities - username, IP address (IPv4 / IPv6), MAC address and email address in all logs /activities / reports are anonymized.
2. If an IT administrator wants to de-anonymize above mentioned user details, approval is required from at least one of the Authorizers.
Note: If you are logged in as one of the Authorizers, approval from at least one of the other Authorizers is required.
3. Similarly, to disable data anonymization, approval from at least one of the Authorizers is required.
Note: If you are logged in as one of the Authorizers, approval from at least one of the other Authorizers is required.
This page provides the following options:
Enable Data Anonymization
Click the check-box to enable it.
Select Authorizer
Administrator List displays all the administrators.
Click the check-box to select the administrator. All the selected administrators are moved to the Selected
Authorizer list.
Figure 342: Data Anonymization Settings
Malware Protection
This feature requires a subscription. It can be configured but cannot be enforced without a valid Email and
Web Protection subscription.
This feature is applicable on Cyberoam models CR1000iNG and above, and Sophos UTM models SG105 and above.
Sophos Firewall offers dual anti-virus scanning, wherein traffic is scanned by two (2) anti-virus engines. Traffic is first scanned by the primary engine, and then by the secondary engine.
Note: You can also view and manage the anti-virus status on the System > Diagnostics > Services and view the malware quarantine on the Protection > Email Protection > Malware Quarantine page.
General Settings
Primary Anti Virus Engine
Select the primary anti-virus engine for traffic scanning. For dual scan, packets are first scanned by the primary engine and then by the secondary engine. For single scan, only the primary engine is used.
Available OptionsSophos EngineAvira Engine
| System | 429
Current Activity
The Current Activity section provides information about the live IPsec, SSL, IP, wireless and RED connections to the device. You can also view the Malware Quarantine and Spam Quarantine area .
•
: Displays a list of all the users currently connected to the device
•
: Displays a list of all the live IPsec connections.
•
: Displays a list of all the live SSL VPN users.
•
: Displays all the Emails quarantined by the device if they are found to be virus-infected,
suspicious or containing a protected attachment. You can release or delete specific emails.
•
: Displays all the Emails quarantined by the device if configured it in any content scanning rule.
You can release or delete specific Emails.
•
: Displays a list of the live IPv4 connections on the device. You can forcefully disconnect the connections from the respective pages.
•
: Displays a list of the live IPv6 connections on the device. You can forcefully disconnect the connections from the respective pages.
•
: Displays list of wireless clients connected to the device. You can forcefully disconnect the
connections from the page.
Live Users
Live users in the device can be managed from a single page. All the active normal users, clientless ssers and single ign-on users are visible from the Live Users page. The administrator can disconnect these users from this page directly.
User Types:
• Normal
• Clientless
• Single Sign-On
• Thin Client
• WWAN user
A normal user has to logon to the device. He requires a client (client.exe) on the user machine or can use a HTTP client component and all the policy-based restriction are applied.
A clientless user does not require a client component (client.exe) on the user machines.
If a user is configured for single sign-on, whenever the user logs on to Windows, he/she is automatically logged to the device.
If the user is a thin client user, whenever the user logs on, he/she is visible on the Live Users page.
If a wireless user is configured and connected, the user is shown on the Live Users page.
To disconnect a user:
1.
Click the Disconnect icon under the Manage column against a user.
2. Specify the message in a dialog box.
3. Click OK to disconnect the User. To disconnect multiple live users, select them and click Disconnect .
Note: Configured messages will not be sent to a clientless user.
| System | 430
Figure 343: Live Users
IPsec Connections
Use IPsec Connections page to display a list of all active IPsec tunnels.
The page displays list of all the connected IPsec tunnels and you can filter the list based on connection name, local server name, local subnet, user name, remote server/host or remote subnet.
The administrator can disconnect any of the IPsec connection if required by clicking Disconnect or update the list by clicking Refresh.
Remote Users
Use Remote Users page to view a list of active remote users.
The page displays a list of all the currently logged remote users and you can filter the connections based on the connection date, username, source IP address, or leased IP address.
The administrator can disconnect any of the remote users, if required, by clicking Disconnect.
Live Connections IPv4
Use Live Connections IPv4 page to view a list of all currently active IPv4 connections.
The page displays the IPv4 live connections report and offers to get a quick real-time statistics of the network traffic.
You can use this report to check the share in network load of different protocols, computer systems (in your LAN or in the Internet), connections, or a combination of these (e.g. network connections with a certain protocol). Drill down quickly to get an in-depth view of your network.
Connections per Application
Use to determine the amount of traffic generated (bandwidth used) by application in real-time. It also displays which user is using which application currently and total data transferred using the application.
Use to view:
•
Connection Details per Application
•
Connections Details per Application and Username
For each connection the list shows:
Application
Applications running on network.
Click number in Total Connections column against application to view destination IP address-wise and destination port-wise connection details for the selected application.
Click the icon to view list of users using the respective application or click the icon to hide the list of users.
Upload Transfer
Data uploaded through the application.
Download Transfer
Data downloaded through the application.
Upstream Bandwidth
Upstream bandwidth.
Downstream Bandwidth
Downstream bandwidth.
Total Connections
Displays number of connections initiating/requesting the application.
Click the number in the Total Connections column to view the connection details for the selected application.
| System | 431
Figure 344: Live Connections IPv4 based on Application
Connections per User
Used to determine the amount of traffic generated (bandwidth used) by users in real time i.e. traffic per user. It also displays which user is using a particular application currently and is consuming how much bandwidth.
Use to view:
•
•
Connections Details per User and Application
For each connection the list shows:
User
Network Users requesting various Applications.
Click to view list of id="image_c1d_kqr_hs"/> icon to hide the list of applications.
Click number in Total Connections column against user to view
Click User to view Destination IP Addresses wise and Destination ports wise Connection details for selected
User.
Upload Transfer
Data uploaded.
Download Transfer
Data downloaded.
Upstream Bandwidth
Upstream bandwidth.
Downstream Bandwidth
Downstream bandwidth.
Total Connections
Displays number of connections initiated by the User.
Click Total Connections to view the connection details for selected User.
Figure 345: Live Connections IPv6 based on Username
Connections per Source IP Address
Use to determine the amount of traffic generated (bandwidth used) by source IP addresses in real time i.e. traffic per source IP address. It also displays which user is using a particular application currently and is consuming how much bandwidth.
Use to view:
•
•
Connection per Source IP Address and Application
Source IP Address
Source IPv4 Addresses requesting various applications.
Click to view list of Source IPv4 Addresses or click to hide the list of IP Addresses.
Upload Transfer
Data uploaded.
Download Transfer
Data downloaded.
Upstream Bandwidth
Upstream bandwidth.
Downstream Bandwidth
Downstream bandwidth.
Total Connections
Displays number of connections initiated by the Source IP Address.
Click Total Connections to view the connection details for selected User.
| System | 432
Figure 346: Live Connections IPv6 based on Source IP
Live Connections IPv6
Use Live Connections IPv6 page to view a list of all currently active IPv6 connections.
The page displays the IPv6 live connections report and offers to get a quick real-time statistics of the network traffic.
You can use this report to check the share in network load of different protocols, computer systems (in your LAN or in the Internet), connections, or a combination of these (e.g. network connections with a certain protocol). Drill down quickly to get an in-depth view of your network.
Connections per User
Used to determine the amount of traffic generated (bandwidth used) by users in real time i.e. traffic per user. It also displays which user is using a particular application currently and is consuming how much bandwidth.
Use to view:
•
•
Connections Details per User and Application
For each connection the list shows:
User
Network users requesting various applications
Click the icon to view the list of applications used by the user or click the icon to hide the list of applications.
Click number in Total Connections column against user to view destination IP address-wise and destination port-wise connection details for the selected user.
Upload Transfer
Data uploaded.
Download Transfer
Data downloaded.
Upstream Bandwidth
Upstream bandwidth.
Downstream Bandwidth
Downstream bandwidth.
Total Connections
Displays the number of connections initiated by the user.
Click the number in the Total Connections column to view the connection details for the selected user.
| System | 433
Figure 347: Live Connections IPv6 based on User
Connections per Source IP Address
Use to determine the amount of traffic generated (bandwidth used) by source IP addresses in real time i.e. traffic per source IP address. It also displays which user is using a particular application currently and is consuming how much bandwidth.
Use to view:
•
•
Connection per Source IP Address and Application
Source IP Address
Source IPv4 Addresses requesting various applications.
Click to view list of Source IPv4 Addresses or click to hide the list of IP Addresses.
Upload Transfer
Data uploaded.
Download Transfer
Data downloaded.
Upstream Bandwidth
Upstream bandwidth.
Downstream Bandwidth
Downstream bandwidth.
Total Connections
Displays number of connections initiated by the Source IP Address.
Click Total Connections to view the connection details for selected User.
Figure 348: Live Connections IPv6 based on Source IP
View Live Connection Details
The page displays the connection details per application, user, and source IP address.
Connection Details for the Selected Application
Click on the Total Connections link against the application to view its connection details.
Start Time
Time when connection was established.
In Interface
Traffic incoming interface.
Out Interface
Traffic outgoing interface.
Source IP
IP address from which the connection for the application was established.
Destination IP
IP address to which the connection was established.
Protocol
Protocol used by the traffic.
Source Port
Port through which the connection was established for the application.
Destination Port
Port to which the connection was established for the application.
Rule ID
Firewall rule ID applied to the connection traffic.
Upload Transfer
Data uploaded.
Download Transfer
Data downloaded.
Upstream Bandwidth
Upstream bandwidth.
Downstream Bandwidth
Downstream bandwidth.
Connection Details for the Selected Application and User
Click on the Total Connections link against the user name to view the connection details of the connections established by the user for the selected application.
Start Time
Time when connection was established.
In Interface
Traffic incoming interface.
| System | 434
Out Interface
Traffic outgoing interface.
Source IP
IP address from which the connection for the application was established.
Destination IP
IP address to which the connection was established.
Protocol
Protocol used by the traffic.
Source Port
Port through which the connection was established for the application.
Destination Port
Port to which the connection was established for the application.
Rule ID
Firewall rule ID applied to the connection traffic.
Upload Transfer
Data uploaded.
Download Transfer
Data downloaded.
Upstream Bandwidth
Upstream bandwidth.
Downstream Bandwidth
Downstream bandwidth.
Connection Details for the Selected User and Application
Click on the Total Connections link against the application to view the connection details of the connections established by the applications for the selected user.
Start Time
Time when the connection was established.
In Interface
Traffic incoming interface.
Out Interface
Traffic outgoing interface.
Source IP
IP address from which the connection for the application was established.
Destination IP
IP address to which the connection was established.
Protocol
Protocol used by the traffic.
Source Port
Port through which the connection was established for the application.
Destination Port
Port to which the connection was established for the application.
Rule ID
Firewall rule ID applied to the connection traffic.
| System | 435
Upload Transfer
Data uploaded.
Download Transfer
Data downloaded.
Upstream Bandwidth
Upstream bandwidth.
Downstream Bandwidth
Downstream bandwidth.
Connection Details of the Selected User
Click on the Total Connections link against the user to view its connection details.
Start Time
Time when the connection was established.
In Interface
Traffic incoming interface.
Out Interface
Traffic outgoing interface.
Source IP
IP address from which the connection for the user was established.
Destination IP
IP address to which the connection was established.
Protocol
Protocol used by the traffic.
Source Port
Port through which the connection was established for the user.
Destination Port
Port to which the connection was established for the user.
Rule ID
Firewall rule ID applied to the connection traffic.
Upload Transfer
Data uploaded.
Download Transfer
Data downloaded.
Upstream Bandwidth
Upstream bandwidth.
Downstream Bandwidth
Downstream bandwidth.
Connection Details of the Selected Source IP Address
Click on the Total Connections link against the source IP address to view its connection details.
Start Time
Time when the connection was established.
In Interface
Traffic incoming interface.
| System | 436
Out Interface
Traffic outgoing interface.
Source IP
IP address from which the connection for the source IP address was established.
Destination IP
IP address to which the connection was established.
Protocol
Protocol used by the traffic.
Source Port
Port through which the connection was established for the source IP address.
Destination Port
Port to which the connection was established for the source IP address.
Rule ID
Firewall rule ID applied to the connection traffic.
Upload Transfer
Data uploaded.
Download Transfer
Data downloaded.
Upstream Bandwidth
Upstream bandwidth.
Downstream Bandwidth
Downstream bandwidth.
Connection Details of the Selected Application and Source IP Address
Click on the Total Connections link against the application to view the connection details of the connections established by the application from the selected source IP address.
Start Time
Time when the connection was established.
In Interface
Traffic incoming interface.
Out Interface
Traffic outgoing interface.
Source IP
IP address from which the connection for the application was established.
Destination IP
IP address to which connection was established.
Protocol
Protocol used by the traffic.
Source Port
Port through which the connection was established for the application.
Destination Port
Port to which the connection was established for the application.
Rule ID
Firewall rule ID applied to the connection traffic.
| System | 437
Upload Transfer
Data uploaded.
Download Transfer
Data downloaded.
Upstream Bandwidth
Upstream bandwidth.
Downstream Bandwidth
Downstream bandwidth.
Wireless Client List
The Wireless Client List page displays a live snapshot of currently managed APs, broadcasted SSIDs (wireless networks), wireless clients connected through SSID to AP and mesh networks.
System > Current Activity > Wireless Client List
Show by SSID/Show by AP
The administrator can filter currently connected clients by Access Point or SSID
For each SSID/AP the list shows:
Name
Displays the name of the wireless connection.
IP Address
Displays IP address leased for the wireless connection.
MAC Address
Displays the MAC address of the wireless client.
Signal
Displays the signal strength.
Connection Time
Displays the connection time of the wireless client.
Frequency
Displays the frequency of the wireless network to which the AP is connected.
Vendor
Displays the vendor name of the client connected to the access point.
| System | 438
Figure 349: Wireless Client List
Malware Quarantine
This feature requires a subscription. It can be configured but cannot be enforced without a valid Email
Protection subscription.
This feature is available in Cyberoam Models CR15iNG and above, and all Sophos UTM Models.
Note: You can also view and manage the Malware Quarantine on the System > Current Activity >
Malware Quarantine page.
| System | 439
Malware Quarantine page displays all the Emails quarantined by device if they are found to be virus-infected, suspicious or contains Protected Attachment.
Use Filter to search for mails from the list of Quarantined Mails.
The Filter result displays a list of all the Quarantined Emails based on the filter criteria. The Administrator can release the quarantined mails to the recipient’s inbox by clicking the Release icon against the mail.
Total Utilization displays the percentage of the Quarantine Area used by quarantined and virus infected messages.
Once the quarantine repository is full older Emails are purged.
Quarantine Digest
The Quarantine Digest is an Email containing a list of quarantined Emails filtered by Device and held in the user's
Quarantine Area. If configured, the user receives a Quarantine Digest as per the frequency set in Protection > Email
Protection > Quarantine Digest. The Digest also provides a link to the User Portal from where the user can access quarantined Emails and take the required action.
Releasing Quarantined Email
Either the Administrator or the user can release the quarantined Emails. The Administrator can release the quarantined
Emails from theQuarantine Area while the user can release them from his User Portal. Released quarantined Emails are delivered to the intended recipient’s inbox. The Administrator can access the Quarantine Area from Protection >
Email Protection > Malware Quarantine/Spam Quarantine, while the user can logon to the User Portal and access the Quarantine Area from Malware/Spam Quarantine. If the Quarantine Digest is configured, the user will receive a
Digest of the quarantined mails as per the configured frequency.
Figure 350: Malware Quarantine
Spam Quarantine
This feature requires a subscription. It can be configured but cannot be enforced without a valid Email
Protection subscription.
This feature is available in Cyberoam Models CR15iNG and above, and all Sophos UTM Models.
Note: You can also view and manage the Spam Quarantine on the System > Current Activity > Spam
Quarantine page.
Spam Quarantine page displays all the Emails quarantined by Device if identified as Spam as configured in any
Content Scanning Rule.
Use Filter to search for mails from the list of Quarantined Mails.
The Filter result displays a list of all the Quarantined Emails based on the filter criteria. The Administrator can release the quarantined mails to the recipient’s inbox by clicking the Release icon against the mail.
Total Utilization displays percentage of Quarantine Area used by quarantined Spam and virus infected messages.
Once the quarantine repository is full older Emails are purged.
| System | 440
Quarantine Digest
The Quarantine Digest is an Email containing a list of quarantined Emails filtered by the Device and held in the user
Quarantine Area. If configured, the user receives a Quarantine Digest as per the frequency in Protection > Email
Protection > Quarantine Digest. The Digest also provides a link to the User Portal from where user can access quarantined Emails and take the required action.
Releasing Quarantined Email
Either the Administrator or the user can release the quarantined Emails. Administrator can release the quarantined
Emails from the Quarantine Area while the user can release them from his User Portal. Released quarantined Emails are delivered to the intended recipient’s inbox. The Administrator can access the Quarantine Area from Protection >
Email Protection > Malware Quarantine/Spam Quarantine, while user can logon to the User Portal and access the
Quarantine Area from Malware/Spam Quarantine. If Quarantine Digest is configured, user will receive Digest of the quarantined mails as per the configured frequency.
Figure 351: Spam Quarantine
DoS Attacks
The page provides information about DoS attacks. The list shows:
Attack Type
Displays the attack type: SYN Flood, UDP Flood, TCP Flood, ICMP Flood.
Source
Displays whether source packet control is applied or not. If applied, it indicates the number of packets dropped.
Destination
Displays whether destination packet control is applied or not. If applied, it indicates the number of packets dropped.
Click the name of the attack type you want to view to get real time updates on flooding.
Figure 352: DoS Attacks
| System | 441
Flooder Report
You can view the details of DoS attack from this page.
The report displays details of the source IP addresses (Flooders) used for flooding and the targeted IP addresses
(Flood Victims). Additionally, it displays the date and time at which the flooding was detected.
Diagnostics
Diagnostics menu allows checking the health of your device in a single shot. Information can be used for troubleshooting and diagnosing problems found in your device.
System > Diagnostics
Use this menu to configure below details:
•
- View the statistics to diagnose the connectivity problem, network problem and test network communication. It assists in troubleshooting issues such as hangs, packet loss, connectivity, discrepancies in the network. Also, troubleshooting reports can be generated to debug system problems.
•
- Use to view graphs pertaining to the system related activities for different time intervals.
•
- Displays packets details on the specified interface.
•
- Provides current or live connection snapshot of your device in the list form.
•
- View the current status and manage all the configured services
•
- Use to search whether the URL is categorized or not.
•
- View the logs for modules like IPS, Web Filter, Email, Malware, Security Policy, etc. This page gives consolidated information about all the events that have occurred.
Tools
Using the Tools page, one can view the statistics to diagnose the connectivity problem, network problem and test network communication. It assists in troubleshooting issues such as hangs, packet loss, connectivity, discrepancies in the network. The page covers:
•
•
•
•
•
Consolidated Troubleshooting Report
Ping
Ping is the most common network administration utility used to test the reachability of a host on an Internet Protocol
(IP) network and to measure the round-trip time for messages sent from the originating host to a destination computer.
Ping sends ICMP echo request/replies to test the connectivity to other hosts. Use standard ICMP ping to confirm that the server is responding. Ping confirms that the server can respond to an ICMP ping request.
Use Ping diagnostically to:
• Ensure that a host computer you are trying to reach is actually operating or the address is reachable or not
• Check how long it takes to get a response
• Get the IP address from the domain name
• Check for the packet loss
The parameters used are:
IP Address/Host Name
Specify the IP address (IPv4/IPv6) or fully qualified domain name to be pinged.
Ping determines the network connection between the device and a host on the network. The output shows if the response was received, packets transmitted and received, packet loss if any and the round-trip time. If a host is not responding, ping displays 100% packet loss.
IP Family
Select the type of IP family from the options available:
Available OptionsIPv4IPv6
Interface
Size
Select the interface through which the ICMP echo requests are to be sent.
Specify the ping packet size, in bytes.
Default: 32 bytes
Size Range: 1 to 65507
| System | 442
Figure 353: Ping
Traceroute
Traceroute is a useful tool to determine if a packet or communication stream is being stopped at the device, or is lost on the Internet by tracing the path taken by a packet from the source system to the destination system, over the
Internet.
Use Traceroute to:
• find any discrepancies in the network or the ISP network within milliseconds.
• trace the path taken by a packet from the source system to the destination system, over the Internet.
The parameters used are:
IP Address/Host Name
Specify the IP address (IPv4/IPv6) or fully qualified domain name.
Traceroute determines the network connection between the device and a host on the network. The output shows all the routers through which data packets pass on way from the source system to the destination system, maximum hops and total time taken by the packet to return measured in milliseconds.
IP Family
Select the type of IP family from the options available:
Available OptionsIPv4IPv6
Interface
Select the interface through which the requests are to be sent.
| System | 443
Figure 354: Traceroute
Name Lookup
Name Lookup is used to query the domain name service for information about domain names and IP addresses. It sends a domain name query packet to a configured domain name system (DNS) server. If a domain name is entered, the return is an IP address to which it corresponds, and if an IP address is entered, then the domain name is returned to which it corresponds. In other words, Name Lookup reaches out over the Internet to do a DNS lookup from an authorized name server, and displays the information in user understandable format.
The parameters used and their descriptions are:
IP Address/Host Name
IP address (IPv4/IPv6) or fully qualified domain name that needs to be resolved.
DNS Server IP
Select the DNS server to which the query is to be sent.
Select Lookup using all Configured Servers to view all the available DNS servers configured in the device.
Selecting this option will also provide information about the time taken by each DNS sever to resolve the query.
Based on the response time,of each server, you can prioritize the DNS server.
Figure 355: Name Lookup
Route Lookup
If you have routable networks and wish to search through which interface the device routes the traffic then lookup the route for the IP address (IPv4/IPv6).
Consolidated Troubleshooting Report
To help the Support team to debug the system problems, a troubleshooting report can be generated which consists of the system’s current status file and log files. The file contains details like a list of all the processes currently running on the system, resource usage etc. in encrypted form.
The administrator has to generate and mail the saved file to Support for diagnosing and troubleshooting the issue.
The file will be generated with the name: CTR_<APPKEY>__<MM_DD_YY>_<HH_MM_SS> where
• APPKEY is the device key of the device for which the report is generated
• MM_DD_YY is the date (month date year) on which the report is generated
• HH_MM_SS is the time (hour minute second) at which the report is generated
By default, the debug mode is off for all the subsystems. Before generating a log file, enable the debug mode by executing following command at the command line: console> diagnostics subsystems <subsystem name> debug on
Note: Debug mode cannot be enabled, if you only want to generate a system snapshot.
The parameters used are:
Generate CTR for
Enable the option(s) for which CTR should be generated.
Available Options:System Snapshot: Generates snapshots to display the issues in the system.Log Files:
Generates log files.
Reason
Specify the reason for generating CTR.
Generate
Click to generate the CTR.
| System | 444
Figure 356: Consolidated Troubleshooting Report
System Graphs
Use System Graphs page to view graphs pertaining to system related activities for different time intervals.
System > Diagnostics > System Graphs
System graphs will display following information for the selected period: Live connection info, CPU usage info, memory usage info, load average and interface usage info. These graphs are same as displayed in Utility wise graphs.
They are regrouped based on the time interval.
1.
2.
3.
4.
5.
6.
Data transfer through WAN zone
7.
CPU Usage Graphs
CPU Info graphs enables the administrator to monitor the CPU usage by the users and system components. Graphs display percentage wise minimum, maximum, average and current CPU usage for user, system, and CPU idle time.
• X-axis –Minutes/hours/days/months (depending on the period selected)
| System | 445
• Y-axis – % use
Legend:
• Orange color – CPU used by user
• Purple color – CPU used by system
• Green color – CPU idle time
Figure 357: CPU Usage
Memory Usage Graphs
Memory Info graphs enable the administrator to monitor the memory usage in percentage. Graph displays percentage wise minimum, maximum, average and current memory used, free memory and total memory available.
• X-axis –Minutes/hours/days/months (depending on the period selected)
• Y-axis – Memory used in MB
Legend:
• Orange color – Memory used
• Purple color – Free memory
• Green color – Total memory
Figure 358: Memory usage
Load Average Graphs
Load Average graphs enablte the administrator to monitor the load on the system. Graphs display the minimum, maximum, average and current load on the system at the interval of one minute, five minute, and fifteen minutes.
• X-axis –Minutes/hours/days/months (depending on the period selected)
• Y-axis – Load average index
Legend:
• Orange color – One minute
• Purple color – Five minutes
• Green color – Fifteen minutes
Figure 359: Load Average
| System | 446
| System | 447
Disk Usage Graphs
Graph displays the minimum, maximum, average and currently used disk space in percentage by various components.
• X-axis –Minutes/hours/days/months (depending on the period selected)
• Y-axis – % use
Legend
• Orange color – Disk space used by signatures
• Purple color – Disk space used by config files
• Green color – Disk space used by reports
• Blue color – Disk space used by temp
Figure 360: Disk Usage
Live Users Graph
Live Users graphs allow the Administrator to monitor the number of live users for the selected time duration.
Live Users graph displays the number of users currently connected to the Internet. In addition, it shows the minimum, maximum and average number of users connected during the selected graph period. This will help the administrator in determining the peak hour of the day.
• X-axis –Minutes/hours/days/months (depending on the period selected)
• Y-axis – Numbers of users
Legend
• Orange color – Number of live connected users
| System | 448
Figure 361: Live Users
Data Transfer Graphs through WAN Zone
Data Transfer graphs for WAN zone is subdivided into three (3) graphs providing the various information about data transfer via WAN zone.
1. Total upload/download data transfer of the last two hours – Graph displays combined graph of upload & download data transfer. Colors differentiate upload & download data traffic. In addition, it shows the minimum, maximum and average data transfer for upload & download traffic individually.
• X-axis –Minutes/hours/days/months (depending on the period selected)
• Y-axis – Upload/download in KBits/second
Legend
• Orange Color - Upload traffic
• Purple Color - Download traffic
2. Total data transfer of the last two hours - Graph displays the total data transfer from the WAN zone. In addition, it shows the minimum, maximum and average data transfer.
• X-axis –Minutes/hours/days/months (depending on the period selected)
• Y-axis – Upload/download in KBits/second
Legend
• Orange Color - Total (upload + download) traffic
• Purple Color - Download traffic
3. Gateway wise total data transfer of the last two hours - Graph displays the gateway-wise data transfer from the
WAN zone. In addition, it shows the minimum, maximum and average data transfer of each gateway.
• X-axis –Minutes/hours/days/months (depending on the period selected)
• Y-axis – Upload/download in KBits/second
Legend
• Different color for each gateway
| System | 449
Figure 362: WAN Data Transfer
Interface Info Graphs
Interface Info graph displays following traffic statistics for all the interfaces - physical interfaces, VLAN interfaces, wireless LAN and WAN interfaces:
1. Bits received and transmitted through the interface
2. Errors occurred while transmitting and receiving packets through the interface
3. Packets dropped while transmitting and receiving packets through the interface
4. Collisions occurred while transmitting and receiving packets through the interface
The graph shows
• X-axis – Minutes/hours/days/months (depending on the period selected)
• Y-axis – KBits/sec
Legend
• Orange color – Bits received (kbits/sec)
• Purple color – Bits transmitted (kbits/sec)
• Light Green color – Bits Received (kbits/sec)
• Blue color – Bits transmitted but dropped
• Pink color – Collisions
• Red color – Transmitted errors
• Dark Green color – Bits received but dropped
| System | 450
Figure 363: Interface Graph
Note:
• Today and Yesterday graphs are plotted at the average of 5 minutes.
• Weekly graph is plotted at the average of 15 minutes.
• Monthly graph is plotted at the average of 6 hours
• Yearly graph is plotted at the average of 1 day
Packet Capture
Packet Capture page displays packets details on the specified interface. It will provide connection details and details of the packets processed by each module packets e.g. firewall, IPS along with information like firewall rule number, user, web and application filter policy number etc. This will help administrators to troubleshoot errant firewall rules.
You can:
•
– Configure filter settings for capturing the packets.
•
– View the packet information.
•
– Specify the filter conditions for the packets.
• Start/Stop – Start and stop packet capturing.
• Refresh – Refresh the list.
• Clear – Clear the details of the packets captured.
Packet Capture
Trace On/Off
Click the slider to enable/disable packet capturing
The status, the buffer size and buffer used for capturing is displayed:
• Trace On - packet capturing is on
• Trace Off - packet capturing is off.
• Buffer Size: 2048 KB
| System | 451
• Buffer used: 0 to 2048 KB
Captured packets fill the buffer up to a size of 2048 KB. While packet capturing is on, if the buffer used exceeds the stipulated buffer size, packet capturing stops automatically. In such a case, you would have to clear the buffer for further use manually.
Figure 364: Packet Capture
Configure
Click to configure packet capturing feature.
Capture filter can be configured through following parameters:Number of Bytes to Capture(per packet)Wrap
Capture Buffer Once FullBPF String
There are various filter conditions for capturing the packets. The BPF string is used for filtering the packet capture. For example, host 192.168.1.2 and port 137
Captured Packet
The Captured Packet section displays a list of all captured packets. For each packet the list shows:
Time
Packet capture time.
In Interface
Interface from which packet is coming.
Out Interface
Interface to which packet is sent.
Ethernet Type
Ether Type: IPv4 or IPv6 or ARP
Ether Type is a field in an Ethernet frame. It is used to indicate the protocol encapsulated in the Ethernet frame.
Source IP
Source IP address (IPv4/IPv6) of the packet.
Destination IP
Destination IP address (IPv4/IPv6) of the packet.
Packet Type
Type of packet: ARP request or UDP.
Ports [src, dst]
Source and destination ports.
Rule ID
Firewall rule ID.
Status
Possible Packet Stati:
• Incoming: Packets received on WAN or LAN interface.
• Forwarded: Packet forwarded to Out Interface
• Consumed: Packets designated for or used by the device
• Generated: Packets generated by the device
• Violation: In case of any policy violation, the device will drop the packet and show the status Violation
Reason
Reason for a packet being dropped, if it is dropped.
Connection Status
Displays state of connection.
Served By
Specifies if connection is Established, TIME_WAIT or NONE.
Web Filter ID
Web filter policy ID applied on the connection traffic.
Connection Flags
System flags
Application ID
Application ID applied on the connection traffic.
Application Category ID
Application category ID applied on the connection traffic.
Connection ID
Unique ID assigned to a connection.
Gateway ID
Gateway ID through which the connection traffic is routed.
Remote Access Policy ID
Remote Access policy ID applied on the connection traffic.
Bandwidth Policy ID
Bandwidth policy ID applied on the connection traffic.
User Group
User group membership.
IPS Policy ID
IPS policy ID applied on the connection traffic.
Application Filter ID
Application filter policy ID applied on the connection traffic.
Web Category ID
Web category ID applied on the connection traffic.
Master Connection ID
Master connection ID of current connection.
Username
Name of the user establishing connection.
Display Filter
Click to set the filter criteria.
Packet Capture can be filtered as per the following criteria: interface name, ether type, packet type, source IP, source port, destination IP and destination port, reason, status, rule ID, user, and connection ID.
| System | 452
Packet Information
Packet Information
Packet information including header details and entities including firewall rules & policies.
Figure 365: Packet Information
Hex & ASCII Detail
Hex & ASCII Detail
Hex & ASCII Detail
Packet Information in Hex & ASCII values.
Figure 366: HEX And ASCII Details
Configuring Capture Filter
The Configuring Capture Filter page allows configuration of number of bytes to be captured per packet.
1. Navigate to System > Diagnostics > Packet Capture and click Configure.
2. Enter details to configure the capture filter.
Number of Bytes To Capture (Per Packet)
Specify the number of bytes to be captured per packet.
Wrap Capture Buffer Once Full
Enable to continue capturing the packets even after the buffer is full.
When the checkbox is enabled, the packet capturing starts again from the beginning of the buffer.
Enter BPF String
Specify a BPF string.
BPF (Berkeley Packet Filter) sits between link-level driver and the user space. BPF is protocol independent and use a filter-before-buffering approach. It includes a machine abstraction to make the filtering efficient.
For example, host 192.168.1.2 and port 137.
Refer to BPF String Parameters for filtering specific packets.
BPF String Parameters
How to check packets of the
specific host specific source host specific destination host specific network specific source network
Example
host 10.10.10.1
src host 10.10.10.1
dst host 10.10.10.1
net 10.10.10.0
src net 10.10.10.0
| System | 453
How to check packets of the
specific destination network specific port specific source port specific destination port specific host for the particular port the specific host for all the ports except SSH specific protocol
Example
dst net 10.10.10.0
Port 20 or port 21 src port 21 dst port 21 host 10.10.10.1 and port 21 host 10.10.10.1 and port not 22 proto ICMP, proto UDP , proto TCP
| System | 454
Figure 367: Configure Packet
3. Click Save.
Display Filter
The Display Filter page restricts the packet capturing to specific types of packets. There are further filtering conditions such as the type of interface, ether type, source IP address & destination IP Address.
1. Navigate to System > Diagnostics > Packet Capture and click Display Filter.
2. Enter details to configure the display filter
Interface Name
From the list, select the physical interface used for filtering packets logs.
Ethernet Type
Select the Ethernet type: IPv4 or IPv6 or ARP.
Ethernet Type is a field in an Ethernet frame. It is used to indicate the protocol encapsulated in the Ethernet frame.
Packet Type
From the list, select the packet type used for filtering packets.
Source IP
Specify source IP address (IPv4/IPv6).
Source Port
Specify source port number.
Destination IP
Specify destination IP address (IPv4/IPv6).
Destination Port
Specify destination port number.
| System | 455
Reason
Select the reason to display the filter from the available options.
Available
Options:FirewallLOCAL_ACLDOS_ATTACKINVALID_TRAFFICINVALID_FRAGMENTED_TRAFFICICMP_REDIRECTSOURCE_ROUTED_PACKETFRAGMENTED_TRAFFICAPPLICATION
FILTERUSER_IDENTITYIPSMAC_FILTERIPMAC_FILTERIP_SPOOFNEIGHBOR_POISONINGSSL_VPN_ACL_VIOLATIONVirtual_Host
Status
Select the status of the filter from available options.
Available Options:AllowedViolationConsumedGeneratedIncomingForwarded
Rule ID
Specify ID for the rule.
User
Select a user from the list of already existing users.
Connection ID
Specify a connection ID.
Clear
Click to remove the filter settings.
| System | 456
Figure 368: Display Filter
3. Click Save.
Connection List
The Connection List page provides a current or live connection snapshot of your device in list form. Apart from the connection details, the list also provides information like firewall rule ID, user ID, and connection ID per connection.
It is possible to filter the connection list as per the requirement.
The administrator can set the refresh interval to automatically refresh the list at the configured time interval or manually refresh the list by clicking the Refresh button. To filter the connection list click the
and specify the parameters.
Connection List
Time
Connection establishment time in the format HH:MM:SS.
Connection ID
Unique ID assigned to a connection.
In Interface
Port used for the incoming connection.
Out Interface
Port used by the outgoing connection.
Source IP
Source IP address (IPV4/IPv6) of the connection.
Destination IP
Destination IP address (IPV4/IPv6) of the connection.
Protocol
Protocol used by the connection, like TCP, UDP.
Source Port
Source port of the connection.
Destination Port
Destination port of the connection.
Master Connection ID
Master connection ID of the current connection.
Rule ID
Firewall rule ID that allows the session.
Username
Name of the user establishing a connection.
Connection Status
Displays the status of the connection.
Flags
System flag
User Group
User group membership.
Web Filter ID
Web filter policy ID applied on the connection traffic.
Application Filter ID
Application filter policy ID applied on the connection traffic.
IPS Policy ID
IPS policy ID applied on the connection traffic.
Traffic Shaping Policy ID
QoS policy ID applied on the connection traffic.
Remote Access Policy ID
Remote access policy ID applied on the connection traffic.
Gateway ID
Gateway ID through which the connection traffic is routed.
Web Category ID
Web category ID applied on the connection traffic.
Application ID
Application ID applied on the connection traffic.
| System | 457
Application Category ID
Application category ID applied on the connection traffic.
Connection Served By
Device serving the connection.
Translated Source
Translated source IP Address for outgoing traffic.
Translated Destination
Translated source IP Address for outgoing traffic.
Expiry (second)
Connection will expire in displayed seconds if idle.
Rx Bytes
The amount of data in bytes received in this session.
Tx Bytes
The amount of data in bytes sent in this session.
Rx Packets
Number of packets received in this session.
Tx Packets
Number of packets sent in this session.
Connection State
Displays state of connection.
Figure 369: Connection List
Display Filter
Use Display Filter page to set filtering criteria for displaying the connection list.
1. Navigate to System > Diagnostics > Connection List and click Display Filter.
2. Enter filter parameters
In Interface
Interface used by the incoming connection.
Out Interface
Interface used by the outgoing connection.
User
Name of the user establishing a connection.
Network Protocol
Select the network protocol used to establish a connection.
| System | 458
Available Options:IPv4IPv6
Source IP
IP address (IPv4/IPv6) from which the connection was established.
Destination IP
IP address (IPv4/IPv6) on which connection is established.
Packet Type
Select the type of packet used for the connection.
Source Port
Source port of the connection.
Destination Port
Destination port for the connection.
Rule ID
Firewall rule ID.
Clear
Click to remove the filter settings.
| System | 459
Figure 370: Display Filter
Services
Services page allows you to view and manage the status of configured services.
You can view the current status and manage all the configured services:
• Anti-Spam
• Anti-Spam Center Connectivity
• Anti-Virus
• Authentication
• DNS Server
• IPS
• Web Proxy
• WAF
• DHCP Server
• DHCPv6 Server
• Router Advertisement Service
• Hotspot
Parameters
Services
Name of the configured service.
Status
Current status of the service.
Manage
Click to start or stop or restart the respective service.
Actions
Start
Start the service whose status is Stopped.
Stop Button
Stop the service whose status is Running.
Restart Button
Restart service: Only for authentication service and web proxy service.
Status
No Web Server configured
Indicates that no web server is configured.
Note: The Start button is disabled in this case.
Connected
Displayed when Internet connectivity is available for the gateway.
Running
Indicates that service has successfully started.
Disconnect
Displayed when Internet connectivity is unavailable for the gateway.
Stopped
Displayed when a service is stopped or when the respective subscription module is not subscribed.
| System | 460
| System | 461
Figure 371: Services
URL Category Lookup
Use URL Category Lookup to search whether the URL is categorized or not. It searches the specified URL and displays the category name under which the URL is categorized along with the category description.
When a custom category is created with a domain/URL which is already categorized in a default category then the custom category overrides the default category and the search result displays the custom category name and not the default category name.
To search a URL
1. Navigate to System > Diagnostics > URL Category Lookup.
2. Enter URL to be searched in Search URL.
3. Click Search.
Figure 372: URL Category Lookup
Log Viewer
Use Log Viewer to view the logs for modules like IPS, Web Filter, Email, Malware, Security Policy, etc. from the
Log Viewer page. This page gives consolidated information about all the events logged by your device.
Access the page from Reports > Log Viewer or System > Diagnostics > Log Viewer.
Using this page, you can:
• Set refresh interval – Select refresh interval for refreshing the logs automatically. Select time from Set Refresh
Interval drop down list or click Refresh to refresh the logs.
• De-anonymize - To view actual (de-anonymized) user identities in all logs which are in encrypted form
(anonymized), if Data-Anonymization is enabled.
• View logs of all modules:
•
•
blocked websites etc. and the action taken by the device (Allowed or Blocked).
| System | 462
•
– Application filter logs provide details about applications to which access was denied by
the device.
•
– Malware logs provide information about the viruses identified by the device.
•
– Email logs provide information about the mail traffic processed by the device.
•
– Security policy logs provide information about how much traffic passes through a particular policy and through which interfaces.
•
– IPS logs provide information about the intrusion attempts detected/blocked by the device.
•
– Authentication logs provide information about all the authentication logs including firewall,
VPN and User Portal authentication.
•
– Admin logs provide information about administrator event and tasks.
•
– WAF logs provide information about HTTP/S requests and action taken on the same.
•
- ATP logs provide information related to threats detected/blocked by the device.
•
- Security Heartbeat logs provide information on Heartbeat connection and status.
View List of System Events
Time
Time when the event occurred.
Log Comp
Displays the log components of the system event.
Log component types – HTTP, HA, central management, IPsec, L2TP, PPTP, SSL VPN, Device, DHCP
Server, Interface, Gateway, DDNS, WebCat, IPS, anti-virus, quarantine, WLAN, HTTPS, guest user, protected application server, CTA, PPPoE, wireless protection, RED, ATP, SSL VPN Client, IPSec client, authentication clients, RED firmware, AP firmware, Up2Date.
Status
Successful or failed.
Username
Username of the user.
Message
Message for the type of system event.
Message ID
Message ID of the message.
Figure 373: System Log
View List of Web Filter Events
Logs are displayed only if the Web Protection module is subscribed.
Time
Time when the event occured.
Action
Allowed or Denied.
Username
Username of the user that accessed the URL.
Source IP
Source IP address (IPv4 / IPv6).
Destination IP
Destination IP address (IPv4 / IPv6).
Category
Web Category under which the URL is categorized by the device.
URL
URL accessed.
Bytes Transfer
Number of bytes transferred.
Message ID
Message ID of the message.
Policy ID
Policy ID applicable to the message.
| System | 463
Figure 374: Web Filter Log Viewer
View List of Application Filter Events
Logs are displayed only if the Web Protection module is subscribed.
Time
Time when event occured.
Action
Denied.
Username
Username of the user that accessed the application.
Source IP
Source IP address (IPv4 / IPv6).
Destination IP
Destination IP address (IPv4 / IPv6).
Application Category
Category under which the application is categorized.
Application
Name of the application denied.
Message ID
Message ID of the message.
Policy ID
Policy ID applicable to the message.
Figure 375: Application Filter Log Viewer
View List of Malware Events
HTTP, HTTPS, FTP logs are displayed only if the Web Protection module is subscribed.
POP, POPS, IMAP, IMAPS, SMTP and SMTPS logs are displayed only if Email Protection module is subscribed.
Time
Time when the event occured.
Protocol
Displays name of the protocol.
Types of protocol: HTTP, HTTPS, FTP, POP, POPS, IMAP, IMAPS, SMTP and SMTPS.
Username
Username on the user on whose sytem virus was detected.
Source IP
Source IP address (IPv4 / IPv6).
Destination IP
Destination IP address (IPv4 / IPv6).
Virus
Name of the virus detected.
| System | 464
Message
Message for the virus detected.
Message ID
Message ID of the message.
Figure 376: Malware Log Viewer
View List of Email Events
Logs are displayed only if the Email Protection module is subscribed.
Time
Time when the event occurred.
Log Comp
Displays the log components of the anti-spam events.
Types of log components: SMTP, SMTPS, POP, POPS, IMAP and IMAPS.
Action
Displays action taken against any anti-spam events.
Actions: Reject, Drop, Accept, Change Recipient, Prefix Subject, Tmp Reject and Accept with SPX
User Name
Username on the user on whose sytem, spam was detected.
Source IP
Source IP address (IPv4 / IPv6).
Destination IP
Destination IP address (IPv4 / IPv6).
Email Sender
Email address of the spam sender.
Email Receiver
Email address of the spam sender.
Email Subject
Email address of the spam sender.
Message
Message related to action taken by the device for the email event.
Message ID
Message ID of the message.
Figure 377: Email Log Viewer
| System | 465
View List of Security Policy Events
Time
Time when the event occured.
Log Comp
Displays the log components of the security policy events.
Examples: policy rule, invalid traffic, local ACL, DoS attack, ICMP redirection, source routed, fragmented traffic, MAC filter, IPMAC filter, IP spoof , protected application server, and heartbeat.
Action
Allowed or Denied.
Username
Username of the user on which the security policy (firewall rule) is applied.
Policy Rule
Security policy rule ID.
In Interface
Interface through which the traffic is coming in.
Out Interface
Interface through which the traffic is going out.
Source IP
Source IP address (IPv4 / IPv6).
Destination IP
Destination IP address (IPv4 / IPv6).
Rule Type
Type of security policy.
Message ID
Message ID of the message.
| System | 466
Figure 378: Security Policy Log Viewer
View List of IPS Events
Logs are displayed only if the Network Protection module is subscribed.
Time
Time when the event occurred.
Log Comp
Displays the log components of IPS events.
Types of log components: anomaly and signatures.
Action
Detect or Drop.
Username
Username of the user that triggered the signature.
Source IP
Source IP address (IPv4 / IPv6).
Destination IP
Destination IP address (IPv4 / IPv6).
Signature ID
Signature ID of the signature.
Signature Name
Name for the detected signature.
Category
Category of the signature.
Platform
Platform of the signature.
Target
Target of the signature.
Policy Rule
Firewall rule applied.
Message ID
Message ID of the message.
Figure 379: IPS Log Viewer
| System | 467
View List of Authentication Events
Time
Date and time when the event occurred.
Log Comp
Displays the log components of the authentication events.
Type of log components: external authentication, firewall authentication, VPN authentication, SSL VPN authentication, My Account authentication, Dial-In authentication and NTLM authentication.
Status
Successful or failed.
Username
Username of the user.
IP Address
IP address of the user.
Auth Client
Authentication client that is used for authentication.
Auth Mechanism
Type of authentication mechanism: local or external server (AD, LDAP or RADIUS).
Message
Message for the type of authentication event.
Message ID
Message ID of the message.
Figure 380: Authentication Log Viewer
| System | 468
View List of Admin Events
Time
Time when the event occurred.
Log Comp
Displays type of log components of admin events. Types of log components: GUI, CLI, API, central management.
Status
Successful or failed.
Username
Username of the admin user.
IP Address
IP address of the admin user.
Message
Message for the type of admin event.
Message ID
Message ID of the message.
| System | 469
Figure 381: Admin Log Viewer
View List of WAF Events
Logs are displayed only if Web Server Protection module is subscribed.
Time
Time when the event occurred.
Web Server Name
Displays a name for the web server.
Source IP/Name
Source IP address or name.
URL
URL accessed.
Reason
Reason for the action taken on any web application.
Message
Message for the WAF event.
Status Code
Status code of the action taken on the web application.
Bytes Received
Displays the bytes of information received by the device.
Bytes Transmitted
Displays the bytes of information transmitted by the device
Message ID
Message ID of the message.
Policy ID
Policy ID applicable to the WAF event.
Figure 382: WAF Log Viewer
View List of ATP Events
Logs are displayed only if the Network Protection module is subscribed.
Time
Time when the event occured.
Host (Source IP)
IP address of the host from where the threat derives.
User
Username of the user.
Destination IP
Destination IP address (IPv4 / IPv6).
Threat
Name of the threat detected by the device.
Threat URL/IP
URL/IP of the threat detected.
Origin
Type of source the threat comes from (Firewall, DNS, IPS, web)
Action
Action taken on the detection of the threat (log only, log and drop)
Message ID
Message ID of the message.
Login User
Name of the login user.
Process User
Name of the process user.
Executable
Name of executable files possibly infected with threats.
| System | 470
| System | 471
Figure 383: ATP Log Viewer
View List of Security Heartbeat Events
Time
Time when the event occurred.
Endpoint Name
Name of the endpoint.
Endpoint IP
IP address of the endpoint.
Endpoint Health
Status of endpoint health (red, yellow, green).
Message ID
Message ID of the message.
Figure 384: Security Heartbeat Log Viewer
De-Anonymize data
To comply with the Data Privacy Law, it is necessary to protect individual data. Device anonymizes data to achieve this by encrypting the log data in a random manner.
The device anonymizes all the user identities - username, IP address (IPv4 / IPv6), MAC address and email address in all logs /activities / reports. It means user identities in all the reports are displayed in encrypted form.
To view the actual details, IT administrator has to de-anonymize data. To de-anonymize data, approval from one of the authorizers configured on the Reports > Data Anomyzation > Settings page is required.
Users
Select username(s) to be de-anonymized.
IP
Add IP address(s) (IPv4 / IPv6) to be de-anonymized.
| System | 472
Advanced Settings (MAC Address, Email)
MAC
Add MAC address to be de-anonymized.
Add email address to be de-anonymized.
Once approved, all the logs and reports are displayed with the actual user details and not in encrypted form. Click
Apply. An authorization window will pop-up.
Here, you can additionally de-anonymize from the reports:
Username
Select the username.
Password
Provide the password for approval.
Support Access
Use the Support Access page to grant support staff temporary access to your device.
The Support Access function enables support staff to connect to the Admin console of Sophos Firewall OS without knowing a certain login account. The HTTPS traffic of the Sophos Firewall OS session is proxied by the Support
Access function. Identification of Sophos Firewall OS happens through an access ID which the admin of Sophos
Firewall OS must tell the support staff. All connections between Sophos Firewall OS and the Support Access function are initiated by Sophos Firewall OS on TCP port 22.
1. Enable the Support Access on Sophos Firewall OS under System > Diagnostics > Support Access and click the toggle switch.
2. Confirm the upcoming message with OK.
| System | 473
3. From the drop-down menu Grant Access For select the time the access is valid.
4. Click Apply to update the settings.
5. Click OK.
Sophos Firewall OS establishes a secure control connection to APU and negotiates a unique access ID.
6. Communicate the Access ID to the support.
The support uses this access ID to login to Sophos Firewall OS. The control connection remains established until the specified time, which is displayed next to Access Until.
You can disable the connection manually any time by clicking the toggle switch and confirming the disable message with OK.
Objects
Objects are the logical building blocks of various policies and rule, which include:
•
- Assets allows defining and managing authentication servers, access point and Web servers.
•
•
- Identity allows configuring Identity and authentication attributes for certificates, groups and users.
•
- Policy describes the security parameters used for establishing and maintaining a secure connection between two peers.
•
- Hosts and Services allows defining and managing system hosts and services.
Assets
Objects > Assets
Assets allows defining and managing authentication servers, access point and Web servers.
This section covers the following topics:
•
- The page allows you to create one or more authentication servers.
•
- The page allows you to create one or more authentication clients.
•
- The Access Point (AP) page provide an overview of the access points known to the system. You can edit AP, delete or group APs and assign wireless networks to APs or AP groups.
•
- This page allows you to organize access points in groups.
•
web servers.
Authentication Server
On this page you can manage databases and backend servers of external user authentication services. External user authentication allows you to validate user accounts against existing user databases or directory services on other servers of your network.
Objects > Assets > Authentication Server
Authentication services currently supported are:
• Novell's eDirectory
• Microsoft's Active Directory
• RADIUS
• TACACS+
• LDAP
The page displays all existing authentication servers. You can add an authentication server, update or delete them.
Following is a description of the table elements:
Name
Displays the name of the authentication server.
IP
Displays the IP address of the authentication server.
Port
Displays the port of the authentication server.
Type
Displays the type of the authentication server.
| Objects | 474
| Objects | 475
Domain/Admin
Displays the domain or admin of the authentication server.
Manage
Displays the available managing options for the authentication server:
• Edit: Allows you to edit the authentication server.
• Delete: Allows you to delete the authentication server.
To either add or delete a authentication server, click on the corresponding buttons.
Add External Server
On this page you can create one or more authentication servers. Follow the links to create them:
Active Directory
Active Directory (AD) is Microsoft's implementation of a directory service and is a central component of Windows
2000/2003 servers. It stores information about a broad range of resources residing on a network, including users, groups, computers, printers, applications, services, and any type of user-defined objects. As such it provides a means of centrally organizing, managing, and controlling access to these resources. The Active Directory authentication method allows you to register Sophos Firewall OS at a Windows domain, thus creating an object for Sophos Firewall
OS on the primary domain controller (DC). Sophos Firewall OS is then able to query user and group information from the domain.
Note: Sophos Firewall OS supports Active Directory 2003 and newer.
LDAP
LDAP, an abbreviation for Lightweight Directory Access Protocol, is a networking protocol for querying and modifying directory services based on the X.500 standard. Sophos Firewall OS uses the LDAP protocol to authenticate users for several of its services, allowing or denying access based on attributes or group memberships configured on the LDAP server.
RADIUS
RADIUS, the acronym of Remote Authentication Dial In User Service is a widespread protocol for allowing network devices such as routers to authenticate users against a central database. In addition to user information,
RADIUS can store technical information used by network devices, such as supported protocols, IP addresses, routing information, and so on. This information constitutes a user profile, which is stored in a file or database on the RADIUS server. The RADIUS protocol is very flexible, and servers are available for most operating systems.
The RADIUS implementation on Sophos Firewall OS allows you to configure access rights on the basis of proxies and users. Before you can use RADIUS authentication, you must have a running RADIUS server on the network.
Whereas passwords are encrypted using the RADIUS secret, the username is transmitted in plain text.
TACACS+
TACACS+ (the acronym of Terminal Access Controller Access Control System) is a proprietary protocol by Cisco
Systems, Inc. and provides detailed accounting information and administrative control over authentication and authorization processes. Whereas RADIUS combines authentication and authorization in a user profile, TACACS
+ separates these operations. Another difference is that TACACS+ utilizes the TCP protocol (port 49) while
RADIUSClosed uses the UDPClosed protocol.
| Objects | 476
eDirectory
Novell eDirectory is an X.500 compatible directory service for centrally managing access to resources on multiple servers and computers within a given network. eDirectory is a hierarchical, object-oriented database that represents all the assets in an organization in a logical tree. Those assets can include people, servers, workstations, applications, printers, services, groups, and so on.
on page 341
Add Active Directory Server
Use the Add External Server page to configure Active Directory server settings.
The Add External Server page provides options to configure Active Directory which in turn allows the device to map the users and groups from ADS for the purpose of authentication.
1. Navigate to Objects > Assets > Authentication Server or System > Authentication > Authentication Server and click Add.
2. On the Add External Server page, select Active Directory for Server Type. If a user is required to authenticate using AD, the device needs to communicate with the AD server for authentication.
3. Enter Active Directory details.
Server Name
Enter a descriptive name for the Active Directory server.
Server IP/Domain
Enter an IP address or domain for the Active Directory server.
Port
Enter the port of the Active Directory server. By default, this is port 389.
NetBIOS Domain
Enter a NetBIOS domain for the Active Directory server.
ADS Username
Enter a username for the admin user of the Active Directory server.
Password
Enter a password for the admin user of the Active Directory server.
Connection Security
Select the type of security to be implemented on the established connection. It provides a method to login to the external server by sending the username and password in encrypted format instead of clear text. We strongly recommend using the encryption method to protect user credentials.
• Simple: User credentials will be send unencrypted, for example, as clear text.
• SSL: Secure Sockets Layer. This is the most common method used for secured connection. The Port will then change from 389 (LDAPClosed) to 636 (ldaps = LDAP over SSL).
• TLS:
Validate Server Certificate
(not with Simple connection security)
Enable to validate the certificate on the external server.
Display Name Attribute
(optional)
Enter the name for the AD server which is displayed as AD username.
Email Address Attribute
(optional)
Enter the alias for the configured email address which is displayed to the user.
Domain Name
Specify the domain name for which the query is to be added.
| Objects | 477
Search Queries
Click Add to enter the search query. Use the Move Up and Move Down buttons to move the search queries in the list. Use Remove to remove the selected item.
If you do not know search DN, refer to NetBIOS name, FQDN and Search DN.
Figure 385: Add Active Directory Server
4. Click Test Connection to check the connectivity between the Active Directory server and the Sophos Firewall. It also validates Active Directory server user credentials.
5. Click Save.
The AD server is now available and appears in the Authentication Server list.
Add LDAP Server
This page describes how to add a LDAP server.
1. Navigate to System > Authentication > Authentication Server or Objects > Assets > Authentication Server and click Add.
2. Select the server type as LDAP Server.
3. Enter values for the following settings:
Server Name
Enter a descriptive name for the LDAP server.
| Objects | 478
Server IP/Domain
Enter an IP address or domain for the LDAP server.
Port
Enter the port of the LDAP server. By default, this is port 389.
Version
Select the version of the LDAP server. Default - 3
Anonymous Login
Enable to send anonymous requests to the LDAP server. Disable to bind user with the server.
Username
(not with Anonymous Login)
Enter a name for the bind user.
Password
(not with Anonymous Login)
Enter a password for the bind user.
Connection Security
Select the connection security for the LDAP server:
• Simple: User credentials will be send unencrypted, for example, as clear text. This connection security is selected by default.
• SSL: Secure Sockets Layer. This is the most common method used for secured connection. The Port will then change from 389 (LDAPClosed) to 636 (ldaps = LDAP over SSL).
• TLS: Transport Layer Security. Same secure connection as SSL but uses the default port.
Validate Server Certificate
(not with Simple Connection Security)
Enable to validate the certificate on the external server.
Client Certificate
Select a client certificate from the list to establish a secured connection. If you do not want a client certificate, select None. Default - Appliance Certificate
Note: You can manage client certificates under Protection > Web Server Protection > Certificate or System > VPN > Certificate or Objects > Identity > Certificate.
Base DN
Enter the Base DN for the LDAP server. The Base DN is the starting point relative to the root of the
LDAP tree where the users are included who are to be authenticated. Note that the Base DN must be specified by the Fully Distinguished Name (FDN) in LDAP notation, using commas as delimiters (e.g.,
O=Example,OU=RnD).
Get Base DN
Click Get Base DN if you are not aware about the Base DN. The Base DN is automatically retrieved from the directory.
Authentication Attribute
Enter an authentication attribute for searching the LDAP directory. The user authentication attribute contains the actual login name each user is prompted for, for example by remote access services.
Display Name Attribute
Enter the name for the LDAP server which is displayed as LDAP username.
Email Address Attribute
Enter the alias for the configured email address which is displayed to the user.
Group Name Attribute
Enter the alias for the configured group name which is displayed to the user.
Expire Date Attribute
Enter the user expire date displayed to the user. The attribute specifies how long a user account is valid.
| Objects | 479
Figure 386: Add LDAP Server
4. Click Test Connection to check the connectivity between LDAP and the Sophos Firewall OS. It also validates
LDAP user credentials.
5. Click Save.
The LDAP server is now available and appears in the Authentication Server list.
Add RADIUS Server
This page describes how to add a RADIUS server.
1. Navigate to System > Authentication > Authentication Server or Objects > Assets > Authentication Server and click Add.
2. Select the server type RADIUS Server.
3. Enter values for the following settings:
Server Name
Enter a descriptive name for the RADIUS server.
Server IP
Enter an IP address for the RADIUS server.
Authentication Port
Enter the authentication port of the RADIUS server. By default, this is port 1812.
Enable Accounting
Enable accounting on RADIUS server.
Sophos Firewall OS sends the following information to the RADIUS server as soon as the user logs in:
• Accounting start request
• User login time
Sophos Firewall OS sends the following information to the RADIUS server the moment the user logs out:
• Accounting stop request
• User logout time
Note: Supported client types: Windows Client, HTTP Client, Linux Client, Android, iOS, iOS
HTTP Client, Android HTTP Client, API Client.
Note: The accounting stop message is not sent to the RADIUS server when Sophos Firewall OS shuts down or reboots.
Accounting Port
(only if Enable Accounting is active)
Enter a RADIUS port number through which the Sophos Firewall OS can communicate with RADIUS.
Shared Secret
Enter the shared secret which is a text string that serves as a password between a RADIUS client and a
RADIUS server.
Group Name Attribute
Enter the alias for the configured group name which is displayed to the user.
| Objects | 480
Figure 387: Add RADIUS Server
4. Click Test Connection to check the connectivity between the RADIUS server and the Sophos Firewall. It also validates RADIUS server user credentials.
5. Click Save.
The RADIUS server is now available and appears in the Authentication Server list.
Add eDirectory Server
This page describes how to add a eDirectory server.
1. Navigate to Objects > Assets > Authentication Server or System > Authentication > Authentication
Serverand click Add.
2. Select the server type eDirectory.
3. Enter values for the following settings:
Server Name
Enter a descriptive name for the eDirectory server.
| Objects | 481
Server IP/Domain
Enter an IP address or domain for the eDirectory server.
Port
Enter the port of the eDirectory server. By default, this is port 389.
Username
Enter a username for the eDirectory server.
Password
Enter a password for the eDirecory server.
Connection Security
Select the connection security for the eDirectory server:
• Simple: User credentials will be send unencrypted, for example, as clear text.
• SSL: Secure Sockets Layer. This is the most common method used for secured connection. The Port will then change from 389 (LDAPClosed) to 636 (ldaps = LDAP over SSL).
• TLS: Transport Layer Security. Same secure connection as SSL but uses the default port.
Base DN
Enter the Base DN for the eDirectory server. The Base DN is the starting point relative to the root of the eDirectory tree where the users are included who are to be authenticated. Note that the Base DN must be specified by the Fully Distinguished Name (FDN) in LDAP notation, using commas as delimiters (e.g.,
O=Example,OU=RnD).
Get Base DN
Click Get Base DN if you are not aware about the Base DN. The Base DN is automatically retrieved from the directory.
Figure 388: Add eDirectory Server
4. Click Test Connection to check the connectivity between the eDirectory server and the Sophos Firewall. It also validates eDirectory server user credentials.
5. Click Save.
The eDirectory server is now available and appears in the Authentication Server list.
Add TACACS+ Server
This page describes how to add a TACACS+ server.
1. Navigate to Objects > Assets > Authentication Server or System > Authentication > Authentication Server and click Add.
2. Select the server type TACACS+ Server.
3. Enter values for the following settings:
Server Name
Enter a descriptive name for the TACACS+ server.
Server IPv4
Enter an IP address for the TACACS+ server.
Port
Enter the port of the TACACS+ server. By default, this is port 49.
Shared Secret
Enter the shared secret which is a text string that serves as a password between a TACACS+ client and a
TACACS+ server.
| Objects | 482
Figure 389: Add TACACS+ Server
4. Click Test Connection to check the connectivity between the TACACS+ server and the Sophos Firewall OS. It also validates TACACS+ server user credentials.
5. Click Save.
The TACACS+ server is now available and appears in the Authentication Server list.
Authentication Clients
Authentication Clients page contains links to download all the clients or add-ins needed to interact with Device.
Device provides various options for user authentication. All the users are authenticated before they are provided access to network resources. User authentication can be performed using a local database, Active Directory, LDAP,
RADIUS, TACACS, eDirectory, NTLM or combination of these. Device also supports Single Sign On (SSO) for transparent authentication whereby windows credentials can be used to authenticate and user has to login only once to access network resources. SSO can be used in Active Directory and Citrix or Terminal Services Environment.
Users can authenticate with Device using Captive Portal, Authentication Clients for Windows, Linux, Macintosh,
Android and iOS platforms or Single Sign On (SSO).
You can download the following clients from this page:
Single Sign-On
Sophos Single Sign-On Client - Enables Users to logon to the organization network as well as Device simultaneously. This requires client installation on the user’s machine.
Sophos Transparent Authentication Suite - Enables transparent authentication whereby windows credentials can be used to authenticate and user has to login only once to access network resources. This does NOT require client installation on the user’s machine.
Sophos Authentication for Thin Client - Enables transparent authentication for users in Citrix or Terminal Services
Environment whereby network credentials can be used to authenticate and user has to login only once to access network resources. This does NOT require client installation on the user’s machine.
| Objects | 483
Authentication Clients
Download MSI Enables Admins to install authentication clients via Microsoft Installer to multiple user devices to access network resources and the Internet as per the policies configured in the Device.
Download CA for MSI Download the Digital Certificate to be installed via MSI to ensure a safe connection with the
Device.
Download for Windows - Enables Users using Windows Operating System to logon to the Device to access network resources and the Internet as per the policies configured in the Device.
Download for MAC OS X - Enables Users using system with Macintosh OS X onwards to logon to the Device to access network resources and the Internet as per the policies configured in the Device.
Download for Linux 32 - Enables Users using 32-bit Linux Operating System to logon to Device to access network resources and the Internet as per the policies configured in the Device.
Download for Linux 64 - Enables Users using 64-bit Linux Operating System to logon to Device to access network resources and the Internet as per the policies configured in the Device.
Download Certificate for iOS/Android client - Download the Digital Certificate to be installed in iOS or Android system to ensure a safe connection with the Device.
SPX Add-ins
The SPX Add-in simplifies the encryption of the messages that contain sensitive or confidential information leaving the organization. The Addin integrates seamlessly with the user’s Microsoft Outlook software, making it easy for users to encrypt messages through the Sophos Firewall (SF) Email Protection.
Follow the steps given below to install the AddOn in Outlook:
1. Unzip the files to a temporary folder.
2. For an interactive install, run setup.exe (users will be prompted for input).
3. For an unattended install, please install the following pre-requisites.
a. Windows XP, Windows Vista, Windows 7, Windows 8 (both 32 and 64-bit) versions are supported.
b. Microsoft Outlook 2007 SP3, 2010 or 2013 (both 32 and 64-bit) versions are supported.
c. Microsoft .NET Framework 4 Client Profile.
d. Microsoft Visual Studio 2010 Tools for Office Runtime 4.0.
e. Now, please run the installer with the following parameters: msiexec /qr /i
SophosOutlookAddInSetupUTM.msi T=1 EC=3 C=1 I=1.
Access Points
The Access Point page provides an overview of the access points (AP) known to the system. Access points can be temporarily disabled on this page. When an AP is physically removed from your network, you can delete it here by clicking the Delete button. As long as the AP remains connected to your network, it will automatically re-appear in the Pending state after deletion. SG "w" appliances with on-board Wi-Fi cannot be deleted from the AP list.
Protection > Wireless Protection > Access Points or Objects > Assets > Access Points
Note: You can also view access points on the System > Current Activity > Wireless Client List page.
Access Point Types
Sophos Firewall OS currently provides the following types of dedicated access points:
| Objects | 484
Table 6:
Name
AP 5
AP 10
AP 15
AP 30
AP 50
AP 55
AP 55C
AP 100
AP 100C
802.11b/g/n
802.11b/g/n
802.11b/g/n
802.11b/g/n
802.11a/b/g/n
Sophos Firewall OS also provides the following dedicated outdoor access points:
Table 7:
Name
AP 100X
Standards
802.11a/b/g/n
802.11a/b/g/n
802.11a/b/g/n/ac
802.11a/b/g/n/ac
Standards
802.11a/b/g/n/ac
Band
2.4 GHz
2.4 GHz
2.4 GHz
2.4 GHz
2.4/5 GHz dual-band/ dual-radio
2.4/5 GHz dual-band/ dual-radio
Channels 1-11
Channels 1-11,
36-48, 149-165
Channels 1-11,
36-48, 149-165
2.4/5 GHz dual-band/ dual-radio
2.4/5 GHz dual-band/ dual-radio
2.4/5 GHz dual-band/ dual-radio
FCC regulatory domain (mainly US)
ETSI regulatory domain (mainly
Europe)
Channels 1-11,
36-48, 149-165
Channels 1-11,
36-48, 149-165
Channels 1-11,
36-48, 149-165
Channels 1-13
Channels 1–13,
36-48
Channels 1-13,
36-64, 100-116,
132-140
Channels 1-13,
36-64, 100-116,
132-140
Channels 1-13,
36-64, 100-116,
132-140
Channels 1-13,
36-64, 100-116,
132-140
Band
2.4/5 GHz dual-band/ dual-radio
FCC regulatory domain (mainly US)
Channels 1-11,
36-64, 100-116,
132-140
ETSI regulatory domain (mainly
Europe)
Channels 1-13,
100-116, 132-140
Sophos Firewall OS also provides the following Local Wi-Fi Devices:
Table 8:
Name
SG 105w/115w
SG 125w/135w
Standards
802.11a/b/g/n
802.11a/b/g/n/ac
Band
2.4/5 GHz dual-band
2.4/5 GHz dual-band
Note: Because of the bandwith on the APs with ac standard there may be an automatic channel change in some cases. For example, if you select channel 36 the AP could choose channel 40 instead because it provides a better connection. The channel shown in the Access Point list represents the primary channel. This can affect all AP 100 appliances (AP 100, AP 100C and AP 100X) and all SG appliances with integrated access
(SG 105w/115w and SG 125w/135w).
| Objects | 485
Access Point Overview
The page gives an overview of the access points (AP) known to the system. Sophos Firewall OS distinguishes between active, inactive and pending APs. To make sure that only genuine APs connect to your network, APs need to be authorized first.
Protection > Wireless Protection > Access Points or Objects > Assets > Access Points
This page has the following sections:
Active/Inactive Access Points
For each access point, the list shows you:
ID
Access point ID
Label
Label of the AP, which allows it to be identified easily in the network.
Status
Status of the access point (active/inactive). Active APs are connected, configured, and running. Inactive APs have been configured in the past but are currently not connected to Sophos Firewall OS. If an AP remains in this state for more than five minutes, please check the network connectivity of the AP and the configuration of your system.
Channel
Channel the AP transmits on.
Group
Access point group the AP is assigned to.
Country
Country where the AP is located.
MAC
MAC address of the AP.
IP/Last Seen
IP address of an active AP or the last seen IP address of an inactive AP.
Type
Type of the AP
Manage
Displays the available management options for the APs:
• Edit Allows you to edit the AP.
• Delete Allows you to delete the AP.
To add or delete an access point, click on the corresponding buttons.
Pending Access Point
Here, APs are listed that are connected to the system but not yet authorized. After receiving its configuration, the authorized access point will immediately be displayed in the above section. For each access point, the list shows you:
ID
ID of the access point.
Label
Label of the AP, which allows it to be identified easily in the network.
Channel
Channel the AP transmits on.
| Objects | 486
Group
Access point group the AP is assigned to.
MAC
MAC address of the AP.
Manage
Displays the available management options for the APs:
• Edit Allows you to edit the AP.
• Delete Allows you to delete the AP.
To add or delete an access point, click on the corresponding buttons.
Rules for Assigning Networks to APs
An access point can only be assigned to a wireless network if the client traffic option of the wireless network and the
VLAN tagging option of the access point fit together. The following rules apply:
• Wireless network with client traffic Separate Zone: VLAN tagging of the access point can be enabled or disabled.
• Wireless network with client traffic Bridge to AP LAN: VLAN tagging of the access point has to be disabled.
• Wireless network with client traffic Bridge to VLAN: VLAN tagging of the access point has to be enabled.
The respective wireless clients will use the Bridge to VLAN ID specified for the wireless network, or they will receive their VLAN ID from the RADIUS server, if specified.
Note: An AP 5 can only be assigned one single wireless network with the Client traffic option Bridge to AP
LAN.
Access Point Groups
On the Protection > Wireless Protection > Access Point Groups or Objects > Assets > Access Point Groups page you can organize access points in groups. The list provides an overview of all access point groups and Local Wi-Fi
Devices.
For each group, the list shows:
Name
Name of the access point group.
Status
Status of the access point (active/inactive). Use the toggle switch to enable/disable the access point group.
Wireless Networks
Wireless networks the access point group is assigned to.
Access Points
List of all the access points in this group.
Manage
Displays the available management options:
• Edit Allows you to edit the access point group.
• Delete Allows you to delete the access point group.
To add or delete an access point group, click on the corresponding buttons.
Add Access Point Group
This page describes how to add an access point group.
1. Navigate to Protection > Wireless Protection > Access Point Groups or Objects > Assets > Access Point
Groups and click Add.
2. Enter the following settings for the new access point group.
| Objects | 487
Name
Enter a descriptive name for the new access point group.
Wireless Networks
Search for wireless networks and select the wireless networks that should be broadcast by the access points of this group.
Note: For an access point to broadcast a wireless network some conditions have to be fulfilled. They are explained in the chapter Objects > Assets > Access Points, in the section Rules for Assigning
Networks to APs.
VLAN Tagging
Select Enable if you want to activate VLAN tagging.
Note: Make sure that the VLAN interface is assigned to the zone which is selected in the Allowed
Zone box on the System > System Services > Wireless page.
Access Point
Search for access points and select which you want to add to this group.
Note: Local Wi-Fi Devices cannot be grouped and do not appear in the Access Point box. Local Wi-
Fi Devices appear in the Access Point Groups list.
Figure 390: Add Access Point Group
3. Click Save.
The new access point group will be displayed in the Access Point Groups table.
Web Servers
On this page you can add the web servers that are to be protected by the WAF.
Protection > Web Server Protection > Web Servers or Objects > Assets > Web Servers
The page displays all existing web servers. You can add, edit or delete web servers. For each web server, the list shows:
Name
Name of the web server.
Host
Host of the web server.
Type
Type of the web server.
| Objects | 488
Manage
Displays the available management options:
• Edit Allows you to edit the web servers.
• Delete Allows you to delete the web servers.
To add or delete a web server, click on the corresponding buttons.
Add Web Servers
This page describes how to add a web server.
1. Navigate to Protection > Web Server Protection > Web Servers or Objects > Assets > Web Servers and click
Add.
2. Enter the following settings:
Name
Enter a descriptive name for the web server.
Description
Enter a description or other information.
Host
Add or select a host, which can either be of the type IP Address or FQDN Host.
on page 565
Note: FQDN Host is recommended here because hosts listed with their IP address transmit empty host headers, which leads to problems with some browsers.
Type
Select a server type, i. e. whether you want the communication between Sophos Firewall and the web server to be encrypted (HTTPS) or plaintext (HTTP).
• Encrypted (HTTPS): Browser-based access to the web server via HTTPS.
• Plaintext (HTTP): Browser-based access to the web server via HTTP. Default.
Port
Enter a port number for the web server. By default the standard port of the selected web server type is selected.
Keep alive
Enable Keep alive to keep the connection between Sophos Firewall and the web server open instead of opening a new connection for every single request.
Note: In rare cases where the web server does not support keep alive properly, this feature can provoke reading errors or timeouts and should be disabled for the affected web server.
Timeout (only available when Keep alive is selected)
Enter a timeout for the Keep alive option. Values between 1 and 65535 seconds are allowed. Default is 300 seconds.
| Objects | 489
Figure 391: Add Webserver
3. Click Save.
The web server is created and appears in the web servers list.
Content
Objects > Content
Content allows defining and managing attributes for traffic based on file, URL and web/app category.
This section covers the following topics:
•
- The File Type page displays the list of all the predefined and custom file type categories. The page also provides option to add a new category, update the parameters of the existing category, or delete a category.
•
- The Custom IPS Patterns page displays list of all the custom signatures. The page provides option to add a new signature, update the parameters of existing signature, or delete the signature.
•
- This page allows you to manage the default web categories and create custom web categories. You can also add or remove specific domains or keywords in the category.
•
- The URL Group page displays list of all the URL groups and you can sort the list based on URL
group name. The page provides option to add, update, or delete the group.
•
- The Application List page displays total number of applications available for use and related information like category it belongs to, risk factors, its characteristics and technology.
•
- The page displays all existing web application authentication templates. This page
provides options to add new templates, edit or delete them.
File Type
The File Type page allows you to manage file types to be used in filtering policy.
The File Type page displays a list of both built-in and custom file types that you can control with policies. For instance, you can restrict access to certain types of files within an otherwise-permitted category.
A file type group consists of collections of files, identified by either file extenstion or MIME headers. Predefined File
Types are provided, and you can create new collections of file types using templates.
This page lists existing File Type categories. The predefined File Type categories can not be modified. File Type groups that you have added can be edited or deleted by selecting the associated icon under the Manage heading. To delete multiple File Types, select the associated checkboxes under the Name heading and click Delete at the top of the page.
Click Add at the top to create a new File Type.
Add File Type Category
Create a File Type category to be used in protection policies.
Navigate to Protection > Web Protection > File Type or Object > Content > File Type and click Addto create a new File Type category:
1. Enter a Name for the new category.
2. Enter Description
3. Under Template, either choose Blank or an option from the drop-down menu.
Drop-down lists all the predefined as well as custom defined file type categories.
4. Specify File Extension and MIME Header text boxes to be included in your new category.
| Objects | 490
Figure 392: Add File Type Category
5. Click Save.
Custom IPS Patterns
The Custom IPS Patterns page displays the list of all the custom IPS patterns.
Custom IPS Patterns provide the flexibility to customize IPS for diverse network environments. Predefined IPS patterns included in the device cover common attacks while Custom IPS Patterns protect your network from uncommon attacks that are due to the use of proprietary server, custom protocol, or specialized applications used in the corporate network.
Note: User will be able to create Custom IPS Pattern and configure policies using them, however, the IPS scanning will work only if 'Network Protection' module is subscribed.
The page provides option to add a new IPS pattern, update the parameters of existing pattern, or delete the pattern.
Add IPS Pattern
Use Add IPS Pattern page to add Custom IPS Pattern.
| Objects | 491
The Add IPS Pattern page allows you to add a new Custom IPS Pattern.
1. Navigate to Objects > Content > Custom IPS Patterns and click Add.
2. Enter the IPS Pattern details.
Name
Enter a name to identify the Custom IPS Pattern.
Protocol
Select IPS protocol from the list.
Available Options:TCPUDPICMPALL
Custom Rule
Specify IPS Pattern definition.
Signature definition must begin with a keyword followed by the value enclosed between the double quotes and must end with semicolon (;)
Format: Keyword: "value";
For example, content: "USER JOHN";
If traffic with the content USER JOHN is detected, action defined in the policy will be taken.
Refer to Appendix B – IPS - Custom IPS Pattern Syntax for more details on creating IPS Pattern.
Severity
Select the level of severity from the available options.CriticalMajorModerateMinorWarning
Recommended Action
Specify action to be taken on the selected policy when matching pattern is found.
Available Actions:
Allow Packet - Check each packet before taking action. Drop Packet - Drop packets. Drop Session -
Terminate entire session instead of scanning all the session packets to save resources and avoid getting high number of alerts. Reset - Send TCP reset packet to the originator. Bypass Session - Scan initial packets only.
If the initial packets match the pattern then the rest of the session packets are not scanned and the traffic is allowed to pass.
In all the cases, device generates the log and alerts the Network Administrator.
Figure 393: Add Custom IPS Pattern
3. Click Save.
Web Categories
The Web Category page displays a list of existing Web Categories.
| Objects | 492
On the Web Category page you can maintain categories of sites and assign them a Classification.There are four categories that can be used in policies to control web usage. These classification are:
• Productive
• Unproductive
• Acceptable
• Objectionable
By default there is a list of web categories you can use in your policies. On this page you can edit or delete existing categories, or create and classify a category of your own.
Add Web Category
Create a new Custom Web Category.
On the Add Web Category page you can create a new Custom Web Category for use in policy decisions. To create a
Web Category:
1. Enter a Name for your new category.
2. Select a classification from the Classification drop-down menu.
Available classifications include:
• Productive
• Unproductive
• Acceptable
• Objectionable
3. Select an option for Traffic Shaping Policy.
4. Set the Configure Category option to either Local or External URL Database.
• If you selectExternal URL Database you can enter a URL in a list of custom URLs that you want to include in the category.
• If you select Local you can enter a list of domains or keywords, either by uploading a text file or by entering them in the related text box. In the Search/Add text boxes you can enter domains or keywords. The existing list will match what you type so that you can see if an entry already exists.
5. Enter a Description to describe your new Web Category.
Figure 394: Add Web Category
6. Click Advanced Settings to configure policies or override the default message for a category.
a) Next to Action, select one or more policies from the Web Filter Policy list. For each policy selected, set the desired action for both HTTP and HTTPS.
a) Next to Denied Message, select Override Default Denied Message to modify the block page shown to the user if a website is blocked by your policy.
| Objects | 493
| Objects | 494
Figure 395: Advanced Settings
7. Click Save.
URL Group
Create a collection of URLs for use in web filter policies.
Use the URL Group page to create groups of URLs. These groups can be used in your web filter policies to block or allow custom collections of sites.
On this page you can edit an existing URL Group by clicking its name under URL Group Name, or by clicking the
Manage icon on the right. To delete an existing URL Group, click the Delete icon.
Add URL Group
Add a collection of URLs for use in policies.
On the URL Group, click the Add button to open the Add URL Group page.
1. Enter a name for your group in the URL Group Name text box.
2. Enter a description for the group you are creating.
3. Add URLs for this collection.
Entries must be single domains on separate lines, such as: example.com
foo.com
| Objects | 495 bar.com
Figure 396: Add URL Group
4. Click Save.
Application List
The Application List page displays all the applications available for use.
The device can identify and control applications which use standard port 80 and 443, non-standard ports, or port hopping, or tunnel through encrypted SSL traffic. This feature enables prioritization of applications based on user identity, time, and bandwidth, allowing great flexibility, visibility, and control. The device also provides implementation of application-based bandwidth management, accelerating critical applications while blocking malware-laden sites through web filtering. Organizations can group applications as per their requirements into business-critical, entertainment, communication, or collaboration, and can control access through security policies.
Note: You need a subscription to Web Protection before you can use this feature. Check its features by taking a free trial. (See System > Administration > Licensing)
The device is shipped with a set of predefined applications. This applications are classified based on their risk level, characteristics and technology, offering more granular controls.
The total number of application signatures included depends on the Application Signatures Database used by the device.
The application list can be filtered based on name of the application, category of the application, risk, characteristics, and technology.
Web App Auth Templates
You can upload HTML forms for reverse authentication. A web application authentication template can be assigned to an authentication profile with frontend mode Form. The respective form will be presented when a user tries to access a site path to which the authentication profile is assigned.
Objects > Content > Web App Auth Templates or Protection > Web Server Protection > Web App Auth
Templates
The page displays all existing web application authentication templates. You can add, edit or delete templates. For each template, the list shows:
Name
Name of the template.
Template
Filename of the template.
Manage
Displays the available management options:
• Edit Allows you to edit the template.
• Delete Allows you to delete the template.
To add or delete a web app auth template, click on the corresponding buttons.
Add Web App Auth Template
This page describes how to add a web application authentication template.
1. Navigate to Objects > Content > Web App Auth Templates or Protection > Web Server Protection > Web
App Auth Templates and click Add.
2. Enter the following settings:
Name
Enter a descriptive name for the template.
Description
Enter a description or other information.
HTML template
Select and upload an HTML template.
Images/Stylesheet
Select and upload images, stylesheets, or JavaScript files that are used by the selected template.
| Objects | 496
Figure 397: Add Web App Auth Template
3. Click Save.
The web app auth template is created and appears in the Web App Auth Templates list.
Identity
Objects > Identity
Identity allows configuring Identity and authentication attributes for certificates, groups and users.
This section covers the following topics:
•
a self-signed certificate, upload a certificate, or generate a Certificate Signing Request (CSR). This page also provides option to regenerate, revoke, download, or delete the certificates.
•
- Device provides a facility to generate a local certificate authority as well as import
certificates, signed by commercial providers, such as VeriSign.This page displays list of all the certificate
| Objects | 497 authority. It also provides option to download, regenerate CA, update the parameters of the existing CA, or delete the CA.
•
- Certificate Revocation List (CRL) page is a way to check the validity of an existing certificate. This page displays the list of available CRLs and also provides options to manage these CRLs.
•
- A Zone is a logical grouping of ports/physical interfaces and/or virtual sub-interfaces if defined. This page displays list of all the zones including system zones and the administrator can manage the zones from this page.
•
appropriate users. Groups let you assign various policies to a number of users in single step. The Groups page displays list of all the default and custom groups and provides option to manage these groups.
•
new users manually or by importing user details from the file, exporting user details, purging AD users, changing status of the user, or deleting user.
•
- Clientless Users are the users who can bypass Client login to access the Internet and are managed by the device itself. The page displays list of all the clientless users. The page also provides option to add a single clientless user or multiple users, delete or change status of the user.
•
- Device allows administrator to pre-configure single or multiple Guest Users using Admin Console.
This page displays the list of all the guest users and also provides with various options like add single or multiple users, update and reset to manage the guest users settings.
Certificate
The Certificate page displays a list of available certificates.
A digital certificate is a document that guarantees the identity of a person or entity and is issued by the certificate authority (CA). Certificates are generated by third party trusted CAs. They create certificates by signing public keys and identify the information of the communicating parties with their own private keys. This way it is possible to verify that a public key really belongs to the communicating party only and has not been forged by someone with malicious intentions.
A certificate signed by a certificate authority (CA) identifies the owner of a public key. Each communicating party may be required to present its own certificate signed by a CA verifying the ownership of the corresponding private key. Additionally, the communicating parties need to have a copy of the CA’s public key. In case the private key is lost or stolen or the information is changed, CA is responsible for revoking the certificate.CA also maintains the list of valid and revoked certificates.
To use certificates for authentication, you must have a valid CA and a certificate. You need to upload a CA if you are using an external CA. You can generate a self-signed certificate if you want to use it as CA.
You can also use the device to act as a certificate authority and sign its own certificates. This eliminates the need of having your own certificate authority. If you are using the device as CA, you have to generate a self-signed certificate, which can be used in various VPN policies.
The page also provides options to generate a self-signed certificate, upload a certificate, or generate a Certificate
Signing Request (CSR).This page also provides the option to regenerate, revoke, download, or delete the certificates.
If you are using a third party CA, you have to submit a request to CA for issuing a certificate. Once CA issues a certificate, you have to upload to use it in the VPN policy.
This page provides options to:
•
•
•
Add Certificate
Use the Certificate page to add a new certificate.
The Certificate page allows you to generate a self-signed certificate, upload a certificate, or generate a Certificate
Signing Request (CSR).
| Objects | 498
1. Navigate to Protection > Web Server Protection > Certificate or System > VPN > Certificate or Objects >
Identity > Certificate and click Add.
2. Choose the action you want to perform.
Action
Select an action from the available options.
Upload CertificateGenerate Self-Signed CertificateGenerate Certificate Signing Request
Upload Certificate
Use the Certificate page to upload a certificate.
1. Enter details of the certificate to be uploaded.
Name
Specify a name of the certificate which you want to update.
Certificate File Format
Select the format of certificate file from the available options.
Available Options: PEM (.pem): Privacy Enhanced Mail (PEM) is a Base64encoded DER certificate.
It is used for encoding the certificate in ASCII code. The certificate and private key are stored in separate files. DER (.der): Distinguished Encoding Rules (DER) is a binary form of ASCII PEM format certificate used on Java platform. The certificate and private key are stored in separate files. CER (.cer): Canonical
Encoding Rules (CER) is a binary format for encoding certificates. It contains information about the owner of certificate, its public and private keys. PKCS7 (.p7b): Public Key Cryptography Standards (PKCS) is a format for encoding the certificate in ASCII code. It contains only certificates and not the private key.
PKCS12 (.pfx or .p12): Public Key Cryptography Standards (PKCS12) is a binary format for encoding certificates. It stores a private key with a public key certificate. It is used on Windows platforms.
Certificate
Select the certificate to be uploaded. Use Browse to select the complete path.
Private Key
Select the private key for the certificate. Use Browse to select the complete path.
Passphrase
Specify and re-confirm a passphrase for a certificate used for authentication. The passphrase must be at least 4 characters long.
2. Click Save.
Generate Self-Signed Certificate
Use the Certificate page to generate a self-signed certificate.
1. Enter details to generate a Self Signed Certificate (Option available only after configuring Default CA Parameters)
Name
Specify a name to identify the Certificate.
Valid From and Valid Up To
Specify certificate validity period using the Calendar . The validity period is the certificate life and indicates the period up to which the certificate will be considered as valid.
Default - 1 day
Key Length
Select key length. Key length is the number of bits used to construct the key.
Available Options:5121024153620484096
Generally, the larger the key, the less chance that it will be compromised but it takes longer to encrypt and decrypt data than smaller keys.
Default - 512
| Objects | 499
Key Encryption
Click to enable the key encryption.
Passphrase
Passphrase for a Certificate used for authentication. The passphrase must be at least 8 characters long. This option is enabled only if the Key Encryption option is selected.
Confirm Passphrase
Re-enter the passphrase for confirmation.
Certificate ID
Specify certificate ID. You can specify any one of the following options:
Available Options: DNSIP Address(IPv4/IPv6 Address) Email Address DER ASN1 DN(X.509) (Applicable when Authentication Type is Digital Certificate)
Once the certificate is created, you need to download and send this certificate to the remote peer with whom the connection is to be established.
Country Name
Select the country.
State
Specify the state within the country.
Locality Name
Specify the name of the locality.
Organization Name
Specify the name of the organization which will use this certificate and domain name. This domain will be certified to use the Certificate.
Use unique Domain name only.
Organization Unit Name
Specify the name of the department/unit which will use this certificate and domain name. This domain will be certified to use the Certificate.
Use unique Domain name only.
Common Name
Specify the common name.
A common name comprises of the host + domain name or is a fully qualified domain name that is used to resolve to SSL VPN interface. It must be same as that of the web address to be accessed when connecting to a secured site.
Email Address
Specify the Email Address of the contact person for communication.
2. Click Save.
Generate Certificate Signing Request
Use the Certificate page to generate certificate signing request.
1. On the Add Certificate page, select the action Generate Certificate Signing Request (CSR)
2. Enter certificate details.
Name
Specify a name to identify the certificate.
Valid Until
Specify certificate validity period using the calendar. Validity period is the certificate life i.e. period up to which the certificate will be considered as valid.
Minimum validity: 1 day
| Objects | 500
Key Length
Select key length. Key length is the number of bits used to construct the key.
Generally the larger the key, the less chance that it will be compromised, but it requires more time to encrypt and decrypt data than smaller keys.
Encryption
Click to enable the key encryption.
Passphrase (only applicable if Encryption is enabled)
Enter a passphrase for the certificate used for authentication. Passphrase must be at least 4 characters long.
Confirm Passphrase
Re-enter passphrase for confirmation.
Certificate ID
Specify a certificate ID. You can specify any one of the following options:
Available Options: DNS IP AddressEmail AddressDER ASN1 DN(X.509) (applicable when the authentication type is Digital Certificate)
3. Enter identification attributes of the certificate owner.
Country Name
Select the country for which the certificate will be used.
Generally, this would be the name of the country where the device is deployed.
State
Specify the state for which the certificate will be used..
Generally, this would be the name of the state where device is deployed.
Locality Name
Specify the name of the locality for which the certificate will be used.
Generally, this would be the name of the locality where device is deployed.
Organization Name
Specify the organization name, which will use this certificate.
Organization Unit Name
Specify the department/unit name, which will use this certificate.
Common Name
Specify the common name, eg. the server's hostname.
Email Address
Specify the email address of the contact person for communication.
4. Click Save.
Download Certificate
Use the Certificate page to download the certificate.
1. Navigate to Protection > Web Server Protection > Certificate or System > VPN > Certificate or Objects >
Identity > Certificate.
2.
Under the Manage column, click the download icon against the certificate you want to download.
Note:
• Only self-signed certificates and certificate signing requests can be downloaded.
• The certificate is downloaded as a .tar.gz file.
Revoke Certificate
Use the Certificate page to revoke the certificate.
| Objects | 501
1. Navigate to Protection > Web Server Protection > Certificate or System > VPN > Certificate or Objects >
Identity > Certificate.
2.
Under the Manage column, click the revoke icon to revoke a self-signed certificate if lost, stolen or updated.
The revoked certificate is automatically added to the Certificate Revocation List (CRL).
Note: You can download the revoked certificate and circulate it, if required.
Certificate Authority
The Certificate Authority page displays a list of all the certificate authorities. The list can be filtered based on the certificate authority name.
The device provides a facility to generate a local certificate authority as well as import certificates, signed by commercial providers, such as VeriSign.
A certificate signed by a certificate authority (CA) identifies the owner of a public key. Each communicating party may be required to present its own certificate signed by a CA verifying the ownership of the corresponding private key. Additionally, the communicating parties need to have a copy of the CA’s public key. In case a private key is lost or stolen or the information is changed, CA is responsible for revoking the certificate. CA also maintains the list of valid and revoked certificates.
After your CA has issued a certificate created by you or have a local certificate, you can upload it for use in VPN.
You can use a default CA, modify and re-generate it as per your requirement if you are not using any external CA.
Using this CA, you can generate a self-signed certificate and use it in the VPN policy.
Using a third party CA involves uploading:
• CA and root certificate
• Certificate
• CRL (Certificate Revocation List)
If the remote peer is using a certificate issued by the following third party CA, you are not required to upload CA:
• VeriSign
• Entrust
• Microsoft
Note: Default CA is regenerated automatically when it is updated.
The page provides option to:
•
•
•
Download Certificate Authority
Use the Certificate Authority page to download CA.
If you are using a local CA, you need to download CA and forward it to the remote peer.
1. Navigate to Protection > Web Server Protection > Certificate Authority or System > VPN > Certificate
Authority or Objects > Identity > Certificate Authority.
The Certificate Authority page displays the details of the default CA.
2.
Click the download icon to download the zip file.
Note: Default CA cannot be deleted.
| Objects | 502
Add Certificate Authority
To update and regenerate the default certificate, click on the default certificate.
•
•
Set CA Parameters
Use the Set CA Parameters page to update and regenerate any (editable) certificate.
The Set CA Parameters page allows you to manually enter details to add a new certificate authority.
1. Navigate to Protection > Web Server Protection > Certificate Authority or System > VPN > Certificate
Authority or Objects > Identity > Certificate Authority and click Add to add a new CA.
If you want to edit any other (editable) CA than the Default CA, click click the edit icon under Manage tab of the CA you want to modify.
2. Enter certificate authority details.
Name
Specify a name to identify the Certificate Authority.
Certificate File Format
Select format of the root certificate to be uploaded.
Available Options:PEM (Privacy Enhanced Mail): A format encoding the certificate in ASCII code.
The certificate, request, and private key are stored in separate files.DER: A binary format for encoding certificates. The certificate, request, and private key are stored in separate files.
Certificate
Specify full path from where the certificate is to be uploaded. Alternately, use Browse to select the path.
Private Key
Specify full path from where the Private Key is to be uploaded. Alternately, use Browse to select the path.
CA Passphrase
CA Passphrase for authentication. Passphrase must be at least 4 characters long.
Confirm CA passphrase for authentication.
3. Click Save.
Edit Default CA Parameters
Use the Edit Default CA Parameters page to update and regenerate the default certificate.
The Edit Default CA Parameters page allows you to manually enter certificate authority details.
1. Navigate to Protection > Web Server Protection > Certificate Authority or System > VPN > Certificate
Authority or Objects > Identity > Certificate Authority.
2.
Click on the icon under Manage tab of the default certificate that you want to update and regenerate.
3. Enter certificate authority details.
Name
Default. This name cannot be changed.
Country Name
Specify the name of the country where the device is installed.
State
Specify the name of the state where the device is installed.
Locality Name
Specify the name of the locality where the device is installed.
| Objects | 503
Organization Name
Specify the organization name, which will use this certificate..
Organization Unit Name
Specify the department/unit name, which will use this certificate.
Common Name
Specify the common name, e.g. the server's hostname.
Email Address
Specify the email address of the contact person for communication.
CA Passphrase
Specify a passphrase for the certificate authority. Passphrase must be at least 4 characters long.
Re-enter passphrase for confirmation.
4. Click Save.
Regenerating Certificate Authority
Use the Certificate Authority page to regenerate the default certificate.
1. Navigate to Protection > Web Server Protection > Certificate Authority or System > VPN > Certificate
Authority or Objects > Identity > Certificate Authority.
2.
Under the Manage column, click the Regenerate icon .
Note: Default CA is regenerated automatically when it is updated.
Certificate Revocation Lists
CA maintains the list of valid and revoked certificates. The page displays the list of available CRLs.
The Certificate Revocation Lists (CRL) page is a way to check the validity of an existing certificate. Certificates which are stolen, lost or updated are revoked by CA and CA publishes such revoked certificates in the revocation list.
VPN connection cannot be established using revoked certificates, hence it is necessary to update the CRL at regular intervals.
The page provides options to:
•
•
Adding a New CRL
Use the Certificate Revocation Lists page to add a new CRL.
If you are using an external certificate authority, you need to upload the CRL obtained from the external certificate authority.
1. Navigate to Protection > Web Server Protection > Certificate Revocation Lists or System > VPN >
Certificate Revocation Lists or Objects > Identity > Certificate Revocation Lists and click Add.
2. Enter certificate revocation list details.
Name
Specify a name to identify the CRL.
CRL File
Specify the CRL file to be uploaded. Browse to select the complete path.
3. Click Save.
The new CRL has been created and is added on the Certificate Revocation Lists page.
| Objects | 504
Downloading CRL
Use the Certificate Revocation List page to download the CRL.
Once a CA is generated, a default CRL is generated with name Default.tar.gz. Once you revoke the certificate, the details of the revoked certificate are added to the default file and are regenerated. You can download and distribute it, if required.
1. Navigate to Protection > Web Server Protection > Certificate Revocation Lists or System > VPN >
Certificate Revocation Lists or Objects > Identity > Certificate Revocation Lists.
2. Click Download" under the Manage column of the CRL to be downloaded.
A .zip file is downloaded.
3. Unzip the file to check the details.
Zone
The Zone page displays a list of all the zones including system zones and lets you manage the zones.
A zone is a logical grouping of ports/physical interfaces and/or virtual sub-interfaces if defined.
Zones provide a flexible layer of security for the firewall. With the zone-based security, the administrator can group similar ports and apply the same policies to them instead of having to write the same policy for each interface.
Next to the name of the zone type, the list displays the members belonging to the specific zone, the zone type, the kind of device access and, optionally, a description.
Default Zone Types
LAN - Depending on the device in use and network design, you can group one to six physical ports in this zone.
Group multiple interfaces with different network subnets to manage them as a single entity. Group all the LAN networks under this zone.
By default the traffic to and from this zone is blocked and hence, it is the most secured zone. However, traffic between ports belonging to the same zone will be allowed.
DMZ (DeMilitarized Zone) – This zone is normally used for publicly accessible servers. Depending on the device in use and network design, you can group multiple physical ports in this zone.
WAN - This zone is used for Internet services. It can also be referred to as Internet zone.
VPN – This zone is used for simplifying secure, remote connectivity. It is the only zone that does not have an assigned physical port/interface. Whenever the VPN connection is established, the port/interface used by the connection is automatically added to this zone and on disconnection; the port is automatically removed from the zone.
Like all other default zones, scanning and access policies can be applied on the traffic for this zone.
WiFi - This zone is used for wireless Internet services.
The device is shipped with a single zone for LAN, WAN, DMZ, VPN and WiFi. These zones are called system zones.
Additionally, you can define LAN and DMZ zone types.
Manage
Displays the available managing options for the zone
• Edit: Allows you to edit the zone.
• Delete: Allows you to delete the zone.
To either Add or Delete a zone, click the corresponding buttons.
Add a Zone
Use the Add page to create a new zone.
The Add Zone page allows you to enter zone details.
1. Navigate to System > Network > Zone or Objects > Identity > Zone and click Add.
2. Enter the zone details.
| Objects | 505
Name
Provide a name to identify the zone.
Description
Provide the description for the zone.
Type
Select the type of zone from the available options. LAN - Depending on the device in use and network design, you can group one to six physical ports in this zone. Group multiple interfaces with different network subnets to manage them as a single entity. Group all the LAN networks under this zone.
By default the traffic to and from this zone is blocked and hence, it is the highest secured zone. However, traffic between ports belonging to the same zone will be allowed.
DMZ (DeMilitarized Zone) - This zone is normally used for publicly accessible servers. Depending on the device in use and network design, you can group one to five physical ports in this zone.
Note: By default, the entire traffic will be blocked except LAN to Local zone services like administration, authentication, and network.
Members
Displays all the member ports.
Click the checkbox to select the ports. All the selected ports are moved to the 'Selected port' list.
Device Access
Device access defines the type of administrative access permitted to a zone.
Admin Services - Enable administrative services that should be allowed through this zone:
• HTTP - Allow HTTP connection to the admin console through this zone
• HTTPS - Allow secure HTTPS connection to the admin console through this zone
• Telnet – Allow Telnet connection to CLI through this zone
• SSH – Allow SSH connection to CLI through this zone
Authentication Services – Enable authentication services that should be allowed through this zone:
• Client Authentication
• Captive Portal
• NTLM
• Radius SSO
Network Services - Enable network services that should be allowed through this zone:
• DNS – Allow this zone to respond to DNS requests
• Ping/Ping6 – Allow this zone to respond to pings
Other Services - Enable other services that should be allowed through this zone:
• Web Proxy
• SSL VPN Tunnel
• Wireless Protection
• User Portal
• Dynamic Routing
Figure 398: Add Zone
3. Click Save.
Note:
• If DMZ uses a private IP address, use NATing to make them publicly accessible.
• You cannot add a zone if the device is deployed as a bridge.
• Local and VPN zones cannot be updated or deleted.
The new zone has been created and appears on the Zone page.
Groups
The Groups page displays a list of all the default and custom groups.
A group is a collection of users having common policies that can be managed as a single unit thus providing the possibility to assign various policies to a number of users in one operation/step. Users that belong to a particular group are referred to as group users.
A group can contain default as well as custom policies.
Various policies that can be grouped are:
• Surfing quota policy which specifies the duration of surfing time and the period of subscription
• Access time policy which specifies the time period during which the user will be allowed access
• Web filter policy which controls and blocks access to inappropriate web sites
• Application filter policy which controlling access to application like IM and P2P, VOIP
| Objects | 506
| Objects | 507
• QoS policy which specifies the bandwidth usage limit of the user
• Data transfer policy which specifies the data transfer quota of the user
• SSL VPN policy which determines the access mode and controls access to private network resources.
The page also provides option to add new group, update group parameters, add new members to the existing group, view user group membership, or delete a group.
Creating a New User Group
Use the Add Group page to create a group of policies.
The Add Group page allows you to configure a group of policies. Once the appropriate Group is assigned, the user will automatically inherit all the policies added to the group.
1. Navigate to System > Authentication > Groups or Objects > Identity > Groups and click Add.
2. Enter user group details.
Group Name
Provide a name to identify the group.
Description
Provide group description.
Group Type
Select Group Type.
Available Options:
Normal - User of this group needs to log on using the device client to access the Internet. Clientless -
User of this group does not need to log on using the device client to access the Internet and is symbolically represented as Group name(C). Access control is placed on the IP Address.
3. Configure the policies.
Surfing Quota
Select the Surfing Quota Policy from the list.
Note: Unlimited policy is automatically applied to Clientless Group.
Access Time (Not applicable to Clientless Group)
Select the Access Time Policy from the list.
Note: Unlimited policy is automatically applied to Clientless Group.
Network Traffic (Not applicable to Clientless Group)
Select the Network Traffic Policy from the list.
Configured policy will be applicable to all the users who are member of this group.
Traffic Shaping
Select the Traffic Shaping policy from the list.
Configured policy will be applicable to all the users who are member of this group.
Remote Access
By default, the user will inherit its group policy. To override the group policy, select a policy from the list.
You can also create a new policy directly from this page itself or from System > VPN > SSL VPN (Remote
Access) page.
If user is not to be provided SSL VPN access then select No Policy Applied.
Clientless
By default, user will inherit its group policy. To override the group policy, select the policy from the list.
You can also create a new policy directly from this page itself or from System > VPN > Clientless Access page.
| Objects | 508
If user is not to be provided the SSL VPN access then select "No Policy Applied".
Quarantine Digest
Configure Quarantine Digest.
Quarantine digest is an Email containing a list of quarantined spam messages filtered by the device and held in the user quarantine area. If configured, device will mail the digest on hourly, daily or weekly basis to the user. Digest also provides a link to User Portal from where user can access and take the action on quarantined messages.
Available Options:Enable - User will receive the Quarantine Digest on configured frequency and overrides
Group setting. Disable - User will not receive Quarantine Digest and overrides Group setting.
MAC Binding (Not applicable to Clientless Group)
Enable/disable “MAC Binding”. By binding User to MAC Address, you are mapping user with a group of
MAC Addresses.
L2TP (Not applicable to Clientless Group)
Enable if group users can get access through L2TP connection.
PPTP (Not applicable to Clientless Group)
Enable if group users can get access through PPTP connection.
Login Restriction (Not applicable to Clientless Group)
Select the appropriate option to specify the login restriction for the user group.
Available Options: Any Node - Select to allow user to login from any of the nodes in the network.Selected
Nodes - Select to allow user to login from the specified nodes only. Specify IP Address and click Add icon
to add more nodes and remove icon to delete nodes. You can even edit the added IP Address by first clicking on the edit icon and then on the save icon .
Note: Editing and removing IP Address options are only provided for the Groups that have been already added.
Node Range - Select to allow range of IP Address. Specify IP Address range.
Only IPv4 Addresses must be provided for options “Selected Nodes” and “Node Range”.
4. Click Save.
Note: User Configuration - MAC binding and policies is given precedence over Group configuration.
Adding Users to the Existing Groups
Use Add Group Member page to add a user to the existing groups.
This page allows you to add group member to the existing groups.
1. Navigate to System > Authentication > Groups or Objects > Identity > Groups.
2.
Select the group in which you want to add the users by clicking the edit icon in the Manage column.
3. Click Add Member(s). A pop-up Add Group Member appears providing a list of all the users who can be added to the group along with some details. To search for a user filter the list based on the name and/or the current group.
4. Select the user you want to add to the group. You can select a single user or multiple users on the same page.
5. Click Add and click OK to confirm adding the member to the group.
Viewing List of Group Members
Use this page to view group members.
This page displays the list of group members.
| Objects | 509
1. Navigate to System > Authentication > Groups or Objects > Identity > Groups.
2.
4.
Click the group for which you want view the group members and click the edit icon in the Manage column.
3. Click Show Group Member(s). A pop-up Group Members appears providing the list of all the userswho are member of the selected group along with their usernames.
Click Close or Close icon to close the Group Member pop-up.
Users
The Users page displays the list of all the users added in the device.
Users are identified by an IP address or a username and are assigned to a user group. All the users in a group inherit the policies defined for that group.
Media Access Control (MAC) address is a unique identifier (hardware address) assigned to a host by the manufacturer for identification and is intended to be immutable. MAC addresses are 48 bit values that are expressed in 6 byte hex-notation separated by colon for example 01:23:45:67:89:AB.
To improve the security of your network and provide spoofing protection, you can enable user-MAC address binding.
By binding a user to a MAC address, you are mapping the user with a group of MAC addresses. It means a user would be able to login through a group of pre-specified machines only making it more difficult for a hacker using random MAC addresses or spoofing a MAC address to gain access to your network.
User types
The device supports five types of users:
• Normal
• Clientless
• Single Sign on
• Thin Client user
• WWAN user
A normal user has to logon to the device which requires a client (client.exe) on the user machine, or the user can use
HTTP client component and all the policy-based restriction are applied.
A clientless user does not require a client component (client.exe) on the user machine.
Users are automatically logged to the device if single sign on settings are configured.
Use the given decision matrix below to choose which type of the user should be created.
Table 9: Decision matrix for adding a user
Feature Normal User
User login required
Type of Group
Normal
Clientless
Yes
Yes
No
Apply login restriction Yes
Apply Surfing Quota policy Yes
Apply Access Time policy Yes
Apply Traffic Shaping policy
Yes
Apply Web Filter Policy Yes
Clientless User
No
No
Yes
Yes
No
No
Yes
Yes
Single Sign On User
No
Yes
No
Yes
Yes
Yes
Yes
Yes
| Objects | 510
Feature
Apply Application Group policy
Apply Network Traffic policy
Normal User
Yes
Yes
Clientless User
Yes
No
Single Sign On User
Yes
Yes
You can filter the list of user's name, username, group, web and application filter policy applied to the user, and date on which users were added.
Note: You can also view and manage live users on the System > Current Activity > Live Users page.
The page also provides options to:
•
•
•
•
Add users by importing user details from the file
•
•
•
Registering a New User
Use the Add User page to enter a new user and quickly configure a related policy.
The Add User page allows you to manually enter user details and configure related policies for a user on your system.
Once a user is registered successfully, the page provides two more options:
•
- Click to reset the usage accounting i.e. internet usage time and data transfer of the user.
•
- Click to view the Internet usage and data transfer usage.
1. Navigate to System > Authentication > Users or Objects > Identity > Users and click Add.
2. Enter user details.
Username
Enter a username, which uniquely identifies the user and is to be used for login.
Name
Enter the name of the user.
Password
Enter a password and re-enter the same password for confirmation.
The password is case-sensitive.
User Type
Select the type of user from the available options.
Available Options:UserAdministrator
Profile (Only when user type Administrator is selected)
Select the administrator profile. The administrator will get access to various Admin Console menus as per the configured profile.
Create a new profile directly from this page or from the Objects > Policies > Access Profile > Add Profile page.
Specify the email address of the user.
Use comma to seperate multiple email addresses.
| Objects | 511
Description
Provide a user description.
3. Enter policies details.
Group
Select a group in which the user is to be added. User will inherit all the policies assigned to the group.
Surfing Quota
By default, the user will inherit its group policy. To override the group policy, select the policy from the list.
You can also create a new policy directly from this page itself or from the Objects > Policy > Surfing
Quota page.
Access Time
By default, the user will inherit its group policy. To override the group policy, select the policy from the list.
You can also create a new policy directly from this page iteself or from the Objects > Policies > Access
Time page.
Network Traffic
By default, the user will inherit its group policy. To override the group policy, select the policy from the list.
You can also create a new policy directly from this page itself or from the Objects > Policies > Network
Traffic Quota page.
Traffic Shaping
By default, user will inherit its group policy. To override the group policy, select the policy from the list.
You can also create a new policy directly from this page itself or from Objects > Policies > Traffic Shaping page.
4. Enter SSL VPN policy details.
Remote Access
By default, the user will inherit its group policy. To override the group policy, select a policy from the list.
You can also create a new policy directly from this page itself or from the System > VPN > SSL VPN
(Remote Access) page.
If the user is not to be provided SSL VPN access then select No Policy Applied.
Clientless
By default, the user will inherit its group policy. To override the group policy, select a policy from the list.
You can also create a new policy directly from this page itself or from the System > VPN > Clientless
Access page.
If the user is not to be provided clientless access then select No Policy Applied.
L2TP
By default, the user is provided remote access through L2TP. Disable if remote access is not to be provided to the user.
If enabled, provide the IP address (IPv4/IPv6) to be leased to the user for L2TP access.
PPTP
By default, the user is provided remote access through PPTP. Disable if remote access is not to be provided to the user.
If enabled, provide the IP address (IPv4/IPv6) to be leased to the user for PPTP access.
Quarantine digest is an email containing a list of quarantined spam messages filtered by the device and held in the user quarantine area. If configured, the device will mail the digest daily to the user. Digest also provides a link to the users My Account from where the user can access and take an action for quarantined messages.
CISCO
™
VPN Client
By default, the user is provided remote access through CISCO VPN client. Disable if remote access is not to be provided to the user.
If enabled, provide the IP address (IPv4/IPv6) to be leased to the user for CISCO VPN access.
| Objects | 512
Note: To use this feature, CISCO
™
VPN client needs to be configured from the System > VPN >
CISCO ™
VPN Client page.
Quarantine Digest
Configure the quarantine digest.
Quarantine digest is an email containing a list of quarantined spam messages filtered by the device and held in the user quarantine area. If configured, the device will mail the digest at the configured frequency to the user. Digest also provides a link to the User Portal from where the user can access and take an action on quarantined messages.
Available Options:Enable - The user will receive the quarantine digest daily. This option overrides the group setting.Disable - User will not receive quarantine digests. This option overrides the group setting.
Simultaneous Logins
Specify the number of concurrent logins that will be allowed for the user or click Unlimited for allowing unlimited concurrent logins.
Default: 1
Acceptable Range: 1 to 99
Note: The specified setting will override the global setting specified in the client preferences.
MAC Binding
Enable/disable MAC Binding. By binding the user to a MAC address, you are mapping the user with a group of MAC addresses.
If enabled, specify MAC addresses for example 01:23:45:67:89:AB.
Once you enable MAC binding, the user will be able to login through pre-specified machines only.
Use comma to seperate multiple MAC addresses. For example 01:23:45:67:89:AB, 01:23:45:67:89:AC.
Login Restrictions
Select the appropriate option to specify the login restriction for the user.
Available Options: Any Node - User will be able to login from any of the nodes in the network. User Group
Node(s) - User will be able to login only from the nodes assigned to his group. Selected Nodes - User will be able to login from the specified nodes only.Node Range - User will be able to login from any of the IP addresses from the configured range.
Note: Only IPv4 addresses must be provided for options Selected Nodes and Node Range.
5. Select administrator advanced settings (Only applicable if the user type is Administrator)
Schedule for Device Access
Schedule the device access.
The administrator will be able to access the device only during the time configured in the schedule.
Login Restriction for Device Access
Select the appropriate option to specify the login restriction for the user.
Available Options:Any Node - Administrator will be able to login from any of the nodes in the network.Selected Nodes - Administrator will be able to login from the specified nodes only. Node Range -
Administrator will be able to login from any of the IP addresses from the configured range.
Reset User Accounting (Displayed only after the user is added)
Click to reset the usage accounting i.e. Internet usage time and network traffic of the user.
View Usage (Displayed only after the user is added)
Click to view the Internet usage and data transfer usage.
Note: User configuration is given precendence over group configuration.
6. Click Save.
| Objects | 513
Reset User Accounting
This option lets you reset the usage accounting i.e. internet usage time and data transfer of the user.
1.
Edit the user account of the user whose data accounting you want to reset by clicking Manage icon in the
Manage column.
2. Click Reset User Accounting and OK to confirm.
Note: You cannot reset user accounting for the liver user.
View Usage
This option lets you view the Internet usage and data transfer usage.
1.
Edit the User account of the user whose data usage you want to view by clicking Manage icon under the
Manage column.
2. Click View Usage. A pop-up displays information of policies applied on the user account, upload and download data transferred by the user.
Importing User Information
The Import Users page allows you to add new users by importing user details from the file.
Instead of creating users again in the device, if you already have users detail in a csv file, you can upload the csv file.
Navigate to System > Authentication > Users and click Import to import the csv file.
Select Browse to include the complete path for migrating user’s information file.
Please consider the csv file format requirements:
1. Header (first) row should contain field names. Format of header row:
• Compulsory field: username
• Optional fields: password, name, group, email address
2. Fields can be configured in any order.
3. Subsequent rows should contain values corresponding to the each field in header row.
4. Number of fields in each row should be same as in the header row.
5. An error will be displayed if data is not provided for any field specified in the header.
6. Blank rows will be ignored.
7. If no password field is included in the header row then it will be set the same as the username.
8. If no group name is included in the header row, the administrator will be able to configure a group at the time of migration.
Exporting Users
This page allows you to export user information.
Navigate to System > Authentication > Users and click Export to export the user details in a csv file.
The .csv file is generated with the following headers: Name, Username, Enc_password, Email Address, and Group.
Purging Active Directory Users
This page allows you to purge AD Users.
Navigate to System > Authentication > Users and click Purge AD Users to synchronize the device’s Active
Directory users with an external Active Directory server.
Note:
• The purge operation will not interrupt user login/logout and accounting events.
• If HA is configured, user details are deleted from both, the primary device and the auxiliary device.
| Objects | 514
Change Status
Navigate to System > Authentication > Users.
Select a user and click Change Status to change the status of that user.
If the current status is Active, the status of the user will change to Inactive when you click this button and vice-versa.
Clientless Users
The Clientless Users page displays a list of all the clientless users.
Clientless users are the users who can bypass the client login to access the Internet and are managed by the device itself. As clientless users can bypass the device login, create clientless users when your network has few Non-
Windows machines, VOIP boxes, or servers.
You can filter the list based on name or username of the user, IP address, or group of the user. The page also provides options to add a single clientless user or multiple users, delete or change the status of the user. The administrator can also reset user accounting data or view the usage statistics.
Use this page to make the following settings:The page also provides options to:
•
•
•
•
•
Changing Policies of the Clientless User
Add a Single Clientless User
Use the Add Clientless User page to add a single clientless user.
The Add Clientless User page allows you to manually enter details to add a single clientless user that can bypass the device login.
Once a user is registered successfully, the page provides two more options:
•
- Click to reset the usage accounting i.e. Internet usage time and data transfer of the user.
•
- Click to view the Internet usage and data transfer usage.
1. Navigate to System > Authentication > Clientless Users or Objects > Identity > Clientless Users and click
Add.
2. Enter clientless users details.
Username
Enter a username which uniquely identifies the user and will be used for login.
IP Address
Specify an IP address(IPv4/IPv6) for the clientless user.
Group
Select a group to which the user is to be added. User will inherit all the polices assigned to the group.
Change the policies applied to the user by editing the user details.
Name
Enter the name of the user.
Enter an email address.
Quarantine Digest
Configure quarantine digest. Quarantine digest is an email and contains a list of quarantined spam messages filtered by the device and held in the user quarantine area. If configured, the device will mail the quarantine digest every day to the user. The digest provides a link to the User Portal from where the user can access quarantined messages and take the required action.
Available Options:Enable - User will receive the quarantine digest daily. This option overrides the group setting.Disable - User will not receive quarantine digests. This option overrides the group setting. Apply
Group's Settings - User will receive quarantine digests as per configured for the group the user belongs to.
Description
Specify a user description.
3. Click Save.
Reset User Accounting
This option lets you reset the usage accounting i.e. internet usage time and data transfer of the user.
1.
Edit the user account of the user whose data accounting you want to reset by clicking Manage icon in the
Manage column.
2. Click Reset User Accounting and OK to confirm.
Note: You cannot reset user accounting for the liver user.
View Usage
This option lets you view the Internet usage and data transfer usage.
1.
Edit the User account of the user whose data usage you want to view by clicking Manage icon under the
Manage column.
2. Click View Usage. A pop-up displays information of policies applied on the user account, upload and download data transferred by the user.
Add Multiple Clientless Users
Use the Add Multiple Clientless Users page to add multiple clientless users.
The Add page allows you to enter details to add multiple clientless users.
1. Navigate to System > Authentication > Clientless Users or Objects > Identity > Clientless Users and click
Add Range.
2. Enter the required details.
From IP
Specify a starting IP address for the range.
To IP
Specify an ending IP address for the range.
Group
You can change the policies applied to the user by editing the user details. If you change the policies for the user, user specific policies will take precedence over user group policies.
| Objects | 515
Figure 399: Clientless User
3. Click Save.
Changing Policies of the Clientless User
This page lets you change the policies configured for a clientless user.
| Objects | 516
Change the policies applied to a user by updating the user details. If you change the policies for the user, user specific policies will take precedence over user group policies.
1. Navigate to System > Authentication > Clientless Users or Objects > Identity > Clientless Users.
2.
Select the user for which you want to change the policies by clicking the edit icon in the Manage column.
3. Update the user details.
Username
Name with which user logs in.
Name
Name of the User.
Description
Provide the clientless user description.
IP Address
IP address (IPv4/IPv6) from which the user logs in.
Group
Group to which the user is added. User will inherit all the policies assigned to the group.
Change the group, if required.
Email address of the user.
Internet Usage Time
Displays total Internet usage time information.
Figure 400: Edit Clientless User
4. Update the policy details.
Traffic Shaping
Traffic Shaping policy applied to the user.
Change the policy, if required.
Policy applied here will take the precedence over the group policy.
Quarantine Digest
Configure quarantine digest.
| Objects | 517
Quarantine digest is an email and contains a list of quarantined spam messages filtered by the device and held in the user quarantine area. If configured, the device will mail the quarantine digest every day to the user. The digest provides a link to the User Portal from where the user can access his quarantined messages and take the required action.
Available Options:Enable - User will receive the quarantine digest daily. This option overrides the group setting. Disable - User will not receive quarantine digests. This option overrides the group setting.
Figure 401: Policies
5. Click Save.
Guest Users
The Guest Users page displays the list of all the guest users added.
Users without a pre-existing user account wanting to access the Internet using a hotspot, or via a network available at the airport, hotels, hostels, etc. are called “guest users”. These users, that are otherwise considered unauthenticated and/or are denied access, are allowed to make an request to connect to the Internet for a limited period by authenticating themselves. On being authenticated, these users are authorized to access the Internet as guest user. At such locations, Internet access is secured by configuring access policies to restrict any malicious use of the network.
Sophos Firewall allows the administrator to pre-configure single or multiple guest users using the Admin Console.
The credentials of guest users configured via the Admin Console can be printed and handed over to the guest user.
Alternately, guest users can register themselves using the guest user portal. The credentials and Internet access details of guest users registered via the guest user portal can either be sent via SMS or can be printed.
In case of successful authentication the guest user is granted access according to the applicable group, or else is redirected to the Captive Portal page.
You can filter the list based on name or username of the user, cell number of the user, and validity of the user account, . The page also provides options to add single or multiple users, distributing credentials for the Internet access, update user parameters, view or reset the data transfer usage.
Resend Credential – Click the Resend Credential icon in the Manage column against a user registered via the
Guest User Portal to whom the access detail’s SMS are to be resent.
Use this page to make the following setings:
•
•
•
•
•
Update Guest User Configuration
Registering a Single Guest User
Use the Add Single page to enter a new single guest user details.
The Add Single page allows you to manually enter and configure guest user details. Before adding a guest user, one has to configure general settings from System > System Services > Guest User Settings.
Once a guest user is registered successfully, the page provides two more options:
•
- Click to reset the usage accounting i.e. Internet usage time and data transfer of the user.
•
- Click to view the Internet usage and data transfer usage.
1. Navigate to System > Authentication > Guest Users or Objects > Identity > Guest Users and click Add
Single.
2. Enter guest user details.
Username
Displays auto-generated username.
Password
Displays auto-generated password.
Name
Specify the name of the guest user.
Specify email address of the guest user.
User Validity (Duration in Days)
Specify the validity of multiple guest users in days.
Minimum number of days: 1 day
Maximum number of days: 999 days
Validity Start
Select the type from when a user's validity should be counted.
Available Options:Immediately - Validity is counted from the time a guest user is created. After First
Login - Validity is counted from the time a guest user logs into the network for the first time.
| Objects | 518
Figure 402: Add Guest User
3. Click Add to register the user or Add and Print to register the user and print the login credentials.
Note: Before adding a guest user, you have to configure general settings on the System System Services
Guest User Settings page.
Reset User Accounting
This option lets you reset the usage accounting i.e. internet usage time and data transfer of the user.
1.
Edit the user account of the user whose data accounting you want to reset by clicking Manage icon in the
Manage column.
2. Click Reset User Accounting and OK to confirm.
Note: You cannot reset user accounting for the liver user.
View Usage
This option lets you view the Internet usage and data transfer usage.
| Objects | 519
1.
Edit the User account of the user whose data usage you want to view by clicking Manage icon under the
Manage column.
2. Click View Usage. A pop-up displays information of policies applied on the user account, upload and download data transferred by the user.
Register Multiple Guest Users
Use the Add Multiple page to enter multiple guest users.
The Add Multiple User page allows you to create multiple guest user logins.
1. Navigate to System > Authentication > Guest Users or Objects > Identity > Guest Users and click Add
Multiple.
2. Enter guest user details.
Number of Users
Specify the number of guest users to be created.
User Validity (Duration in Days)
Specify the validity of multiple guest users in days.
Minimum number of day: 1 day
Maximum number of days: 999 days
Validity Start
Select the type from when a user's validity should be counted.
Available Options:Immediately - Validity is counted from the time a guest user is created.After First Login
- Validity is counted from the time a guest user logs into the network for the first time.
3. Click Add to register the users or Add and Print to register the users and print the login credentials.
Update Guest User Configuration
This page lets you change the policies configured of the guest user.
Change the policies applied to the guest user by updating the user details.
1. Navigate to System > Authentication > Guest Users or Objects > Identity > Guest Users.
2.
Select the guest user for which you want to change the policies by clicking the edit icon in the Manage column.
3. Update the guest user details.
Username
Displays the username of the guest user.
Name
Specify the name of the guest user.
Password
Displays the password in encrypted format.
You can change the password by clicking on Change Password.
If you change it, enter the new password in the Password field and re-enter it in the Confirm Password field.
Cell Phone Number
Displays the cell phone number.
Note: The cell phone number cannot be edited.
Specify the email address of the guest user.
| Objects | 520
Internet Usage Time
Displays total Internet usage time information in HH:MM format.
4. Update the policy details.
Group
Displays the group to which the user belongs. User will inherit all the policies assigned to the group.
Note: The guest user group cannot be edited.
Surfing Quota
Select the surfing quota policy from the list.
You can also create a new policy directly from this page and attach it to the user.
Access Time
Select the access time policy from the list.
You can also create a new policy directly from this page and attach it to the user.
Network Traffic
Select the network traffic policy from the list.
You can also create a new policy directly from this page and attach it to the user.
Traffic Shaping
Select the traffic shaping policy from the list.
You can also create a new policy directly from this page and attach it to the user.
Note: User configuration is given precedence over Group Configuration i.e. User MAC binding and policies configuration is given priority over Group configuration.
5. Enter the SSL VPN policy details.
Remote Access
Select a policy for remote access from the list or create a new one. To create a new policy, click Create New.
You can create a new policy directly from this page itself or from System > VPN > Remote Access page.
Clientless
Select a policy for clientless access from the list or create a new one. To create a new policy, click Create
New.
You can also create a new policy directly from this page itself or from System > VPN > Clientless Access page.
If a user is not to be provided SSL VPN access then select No Policy Applied.
L2TP
Enable if you are mapping user to get access through L2TP connection.
Provide the IP Address to be leased to the Guest User for L2TP access.
PPTP
Enable if you want to allow the user to get access through a PPTP connection.
If enabled, provide the IP address (IPv4/IPv6) to be leased to the guest user for PPTP access.
CISCO
™
VPN Client
By default, the user is provided remote access through the CISCO VPN client. Disable if remote access is not to be provided to the user.
If enabled, provide the IP address (IPv4/IPv6) to be leased to the user for CISCO VPN access.
Note: To use this feature, CISCO
™
VPN client needs to be configured from the System > VPN >
CISCO
™
VPN Client page.
Quarantine Digest
Configure the quarantine digest.
| Objects | 521
Quarantine digest is an email and contains a list of quarantined spam messages filtered by the device and held in the user quarantine area. If configured, device will mail the quarantine digest every day to the user. The digest provides a link to the user's My Account from where the user can access his quarantined messages and take the required action.
Available Options:Enable - User receives the quarantine digest daily. This option overrides the group setting. Disable - User does not receive quarantine digests. This option overrides the group setting.
Simultaneous Logins
Specify the number of concurrent logins that will be allowed to the user or click Unlimited for allowing unlimited concurrent logins.
The specified setting overrides the global setting specified in the client preferences.
MAC Binding
Enable/disable MAC Binding. By binding the user to a MAC address, you are mapping the user with a group of MAC addresses.
For Selected Nodes and Node Range only IPv4 addresses can be provided.
MAC Address List
Specify MAC addresses for example 01:23:45:67:89:AB.
Once you enable MAC binding, the user can login through pre-specified machines only.
To configure multiple MAC addresses use comma. For example 01:23:45:67:89:AB, 01:23:45:67:89:AC.
Login Restriction
Select the appropriate option to specify the login restriction for the user.
Available Options:Any Node - User can login from any of the nodes in the network.User Group Node(s) -
User can login only from the nodes assigned to the group.Selected Nodes - User can login from the specified nodes only.Node Range - User can login from any of the IP addresses from the configured range.
6. Click Save .
7. Click Reset User Accounting to restart the accounting of guest user's Internet usage.
8. Click View Usage to view the Internet usage information of that particular guest user.
Policies
Objects > Policy
Policy describes the security parameters used for establishing and maintaining a secure connection between two peers.
This section covers the following topics:
•
- Schedule defines a time schedule for applying Firewall Rule or Web & Application Filter policy. This page displays a list of schedules and also provides various options to manage it.
•
- Schedule Internet access for individual users by defining Access Time policy. This page displays
list of all the default as well as custom policies.
•
- Control individual user surfing time by defining Surfing Quota policy. This page displays the list of all policies and also provides option to add, update or delete surfing quota policies.
•
- Limit total as well as individual upload and/or download data transfer by defining
Network Traffic Quota. This page displays default as well as custom policies. The page also provides option to manage these policies.
•
- The Network Address Translation page displays list of all the NAT policies and you can sort the list based on policy name.The page also provides option to add a new policy, update the parameters of the existing policy, or delete a policy.
•
- An IPsec policy defines IKE (Internet Key Exchange) and IPsec proposal parameters of an IPsec connection.This page displays list all the preconfigured and custom IPsec policies. It also provides option to add a new policy, update the parameters of an existing policy, or delete the policy.
•
- Create and deploy IPS Policies to block malicious or suspicious traffic and increase security and productivity. This page displays the list of all the pre-defined and custom IPS policies.
•
- Configure and manage web filtering through the device with Web Filter policies. This page displays
the list which includes predefined and custom policies. You can filter or sort the list based on the policy name.
•
- Traffic Shaping policy allocates & limits the maximum bandwidth usage of the user and controls the web and network traffic. This page displays list of predefined and custom policies and also provides various options to manage it.
•
- The page displays all existing web application protection objects. The page also provides
option to add new protocol security objects, edit or delete them.
•
- The page displays all existing web application authentication profiles. The page also provides option to add new application authentication profiles, edit or delete them.
•
- This page shows the default and custom profiles and also provides options to manage
these profiles.
•
- This page displays list of all the global application traffic shaping policies. The
page provides option to edit the category or application to apply the traffic shaping policy.
•
- This page displays list of all the predefined and custom policies. The page also provides option to add a new policy, update parameters of the exisiting policy, delete a policy, add a filtering rule to a policy or delete a filtering rule attached to a policy.
•
- This page displays a list of hotspot voucher definition and also provides various options to manage it.
Schedule
The Schedule page displays the list of all the predefined and custom schedules.
Schedule defines a time schedule for applying Security Policies or Web & Application Filter policy. It is used to control when these policies are active or inactive.
Schedule also defines the system triggered scan for Rogue AP Scan.
Types of Schedules:
• Recurring - use to create policies that are effective only at specified times of the day or on specified days of the week.
• One-time - use to create Security Policies that are effective once for the period of time specified in the schedule.
The device is shipped with the following predefined schedules which can be applied to various security policies:
Work hours (5 Day week), Work hours (6 Day week), All Time on Weekdays, All Time on Weekends, All Time on Sunday, All Days 10:00 to 19:00. You can also create new schedule, modify the existing schedules or delete a schedule.
Note: Schedule used by Security Policies or any policies cannot be deleted.
Add a New Schedule
Use the Add Schedule page to add a new schedule.
The Add Schedule page allows you to manually configure a new schedule.
1. Navigate to Objects > Policies > Schedule and click Add.
2. Enter the details.
Name
Enter a name to identify a Schedule.
Description
Specify schedule description.
Recurrence
Select recurrence type.
| Objects | 522
| Objects | 523
Available Options: Recurring - Use to create policies that are effective only at specified times of the day or on specified days of the week. One Time - Use to create policies that are effective once for the period of time specified in the schedule. It can be implemented from Policies > User Application Policy or Policies >
Network Policy page.Start & End Date - Specify Start and Stop date. This is applicable for the one time schedule only.
Also, select the days of the week and specify time for the schedule to be active. Stop time cannot be greater than start time.
Figure 403: Add Schedule - Recurring
3. Click Save.
Access Time
The Access Time page displays list of all the default as well as custom policies.
Access time is the time period during a day in which user can be allowed/denied the Internet access. An example would be “only office hours access” for a certain set of users.
Access time policy enables to set time interval - days and time - for the Internet access with the help of schedules. See
for more details.
A time interval defines days of the week and times of each day of the week when the user will be allowed/denied the
Internet access.
Two strategies based on which Access time policy can be defined:
• Allow strategy - By default, allows access during the schedule
• Deny strategy - By default, denies access during the schedule
Device is shipped with the following predefined policies: Allowed all the time, Denied all the time, Allowed only during Work Hours, Denied during Work hours. These predefined policies are immediately available for use until configured otherwise. You can also define custom policies to define different levels of access for different users to meet your organization’s requirements.
The page also provides option to add, update, or delete the access time policies.
Note: Among all the policies applied, device takes into account the policy that first reaches its threshold limit.
Create a New Access Time Policy
Use the Add Access Time Policy page to add a new access time policy.
The Add Access Time Policy page allows you to manually add an access time policy.
1. Navigate to Objects > Policies > Access Time and click Add.
2. Enter the details.
Name
Enter name to identify the policy.
Description
Provide policy description.
Action
Specify the action to be applied during the scheduled time interval.
Available Options:Allow - Allows the Internet access during the scheduled time interval.Deny - Denies
Internet access during the scheduled time interval.
Schedule
Select schedule from the available options. Only Recurring schedule can be applied.
Available Options:All the TimeWork hours (5 Day Week)Work hours (6 Day Week)All time on
WeekdaysAll time on WeekndsAll time on SundayAll Days 10:00 to 19:00
Depending on the policy strategy, access will be allowed/denied for the scheduled time interval.
Note: Changes made in the policy becomes effective immediately on saving the changes.
| Objects | 524
Figure 404: Add Access Time Policy
3. Click Save.
Surfing Quota
The Surfing Quota Policy page displays the list of all default and custom surfing quota policies.
A surfing quota policy specifies for how long (in hours) a user or group of users can access the Internet.
A surfing quota policy:
• Allows you to allocate Internet access time on a cyclic or non-cyclic basis.
• Can be applied to a number of Groups or Users.
The device is shipped with the following predefined policies: Unlimited Internet Access, 1 Month Unlimited Access,
1 month 100 hours, Monthly 100 hours Cyclic, Daily 1 hour Cyclic, Weekly 7 hours Cyclic. These predefined policies are immediately available for use until configured otherwise. You can also define custom policies to specify different levels of access for different users to meet your organization’s requirements.
The page also provides options to add, update, or delete surfing quota policies.
Note: Among all the policies applied, the device takes into account the policy that first reaches its threshold limit.
Add Surfing Quota Policy
Use the Add Surfing Quota page to configure a new surfing quota policy.
| Objects | 525
The Add Surfing Quota page allows you to configure a surfing quota policy.
1. Navigate to Protection > Web Protection > Surfing Quota or Objects > Policies > Surfing Quota and click
Add.
2. Enter the details.
Name
Specify name to identify the policy. Duplicate names are not allowed.
Cycle Type
Select Cycle type.
Available Options:Cyclic - Once the cycle ends, the user is automatically registered for new cycle. Non-
Cyclic - Once the specified time limit ends, the user will be disconnected.
Cycle Hours
Specify Cycle Hours. Cycle hours define the upper limit of surfing hours for cyclic types of policies i.e. Daily,
Weekly, Monthly and Yearly.
At the end of each cycle, cycle hours are reset to zero, e.g. for the "Weekly" Cycle type, cycle hours will reset to zero every week even if cycle hours are unused.
Validity
Specify Validity in number of days. Validity defines the upper limit of total surfing days allowed, i.e. it restricts total surfing days to valid allotted days.
OR
Click Unlimited Days, if you do not want to restrict the total surfing days.
Maximum Hours
Specify Maximum Hours. Maximum hours define the upper limit of total surfing hours allowed i.e. it restricts total surfing hours to maximum hours.
OR
Click Unlimited Hours, if you do not want to restrict the total surfing hours.
Description
Provide a description for the surfing quota policy.
Figure 405: Add Surfing Quota Policy
3. Click Save.
Network Traffic Quota
The Network Traffic Quota page displays list of all the default as well as custom network traffic policies.
| Objects | 526
Once the user logs on, the bandwidth is available and the total available bandwidth is shared among all the active users at the particular time. Bandwidth being the limited resource, bandwidth shortage and congestion problems is common. The device facilitates limiting data transfer allowed to individual user according to the requirement.
Bandwidth is limited using the Traffic Shaping policy while network traffic quota policy defines the upper limit for data transfer carried out by the user.
Network Traffic Quota policy:
• Allows limiting data transfer on a cyclic or non-cyclic basis.
• Single policy can be applied to number of Groups or Users.
Data transfer restriction can be based on:
• Total Data transfer (Upload + Download)
• Individual Upload and/or Download
Device is shipped with the following predefined policies: 100 MB Total Data Transfer policy, Daily 10 MB. These predefined policies are immediately available for use until configured otherwise. You can also define custom policies to define different levels of access for different users to meet your organization’s requirements.
The page also provides option to add, update, or delete network traffic quota policies.
Note: Among all the policies applied, device takes into account the policy that first reaches its threshold limit.
Create a New Network Traffic Quota Policy
Use the Add Network Traffic Quota page to quickly configure a new network traffic policy.
The Add Network Traffic Quota page allows you to manually enter details to configure network traffic policy.
1. Navigate to Objects > Policies > Network Traffic Quota and click Add.
2. Enter the details.
Name
Enter a name to identify the Policy. Duplicate names are not allowed.
Description
Specify Network Traffic Policy description.
Restriction Based On
Specify whether the network traffic restriction is on Total Network Traffic or on Individual Network Traffic
(Upload and Download).
Cycle Type
Select Cycle Type.
Available Options: Cyclic - Once the cycle ends, user is automatically registered for new cycle. Non Cyclic -
On reaching the upper limit of the network traffic quota specified, user will be unable to send or receive data.
3. Restriction based on Total Network Traffic and Cyclic Policy.
Cycle Period
Specify Cycle Period. Cycle period defines the duration for cyclic types of policies i.e. Day, Week, Month and
Year.
Cycle Network Traffic
Specify Cycle Network Traffic limit. It is the limit of network traffic allowed to the user per cycle. User will be disconnected if limit is reached.
Maximum Network Traffic
Specify Maximum Network Traffic limit. It is the network traffic allowed to the user and if the limit is reached user will not be able to log on until the policy is renewed.
OR
If you do not want to restrict amount of network traffic, click Unlimited Maximum Network Traffic.
| Objects | 527
Figure 406: Total Network Traffic and Cyclic Policy
4. Restriction based on Total Network Traffic and Non-Cyclic Policy.
Maximum Network Traffic
Specify Maximum Network Traffic limit. It is the network traffic allowed to the user and if the limit is reached user will not be able to log on until the policy is renewed.
OR
If you do not want to restrict amount of network traffic, click Unlimited Maximum Network Traffic.
Figure 407: Total Network Traffic and Non-Cyclic Policy
5. Restriction based on Individual Network Traffic and Cyclic Policy.
Cycle Period
Specify Cycle Period. Cycle period defines the duration for cyclic type of policies i.e. Day, Week, Month and
Year.
| Objects | 528
Cycle Upload Network Traffic
Specify Cycle Upload Network Traffic limit. It is the upper upload network traffic limit allowed to the user per cycle. User will be disconnected if the limit is reached.
OR
If you do not want to restrict amount of network traffic per cycle, click Unlimited Cycle Upload Network
Traffic.
Cycle Download Network Traffic
Specify Cycle Download Network Traffic limit. It is the upper limit of download network traffic allowed to the user per cycle. User will be disconnected if limit is reached.
OR
If you do not want to restrict amount of download network traffic per cycle, click Unlimited Cycle Download
Network Traffic.
Maximum Upload Network Traffic
Specify Maximum Upload Network Traffic limit. It is the maximum upload network traffic allowed to the user and if the limit is reached user will not be able to log on until the policy is renewed.
OR
If you do not want to restrict amount of upload network traffic, click Unlimited Upload Network Traffic.
Maximum Download Network Traffic
Specify Maximum Download Network Traffic limit. It is the maximum download network traffic allowed to the user and if the limit is reached user will not be able to log on until the policy is renewed.
OR
If you do not want to restrict amount of download network traffic, click Unlimited Download Network
Traffic.
Figure 408: Individual Network Traffic and Cyclic Policy
6. Restriction based on Individual Network Traffic and Non-Cyclic Policy.
| Objects | 529
Maximum Upload Network Traffic
Specify Maximum Upload Network Traffic allowed to the user. Once the limit is reached user will not be able to log on until the policy is renewed.
OR
If you do not want to restrict amount of upload network traffic, click Unlimited Upload Network Traffic.
Maximum Download Network Traffic
Specify Maximum Download Network Traffic allowed to the user. Once the limit is reached user will not be able to log on until the policy is renewed.
OR
If you do not want to restrict amount of download network traffic, click Unlimited Download Network
Traffic.
Description
Provide Policy Description.
Figure 409: Individual Network Traffic and Non-Cyclic Policy
Note: Cycle Network Traffic limit cannot be greater than Maximum Network Traffic limit.
7. Click Save.
Network Address Translation
The NAT Policy page displays list of all the NAT policies and you can sort the list based on the policy name.
Network Address Translation (NAT) is the process of rewriting the source addresses of IP packets as they pass through a router or Firewall. Mostly NAT is used to enable multiple hosts on a private network to access the Internet using a single public IP Address. When a client sends an IP packet to the router, NAT translates the sending address to a different, public IP Address before forwarding the packet to the Internet. When a response packet is received,
NAT translates the public address into the original address and forwards it to the client.
| Objects | 530
NAT policy tells Securities Policies to allow access but only after replacing the source IP Address with the IP
Address specified in the NAT policy. Use NAT to change or remap source or destination address of the packet.
Using NAT eliminates the need for public IP Addresses for all computers on your LAN. It is a way to conserve
IP Addresses available from the pool of Public IP Addresses for the Internet. NAT also allows you to conceal the addressing scheme of your network.
The page also provides option to add a new policy, update the parameters of the existing policy, or delete a policy.
Add NAT Policy
Use the Add NAT Policy page to quickly configure a new NAT policy.
The Add NAT Policy page allows you to manually enter details to configure NAT policy.
1. Navigate to Objects > Policies > Network Address Translation and click Add.
2. Enter the details.
Name
Enter a name to identify the NAT Policy.
IP Address
Select IP Address for source NATing.
Available Options: IP Address - It will replace source IP Address with the specified IP Address. IP Range -
It will replace source IP Address with any of the IP Address from the specified range.
You can search and select a particular IP Address based on the Host name. If IP Host or range is not already added, it can be added from here itself or can be added from Objects > Assets > IP Hosts.
Note: MASQ is a default NAT policy and cannot be updated or deleted.
Figure 410: Add NAT Policy
3. Click Save.
IPsec
The IPsec displays list all the preconfigured and custom IPsec policies.
Policy describes the security parameters used for negotiations to establish and maintain a secure tunnel between two peers.
Before you set up your secure tunnels, to make their configuration faster and easier, you can create VPN policies that work on a global level. Rather than configuring the policy parameters for every tunnel you create, you can configure general policies and then later apply them to your secure tunnels.
Authentication mode
To ensure secure communication, there are two phases to every IKE (Internet Key Exchange) negotiation - Phase 1
(Authentication) and Phase 2 (Key exchange).
The Phase 1 negotiation establishes a secure channel between peers and determines a specific set of cryptographic protocols, exchanges shared secret keys and encryption and authentication algorithm that will be used for generating keys.
The Phase 2 negotiation establishes a secure channel between peers to protect data. During Phase 2 negotiation, the protocol security association for the tunnel is established. Either of the peers can initiate Phase 1 or Phase 2 renegotiation at any time. Both can specify intervals after which to negotiate.
| Objects | 531
Key life
Lifetime of key is specified as Key life.
Once the connection is established after exchanging authenticated and encrypted keys, connection is not dropped till the key life. If the key life of both the peers is not same then negotiation will take place whenever the key life of any one peer is over. This means intruder has to decrypt only one key to break in your system.
Key generation and key rotation are important because the longer the life of the key, the larger the amount of data at risk, and the easier it becomes to intercept more ciphered text for analysis.
Perfect Forward Secrecy (PFS)
It becomes difficult for a network intruder to get the big picture if keys are changing and they have to keep cracking keys for every negotiation. This is achieved by implementing PFS. By selecting PFS, new key will be generated for every negotiation and a new DH key exchange is included. So every time intruder will have to break yet another key even though he already knows the key. This enhances security.
Diffie-Hellman (DH) Group (IKE group)
Diffie-Hellman is a public-key cryptography scheme that allows peers to establish a shared secret over an insecure communications channel. Diffie-Hellman Key Exchange uses a complex algorithm and public and private keys to encrypt and then decrypt the data.
The Diffie-Hellmann Group describes the key length used in encryption. Group number is also termed as Identifiers.
14
15
16
2
5
DH Group
1
Key length (bits)
768
1024
1536
2048
3072
4096
If mismatched groups are specified on each peer, negotiation fails. The group cannot be switched during the negotiation.
Re-key Margin
Time before the next key is exchanged. Time is calculated by subtracting the time elapsed since the last key exchange from the key life. By turning Re-keying ‘Yes’, negotiation process starts automatically without interrupting service before key expiry.
Dead Peer Detection settings
Use to check whether device is able to connect the IP Address or not. Set time interval after which the status of peer is to be checked and what action to take, if peer is not alive.
Tunnel Negotiation
Negotiation process starts to establish the connection when local or remote peer wants to communicate with each other. Depending on the connection parameters defined, the key is generated which is used for negotiations. Lifetime of key is specified as Key life. Once the connection is established, connection is alive/active and data can be transferred up to the specified key life. Connection will be closed/deactivated once the key expires.
If the connection is to be activated again then the entire negotiation process is to be started all over again. Negotiation process can be started again automatically by either local or remote peer only if Allow Re-keying is set to ‘Yes’.
Set the re-keying time in terms of the remaining key life when negotiation is to be started automatically without interrupting the communication before key expiry. For example, if key life is 8 hours and Re-key margin time is 10 minutes then negotiation process will automatically start after 7 hours 50 minutes of key usage.
| Objects | 532
Negotiation process will generate new key only if Perfect Forward Secrecy (PFS) is set to ‘Yes’. PFS will generate a new key from scratch and there will be no dependency between old and new key.
Re-keying
Yes
No
Result
Local and remote peer both will be able to initiate request for connection. Depending on PFS, negotiation process will use same key or generate a new key.
Only remote peer will be able to initiate request for connection. Depending on PFS, negotiation process will use same key or generate a new key.
Device provides 5 default policies and you can also create a custom policy to meet your organization’s requirement.
To make VPN connection configuration an easy task, following five preconfigured VPN policies are included for the frequently used VPN deployment scenarios:
• Road warrior
• L2TP
• Head office connectivity
• Branch office connectivity
• Default
It also provides option to add a new policy, update the parameters of an existing policy, or delete the policy. Instead of creating a policy from scratch, you can also create a new policy based on the already created policy by duplicating its parameters.
Duplicate - Click the duplicate icon in the Manage column against the VPN Policy to be duplicated. Add VPN
Policy window is displayed which has the same values for parameters as the existing policy. Click OK to add a new policy with modification in values for parameters.
Note: Default policy can be updated but cannot be deleted.
Create a New IPsec Policy
Use the Add page to quickly configure a new IPsec policy.
The Add page allows you to manually enter details to add IPsec policy.
1. Navigate to Objects > Policies > IPsec or System > VPN > IPsec and click Add.
2. Enter General Settings Details.
Name
Specify a name to identify the IPsec Policy.
Description
Provide description for the IPsec Policy.
Allow Re-keying
Enable Re-Keying to start the negotiation process automatically before key expiry. Process will start automatically at the specified time in re-key margin.
If enabled, negotiation process can be initiated by both the local or remote peer. Depending on PFS, negotiation process will use same key or generate a new key.
Key Negotiation Tries
Specify maximum key negotiation trials allowed. Set 0 for unlimited number of trials.
Authentication Mode
Select Authentication Mode. Authentication Mode is used for exchanging authentication information.
Available Options:Main Mode - Main mode consists of 6 messages. It processes and validates the diffiehellman in 3 exchanges. Aggressive Mode - Agressive mode consists of 3 messages. With Aggressive
Mode, tunnel can be established faster than using Main Mode as less number of messages are exchanged
| Objects | 533 during authentication and no cryptographic algorithm is used to encrypt the authentication information. Use
Aggressive Mode when remote peer has dynamic IP Addresses.
Depending on Authentication Mode, the phase 1 parameters are exchanged for authentication purpose.
In Main Mode, the phase 1 parameters are exchanged in multiple rounds with encrypted authentication information while in Aggressive Mode phase1 parameters are exchanged in single message without encrypted information.
Pass Data In Compressed Format
Enable to pass data in compressed format to increase throughput.
Figure 411: General Settings
3. Enter PHASE 1 details.
Encryption Algorithm
Select encryption algorithm that would be used by communicating parties for integrity of exchanged data for phase 1.
Supported Encryption algorithms: DES, 3DES, AES128, AES192, AES256, TwoFish, BlowFish, and Serpent.
3DES – Triple DES is a symmetric strong encryption algorithm that is compliant with the OpenPGP standard.
It is the application of DES standard where three keys are used in succession to provide additional security.
AES – Advanced Encryption Standard offers the highest standard of security. The effective key lengths that can be used with AES are 128, 192 and 256 Bits. This security system supports a number of encryption algorithms.
Serpent – Serpent is a 128-bit block cipher i.e. data is encrypted and decrypted in 128-bit chunks variable key length to be 128, 192, or 256 bits. The Serpent algorithm uses 32 rounds, or iterations of the main algorithm.
Serpent is faster than DES and more secure than Triple DES.
BlowFish – BlowFish is a symmetric encryption algorithm which uses the same secret key to both encrypt and decrypt messages. It is also a block cipher which divides a message into fixed length blocks during encryption and decryption. It has a 64-bit block size and a key length of anywhere from 32 bits to 448 bits and uses 16 rounds of main algorithm.
TwoFish – TwoFish is a symmetric key block cipher with a block size of 128 bits and key sizes up to 256 bits.
Authentication Algorithm
Select Authentication Algorithm that would be used by communicating parties for integrity of exchanged data for phase 1.
Supported Authentication algorithms: MD5, SHA1
Maximum three combinations of Encryption and Authentication Algorithm can be selected. The remote peer must be configured to use at least one of the defined combinations.
Click Add icon to add more than one combination of Encryption and Authentication Algorithm.
Default - MD5
DH Group (Key Group)
Select one Diffie-Hellman Group from 1, 2, 5, 14, 15 or 16. DH Group specifies the key length used for encryption.
DH Group 1 uses 768-bit encryption
DH Group 2 uses 1024-bit encryption
DH Group 5 uses 1536-bit encryption
DH Group 14 uses 2048-bit encryption
DH Group 15 uses 3072-bit encryption
DH Group 16 uses 4096-bit encryption
The remote peer must be configured to use the same group. If mismatched groups are specified on each peer, negotiation fails.
Key Life
Specify Key Life in terms of seconds. Key Life is the amount of time that will be allowed to pass before the key expires.
Default - 3600 seconds
Re-Key Margin
Specify ReKey Margin. Set time in terms of the remaining Key Life. Re-Key Margin is the time when the negotiation process should be started automatically without interrupting the communication before the key expiry.
For example, if Key Life is 8 hours and Re-key Margin is 10 minutes then negotiation process will automatically start after 7 hours 50 minutes usage of Key Life.
Default - 120 seconds
Randomize Re-Keying Margin By
Specify Randomize Re-Keying time.
For example, if Key Life is 8 hours, Re-Key Margin is 10 minutes and Randomize Re-Keying time is 20% then the Re-Key Margin will be 8 to 12 minutes and negotiation process will start automatically 8 minutes before the key expiry and will try up to 2 minutes after key expiry.
Default - 0%
Dead Peer Detection
Enable to check at regular interval whether peer is live or not.
Default - Enabled
Check Peer After Every (Only if Dead Peer Detection option is "Enabled")
Specify time after which the peer should be checked for its status. Once the connection is established, peer which initiated the connection checks whether another peer is live or not.
Default - 30 seconds
Wait For Response Upto (Only if Dead Peer Detection option is "Enabled")
Specify till what time (seconds) initiated peer should wait for the status response. If the response is not received within the specified time, the peer is considered to be inactive.
Default - 120 seconds
Action When Peer Unreachable (Only if Dead Peer Detection option is "Enabled")
Specify what action should be taken if peer is not active.
Available Options: Hold - Holds the connectionDisconnect - Closes the connectionRe-initiate - Reestablishes the connection
| Objects | 534
| Objects | 535
Default - Disconnect
Figure 412: Phase 1
4. Enter Phase 2 Details
Encryption Algorithm
Select encryption algorithm that would be used by communicating parties for integrity of exchanged data for phase 2.
Supported Encryption algorithms: DES, 3DES, AES128, AES192, AES256, TwoFish, BlowFish, and Serpent.
3DES – Triple DES is a symmetric strong encryption algorithm that is compliant with the OpenPGP standard.
It is the application of DES standard where three keys are used in succession to provide additional security.
AES – Advanced Encryption Standard offers the highest standard of security. The effective key lengths that can be used with AES are 128, 192 and 256 Bits. This security system supports a number of encryption algorithms.
Serpent – Serpent is a 128-bit block cipher i.e. data is encrypted and decrypted in 128-bit chunks variable key length to be 128, 192, or 256 bits. The Serpent algorithm uses 32 rounds, or iterations of the main algorithm.
Serpent is faster than DES and more secure than Triple DES.
BlowFish – BlowFish is a symmetric encryption algorithm which uses the same secret key to both encrypt and decrypt messages. It is also a block cipher which divides a message into fixed length blocks during encryption and decryption. It has a 64-bit block size and a key length of anywhere from 32 bits to 448 bits and uses 16 rounds of main algorithm.
TwoFish – TwoFish is a symmetric key block cipher with a block size of 128 bits and key sizes up to 256 bits.
Authentication Algorithm
Select Authentication Algorithm that would be used by communicating parties for integrity of exchanged data for phase 2.
Supported Authentication algorithms: MD5, SHA1
Maximum three combinations of Encryption and Authentication Algorithm can be selected. The remote peer must be configured to use at least one of the defined combinations.
Click Add icon to add more than one combination of Encryption and Authentication Algorithm.
Default - MD5
PFS Group (DH Group)
Select one Diffie-Hellman Group from 1, 2, 5, 14, 15 or 16. DH Group specifies the key length used for encryption.
DH Group 1 uses 768-bit encryption
DH Group 2 uses 1024-bit encryption
DH Group 5 uses 1536-bit encryption
DH Group 14 uses 2048-bit encryption
DH Group 15 uses 3072-bit encryption
DH Group 16 uses 4096-bit encryption
The remote peer must be configured to use the same group. If mismatched groups are specified on each peer, negotiation fails.
If “Same as Phase 1” is selected PFS group specified at connection initiator’s end will be used.
If No PFS is selected, this security parameter cannot be added for Phase 2.
Key Life
Specify Key Life in terms of seconds. Key Life is the amount of time that will be allowed to pass before the key expires.
Default - 3600 seconds
| Objects | 536
Figure 413: Phase 2
5. Click Save.
Intrusion Prevention
The Intrusion Prevention page displays the list of all the pre-defined and custom IPS policies.
The device is a real time Intrusion Prevention System (IPS) system that protects your network from known and unknown attacks by worms and viruses, hackers and other Internet risks.
The device at the perimeter of your network analyzes entire traffic and prevents attacks from reaching your network.
Whether it is a worm, a suspicious web request, a hacker targeting your mail server or any other attack - it simply does not get through.
Note: Intrusion Prevention System module is a subscription module that needs to be subscribed before use.
Note: You can also view and manage the IPS status on the System > Diagnostics > Services page.
IPS consists of a signature engine with a predefined set of signatures. Signatures are the patterns that are known to be harmful. IPS compares traffic to these signatures and responds at a high rate of speed if it finds a match. Signatures included within the device are not editable.
As per your network requirements, device allows you to define multiple policies instead of one global policy, to decrease packet latency and reduce the false positives.
IPS policy allows you to view predefined signatures and customize the intrusion prevention configuration at the category as well as individual signature level. Categories are signatures grouped together based on the application and protocol vulnerabilities.
The device instead of providing only a single policy (global) for managing multiple networks/hosts, allows to tailor policy per network/host i.e. allows to define multiple policies for managing multiple networks/hosts.
To enable the Intrusion Prevention System, apply IPS policy from Security Policies. You can create rule to apply:
| Objects | 537
• single policy for all the users/networks
• different policies for different users/networks or hosts
As Security Policies control all traffic passing through the device and decide whether to allow or drop the connection,
IPS rule will be applied to only that traffic/packet which passes through Firewall.
Category
Signatures are organized in categories such as DNS, Finger, P2P, DDOS, and others. These signature categories are listed in the policy. You can configure these categories to change the prevention and/or detection settings. To perform
Intrusion Prevention, you need to enable IPS services for each category i.e. you will be able to configure attack threats for individual signature only if an IPS service for the category is “Enabled”.
Each IPS policy contains a set of signatures that device searches for, logs, blocks and allows to:
• Enable or disable category from IPS protection.
• Enable or disable individual signature in a category to tailor IPS protection based on your network environment.
• Define an action to be taken when the matching traffic pattern is found. Device can either detect or drop the connection. In either of the case, device generates the log and alerts the Network Administrator.
IPS provides six actions for managing attack threats: (action if signature matches)
• Allow Packet - Allows the packet to its intended destination.
• Drop Packet - Drops packets if detects any traffic that matches the signature.
• Disable - Disables the signature, if it detects any traffic that matches the signature.
• Drop Session - Drops the entire session if detects any traffic that matches the signature.
• Reset - Resets entire session if detects any traffic that matches the signature.
• Bypass Session - Allows the entire session if detects any traffic that matches the signature.
In packet-based actions, the device checks each packet before taking an action while for session-based action, only the first packet is checked and an action is taken. In case of Reset, TCP reset packet is sent to the originator. In all the cases, the device generates the log and alerts the Network Administrator.
To save resources and avoid latency, set action as “Bypass Session” as in this, if the initial packets match the signature then the rest of the session packets will not be scanned at all.
To avoid getting high number of Alerts and save resources, set action as “Drop session” as in this, if the device identifies attack in the initial packets then it will terminate the entire session instead of scanning all the session packets.
The page provides option to add a new policy, configure the handling of signatures by category or on a signature-bysignature basis, or delete the policy.
The device provides following pre-defined policies. You can directly use policies 1 to 6 without any modifications while policies 7 to 10 can either be used directly or, can be modified as per your requirements:
1. DMZ TO LAN
2. DMZ TO WAN
3. LAN TO DMZ
4. LAN TO WAN
5. WAN TO DMZ
6. WAN TO LAN
7. generalpolicy
8. lantowan strict policy
9. lantowan general policy
10. dmzpolicy
Create an IPS Policy
Use the Add page to quickly configure a new IPS policy.
The Add page allows you to manually enter details to create an IPS policy.
1. Navigate to Objects > Policies > Intrusion Prevention and click Add.
2. Enter details.
Name
Enter a name to identify the IPS Policy.
Description
Enter IPS Policy description.
Clone Rules
Select the IPS Policy to be used as a template from the available list.
Available Options:generalpolicylantowan_strictlantowan_generaldmzpolicyLAN to WANLAN to
DMZWAN to DMZWAN to LANDMZ to WANDMZ to LAN
| Objects | 538
Figure 414: Details
3. Click Save.
4. Once the policy is created, policy rules can be added to take appropriate action for signatures in the policy. Define rule to configure action to be taken when the matching traffic pattern is found. If the rules are already added, list of rules are displayed along with its details like signature filtering criteria, action. You can add, update, or delete the rules.
IPS Policy Rules
Use the Add Policy Rules page to quickly configure IPS Policy Rules.
The Add Policy Rules page allows you to manually configure policy rules.
Once the policy is created, policy rules can be added to take appropriate action for signatures in the policy. Define rule to configure action to be taken when the matching traffic pattern is found. If the rules are already added, list of rules are displayed along with its details like signature filtering criteria, action. You can add, update, or delete the rules.
1. Navigate to Objects > Policies > Intrusion Prevention .
2.
Click on the Manage icon under the Manage column for the particular IPS Policy for which you want to add the policy rule.
3. Click Add.
4. Enter details.
Rule Name
Enter a name for IPS Policy Rule.
Figure 415: Rule Detail
5. Enter signature details.
Default
Select to view a list of default signatures.
Custom Signature
Select to view a list of custom signatures.
Category
Select IPS signature category from the list of available categories.
Severity
Severity is the level of threat posed by the attack. Select the type of severity from the available options.
Available Options:Select All1 - Critical2 - Major3 - Moderate4 - Minor5 - Warning
Platform
Platform is the OS affected by the attack. Select the platform from the available options:
Available Options: Select AllWindowsLinuxUnixMACSolarisBSDOther
Target
Target is the type of device targeted by the attack.Select the target from available options:
Available Options:Select AllClientServer
| Objects | 539
Figure 416: Signature Criteria
6. List of Matching Signature. Displays list of signature as per the filter criteria along with the Signature name,
Category, Severity, Platform, Target and Recommended Action
Select All
Select to choose all the signatures listed for the selected criteria.
Based on the Signature Criteria the signatures are made available.
Select Individual Signature
Select to customize the choice of Signatures list for the selected criteria.
Based on the Signature Criteria the signatures are made available.
Search
Specify Signature Name in the textbox to search a Signature.
This option is available, only if option “Select Individual Signature” is selected.
| Objects | 540
Figure 417: List of Matching Signatures
7. Enter Action details.
Action
Select an action to be taken from the available options:
Available Options:Recommended - This action means that you want the OS to handle this alert level according to best-fit recommendations. Allow Packet - Allows the packet to its intended destination.Drop
Packet - Drops packets if it detects any traffic that matches the signature. Disable - Disables the signature, if it detects any traffic that matches the signature. Drop Session - Drops the entire session if detects any traffic that matches the signature. Reset – Resets entire session if detects any traffic that matches the signature.Bypass Session – Allows the entire session if detects any traffic that matches the signature.
Figure 418: Action
8. Click Save.
Web Filter Policies
The Web Filter Policies page allows you to Add, Delete, or Edit web filter policies.
Use the Web Filter Policies page to create and maintain a set of Web Filter policies. You can access the Web Filter
Policies page by going to Protection > Web Protection > Web Filter Policies or Objects > Policies > Web Filter.
| Objects | 541
Each policy can filter based on a Web Category, File Type, URL Group, or Dynamic Category. Default policies are included, and you can create and maintain your own.
On this page you can view the list of Web Filter polices. The list shows details of each:
• Name: The policy name. To edit a policy, click the Name, or select the check box and click the wrench icon under
Manage.
• Default Action: Shows the default action configured for the policy.
• Reporting: Shows if reporting is Enabled or Disabled for the policy.
• Description: Provides a short description for the policy.
• Manage: Allows you to edit or delete policies.
Add Web Filter Policy
Create a new Web Filter Policy.
On the Add Web Filter Policy page you can create a new Web Filter Policy.
1. Enter a Name for the policy.
2. Enter a brief Description for the policy you want to create.
3. Under Template you can select an existing template from the dropdown list.
This will populate categories from the existing template to help create a similar policy.
4. Select the Enable Reporting check box to include this policy in generated reports.
5. Set Download File Size Restriction to the maximum file size that can be downloaded for this policy. Leave this set at zero for no restriction.
6. Under YouTube Education Filter enter your school ID for YouTube for Schools.
Note:
If enabled, users trying to open a YouTube video are restricted to videos either belonging to the subsection YouTube EDU or uploaded by your school account.
Figure 419: Add Web Filter Policy
7. Click Add to configure categories associated with this Web Filter Policy.
a) Select a Category Type from the drop down list.
b) Click Add New Item and select categories you would like included.
c) Select Allow or Deny for both HTTP Action and HTTPS Action.
d) For Web Category and URL Group you can click Exception and configure File Type Category to be excluded from the policy.
e) Select an option from the Schedule drop down list.
f) Click Add.
Figure 420: Configure Web Filter Policy Category
| Objects | 542
| Objects | 543
8. Click Save.
Traffic Shaping
The Traffic Shaping page displays list of predefined and custom policies and provides option to create a new traffic shaping policy, schedule traffic shaping policy, update parameters or delete the policy.
Bandwidth is the amount of data passing through a media over a period of time and is measured in terms of kilobytes per second (KBps) or kilobits per second (kbits) (1 Byte = 8 bits). The primary objective of traffic shaping policy is to manage and distribute the total bandwidth on certain parameters and user attributes. Traffic shaping policy allocates & limits the maximum bandwidth usage of the user and controls the web and network traffic.
To configure traffic shaping policy:
• Define for whom you want to create policy
• Define policy type
• Define the implementation strategy of the policy
• Define bandwidth usage
Policy can be defined/created for:
• Users - It restricts the bandwidth of a particular user.
• Rules - It restricts the bandwidth for any entity to which the rule is applied.
• Web Categories - It restricts the bandwidth for the URL categorized under the Web Categories. To implement restriction, policy is to be assigned through Security Policies.
• Applications - It restricts the bandwidth for the application. To implement restriction, policy is to be assigned through Security Policies.
Types of policies
Two types of bandwidth restriction can be placed:
1. Limit - user cannot exceed the defined bandwidth limit.
2. Guarantee - user is allocated the guaranteed amount of bandwidth and can draw bandwidth up to the defined burst-able limit, if available.
It enables to assign fixed minimum and maximum amounts of bandwidth to the users. By borrowing the excess bandwidth when available, users are able to burst above guaranteed minimum limits, up to the burst-able rate.
Guaranteed rates also assure minimum bandwidth to critical users for receiving constant levels of bandwidth during peak and non-peak traffic periods.
Guaranteed represents the minimum guaranteed bandwidth and burst-able represents the maximum bandwidth that the user can use, if available.
Limit Upload/Download Seperately:
Policy can be implemented in two ways depending on the policy Type:
• Total (Upload + Download)
• Individual Upload and Individual Download
Limit Policy
In this type of bandwidth restriction, user cannot exceed the defined bandwidth limit. Two ways to implement strict policy:
• Total (Upload + Download)
• Individual Upload and Individual Download
Implementation Strategy
Total (Upload + Download)
Bandwidth specified
Total bandwidth
Example
Total bandwidth is 20 kbps upload and download combined cannot cross
20 kbps
| Objects | 544
Implementation Strategy
Individual (Upload / Download)
Bandwidth specified
Individual bandwidth i.e. separate for both
Example
Upload and Download bandwidth is
20 kbps then either cannot cross 20 kbps
Guarantee Policy
Implementation Strategy
Total (Upload + Download)
Individual (Upload / Download)
Bandwidth specified
Guaranteed bandwidth Burst-able bandwidth
Individual Guaranteed and Burstable bandwidth i.e. separate for both
Example
Guaranteed bandwidth is 20 kbps upload and download combined will get 20 kbps guaranteed (minimum) bandwidth. Burst-able bandwidth is 50 kbps upload and download combined can get up to 50 kbps of bandwidth (maximum), if available.
Individual guaranteed bandwidth is 20 kbps Individually get 20 kbps guaranteed (minimum) bandwidth.
Individual burstable bandwidth is
50 kbps Individually get maximum bandwidth up to 50 kbps, if available.
Bandwidth Usage Type
Policy can be configured for two types of bandwidth usage:
• Individual - Allocated bandwidth is for the particular User/Rule/Web Category/Application only.
• Shared - Allocated bandwidth is shared among all the Users/Rules/Web Categories/Applications who have been assigned this policy.
The device is shipped with predefined traffic shaping policies. These predefined policies are immediately available for use until configured otherwise. You can also define custom policies to meet your organization’s requirements.
Create a New Traffic Shaping Policy
Use the Add Traffic Shaping (QoS) Policy page to quickly configure a new traffic shaping policy.
The Add Traffic Shaping (QoS) Policy page allows you to manually enter details to create a traffic shaping policy.
1. Navigate to Objects > Policies > Traffic Shaping and click Add.
2. Enter Traffic Shaping Policy details.
Name
Enter a name to identify the Policy.
Policy Association
Select an option to specify for whom the policy is to be created.
Available Options:Users - Restricts the bandwidth for a particular user.Rules - Restricts the bandwidth of any entry to which Security Policies is applied.Web Categories - Restricts the bandwidth for the URL categorized under the Web category.Applications - Restricts the bandwidth for the applications categorized under the Application category.
Rule Type
Select the type of policy.
Available Options:Limit - In this type of policy, user cannot exceed the defined bandwidth limit.Guarantee-
In this type of policy, user is allocated the guaranteed amount of bandwidth and can draw bandwidth up to the defined Limit, if available.
| Objects | 545
It enables to assign fixed minimum and maximum amounts of bandwidth to the users. By borrowing excess bandwidth when available, users are able to burst above guaranteed minimum limits, up to the defined Limit.
Guaranteed rates also assure minimum bandwidth to critical users to receive constant levels of bandwidth during peak and non-peak traffic periods.
Guarantee represents the minimum guaranteed bandwidth and Limit represents the maximum bandwidth that the user can use, if available.
Limit Upload/Download Separately
Select from the available options.
Available Options:
Disable - Limits total (Upload + Download) bandwidth.
Enable - Limits Upload and Download bandwidth separately.
Priority
Set the bandwidth priority. Priority can be set from 0 (highest) to 7 (lowest) depending on the traffic required to be shaped.
0 - Real Time for example, VOIP 1 - Business Critical 2 to 5 - Normal 6 - Bulky - FTP 7 - Best Effort for
Example, P2P
By default, priority is given to the real time traffic. However, if administrator does not want this preference, feature can be disabled from System > System Services > Traffic Shaping Settings page.
If Optimize for Real-Time (VoIP), under System > System Services > Traffic Shaping Settings page is disabled then priority will be applicable only for excess bandwidth i.e. bandwidth remaining after guaranteed bandwidth allocation.
If Optimize for Real-Time (VoIP), under System > System Services > Traffic Shaping Settings page is enabled then Real-time traffic (Traffic Shaping policy with priority 0) like VOIP will be given precedence over all other traffic.
As priority is given to the real time traffic, it is possible that some non real-time traffic will not get their minimum guaranteed bandwidth. Specifically, if sum of Limit (max allowed) of all Traffic Shaping policies
(real-time and non real-time) is greater than total max-limit then guaranteed bandwidth of the real-time policies will be fulfilled but non real-time might not get the minimum guaranteed bandwidth.
Limit (in KBps) (Only if Policy Type is 'Limit' and Limit Upload/Download Separately is disabled)
Specify allowed total bandwidth.
Total Bandwidth Range: 2 – 2560000KBps
Limit bandwidth should be greater than or equal to guaranteed bandwidth.
Upload Bandwidth (in KBps) (Only if Policy Type is 'Limit' and Limit Upload/Download Separately is enabled)
Specify upload bandwidth.
Total Bandwidth Range: 2 – 2560000KBps
Download Bandwidth (in KBps) (Only if Policy Type is 'Limit' and Limit Upload/Download Separately is enabled)
Specify download bandwidth.
Total Bandwidth Range: 2 - 2560000KBps
Guarantee -Limit (in KBps) (Only if Policy Type is 'Guarantee' and Limit Upload/Download Separately is disabled)
Specify range for guaranteed bandwidth limit.
Total Bandwidth Range: 2 – 2560000KBps
Guarantee - Limit Upload (in KBps) (Only if Policy Type is 'Guarantee' and Limit Upload/Download
Separately is enabled)
Specify range for guaranteed upload bandwidth.
Total Bandwidth Range: 2 – 2560000KBps
Guarantee - Limit Download (in KBps) (Only if Policy Type is 'Guarantee' and Limit Upload/Download
Separately is enabled)
Specify range for guaranteed download bandwidth.
Total Bandwidth Range: 2 - 2560000KBps
Bandwidth Usage Type
Select the type of bandwidth usage.
Available Options:Individual - Allocated bandwidth is for the particular User/Rule/Web Category/
Application only.Shared - Allocated bandwidth is shared among all the Users/Rules/Web Categories/
Applications who have been assigned this policy.
Description
Provide description for the policy.
| Objects | 546
Figure 421: Add Traffic Shaping (QoS) Policy
3. Select Save.
Schedule Traffic Shaping Policy
Use the Add Traffic Shaping (QoS) Policy Detail page to schedule a traffic shaping policy.
The page allows you to add a schedule-wise traffic shaping policy to override default traffic shaping policy details.
1. Navigate to Objects > Policies > Traffic Shaping.
2.
Click on the Manage icon under the Manage column.
3. Click Add.
4. Enter Traffic Shaping Policy details.
Name
Displays policy name.
Rule Type
Displays default Policy Type set at the time of creation of policy, modify if required.
Note: Configured policy type will override the default policy and will be applicable only for the selected scheduled time interval.
Limit Upload/Download Separately
Displays default implementation strategy set at the time of creation of policy, modify if required.
Note: Configured policy type will override the default policy and will be applicable only for the selected scheduled time interval.
Limit (in KBps) (Only if Policy Type is 'Limit'and Limit Upload/Download Seperately is disabled)
Displays allocated Total bandwidth. Modify if required.
Note: The modified bandwidth restriction is applicable only for the selected time interval.
Upload Bandwidth (in KBps) (Only if Policy Type is 'Limit'and Limit Upload/Download Seprately is enabled)
Displays allocated Individual upload bandwidth. Modify if required.
Note: The modified bandwidth restriction is applicable only for the selected time interval.
Download Bandwidth (in KBps) (Only if Policy Type is 'Limit'and Limit Upload/Download Seprately is enabled)
Displays allocated Individual download bandwidth. Modify if required.
Note: The modified bandwidth restriction is applicable only for the selected time interval.
Guarantee -Limit (in KBps) (Only if Policy Type is 'Guarantee' and Limit Upload/Download Seprately is disabled)
Displays range for total guaranteed bandwidth. Modify if required.
Total Bandwidth Range: 2 – 2560000KBps
Guarantee - Limit Upload (in KBps) (Only if Policy Type is 'Guarantee' and Limit Upload/Download
Seprately is enabled)
Displays range for guaranteed upload bandwidth. Modify if required.
Total Bandwidth Range: 2 – 2560000KBps
Guarantee - Limit Download (in KBps) (Only if Policy Type is 'Guarantee' and Limit Upload/Download
Seprately is enabled)
Displays range for guaranteed download bandwidth. Modify if required.
Total Bandwidth Range: 2 - 2560000KBps
Schedule
Select Schedule from the available list during which the traffic shaping policy will be applied.
Only Recurring Schedule can be applied.
If you are not sure about the Schedule details, check
| Objects | 547
Figure 422: Add Traffic Shaping (QoS) Policy Detail
5. Click Save.
| Objects | 548
Web App Protection Policies
With Web App Protection Policies you can define the modes and levels of protection for your web servers.
Objects > Policy > Web App Protection or Protection > Web Server Protection > Web App Protection Policies
The page displays all existing web application protection objects. You can add new protocol security objects, edit or delete them. For each protection object, the list shows:
Name
Name of the web app protection object.
Manage
Displays the available management options:
• Edit Allows you to edit the web app protection object.
• Delete Allows you to delete the web app protection object.
To add or delete a web app protection object, click on the corresponding buttons.
Add Application Protection Policy
This page describes how to add a web app protection object.
1. Navigate to Objects > Policy > Web App Protection or Protection > Web Server Protection > Web App
Protection Policies and click Add.
2. Enter values for the following settings:
Name
Enter a descriptive name for the web app protection object.
Description
Enter a description or other information.
Pass Outlook Anywhere
Enable this to allow external Microsoft Outlook clients to access the Microsoft Exchange Server via theWeb
Application Protection. Microsoft Outlook traffic will not be checked or protected by the Web Application
Protection.
Mode
Select a mode from the drop-down list:
• Monitor: HTTP requests are monitored and logged.
• Reject: HTTP requests are rejected.
Cookie Signing
Enable this to protect a web server against manipulated cookies. When the web server sets a cookie, a second cookie is added to the first cookie containing a hash built of the primary cookie's name, its value and a secret, where the secret is only known by the Web Application Protection. Thus, if a request cannot provide a correct cookie pair, there has been some sort of manipulation and the cookie will be dropped.
Static URL Hardening
Enable this to protect against URL rewriting. For that, when a client requests a website, all static URLs of the website are signed. The signing uses a similar procedure as with cookie signing. Additionally the response from the web server is analyzed regarding what links can be validly requested next. Static Hardened URLs can furthermore be bookmarked and visited later.
Note: Static URL hardening affects all files with a HTTP content type of text/* or *xml*, where * is a wildcard. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the URL hardening feature. It does not work for dynamic URLs created by client, for example: JavaScript.
| Objects | 549
Note: You can find more information about Static URL Hardening and Form Hardening under:
Additional Information on Static URL Hardening and Form Hardening
on page 135
Entry URLs (only applicable if Static URL Hardening is enabled)
Add URL for static URL hardening:
Form Hardening
Enable this to protect against web form rewriting. Form hardening saves the original structure of a web form and signs it. Therefore, if the structure of a form has changed when it is submitted the Web Application
Protection rejects the request.
Note: Form hardening affects all files with a HTTP content type of text/* or *xml*, where * is a wildcard. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the form hardening feature.
Note: You can find more information about static URL hardening and form hardening under:
Additional Information on Static URL Hardening and Form Hardening
on page 135
Anti-Virus
Enable this to protect a web server against viruses.
Direction
Select from the drop-down list whter to scan only uploads or downloads or both.
• Uploads
• Downloads
• Uploads and Downloads
Block unscannable content
Enable this to block files that cannot be scanned. The reason for that may be, among other things, that files are encrypted or corrupt.
Limit scan size
Enable this to enter the scan size limit into an additional field. Provide the limitation in megabytes.
Note: Please note that the scan size limit refers to an upload, not to single files. This means, if you, for example, limit to 50 MB and make an upload with multiple files (45 MB, 5 MB and 10
MB), the last file will not be scanned and a virus cannot be detected caused by the limitation.
Note: If you do not enter a limitation value it will be saved with '0' megabytes, which means the limitation is not active.
Block clients with bad reputation
Enable this to block clients which have a bad reputation according to their classification, based on
GeoIPClosed and RBLClosed information. Sophos uses the following classification providers: RBL sources:
• Commtouch IP Reputation (ctipd.org)
• http.dnsbl.sorbs.net
The GeoIP source is Maxmind. The WAF blocks clients that belong to one of the following Maxmind categories:
• A1: Anonymous proxies or VPN services used by clients to hide their IP address or their original geographical location.
• A2: Satellite providers are ISPs that use satellites to provide Internet access to users all over the world, often from high risk countries.
Skip remote lookups for clients with bad reputation (only applicable if Block clients with bad reputation is enabled)
Enable to use GeoIP-based classification which uses cached information only and is therefore much faster.
As reputation lookups include sending requests to remote classification providers, using reputation-based blocking may slow down your system.
| Objects | 550
Common Threat Filter
Enable this to protect your web servers from several threats. You can specify the threat filter categories you want to use in the Threat Filter Categories section below. All requests will be checked against the rule sets of the selected categories. Depending on the results, a notice or a warning will be shown in the live log or the request will be blocked directly.
Rigid Filtering
Enable this to tighten several of the selected rules. This may lead to false positives.
Skip Filter Rules
Some of the selected threat categories may contain rules that lead to false positives. To avoid false positives induced by a specific rule, add the rule number that you want to skip this box.
Protocol Violations
Enforces adherence to the RFC standard specification of the HTTP protocol. Violating these standards usually indicates malicious intent.
Protocol Anomalies
Searches for common usage patterns. Lack of such patterns often indicates malicious requests. These patterns include, among other things, HTTP headers like 'Host' and 'User-Agent'.
Request Limits
Enforces reasonable limits on the amount and ranges of request arguments. Overloading request arguments is a typical attack vector.
HTTP Policy
Narrows down the allowed usage of the HTTP protocol. Web browsers typically use only a limited subset of all possible HTTP options. Disallowing the rarely-used options protects against attackers aiming at these often less well-supported options.
Bad Robots
Checks for usage patterns characteristic of bots and crawlers. By denying them access, possible vulnerabilities on your web servers are less likely to be discovered.
Generic Attacks
Searches for attempted command executions common to most attacks. After having breached a webserver, an attacker usually tries to execute commands on the server like expanding privileges or manipulating data stores. By searching for these post-breach execution attempts, attacks can be detected that might otherwise have gone unnoticed, for example because they targeted a vulnerable service by the means of legitimate access.
SQL Injection Attacks
Checks for embedded SQL commands and escape characters in request arguments. Most attacks on web servers target input fields that can be used to direct embedded SQL commands to the database.
XSS Attacks
Checks for embedded script tags and code in request arguments. Typical cross-site scripting attacks aim at injecting script code into input fields on a target web server, often in a legitimate way.
Tight Security
Performs tight security checks on requests, like checking for prohibited path traversal attempts.
Trojans
Checks for usage patterns characteristic of trojans, thus searching for requests indicating trojan activity. It does not, however, prevent the installation of such trojans as this is covered by the antivirus scanners.
Outbound
Prevents web servers from leaking information to the client. This includes, among other things, error messages sent by servers which attackers can use to gather sensitive information or detect specific vulnerabilities.
| Objects | 551
Figure 423: Add Application Protection Policy
3. Click Save.
The web app protection object is created and appears in the Web App Protection page.
Additional Information on Static URL Hardening and Form Hardening
It is best practice always to enable both URL hardening and form hardening. These two functions are complementary, especially in the way that they prevent the issues you may have if you enable just one of them:
• Only form hardening is activated: When a webpage contains hyperlinks with appended queries (which is the case with certain CMSs), e.g. http://example.com/?view=article&id=1, such page requests are blocked by form hardening because it expects a signature, which is missing.
• Only URL hardening is activated: When a web browser appends form data to the action URL of the form tag of a web form (which is the case with GET requests), the form data becomes part of the request URL sent to the web server, thereby rendering the URL signature invalid.
Activating both functions solves those issues because if either form hardening or URL hardening find that a request is valid, the Web Application Protection accepts the request.
Web App Authentication Policies
You can use the Web Application Firewall (WAF) to authenticate users directly instead of leaving the authentication to the real web servers. Via authentication profiles, the reverse authentication can be used to assign specific authentication settings to each site path route.
Protection > Web Server Protection > Web App Authentication Policies or Objects > Policies > Web App
Authentication
Note: You can also view and manage the WAF status on the System > Diagnostics > Services page.
The page displays all existing web application authentication profiles. You can add, edit or delete application authentication profiles. For each authentication profile, the list shows:
Name
| Objects | 552
Name of the web app authentication profile.
Manage
Displays the available management options:
• Edit Allows you to edit the web app authentication profile.
• Delete Allows you to delete the web app authentication profile.
To add or delete a web app authentication profile, click on the corresponding buttons.
Add Web App Authentication Policies
This page describes how to add a web app authentication profile.
1. Navigate to Protection > Web Server Protection > Web App Authentication Policies or Objects > Policies >
Web App Authentication Policies and click Add.
2. Enter values for the following settings:
Name
Enter a descriptive name for the web app authentication profile.
Description
Enter a description or other information.
3. Enter the settings for the Client Authentication.
Mode
Select how the users should authenticate at the Web Application Firewall.
• Basic: Users authenticate with HTTP basic authentication, entering username and password. As the credentials are sent unencrypted with this mode, it should be used over HTTPS. In this mode, no session cookies will be generated and a dedicated logout is not possible.
• Form: Users will be presented with a form where they have to enter their credentials. In this mode, session cookies will be generated and a dedicated logout is possible. The form template to be used can be selected in the Web App Auth Template list. Besides the default form template, the list shows the forms
page
Basic Prompt
(only with Basic mode)
The realm is a unique string that provides additional information on the login page and is used for user orientation.
Note: These characters are allowed for the Basic Prompt: A-Z a-z 0-9 , ; . : - _ ' + = ) ( & % $ ! ^ <
> | @
Web App Auth Template
(only with Form mode)
Select the form template that will be presented to the users for authentication. Form templates are defined on
page.
Users or Groups
Select the users or user groups that should be assigned to this web app authentication profile or create a new one. After assigning this profile to a site path route, these users will have access to the site path with the authentication settings defined in this profile. Typically, this would be a backend user group.
You can create a new user directly on this page or on the System > Authentication > Users or Objects >
Identity > Users page.
You can create a new group directly on this page or on the System > Authentication > Groups or Objects >
Identity > Groups page.
| Objects | 553
Note: Sometimes users should be required to use the user principal name notation 'user@domain' when entering their credentials, for example when using Exchange servers in combination with
Active Directory servers.
4. Enter the settings for the Authentication Forwarding.
Mode
Select how the Web Application Firewall authenticates against the web servers. The mode has to match the web servers' authentication settings.
• Basic: Authentication works with HTTP basic authentication, providing username and password.
• None: There is no authentication between WAF and the web servers. Note that even if your web servers do not support authentication, users will be authenticated via the frontend mode.
Username affix
(only with Basic Authentication Forwarding mode)
Select an affix for the username and enter it into the concerning field. Affixes are useful when working with domains and email addresses.
• None
• Prefix
• Suffix
• Prefix & Suffix
Note: Prefix and suffix will be added automatically if the user enters their username. Prefix and suffix will not be added if the user enters it. Example: If the suffix is @testdomain.de and the user enters their username test.user the suffix will be added. If they enter [email protected] the suffix will be ignored.
Remove Basic Header
(only with None Authentication Forwarding)
Enable this if you do not want to send the basic header from Sophos Firewall OS to the web server.
5. Enter the settings for the User Session.
Session Timeout
Enable this to set a timeout for the user session, which will confirm the user's credentials by having them log in again if they do not perform any action. Default - ON
Limit to
(only if Session Timeout is enabled)
Set an interval for the session timeout. Default is 5 minutes.
Session Lifetime
Enable this to set a hard limit for how long users may remain logged in, regardless of activity in the meantime.
Default - ON
Limit to
(only if Session Lifetime is enabled)
Set a value for the session lifetime. Default is 8 hours.
| Objects | 554
Figure 424: Add Web App Authentication Policy
6. Click Save.
The Web App Authentication profile is created and appears in the Web App Authentication Policies list.
Device Access Profile
Objects > Policies > Device Access Profile
Role-based administration capabilities are provided to offer greater granular access control and flexibility.
It allows an organization to separate super administrator's capabilities and assign through Profiles. Profiles are a function of an organization's security needs and can be set up for special-purpose administrators in areas such as policy administration, network administration, and logs administration. Profiles allow granting permissions to individual administrators depending on their role or job need in the organization.
The profile separates device features into access control categories for which you can enable none, read only, or readwrite access.
The Profiles list shows the default and custom profiles you have created and enables you to add, edit, and delete the profiles.
For ease of use, by default the device provides 5 profiles:
• Administrator – super administrator with full privileges
• Audit Admin – read-write privileges for Logs & Reports only
• Crypto Admin – read-write privileges for Certificate configuration only
• HA Profile – read-only privileges. If HA is configured, any user accessing Web Admin Console of Auxiliary device will have privileges as defined in HA Profile.
• Security Admin – read-write privileges for all features except Profiles and Log & Reports
An Administrator with full privileges can create other custom administrators and assign them restricted/full privileges.
A custom administrator so created, if has restricted privileges, can only update their Email Address and password.
Note:
• You cannot delete the default profiles.
| Objects | 555
• You cannot delete the profile which is already assigned to administrator.
Access Denied page
Device provides role-based administration capabilities and privileges are assigned to the Administrator through
Profiles. Administrator can have read only, read-write or no access privilege for the pages of Web Admin Console.
Access denied page is displayed when the Administrator tries to access a page or perform the operation, which is not allowed to him/her.
Add a new Profile
The Add Profile page allows you to add administrator profiles.
1. Navigate to Objects > Policies > Device Access Profile and click Add.
2. Enter Profile details.
Profile Name
Specify a name to identify the profile.
Configuration
Click on the access level you want to provide to a profile. There are three levels of access each of the created profile can have.
Available Options:
None: No access to any page Read-Only: View the pages Read-Write:Modify the details
Access levels can be set for individual menus as well. You can either set a common access level for all the menus or individually select the access level for each of the menu.
Click icon against a menu to view the items under that menu.
For example, if you set access level as Read-Only against the Web Filter, the profile user would only be able to view the Web Filter menu but would not be able to make any modifications. To make modifications, Read-
Write option is to be used.
Figure 425: Add Profile
Traffic Shaping Defaults
Use the Traffic Shaping Defaults page to view the list of all the Application categories. This page also provides an option to edit the category or application to apply the traffic shaping policy.
| Objects | 556
| Objects | 557
The applications shipped with the device are grouped into categories. These categories can be used in filtering policy and bandwidth restriction can be applied. Bandwidth restriction can be applied to the category or to the individual application within the category.
The categories list can be filtered based on name of the category. Use the or toggle beside the category name to expand and collapse the list of applications grouped in the respective category.
Configure Traffic Shaping Policy for Category or Application
Use this page to configure traffic shaping policy.
This page allows you to configure traffic shaping policy for category or application.
1. to Protection > Application Protection > Traffic Shaping Default or Objects > Policies > Global Application
Traffic Shaping and click on
.
2. Enter the details.
Name
Name of the Application Filter Category or Application.
Traffic Shaping Policy
Click ‘Create New’ to create a new traffic shaping policy for the application/application category.
Traffic Shaping policy allocates and limits the bandwidth usage of the user, web category, application category.
3. Click Save.
Application Filter
The Application Filter page displays a list of all the predefined and custom policies.
An Application Filter Policy controls a user’s application access. It specifies which user has access to which applications and allows you to define powerful security policies based on almost limitless policy parameters like:
• Individual users
• Groups of users
• Time of day
The device is shipped with the following predefined policies for application filters:
• Allow: By default, allows access for all the groups except the specified groups. Access for the specified groups depends on the strategy defined for each group.
• Deny: By default, denies access for all the groups except the specified group. Access for the specified groups depends on the strategy defined for each group.
These two predefined policies are immediately available for use until configured otherwise. You can also define custom policies to specify different levels of access for different users to meet your organization’s requirements.
The page also provides options to add a new policy, update the parameters of an exisiting policy, delete a policy, add a filtering rule to a policy, or delete a filtering rule attached to a policy.
Add Application Filter Policy
This page lets you configure custom policies to define different levels of access for different users to meet your organization’s requirements.
The Add page allows you to manually configure policies.
1. Navigate to Protection > Application Protection > Application Filter or Objects > Policies > Application
Filter and click Add.
2. Enter the Application Filter Policy details.
Name
Enter a name to identify the Application Filter Policy.
Description
Enter description for the Application Filter Policy.
Enable Micro App Discovery
Enable to scan and classify microapps using HTTP protocol for communication. Microapps are applications that are used withing web browsers.
To allow/deny microapps, you need to specify action accordingly.
Refer Appendix D - Supported Micro-Apps for more details on supported applications.
Template
Select template for the Application Filter Policy.
| Objects | 558
Figure 426: Application Filter
3. Click Save.
4. Once the policy is added, next step is to add a rule for configuring filtering criteria.
Note:
• Rules can be added for custom policies only.
• If Micro App Discovery is enabled, one has to import SSL CA to avoid Certificate error.
Add Rule for Application Filter Policy
Use the Add New Rule page to configure a new rule for Application Filter Policy.
The Add New Rule page allows you to manually configure a new rule.
1. Navigate to Protection > Application Protection > Application Filter or Objects > Policies > Application
Filter and click .
2. Click Add under Application Filter Policy.
3. Enter the application filter details.
Category
Select Application Category from the list of available categories.
Risk
Select the level of risk from the available options.Select All1 - VERY LOW 2 - LOW3 - MEDIUM 4 -
HIGH5 - VERY HIGH
Characteristics
Select the characteristics from the available options.Select AllExcessive BandwidthProne to misuseTransfer filesTunnels other appsVulnerabilities Widely usedLoss of productivityCan bypass firewall policy
Technology
Select the technology from the available options.Select AllBrowser BasedClient ServerNetwork ProtocolP2P
| Objects | 559
Figure 427: Application Filter Criteria
4. Enter the list of matching applications.
Select All
Click to select all the Applications from the list.
Applications are available based on the Application Filter Criteria.
Select Individual Application
Click to select the Applications from the list.
Applications are available based on the Application Filter Criteria.
Search
Specify the name of the application in the textbox to be searched.
This option is available, only if option "Select Individual Application" is selected.
Name
Displays name of the Applications under the Category selected. You can also select more than one application using the checkbox.
Description
Displays description of the Application.
Category
Displays category of the Application.
Risk
Displays the risk factor involved with the Application.
Characteristics
Displays the characteristics of the Application.
Technology
Displays the technology utilized for the Application.
Figure 428: List of Matching Applications
5. Enter the action you want to perform.
Action
Select an Action for the Policy from the available options. Allow Deny
Schedule
Select schedule from the list available in the dropdown list.
Figure 429:
6. Click Save.
Hotspot Voucher Definition
On this page you can manage different voucher definitions for voucher type Hotspots.
Objects > Policies > Hotspot Voucher Definition
The page displays all existing voucher definitions. You can add new voucher definitions, update or delete them. For each voucher definition, the lis shows:
Name
Name of the voucher definition.
Manage
Displays the available management options:
• Edit: Allows you to edit the voucher definition.
• Delete: Allows you to delete the voucher definition.
To add or delete a voucher definition, click on the corresponding buttons.
| Objects | 560
| Objects | 561
Add Hotspot Voucher
This page describes how to add a voucher definition.
1. Navigate to Objects > Policies > Hotspot Voucher Definition and click Add.
2. Enter the following settings:
Name
Enter a descriptive name for the voucher definition.
Description
Enter a description or other information.
Validity Period
Enter the time span for which a voucher with this definition will be valid. Counting starts at the first login. We strongly recommend that you enter a time period.
Note: The maximum time for the Validity Period is two years.
Time Quota
Here you can restrict the allowed online time. Enter the maximum online time after which a voucher of this definition expires. Counting starts at login and stops at logout. Additionally, counting stops after 5 minutes of inactivity.
Note: The maximum time for the Time Quota is two years.
Data Volume
Here you can restrict the allowed data volume. Enter the maximum data volume to be transmitted with this voucher definition.
Note: The maximum data volume is 100 GB.
Figure 430: Add Hotspot Voucher
3. Click OK.
The voucher definition is now available and appears on the voucher list.
Hosts and Services
Objects > Hosts and Services
Hosts and Services allows defining and managing system hosts and services.
This section covers the following topics:
•
host, update the existing host, or delete a host.
| Objects | 562
•
- Host Group is a grouping of hosts. Security Policies can be created for the individual host or host groups. This page displays the list of all the host groups. It also provides options to manage these host groups.
•
- Device allows creating a host based on MAC Address. One can create a MAC Host of either a single
MAC Address or multiple MAC Addresses. This page displays the list of all the available MAC host. The page also provides option to add a new MAC host, update the existing host, or delete a host.
•
- This page displays the list of all the available FQDN host.
•
- FQDN Host Group is a grouping of FQDN hosts. This page displays the list of all the
available FQDN host groups.
•
- The device allows to create Country based Host. With Country based Host one can apply all
Security and UTM Policies based on the traffic coming from the country and/or going out of the country. This page displays the list of all the available Country hosts.
•
- Country Host Group is a grouping of Country Hosts. Multiple countries can be selected to block or allow incoming traffic by using Country Host Group. This page displays the list of all the available
Country host groups.
•
displays the list of all the default and custom services. It also provides options to manage services.
•
- Service Group is a grouping of services. Custom and default services can be grouped in a single group. The page displays the list of all the default and custom groups.
IP Host
The IP Host page displays the list of all the dynamic hosts, default hosts and manually added hosts.
Hosts allow the entities to be defined once and be re-used in multiple referential instances throughout the configuration. For example, consider an internal Mail Server with an IP Address 192.168.1.15. Rather than repeated use of the IP Address while configuring Security Policies or NAT Policies, it allows to create a single entity Internal
Mail Server as a Host name with an IP Address 192.168.1.15. This host, Internal Mail Server can then be selected in any configuration that uses Host as a defining criterion.
By using host name instead of numerical address, you only need to make changes in a single location, rather than in each configuration where the IP Address appears.
Using Hosts, reduces the error of entering incorrect IP Addresses, makes it easier to change IP Addresses, and increases readability.
The IP Host page displays the list of all the dynamic hosts which are automatically added on creation of VPN
Remote access connections (IPsec and SSL) and the default hosts (IPv6 and IPv4) for remote access connection -
##ALL_RW, ##WWAN1, ##ALL_IPSEC_RW and ##ALL_SSLVPN_RW along the manually added hosts. The page also provides option to add a new host, update the existing host, or delete a host.
Note:
• System hosts cannot be updated or deleted.
• Dynamic hosts which are automatically added on creation of VPN Remote Access connections cannot be deleted.
• Default hosts (IPv6 and IPv4) for remote access connection - ##ALL_RW, ##WWAN1,
##ALL_IPSEC_RW and ##ALL_SSLVPN_RW cannot be updated or deleted.
Adding a IP Host
The Add IP Host page allows you to manually add an IP host.
1. Navigate to Objects > Hosts and Services > IP Host and click Add.
2. Enter IP host details.
Name
Enter a name to identify the IP host.
IP Family
Select the type of IP family from the options available:
Available Options:
• IPv4
• IPv6
Type
Select the type of host.
Available Options:
• IP: single IP address
• Network: Network IP with subnet
• IP Range
• IP List: To add assorted IP addresses.
IP Address
Specify an IPv4 address or IPv6 address based on the Type of host selected.
List of IP Addresses (only applicable if IP List is selected)
Use a comma to specify assorted multiple IP addresses. Create an IP list to configure a single policy for multiple IP addresses which are not in a range.
Note: Only Class B IP addresses can be added in an IP list. IP addresses can be added or removed from the IP list.
IP Host Group (applicable for host types IP, Network, and IP Range)
Select a host group or add a new one. You can add a host group on this page or on the Objects > Hosts and
Services > IP Host Group page.
Note: A single host can be member of multiple host groups. A group with IPv4 and IPv6 hosts cannot be created.
| Objects | 563
Figure 431: Add IP Host
3. Click Save
The IP host has been created and appears on the IP Host page.
IP Host Group
The IP Host Group page displays the list of all the host groups.
Host Group is a grouping on hosts. Security policies can be created for the individual host or host groups.
Note: Dynamic host groups which are automatically added on creation of VPN Remote Access Connections cannot be deleted.
The page also provides option to add a new host group, update the parameters of the existing host group, add members to the existing host group, or delete a host group.
Adding a IP Host Group
Use the Add IP Host Group page to create a new host group.
The Add IP Host Group page allows you to configure an IP host group.
1. Navigate to Objects > Hosts and Services > IP Host Group and click Add.
2. Enter IP host group details.
Name
Enter a name to identify the IP host group.
Description
Enter a description for the IP host group.
IP Family
Select the type of IP family from the options available:
Available Options:
• IPv4
• IPv6
Select Host
The host list displays all the hosts including default hosts. Click the corresponding checkbox(es) to select the host(s). A single host can be a member of multiple host groups. A group with IPv4 and IPv6 hosts cannot be created.
| Objects | 564
Figure 432: Add IP Host Group
3. Click Save.
The IP host group has been created and appears on the IP Host Group page.
MAC Host
The MAC Host page displays the list of all the available MAC hosts.
Device allows to create a host based on MAC Address. One can create a MAC Host of either a single MAC Address or multiple MAC Addresses.
MAC Hosts allow entities to be defined once and be re-used in multiple referential instances throughout the configuration. For example, test has a MAC Address as 00:16:76:49:33:CE or 00-16-76-49-33-CE. Rather than
| Objects | 565 remembering the MAC Address of the intended machine while applying policies, you can simply provide its MAC
Host name.
By using MAC hosts, you only need to make changes in a single location, rather than in each configuration where the
MAC Address appears.
Using MAC Hosts reduces the error of entering incorrect MAC Addresses, makes it easier to change addresses, and increases readability.
The page also provides option to add a new MAC host, update the existing host, or delete a host.
Adding a MAC Host
Use the Add MAC Host page to create a MAC Host.
The Add MAC Host page allows you to manually create a MAC Host of either a single MAC Address or multiple
MAC Addresses.
1. Navigate to Objects > Hosts and Services > MAC Host and click Add.
2. Enter MAC Host details.
Name
Enter a name to identify a MAC Host.
Type
Select the MAC Host Type.
Available Options:MAC Address - Select to add a single MAC Address.MAC List - Select to add multiple
MAC Addresses.
MAC Address (Applicable only if Type is selected as MAC Address)
Specify MAC Address based on the Host Type selected in the form of 00:16:76:49:33:CE or 00-16-76-49-33-
CE.
List of MAC Addresses (Applicable only if Type is selected as MAC List)
Specify MAC Address based on the Host Type selected in the form of 00:16:76:49:33:CE or 00-16-76-49-33-
CE.
Use comma to configure multiple MAC Addresses.
Figure 433: Add MAC Host
3. Click Save.
FQDN Host
The FQDN Host page displays the list of all the available FQDN host.
FQDN (Fully Qualified Domain Name) Hosts allow entities to be defined once and be re-used in multiple referential instances throughout the configuration. For example,
www.example.com
has an IP Address as 192.168.1.15.
Rather than remembering the IP Address of the intended website while accessing it, you can simply provide
www.example.com
in the browser. The FQDN
www.example.com
will now be mapped to its respective IP Address, and the intended webpage opens.
The page also provides option to add a new FQDN host, update the existing host, or delete a host.
Adding a FQDN Host
Use the Add FQDN Host page to create a new FQDN host.
The Add FQDN Host page allows you to manually configure a new FQDN host.
1. Navigate to Objects > Hosts and Services > FQDN Host and click Add.
2. Enter FQDN host details.
Name
Specify a name to identify the FQDN host.
FQDN
Specify a FQDN address.
FQDN Host Group
Select a FQDN host group or add a new one. A single FQDN host can be member of multiple host groups.
You can add a new FQDN host group on this page or on the Objects > Hosts and Services > FQDN Host
Group page.
| Objects | 566
Figure 434: Add FQDN Host
3. Click Save.
The FQDN host has been created and appears on the FQDN Host page.
FQDN Host Group
The FQDN Host Group page displays the list of all the available FQDN host groups.
FQDN Host Group is a grouping of FQDN hosts. Security Policies can be created for the individual FQDN host or host group to allow or deny access to any website.
The page also provides option to add a new FQDN host group, update the parameters of the existing host group, add members to the existing host group, or delete a group.
Adding a FQDN Host Group
Use the Add FQDN Host Group page to create a new FQDN host group.
The Add FQDN Host Group page allows you to configure a new FQDN host group.
1. Navigate to Objects > Hosts and Services > FQDN Host Group and select Add.
2. Enter FQDN host group details.
Name
Enter a name to identify the FQDN host group.
Description
Enter a description for the FQDN host group.
Select Host
The host list displays all the hosts including default hosts. Click the corresponding checkbox(es) to select the host(s). A single host can be a member of multiple host groups.
Figure 435: Add FQDN Host Group
3. Click Save.
The FQDN host group has been created and appears on the FQDN Host Group page.
Country Host
The Country Host page displays the list of all the available Country hosts.
The device allows to create Country based Host. With Country based Host one can apply all Security and UTM
Policies based on the traffic coming from the country and/or going out of the country.
Country Hosts created once can be re-used in multiple referential instances throughout the configuration. For example, you want to deny incoming traffic from country “X”. You can select the country “X” and select the option to block the traffic coming from “X”.
Adding a Country Host
Use the Add Country Host page to create country based host.
The Add Country Host page allows you to manually enter details to add a country based host.
1. Navigate to Objects > Hosts and Services > Country Host and click Add.
2. Enter details.
Name
Enter a name to identify the Country Host.
Country
Select the Country.
Country Host Group
Select Country Host Group. Single host can be member of multiple host groups.
You can add a new Country Host Group from this page itself or from Objects > Hosts and Services >
Country Host Group page.
| Objects | 567
| Objects | 568
Figure 436: Add Country Host
3. Click Save.
Country Host Group
The Country Host Group page displays the list of all the available Country host groups.
Country Host Group is a grouping of Country Hosts. Multiple countries can be selected to deny or allow incoming traffic by using Country Host Group. Security Policies can be created for an individual Country Host or Country Host
Groups.
The page also provides option to add a new host group, update the parameters of the existing host group, add members to the existing host group, or delete a group.
Adding a Country Host Group
Use the Add Country Host Group page to create a new country host group.
The Add Country Host Group page allows you to manually configure parameters to add a new country host group.
1. Navigate to Objects > Hosts and Services > Country Host Group and click Add.
2. Enter Country Host Group details.
Name
Enter a name to identify the Country Host group.
Description
Country Host Group description.
Select Host
"Host" List displays all the hosts including default hosts.
Click the checkbox to select the hosts. All the selected hosts are moved to 'Selected host' list.
Single host can be a member of multiple host groups.
| Objects | 569
Figure 437: Add Country Host Group
3. Click Save.
Services
The Services page displays the list of all the default and custom services.
Services are definitions of certain types of network traffic and combine information about a protocol such as TCP,
ICMP or UDP as well as protocol-related options such as port numbers. You can use services to determine the types of traffic allowed or denied by the firewall.
Certain well-known traffic types have been predefined in services. These predefined services are defaults, and cannot be updated or deleted. If you require service definitions that are different from the predefined services, you can add them as custom services.
The page also provides option to add a new service, update the parameters of the existing service, or delete a service.
Note:
• Service used by Security Policies cannot be deleted.
• Default Services can neither be updated nor deleted.
Adding a New Service
Use the Add Service page to add a new Service.
The Add Service page allows you to manually configure parameters to add a new Service.
1. Navigate to Objects > Hosts and Services > Services and click Add.
2. Enter Service parameters.
Name
Enter a name to identify the Service.
Type
Select a protocol for the service.
Available Options:TCP/UDP - Enter Source and Destination port. You can enter multiple ports for the same service. IP - Select Protocol Number for the Service. You can select multiple ports for the same service.
ICMP - Select ICMP Type and Code. You can enter multiple types and codes for the same service. Use Add icon and Remove icon to add and delete the parameters respectively. ICMPv6 - Select ICMPv6 Type and Code. You can enter multiple types and codes for the same service.
Use Add and Remove to add and delete the parameters.
| Objects | 570
Figure 438: Add Service
3. Click Save.
Service Group
The Service Group page displays the list of all the default and custom service groups.
Service Group is a grouping of services. Custom and default services can be grouped in a single group.
Use to configure Security Policies to:
• block group of services for specific zone
• limit some or all users from accessing group of services
• allow only specific user to communicate using group of service
Create groups of services and then add one firewall to allow or block access for all the services in the group. A service group can contain default services as well as custom services in any combination. A single service can be a member of multiple service groups.
The page also provides option to add a new group, update the parameters of the existing group, add members to the existing group, or delete a group.
Note:
• Default Service Groups can neither be updated nor deleted.
• Service Group used by the Security Policies cannot be deleted.
Adding a Service Group
Use the Add Service Group page to add a new customized Service Group.
The Add Service Group page allows you to manually enter details and configure a new service group.
1. Navigate to Objects > Hosts and Services > Service Group and click Add.
2. Enter Service Group details.
Name
Enter a name to identify the Service Group.
Description
Service Group Description.
Select Service
Service List displays all the services including default services.
Click the checkbox to select the service. All the selected services are moved to the Selected Service list.
Single service can be a member of multiple groups.
Use Search to search a service from the list.
You can create a group containing IPv4 and IPv6 services.
Figure 439: Add Service Group
3. Click Save.
| Objects | 571
| Appendix A - Logs | 572
Appendix A - Logs
Device provides extensive logging capabilities for traffic, system, and network protection functions. Detailed log information and reports provide historical as well as current analysis of network activity to help identify security issues and reduce network misuse and abuse.
Device provides following logs:
• System Logs
• Web Filter Logs
• Application Filter Logs
• Malware Logs
• Email Logs
• Security Policy Logs
• IPS Logs
• Authentication Logs
• Admin Logs
• WAF Logs
• Advanced Threat Protection Logs
• Heartbeat Logs
Log ID Structure
Log is identified by Log ID. Log ID is a unique 12 characters code c1c2c3c4c5c6c7c8c9c10c11c12
Where: c1c2 - Log Type ID c3c4 - Log Component ID c5c6 - Log Sub Type ID c7 - Priority c8c9c10c11c12 - Message ID
Considering the example above, the Log ID is 010101600001.
c1c2 – 01 c3c4 – 01 c5c6 – 01 c7 6 c8c9c10c11c12 - 00001
Hence, from the Log ID, we derive:
Log Type (01) = Firewall
Log Component (01) = Firewall Rule
Log Sub Type (01) = Allowed
Priority (6) = Information
| Appendix A - Logs | 573
Message (00001) = Firewall Traffic Allowed (to be seen under appropriate type of logs. Here, since Log Type is
Firewall, Message is found under Firewall Logs)
Log Type
Log Type ID identifies the type of log.
Type ID
05
06
07
08
01
02
03
04
09
10
11
12
Log Type
Security Policy
IPS
Anti Virus
Anti Spam
Content Filtering
Event
WAF
ATP
EATP
Wireless Protection
HeartBeat
System Health
Log Component
Log Component ID identifies the component of the log.
Comp ID
13
14
15
16
09
10
11
12
05
06
07
08
01
02
03
04
Component
Firewall Rule
Invalid Traffic
Appliance Access
DoS Attacks
ICMP Redirection
Source Routed
Anomaly
Signatures
HTTP
FTP
SMTP
POP3
IMAP4
Fragmented Traffic
Invalid Fragmented Traffic
HA
Comp ID
45
46
47
48
41
42
43
44
49
50
51
52
37
38
39
40
33
34
35
36
29
30
31
32
25
26
27
28
21
22
23
24
17
18
19
20
Component
CLI
LCD
CCC
IM
Foreign Host
IPMAC Filter
IP Spoof
GUI
IPSec
L2TP
PPTP
SSL VPN
Firewall Authentication
VPN Authentication
SSL VPN Authentication
My AccountAuthentication
Appliance
DHCP Server
Interface
Gateway
DDNS
WebCat
IPS
AV
Dial-In Authentication
Dial-In
Quarantine
Application Filter
Landing Page
WLAN
ARP Flood
HTTPS
Guest User
WAF
Virtual Host
CTA
| Appendix A - Logs | 574
Comp ID
73
74
75
76
69
70
71
72
77
78
79
65
66
67
68
61
62
63
64
57
58
59
60
53
54
55
56
Log Subtype
Log Subtype ID
01
02
03
04
05
06
Component
NTLM
Appliances Deactivated
PPPoE
External Authentication
API
ICAP
SMTPS
Wireless Controller
POPS
IMAPS
Firewall
DNS
Web Proxy
Heartbeat
End Point
RED
ATP
SSLVPN Client
IPSEC client
Authentication client
RED Firmware
AP Firmware up2date
CPU
Memory
Disk
Live User
Sub type
Allowed
Denied
Detect
Drop
Clean
Virus
| Appendix A - Logs | 575
Priority
Priority
6
7
4
5
2
3
0
1
Log Subtype ID
19
20
21
22
15
16
17
18
23
24
25
26
11
12
13
14
07
08
09
10
Common Fields for all Logs
Data Fields
date
Type
date
Sub type
Spam
Probable Spam
Admin
Authentication
System
OB Clean
OB Spam
OB Probable Spam
No Modification
Modified Headers
Modified Body
4xx Error
5xx Error
Alert
DLP
SPX
DOS
Override
Information
Usage
Description
Emergency
Alert
Critical
Error
Warning
Notification
Information
Debug
Description
Date (yyyy-mm-dd) when the event occurred
| Appendix A - Logs | 576
Data Fields
time timezone device_name device_id deployment_mode log_id
Type
time string string string string log_type log_component log_subtype priority
Admin Logs
string string string string
| Appendix A - Logs | 577
Description
Time (hh:mm:ss) when the event occurred
Time zone set on the appliance e.g. IST
Model Number of the Device
Unique Identifier of the Device
Mode in which appliance is deployed Possible values: Route,
Bridge
Unique 12 characters code (c1c2c3c4c5c6c7c8c9c10c11) e.g.
0101011, 0102011 c1c2 - Log Type e.g. 01 for firewall log c3c4 - Log Component i.e. firewall/local ACL/ DoS Attack etc.
c5c6 - Log Sub Type i.e. allow/violation c7 - Priority e.g. 0 for
Emergency C8c9c10c11 - Message ID e.g. 00001 for traffic allowed by firewall
Type of event e.g. firewall event
Component responsible for logging e.g. Firewall rule
Sub type of event
Severity level of traffic
| Appendix A - Logs | 578 priority=Information user_name=""admin"" src_ip=10.20.20.15 message=""Log Settings were changed by 'admin' from '10.20.20.15' using 'GUI'""
6/12/2015 1:47 PM,Info,10.20.22.173,timezone=""IST"" device_name=""SG135"" device_id=SFDemo1234567890 log_id=062009617503 log_type=""Event"" log_component=""GUI"" log_subtype=""Admin"" status=""Successful"" priority=Information user_name=""admin"" src_ip=10.20.20.15 message=""SSL VPN Policy(ies) were deleted by
'admin' from '10.20.20.15' using 'GUI'""
6/12/2015 1:44 PM,Info,10.20.22.173,timezone=""IST"" device_name=""SG135"" device_id=SFDemo1234567890 log_id=062009617504 log_type=""Event"" log_component=""GUI"" log_subtype=""Admin"" status=""Successful"" priority=Information user_name=""admin"" src_ip=10.20.20.15 message=""40 users were imported by 'admin' from
'10.20.20.15' using 'GUI' successfully""
Security Policy Logs
Message ID
03001
04001
05001
05051
05101
05151
05201
05301
05401
00001
00002
00003
01001
01301
01601
02001
02002
Message
Firewall Traffic Allowed
Firewall Traffic Denied
Firewall traffic Drop by Galileo Heartbeat
Invalid traffic dropped
Fragmented traffic denied
Invalid fragmented traffic denied
Local ACL traffic allowed
Local ACL traffic denied
DoS attack dropped
ICMP Redirected packet dropped
Source Routed packet dropped
Foreign Host denied
IPMAC pair denied
IP Spoof denied
SSL VPN Resource Access Denied
ARP Flood traffic denied
Traffic for Virtual Host <virtualhostname> is denied, No
Internal server is available to process the traffic.
Sample Logs:
6/9/2015 1:29 PM,Info,10.20.22.172,timezone=""IST"" device_name=""SG135"" device_id=SFDemo1234567890 log_id=010302602002 log_type=""Security Policy"" log_component=""Appliance Access"" log_subtype=""Denied"" status=""Deny"" priority=Information duration=0 fw_rule_id=0 policy_type=0 user_name="""" user_gp="""" iap=0 ips_policy_id=0 appfilter_policy_id=0 application="""" application_risk=0 application_technology="""" application_category="""" in_interface=""eth0"" out_interface="""" src_mac=00:90:fb:37:6e:0e src_ip=10.20.21.89
src_country_code= dst_ip=10.20.23.255 dst_country_code= protocol=""UDP"" src_port=137 dst_port=137 sent_pkts=0 recv_pkts=0 sent_bytes=0 recv_bytes=0 tran_src_ip= tran_src_port=0 tran_dst_ip= tran_dst_port=0 srczonetype="""" srczone="""" dstzonetype="""" dstzone="""" dir_disp="""" connid="""" vconnid="""" hb_health=""No Heartbeat""
| Appendix A - Logs | 579
6/9/2015 1:29 PM,Info,10.20.22.173,timezone=""IST"" device_name=""SG135"" device_id=SFDemo1234567890 log_id=016602600003 log_type=""Security Policy"" log_component=""Heartbeat"" log_subtype=""Denied"" status=""Deny"" priority=Information duration=0 fw_rule_id=6 policy_type=1 user_name=""atp25"" user_gp="""" iap=2 ips_policy_id=0 appfilter_policy_id=0 application="""" application_risk=0 application_technology="""" application_category="""" in_interface=""eth0"" out_interface="""" src_mac=00:50:56:85:78:80 src_ip=10.20.21.179
src_country_code= dst_ip=10.201.4.51 dst_country_code= protocol=""UDP"" src_port=49321 dst_port=53 sent_pkts=0 recv_pkts=0 sent_bytes=0 recv_bytes=0 tran_src_ip= tran_src_port=0 tran_dst_ip= tran_dst_port=0 srczonetype="""" srczone="""" dstzonetype="""" dstzone="""" dir_disp="""" connid="""" vconnid="""" hb_health=""Red""
6/9/2015 1:29 PM,Info,10.20.22.172,timezone=""IST"" device_name=""SG135"" device_id=SFDemo1234567890 log_id=010101600001 log_type=""Security Policy"" log_component=""Policy Rule"" log_subtype=""Allowed"" status=""Allow"" priority=Information duration=10 fw_rule_id=3 policy_type=0 user_name=""iview1"" user_gp="""" iap=1 ips_policy_id=0 appfilter_policy_id=1 application=""FTP Base"" application_risk=4 application_technology=""Client Server"" application_category=""Infrastructure"" in_interface=""eth0"" out_interface="""" src_mac=00: 0:00: 0:00: 0 src_ip=10.20.21.159 src_country_code=R1 dst_ip=10.201.3.102
dst_country_code=R1 protocol=""TCP"" src_port=1558 dst_port=34322 sent_pkts=4 recv_pkts=2 sent_bytes=172 recv_bytes=92 tran_src_ip= tran_src_port=0 tran_dst_ip=10.20.22.173 tran_dst_port=0 srczonetype=""LAN"" srczone=""LAN"" dstzonetype="""" dstzone="""" dir_disp="""" connevent=""Stop"" connid=""2818264736"" vconnid="""" hb_health=""No Heartbeat""
6/9/2015 1:29 PM,Info,10.20.22.172,timezone=""IST"" device_name=""SG135"" device_id=SFDemo1234567890 log_id=010202601001 log_type=""Security Policy"" log_component=""Invalid Traffic"" log_subtype=""Denied"" status=""Deny"" priority=Information duration=0 fw_rule_id=0 policy_type=0 user_name="""" user_gp="""" iap=0 ips_policy_id=0 appfilter_policy_id=0 application="""" application_risk=0 application_technology="""" application_category="""" in_interface=""eth0"" out_interface="""" src_mac=00:50:56:95:62:26 src_ip=10.20.21.159
src_country_code= dst_ip=92.123.102.76 dst_country_code= protocol=""TCP"" src_port=1300 dst_port=443 sent_pkts=0 recv_pkts=0 sent_bytes=0 recv_bytes=0 tran_src_ip= tran_src_port=0 tran_dst_ip= tran_dst_port=0 srczonetype="""" srczone="""" dstzonetype="""" dstzone="""" dir_disp="""" connid="""" vconnid="""" hb_health=""No Heartbeat""
6/9/2015 1:29 PM,Info,10.20.22.172,timezone=""IST"" device_name=""SG135"" device_id=SFDemo1234567890 log_id=010301602001 log_type=""Security Policy"" log_component=""Appliance Access"" log_subtype=""Allowed"" status=""Allow"" priority=Information duration=16 fw_rule_id=0 policy_type=0 user_name="""" user_gp="""" iap=0 ips_policy_id=0 appfilter_policy_id=0 application="""" application_risk=0 application_technology="""" application_category="""" in_interface=""eth0"" out_interface="""" src_mac=00:
0:00: 0:00: 0 src_ip=10.20.20.15 src_country_code= dst_ip=10.20.22.173 dst_country_code= protocol=""TCP"" src_port=53371 dst_port=80 sent_pkts=10 recv_pkts=13 sent_bytes=2128 recv_bytes=8496 tran_src_ip= tran_src_port=0 tran_dst_ip= tran_dst_port=0 srczonetype="""" srczone="""" dstzonetype="""" dstzone="""" dir_disp="""" connevent=""Stop"" connid=""1388929440"" vconnid="""" hb_health=""No Heartbeat""
6/9/2015 1:29 PM,Info,10.20.22.172,timezone=""IST"" device_name=""SG135"" device_id=SFDemo1234567890 log_id=011902605151 log_type=""Security Policy"" log_component=""IP Spoof"" log_subtype=""Denied"" status=""Deny"" priority=Information duration=0 fw_rule_id=0 policy_type=0 user_name="""" user_gp="""" iap=0 ips_policy_id=0 appfilter_policy_id=0 application="""" application_risk=0 application_technology="""" application_category="""" in_interface="""" out_interface="""" src_mac= src_ip=169.254.234.5 src_country_code= dst_ip=128.0.0.1 dst_country_code= protocol=""ICMP"" icmp_type=0 icmp_code=0 sent_pkts=0 recv_pkts=0 sent_bytes=0 recv_bytes=0 tran_src_ip= tran_src_port=0 tran_dst_ip= tran_dst_port=0 srczonetype="""" srczone="""" dstzonetype="""" dstzone="""" dir_disp="""" connid="""" vconnid="""" hb_health=""No Heartbeat""
Module-specific Fields
Data Fields
status
Type
string duration integer
Description
Ultimate status of traffic – allowed or denied
Durability of traffic (seconds)
integer
Integer string string string string string string
Type
integer string string integer string string integer integer integer integer integer integer integer integer integer integer dst_ip dst_country_code protocol src_port dst_port icmp_type icmp_code sent_pkts received_pkts sent_bytes recv_bytes trans_src_ ip
Data Fields
fw_rule_id user_name user_group iap ips_policy_id appfilter_policy_id application in_interface out_interface src_ip src_mac src_country_code trans_src_port integer
Description
Firewall rule id i.e. firewall rule id which is applied on the traffic
User name
Group Id of user
Internet Access policy Id applied on the traffic
IPS policy ID applied on the traffic
Application Filter Policy applied on the traffic
Application name
Interface for incoming traffic e.g. Port
ABlank for outgoing traffic
Interface for outgoing traffic e.g. Port
BBlank for incoming traffic
Original Source IP address of traffic
Original source MAC address of traffic
Code of the country to which the source
IP belongs
Original Destination IP address of traffic
Code of the country to which the destination IP belongs
Protocol number of traffic
Original Source Port of TCP and UDP traffic
Original Destination Port of TCP and
UDP traffic
ICMP type of ICMP traffic
ICMP code of ICMP traffic
Total number of packets sent
Total number of packets received
Total number of bytes sent
Total number of bytes received
Translated source IP address for outgoing traffic. It is applicable only in route mode. Possible values:"" – When appliance is deployed in Bridge mode or source IP address translation is not doneIP Address – IP Address with which the original source IP address is translated
Translated source port for outgoing traffic. It is applicable only in route
| Appendix A - Logs | 580
| Appendix A - Logs | 581
Data Fields
trans_dst_ip trans_dst_port srczonetype dstzonetype dir_disp conn_event conn_id vconn_id
Type
integer integer string string string integer integer
Description
mode. Possible values:"" – When appliance is deployed in Bridge mode or source port translation is not donePort
– Port with which the original port is translated
Translated Destination IP address for outgoing traffic. It is applicable only in route mode. Possible values:"" – When appliance is deployed in Bridge mode or destination IP address translation is not doneIP Address – IP Address with which the original destination IP address is translated
Translated Destination port for outgoing traffic. It is applicable only in route mode. Possible values:"N/A" – When appliance is deployed in Bridge mode or destination port translation is not donePort – Port with which the original port is translated
Type of source zone e.g. LAN
Type of destination zone e.g. WAN
Packet direction Possible values:“org”,
“reply”, “”
Event on which this log is generated
Unique identifier of connection
Connection ID of the master connection
Web Filter Logs
Logs are displayed only if Web Protection Module is subscribed.
Message ID
16001
16002
16003
16004
Message
web site/file/application access is allowed according to the internet access policy web site/file/application access is blocked according to the internet access policy
HTTP File upload allowed
Token override
Sample Logs:
6/9/2015 1:29 PM,Info,10.20.22.173,timezone=""IST"" device_name=""SG135"" device_id=SFDemo1234567890 log_id=050902616002 log_type=""Content Filtering"" log_component=""HTTP"" log_subtype=""Denied"" status="""" priority=Information fw_rule_id=0 user_name=""atp25"" user_gp="""" iap=2 category=""IPAddress"" category_type=""Acceptable"" url=""http://172.16.6.146/favicon.ico"" contenttype="""" override_token=""""
| Appendix A - Logs | 582 httpresponsecode="""" src_ip=10.20.21.179 dst_ip=172.16.6.146 protocol=""TCP"" src_port=49330 dst_port=80 sent_bytes=0 recv_bytes=0 domain=172.16.6.146
6/9/2015 1:29 PM,Info,10.20.22.172,timezone=""IST"" device_name=""SG135"" device_id=SFDemo1234567890 log_id=050901616001 log_type=""Content Filtering"" log_component=""HTTP"" log_subtype=""Allowed"" status="""" priority=Information fw_rule_id=0 user_name=""iview1"" user_gp="""" iap=1 category=""Search
Engines"" category_type=""Acceptable"" url=""http://mtalk.google.com:443/"" contenttype="""" override_token="""" httpresponsecode="""" src_ip=10.20.21.159 dst_ip=74.125.130.188 protocol=""TCP"" src_port=1555 dst_port=443 sent_bytes=0 recv_bytes=0 domain=mtalk.google.com
Module-specific Fields
Data Fields
status fw_rule_id
Type
string integer user_name user_gp iap category category_type url content_type httpresponsecode src_ip dst_ip protocol src_port dst_port sent_bytes recv_bytes domain string string integer string string string string string string string integer integer integer integer integer string
Description
Ultimate state of traffic – accept/deny
Firewall rule id i.e. firewall rule id which is applied on the traffic
User name
Group ID of user
Web Filter policy ID applied on the traffic
Name of the category under which website falls
Type of category under which website falls
URL of the webpage accessed
Type of the content code of HTTP response
Original Source IP address of traffic
Original Destination IP address of traffic
Protocol number of traffic
Original Source Port of TCP and UDP traffic
Original Destination Port of TCP and
UDP traffic
Total number of bytes sent
Total number of bytes received
Domain of the website accessed
Application Filter Logs
Logs are displayed only if Web Protection Module is subscribed.
Message ID
17051
Message
Application access was denied according to application filter policy
Module-specific Fields
Data Fields
fw_rule_id user_name user_group application_filter_policy category application_name src_ip src_country_code dst_ip dst_country_code protocol src_port dst_port sent_bytes recv_bytes status message
Type
integer string string integer string string string string string integer integer integer integer integer integer string string
Description
Firewall rule id i.e. firewall rule id which is applied on the traffic
User name
Group ID of user
Application Filter Policy ID applied on the traffic
Name of the category under which application falls
Name of the application accessed
Original Source IP address of traffic
Code of the country to which the source
IP belongs
Original Destination IP address of traffic
Code of the country to which the destination IP belongs
Protocol number of traffic
Original Source Port of TCP and UDP traffic
Original Destination Port of TCP and
UDP traffic
Total number of bytes sent
Total number of bytes received
Ultimate state of traffic – accept/deny
Message displayed
IPS Logs
Logs are displayed only if Network Protection Module is subscribed.
Message ID
06001
06002
07001
07002
17818
17921
Message
IPS Anomaly detected
IPS Anomaly dropped
IPS Signature detected
IPS Signature dropped
IPS Signatures upgraded from <old version> to <new version>
IPS Signatures upgrade failed
| Appendix A - Logs | 583
| Appendix A - Logs | 584
Module-specific Fields
Data Fields
status
Type
string ips_policy_id ips_policy_name firewall_rule_id user_name signature_id singature_message classification rule_priority source_ip destination ip protocol source_port destination_port icmp_type icmp_code integer integer integer string string string string string string string integer integer integer integer integer
Description
Ultimate status of traffic – allowed or denied
IPS policy id i.e. IPS policy id which is applied on the traffic
IPS policy name i.e. IPS policy name which is applied on the traffic
Firewall rule id i.e. firewall rule id which is applied on the traffic
User name
Signature identifier
Signature messsage
Signature classification
Priority of IPS policy
Original Source IP address of traffic
Original Destination IP address of traffic
Protocol number of traffic
Original Source Port of TCP and UDP traffic
Original Destination Port of TCP and
UDP traffic
ICMP type of ICMP traffic
ICMP code of ICMP traffic
Anti Virus Logs
HTTP, HTTPS, FTP Logs are displayed only if Web Protection Module is subscribed.
POP, POPS, IMAP, IMAPS, SMTP and SMTPS Logs are displayed only if Web Protection Module is subscribed.
Message ID
08001
08002
09001
09002
10001
Message
The URL has been blocked as it contained a virus
Access to URL is allowed as it does not contain any virus
FTP data transfer was blocked as it contained a virus
FTP data transfer didn’t have any virus and completed successfully
The mail is infected with a virus detected by the Device
Log Component
HTTP
HTTP
FTP
FTP
SMTP
| Appendix A - Logs | 585
Message ID
10002
11001
11002
12001
Message
Mail doesn’t contain any virus
The mail is infected with a virus detected by the Device
Mail doesn’t contain any virus
The mail is infected with a virus detected by the Device
Mail doesn’t contain any virus
Log Component
SMTP
POP3
POP3
IMAP4
IMAP4 12002
Sample Logs:
6/10/2015 6:58 PM,Critical,10.20.22.173,timezone=""IST"" device_name=""SG135"" device_id=SFDemo1234567890 log_id=031006209001 log_type=""Anti-Virus"" log_component=""FTP"" log_subtype=""Virus"" status="""" priority=Critical fw_rule_id=0 user_name=""iview1"" virus=""Troj/Cspy-A,""
FTP_url=""/Test/10342546556.zip"" FTP_direction=""Download"" filename=""10342546556.zip"" file_size=0 file_path=""/Test/10342546556.zip"" ftpcommand=""RETR"" src_ip=10.20.21.158 src_country_code=R1 dst_ip=172.16.6.146 dst_country_code=R1 protocol=""TCP"" src_port=57330 dst_port=21 dstdomain="""" sent_bytes=0 recv_bytes=0
6/9/2015 1:29 PM,Info,10.20.22.172,timezone=""IST"" device_name=""SG135"" device_id=SFDemo1234567890 log_id=031001609002 log_type=""Anti-Virus"" log_component=""FTP"" log_subtype=""Allowed"" status="""" priority=Information fw_rule_id=0 user_name=""iview1"" virus="""" FTP_url=""/home/hemant.agrawal/ hemant_unicode.html"" FTP_direction=""Download"" filename=""hemant_unicode.html"" file_size=44635 file_path=""/home/hemant.agrawal/hemant_unicode.html"" ftpcommand=""RETR"" src_ip=10.20.21.159
src_country_code= dst_ip=10.201.3.102 dst_country_code= protocol=""TCP"" src_port=1556 dst_port=21 dstdomain="""" sent_bytes=0 recv_bytes=44635
6/10/2015 4:32 PM,Critical,10.20.22.173,timezone=""IST"" device_name=""SG135"" device_id=SFDemo1234567890 log_id=030906208001 log_type=""Anti-Virus"" log_component=""HTTP"" log_subtype=""Virus"" status="""" priority=Critical fw_rule_id=0 user_name=""iview1"" iap=1 av_policy_name="""" virus=""EICAR-AV-Test"" url=""http://www.eicar.org/download/eicar.com.txt"" domainname=""www.eicar.org"" src_ip=10.20.21.159 src_country_code=R1 dst_ip=188.40.238.250
dst_country_code=DEU protocol=""TCP"" src_port=3662 dst_port=80 sent_bytes=0 recv_bytes=0
Module-specific Fields
Data Fields
status
Type
string fw_rule_id user_name iap av_policy_name from_email_address to_email_address subject mailid integer string integer integer string string string string
Description
Ultimate status of traffic – allowed or denied
Firewall rule id i.e. firewall rule id which is applied on the traffic
User name
Policy Code of the Internet Access Policy applied
AV policy name which is applied on the traffic
Sender email address
Receipeint email address
Signature messsage
Signature classification
Data Fields
mailsize virus
FTP_url
FTP_direction filename filesize filepath ftpcommand url domainname quarantine src_domainname dst_domainname src_ip src_country_code dst_ip dst_country_code protocol src_port dst_port sent_bytes recv_bytes
Type
string string string string string integer string string string string string string string string string string string integer integer integer integer integer
Description
Priority of IPS policy
Virus name
FTP URL from which virus was downloaded
Direction of FTP transfer: Upload or
Download
Name of the file that contained virus
Size of the file that contained virus
Path of the file containing virus
FTP command used when virus was found
URL from which virus was downloaded
Domain from which virus was downloaded
Path and filename of the file quarantined
Sender domain name
Receiver domain name
Original Source IP address of traffic
Code of the country to which the source
IP belongs
Original Destination IP address of traffic
Code of the country to which the destination IP belongs
Protocol number of traffic
Original Source Port of TCP and UDP traffic
Original Destination Port of TCP and
UDP traffic
Total number of bytes sent
Total number of bytes received
Anti Spam Logs
Logs are displayed only if Email Protection Module is subscribed.
Message ID
13001
13002
13003
13004
Message
A mail considered to be a SPAM.
A mail considered to be a PROBABLE SPAM.
A mail was not considered SPAM or PROBABLE SPAM.
Sender IP address is blacklisted.
| Appendix A - Logs | 586
| Appendix A - Logs | 587
Message ID
14001
14002
14003
15001
15002
15003
13005
13006
13007
13008
13009
13010
13011
13012
Module-specific Fields
Data Fields
status firewall_rule_id
Type
string integer user_name policy_name string string from_email_address string to_email_address string email_subject mailid mailsize spam_action string string string string
Reason
Message
A mail considered to be an Outbound SPAM
A mail considered to be an Outbound Probable SPAM
Flagged clean by both IBS/OBS
Message is marked clean by outbound
DLP detected in mail
SPX successfully applied
SPX failed
SMTP DOS
A mail considered to be a SPAM.
A mail considered to be a PROBABLE SPAM.
A mail was not considered SPAM or PROBABLE SPAM.
A mail considered to be a SPAM.
A mail considered to be a PROBABLE SPAM.
A mail was not considered SPAM or PROBABLE SPAM.
string
Email subject
Email id
Email size
Action performed on the messagePossible values:RejectDropAcceptChange
ReceipientPrefix subject
Reason why Email was detected as Spam Possible values for
Reason: Device Anti-Spam identifies mail as Spam/Probable
Spam From email address/From
Domain/From IP Address is marked as spam in spam policy
From email address/From IP
Address belonged to email group/
IP address group marked as spam
Description
Ultimate status of traffic – allowed or denied
Firewall rule id i.e. firewall rule id which is applied on the traffic
User name
Spam policy name which is applied on the traffic
Sender email address
Recipient email address
| Appendix A - Logs | 588
Data Fields Type
src_domainname dst_domainname src_ip src_country_code dst_ip dst_country_code protocol src_port dst_port sent_bytes recv_bytes string integer integer integer integer integer string integer string string string
System Logs
Log Component
HA
DHCP Server
Message ID
60012
60013
60014
60015
60016
60017
60018
60019
17838
60020
Message size is greater/less than
<msg_size> MB as specified in the spam policy Message header={Message Header|
Subject | From | To | Other=(other header)} contains/equals <value specified in spam policy> Sender
IP address is blacklisted by
RBL=<RBL Group> specified in the spam policy
Sender domain name
Receiver domain name
Original Source IP address of traffic
Code of the country to which the source IP belongs
Original Destination IP address of traffic
Code of the country to which the destination IP belongs
Protocol number of traffic
Original Source Port of TCP and
UDP traffic
Original Destination Port of TCP and UDP traffic
Total number of bytes sent
Total number of bytes received
Description
Message
Appliance becomes standalone
Appliance goes in fault
Appliance becomes auxiliary
Appliance becomes primary
Appliance becomes standalone at appliance start up
Appliance goes in fault at appliance start up
Appliance becomes auxiliary at appliance start up
Appliance becomes primary at appliance start up
HA was disabled
DHCP lease renew
Log Component
Appliance
Interface
Gateway
DDNS
WebCat
AV
IPS
Interface
Dial-In
17817
17920
17819
17922
17921
17820
17821
17822
17905
17943
17944
17813
17814
18036
17815
17923
17924
17931
17932
17933
17934
17941
17942
Message ID
60021
60022
17807
17808
17809
17810
17811
17812
17816
17904
| Appendix A - Logs | 589
Message
DHCP lease release
DHCP lease expired
CPU usage exceeded the threshold
Physical memory usage exceeded the threshold
SWAP memory usage exceeded the threshold
Config disk usage exceeded the threshold
Signature disk usage exceeded the threshold
Reports disk usage reached the higher threshold
Appliance started successfully
Reserved for OPCODE failure snmp trap (logs will be added later)
Reserved for Service failure snmp trap (logs will be added later)
Scheduled backup was successfully taken (Information)
Failed to send scheduled backup
Fan Speed has decreased below the desirable level
Temperature has increased above the desired level
Report disk usage reached lower than the lower threshold
Report disk usage exceeded the lower threshold
The audit subsystem has successfully shut down.
Fail to send certificate passphrase .
Connectivity to ConnectWise Server has been lost.
Fail to send test mail : <Reason>
Interface UP/Interface Down
Gateway live/ Gateway dead
Up/down gateway detail to SFM
DDNS Update successful/failed
WebCat Database upgraded from <old version> to <new version>
WebCat Database upgrade failed
AV Definitions upgraded from <old version> to <new version>
AV Definitions upgrade failed
IPS Signatures upgrade failed
Primary Link down/Up and link failover/failback to backup/ primary link
Dial-In client connected
Dial-In client disconnected
Log Component
Quarantine
SSL VPN
L2TP
PPTP
IPSec
17840
17841
17842
17843
17844
17832
17833
17834
17835
17836
17936
17937
17803
17804
17805
17806
17801
17802
Message ID
17823
17824
17825
17826
17827
17828
17829
17830
17831
17837
17839
| Appendix A - Logs | 590
Message
Quarantined email could not be released because <reason>
SSL VPN Connection (Tunnel Access) Established
SSL VPN Connection (Tunnel Access) Terminated
SSL VPN Connection (Web Access) Established
SSL VPN Connection (Web Access) Terminated
SSL VPN Connection (Application Access) Established
SSL VPN Connection (Application Access) Terminated
SSL VPN resource access allowed
SSL VPN resource access denied
User Certificate <certificate_name> was created for user
<username>
All User Certificates deleted
L2TP Connection Established
L2TP Connection Terminated
PPTP Connection Established
PPTP Connection Terminated
IPSec Connection Established
IPSec Connection Terminated
Failover group Activation successful. A particular connection/
No connection established
Failover successful
Failover failed. Connection will be established on next failback event
Failback successful
Failback failed, revert back to current running connection successful
Failback failed, revert back to current running connection also failed. Connection will be established on next failback event
<connectionname>, activation: Connection activated successfully
<connectionname>, activation: Failed to activate this connection. Reason: <reason>
<connectionname>, activation: Trying to deactivate/initiate/ terminate an inactive connection. Probable DB sync problem
<connectionname>, EST-P1-MM: Response to establishment request from <peeris> peer <peerrequesterip> successful
<connectionname>, EST-P1-MM: Response to establishment request from <peerrequesterip> failed because <reason>
<connectionname>, EST-P1-AM: Responding to establishment request from <peerrequesterip>, state # <state>
Log Component Message ID
17845
17846
17847
17848
17849
17850
17851
17852
17853
17854
17855
17856
17857
17858
17859
17860
17861
| Appendix A - Logs | 591
Message
<connectionname>, EST-P1-AM: Response to establishment request from <peerrequesterip> failed because <reason>
<connectionname>, EST-P1-MM: Connection being initiated on request
<connectionname>, EST-P1-AM: Connection with state
<state> being initiated on request
<connectionname>, EST-P1-MM: Peer ID is <peerid>
<connectionname>, EST-P1-AM: Peer ID is <peerid>
<connectionname>, EST-P1: Phase-1 ID mismatch.
Configured peer id is <remoteid> and received peer id is
<peerid>. System is initiator. Verify ID configuration at both the ends is in sync.
<connectionname>, EST-P1: Phase-1 ID mismatch. No suitable connection for peer id <peerid>. System is responder.
Verify ID configuration at both the ends is in sync.
<connectionname2>, EST-P1: switched the connection from <connectionname> to <connectionname2> because a
<connection name2>'s configuration matches the request better.
<connectionname>, EST-P1: Peer did not accept any proposal sent. Reconfigure the connection on either of the ends
<connectionname>, EST-P1: System did not accept any proposal received. Need to reconfigure the connection on either of the ends.
<connectionname>, EST-P1: An error (mostly related to network) has occurred while sending a packet to advance the
IKE state machine from state <state>.
<connectionname>, EST-P1: max number of retransmissions
<count> reached STATE_MAIN_I1. No response (or no acceptable response) to first IKE message
<connectionname>, EST-P1: max number of retransmissions
<count> reached STATE_MAIN_I3. Possible authentication failure or NAT device in between: no acceptable response to first encrypted message
<connectionname>, EST-P1: Malformed payload in packet.
probable authentication failure (mismatch of preshared secrets). Verify pre-shared secrets are same at both the ends.
<connectionname>, EST-P1: unexpected message received in state <state>. payload received from the peer do not lead the
System to the next expected IKE state
<connectionname>, EST-P1: Informational Exchange message is invalid because it has a previously used Message ID
<messageid>
<connectionname>, EST-P1-MM: Phase-1 SA initiated by peer is established
Log Component Message ID
17865
17866
17867
17868
17869
17870
17871
17876
17877
17878
17879
17872
17873
17874
17875
17880
17881
| Appendix A - Logs | 592
Message
<connectionname>, EST-P2: Initiating Phase-2 (protected by
Phase-1 SA with <state>) on request with policy <policybits>
<connectionname>, EST-P2: Initiating Phase-2 SA re-keying using Phase-1 SA <state>
<connectionname>, EST-P2: Responding to a Phase-2 establishment request with Message id <MESSAGE ID>
<connectionname>, EST-P2: max number of retransmissions
<count> reached STATE_QUICK_I1. No acceptable response to our first Quick Mode message: perhaps peer likes no proposal
<connectionname>, EST-P2: System require Perfect Forward
Secrecy(PFS) but peer proposed not to use PFS
<connectionname>, EST-P2: Local subnet – Remote subnet configuration of the connection being initiated conflicts with that of an already established connection
<establishedconnectionname>. Terminate connection
<establishedconnectionname> before initiating.
<connectionname>, EST-P2: System received a Phase-2 connection request whose Local subnet – Remote subnet configuration conflicts with that of an already established connection <establishedconnectionname>. System is terminating connection <establishedconnectionname> to honour the incoming request.
<connectionname>, EST-P2: A Phase-2 SA initiated by
System is established.
<connectionname>, EST-P2: A Phase-2 SA initiated by peer is established
<connectionname>, NAT-T: No NAT device detected between Local Server and Remote Server
<connectionname>, NAT-T: Local server is behind a NAT device
<connectionname>, NAT-T: Remote server is behind a NAT device
<connectionname>, NAT-T: Both Local and remote server are behind NAT devices
<connectionname>, SA-MGT: Peer requested to delete
Phase-1 SA. Deleting ISAKMP state <state>
<connectionname>, SA-MGT: Peer requested to delete
Phase-2 SA. Deleting IPSec state <state>
<connectionname>, SA-MGT: Peer requested to delete
Phase-2 SA. Deleting existing SA and re-inititate a new one.
Replacing IPSEC State #<state>
<connectionname>, SA-MGT: Deleting remote access connection instance with peer <remoteinterfaceip>, isakmp=#<isakmp>, ipsec=#<ipsec>
Log Component
17901
17902
17903
17939
17895
17896
17897
17898
17899
17900
17885
17886
17887
17888
17889
17890
17891
17892
17893
17894
Message ID
17882
17883
17884
| Appendix A - Logs | 593
Message
<connectionname>, SA-MGT: Deleting connection
<connectionname>, SA-MGT: On deletion of connection, corresponding SA <state> is being deleted
<connectionname>, SA-MGT: Initiating Re-keying of connection 's Phase-1 (main mode) SA <state>
<connectionname>, SA-MGT: Initiating Re-keying of connection 's Phase-1 (aggresive mode) state <oldstate> to state <newstate>
<connectionname>, SA-MGT: Phase 1 SA is being re-keyed
<connectionname>, SA-MGT: Phase 2 SA is being re-keyed
<connectionname>, SA-MGT: Phase 1 SA has expired
<connectionname>, SA-MGT: Phase 1 SA has expired.
Connection is configured not to re-key
<connectionname>, SA-MGT: Phase 2 SA has expired
<connectionname>, SA-MGT: Phase 2 SA has expired.
Connection is configured not to re-key
<connectionname>, DPD: Dead peer detection enabled
<connectionname>, DPD: Peer was unreachable and was marked as dead for this connection
<connectionname>, DPD: Connection was
<actiononpeerdead> because peer was dead
<connectionname>, DPD: Connection was scheduled to be rekeyed because peer was unreachable and connection was reinitiated
<connectionname>, XAUTH: Sending username/password request
<connectionname>, XAUTH: User <user> attempting to login
<connectionname>, XAUTH: User <user> authenticated successfully
<connectionname>, XAUTH: User <user> failed to authenticate because <reason>
<connectionname>, XAUTH: received MODECFG message when in state <STATE NAME>, and Appliance is not
XAUTH client
<connectionname>, XAUTH: Username/password requested but connection configured as XAUTH client cannot be rekeyed. Turn off rekey for the connection
<connectionname>, XAUTH: XAUTH: Answering XAUTH challenge with user <user>
<connectionname>, XAUTH: Successfully authenticated.
Appliance is XAUTH Client
Failed to send IPSec tunnel UP/Down notification mail
Log Component
Landing Page
WLAN
CCC
Appliance Access
HTTPS
Guest User
Virtual Host
CTA
PPPoE
Message ID
17938
17906
17907
17908
17909
17911
17910
17912
17918
17919
17927
17928
17929
17930
17935
17940
17953
17913
17914
17915
17916
17917
17925
17926
17954
17955
17956
17957
17958
| Appendix A - Logs | 594
Message
IPSec tunnel UP/Down notification mail sent successfully
Landing page accepted
Landing page declined
Rogue AP scan successfully completed
Rogue AP scan failed
System triggered Rogue AP Scan was initiated
Failed to send heartbeat from appliance to CCC (reserved for use with CCC, no log is generated) heartbeat sent from appliance to CCC (reserved for use with
CCC, no log is generated)
Failed to send keep-alive from appliance to CCC (reserved for use with CCC, no log is generated) keep-alive sent from appliance to CCC (reserved for use with
CCC, no log is generated)
System blocked administrator account for login because of too may wrong login attempts
System unblocked administrator account
System locked administrator's session
Unknown protocol traffic was denied
Invalid Certificate was blocked
Guest user is added in system
Access details SMS sent to the SMS gateway for delivery to guest user
One or more Guest user expired and auto-purged successfully
One or more Guest user expired and auto-purged failed
One or more Guest user expired and auto-purge partially failed
Failed to send Access details SMS
Mapped Server <server_ipaddress> is UP/Mapped Server
<server_ipaddress> is DOWN
CTA started with active collectors
<interface name: PADO packet timeout no response from server.
<interface name>: Terminating Session, Reattempting in
<seconds> Sec.
<interface name>: Discovery process completed
<interface name>: LCP link established
<interface name>: ISP not supporting LCP
<interface name>: Authentication successful
Log Component
PPTP
L2TP
17977
17978
17979
17980
Message ID
17959
17960
17961
17962
17963
17964
17965
17966
17967
17969
17972
17973
17974
17975
17976
17981
17982
17983
17984
17985
17986
17987
17988
| Appendix A - Logs | 595
Message
<interface name>: Authentication Fail. Please check username and password
<interface name>: Set interface IP < local IP>
<interface name>: Set gateway IP < remote IP>
<interface name>: Set Primary DNS < DNS IP if enable>
<interface name>: Set Aux DNS < DNS IP>
<interface name>: PPPoE Link Up
<interface name>: PPPoE Link Down
<interface name>: Disconnect PPPoE due to LCP timeout
<interface name>: Disconnect PPPoE due to Idle timeout
<interface name>: Reconnected on schedule event.
LCP : Negotiation Opening for < Client IP >
LCP : Link Established for < Client IP >
< PAP/CHAP/MS-CHAPv2 > : Starting Authentication
< PAP/CHAP/MS-CHAPv2 > : Authentication Successful for
User < user name >
< PAP/CHAP/MS-CHAPv2 > : Authentication Failed for User
< user name >
IPCP : IP allocated : < IP allocated >, IPCP : Set DNS : <
Primary/secondary DNS Server >, IPCP : Set WINS : <
Primary/secondary WINS Server >
LCP : Disconnect due to LCP timeout
STATS : Connect time : < connection time >, STATS : Sent < no. of bytes > bytes, received < no. of bytes > bytes
IPCP : Taking IPCP down for < Client IP > : < Reason >,
LCP : Negotiation Closing for <Client IP > : < Reason >,
LCP : Negotiation Closed for < Client IP >
IPCP : Taking IPCP down for < Client IP > : < Reason >,
LCP : Negotiation Closing for <Client IP > : < Reason >,
LCP : Negotiation Closed for < Client IP >
LCP : Negotiation Opening for < Client IP >
LCP : Link Established for < Client IP >
< PAP/CHAP/MS-CHAP > : Starting Authentication
< PAP/CHAP/MS-CHAP > : Authentication Successful for
User < user name >
< PAP/CHAP/MS-CHAP > : Authentication Failed for User < user name >
IPCP : IP allocated : < IP allocated >, IPCP : Set DNS : <
Primary/secondary DNS Server >, IPCP : Set WINS : <
Primary/secondary WINS Server >
LCP : Disconnect due to LCP timeout
Log Component Message ID
17989
17990
System
WC
RED
ATP
SSLVPN clients
IPSEC clients
Authentication clients
RED firmware
18017
18018
18019
18020
18021
18022
18023
18024
18025
18001
18002
18003
18004
18005
18006
18007
18008
18014
18015
18016
18032
17991
18000
17998
17999
| Appendix A - Logs | 596
Message
STATS : Connect time : < connection time >, STATS : Sent < no. of bytes > bytes, received < no. of bytes > bytes
IPCP : Taking IPCP down for < Client IP > : < Reason >,
LCP : Negotiation Closing for <Client IP > : < Reason >,
LCP : Negotiation Closed for < Client IP >
IPCP : Taking IPCP down for < Client IP > : < Reason >,
LCP : Negotiation Closing for <Client IP > : < Reason >,
LCP : Negotiation Closed for < Client IP >
Event new firmware detected for <type>: <version>
[ <AP-ID>] unknown AP model encountered: <type>, dropping.
[<AP-ID>] no firmware available for AP type '<type>', dropping.
[ <AP-ID> ] device not authorized yet, dropping.
[ <AP-ID> ] Corrupt payload. Device may have wrong key.
Delete device to re-register it.
[ <AP-ID>] sent firmware <firmware> to device, releasing connection.
[ <AP-ID> ] failed to send <firmware> to device, dropping.
[MASTER] sending notification about offline AP <AP>
Successfully sent config to AP [ <AP-ID> ].
Failed to send config to AP [ <AP-ID> ].
RED is connected
RED in disconnected
RED interim event
Red devices: Disabled: 5 Enabled: 15 Connected: 12
Disconnected 3
ATP Definitions upgraded from <old version> to <new version>
ATP Definitions upgrade failed
SSLVPN clients upgraded from <old version> to <new version>
SSLVPN clients upgrade failed
IPSEC clients upgraded from <old version> to <new version>
IPSEC clients upgrade failed
Authentication clients upgraded from <old version> to <new version>
Authentication clients upgrade failed
RED firmware upgraded from <old version> to <new version>
| Appendix A - Logs | 597
Log Component
AP firmware up2date
WAF
Message ID
18026
18027
18028
18029
18030
18033
18034
Message
RED firmware upgrade failed
AP firmware upgraded from <old version> to <new version>
AP firmware upgrade failed
Failed to checked for updates
Failed to download file <MODULE>
WAF Rules upgraded from <old version> to <new version>
WAF Rules upgrade failed
Sample Logs:
6/10/2015 11:38 AM,Info,10.20.22.173,timezone=""IST"" device_name=""SG135"" device_id=SFDemo1234567890 log_id=062811617824 log_type=""Event"" log_component=""SSL
VPN"" log_subtype=""System"" priority=Information Mode=""Tunnel Access"" sessionid= starttime=0 user_name=""srv_478a5ac8b0a0c657b30278d8d5a80c4a"" ipaddress=1c93:c08:6cca:1309:ec46:ccff:fc28:1209 sent_bytes=0 recv_bytes=0 status=""Established"" message=""User srv_478a5ac8b0a0c657b30278d8d5a80c4a connected through SSL VPN using Tunnel Access mode"" timestamp=1433916812
6/10/2015 11:57 AM,Info,10.20.22.173,timezone=""IST"" device_name=""SG135"" device_id=SFDemo1234567890 log_id=062811617825 log_type=""Event"" log_component=""SSL VPN"" log_subtype=""System"" priority=Information Mode=""Tunnel Access"" sessionid= Reason=""User
Logout"" starttime=1433916801 user_name=""srv_478a5ac8b0a0c657b30278d8d5a80c4a"" ipaddress=1e93:c08:4ccb:1309:48:ccff:fc28:1209 sent_bytes=3829210 recv_bytes=8976910 status=""Terminated"" message=""User srv_478a5ac8b0a0c657b30278d8d5a80c4a disconnected through SSL VPN using Tunnel Access mode because User Logout"" timestamp=1433917976
6/11/2015 3:46 PM,Info,10.20.22.173,timezone=""IST"" device_name=""SG135"" device_id=SFDemo1234567890 log_id=062811617826 log_type=""Event"" log_component=""SSL VPN"" log_subtype=""System"" priority=Information Mode=""Application Access"" sessionid=93pw667o577nnfgovg431r6f sslvpnpolicyname=RA starttime=0 user_name=""vpnuser3"" ipaddress=172.16.6.159 sent_bytes=0 recv_bytes=0 status=""Established"" message=""User vpnuser3 connected through SSL VPN using Clientless Access"" timestamp=1434018110
Authentication Logs
Log Component
Firewall Authentication
My Account Authentication
VPN Authentication
Message ID
17701
17702
17703
17945
17704
17705
17706
17947
17707
17708
Message
User logged in successfully to firewall
User failed to login to firewall
User logged out from firewall
Received challenge from <Auth Mech> server via
<Client Type>.
User logged in successfully to My Account
User failed to login to My Account
User logged out from Account
Received challenge from <Auth Mech> server via
<Client Type>.
User logged in successfully to VPN
User failed to login to VPN
| Appendix A - Logs | 598
Log Component
SSL VPN Authentication
Dial-In Authentication
NTLM
External Authentication
17946
17713
17714
17715
17948
17949
Message ID
17709
17710
17711
17712
17950
17951
17952
17968
Message
User logged out from VPN
User logged in successfully to SSL VPN
User failed to login to SSL VPN
User logged out from SSL VPN
Received challenge from <Auth Mech> server via
<Client Type>.
User logged in using Dial-In
User failed to login using Dial-In
User logged out of Dial-In
NTLM enabled but AD server not configured
Cannot establish NTLM authentication channel with
<server name>
NTLM authentication channel established successfully with <server name>
Cannot establish NTLM authentication channel with
<server name>
NTLM authentication disabled from appliance access connection to ADS/LDAPS <server ip/fqdn> failed because <reason>
Advanced Threat Protection (ATP) Logs
Logs are displayed only if Network Protection Module is subscribed.
Message ID
18009
18010
Message
Alert by ATP
Drop by ATP
Sample Logs:
6/12/2015 4:05 PM,Notice,10.20.22.173,timezone=""IST"" device_name=""SG135"" device_id=SFDemo1234567890 log_id=086520518009 log_type=""ATP"" log_component=""HTTP Proxy"" log_subtype=""Alert"" priority=Notice protocol=""TCP"" src_port=8173 dst_port=80 sourceip=10.20.21.159
destinationip=202.31.139.173 url=http://202.31.139.173/ threatname=C2/Generic-A eventid=BF9283B5-
C043-4483-8063-F890C982AD84 eventtype=""Standard"" login_user="""" process_user="""" ep_uuid= execution_path=""""
6/12/2015 4:05 PM,Warning,10.20.22.173,timezone=""IST"" device_name=""SG135"" device_id=SFDemo1234567890 log_id=086304418010 log_type=""ATP"" log_component=""Security Policy"" log_subtype=""Drop"" priority=Warning protocol=""TCP"" src_port=3361 dst_port=20480 sourceip=10.20.21.159
destinationip=77.91.166.16 url=77.91.166.16 threatname=C2/Generic-A eventid=522D2600-3A66-4A31-A8D8-
FFF8C0170F9B eventtype=""Standard"" login_user="""" process_user="""" ep_uuid= execution_path=""""
| Appendix A - Logs | 599
Heartbeat Logs
Logs are displayed only if Network Protection Module is subscribed.
Message ID
18012
18013
Message
Heartbeat status
Endpoint status
Web Application Firewall (WAF) Logs
Logs are displayed only if Web Server Protection Module is subscribed.
Message ID
17071
17072
Message
A web request is allowed by WAF
A web request is blocked by WAF
System Health Logs
Message ID
18031
Message
CPU, Memory, Disk, Live User, Interface Usage
Sample Logs:
6/9/2015 1:29 PM,Info,10.20.22.172,timezone=""IST"" device_name=""SG135"" device_id=SFDemo1234567890 log_id=127826618031 log_type=""System Health"" log_component=""Disk"" log_subtype=""Usage"" priority=Information Configuration=13.00% Reports=0.00% Signature=16.00% Temp=0.00%
| Appendix B – IPS - Custom Pattern Syntax | 600
Appendix B – IPS - Custom Pattern Syntax
Keyword
srcaddr/dstaddr srcport/dstport content nocase Can be used with content keyword only rawbytes Can be used with content keyword only depth Can be used with content keyword only offset Can be used with content keyword only distance Can be used with content keyword only within Can be used with content keyword only uricontent isdataat
Value
<ipaddress>;
<Number>;
"<content string>"; A string quoted within double quotes.
Usage
The source/destination IP address
The source/destination port
Multiple contents can be specified in one rule. The value can contain mixed text and binary data. The binary data is generally enclosed within the pipe (|) character.
Ignore case in the content value NULL
NULL
<number>; e.g. depth:5;
<number>; e.g. content:”cgi-bin/ phf”;offset:4;depth:20;
<number>; For example content :"ABC";content:"DEF"; distance:1;
Ignore any decoding. Look at the raw packet data
Look for the contents within the specified number of bytes of the payload. If the value of the depth keyword is smaller than the length of the value of the content keyword, this signature will never be matched
Start looking for the contents after the specified number of bytes of the payload. This tag is an absolute value in the payload. Follow the offset tag with the depth tag to stop looking for a match after the value specified by the depth tag. If there is no depth specified, continue looking for a match until the end of the payload.
Search for the contents the specified number of bytes relative to the end of the previously matched contents. The distance tag could be followed with the within tag. If there is no value specified for the within tag, continue looking for a match until the end of the payload.
<number>; For example Look for the contents within the specified number of bytes of the payload. Use with the distance tag.
uricontent:<content string>; For exampleuricontent:"%3F";
Search for the normalized request
URI field. Binary data can be defined as the URI value.
<value> [,relative]; For Verify that the payload has data at a examplecontent:"PASS";isdataat:50,relative; for data relative to the end of the previous content match.
Keyword
pcre byte_test
| Appendix B – IPS - Custom Pattern Syntax | 601
Value Usage
pcre:[!]"(/<regex>/|m/<regex>/)
[ismxAEGRUB]"; For examplepcre:"/BLAH/i";
The pcre keyword allows rules to be written using perl compatible regular expressions. i - Case insensitive s - Include newlines in the dot metacharacter m - By default, the string is treated as one big line of characters^ and $ match at the start and end of the string. When m is set,
^ and $ match immediately following or immediately before any newline in the buffer, as well as the very start and very end of the buffer. x
- Whitespace data characters in the pattern are ignored except when escaped or inside a character class
A - The pattern must match only at the start of the buffer (same as ^ )
E - Set $ to match only at the end of the subject string. Without E, $ also matches immediately before the final character if it is a newline
(but not before any other newlines)
G - Inverts the "greediness" of the quantifiers so that they are not greedy by default, but become greedy if followed by "?" R - Match relative to the end of the last pattern match
(similar to distance:0;) U Match the decoded URI buffers (similar to the uri keyword) B Do not use the decoded buffers (similar to the raw keyword).
<bytes to convert>, [!]<operator>,
<value>, <offset> [,relative]
[,<endian>] [,<number type>, string]; oct,dec,hex used with string only
For examplemsg:"AMD procedure
7 plog overflow"; content:"|00 04
93 F3|";content:"|00 00 00 07|";
Test a byte field against a specific value (with operator). Capable of testing binary values or converting representative byte strings to their binary equivalent and testing them.
bytes_to_convert - The number of bytes to pick up from the packet distance:4.within:4;byte_test:4,>,1000,20,relative; to test thevalue (<,>,=,!,&) value -
The value to test the converted value against offset - The number of bytes into the payloadto start processing relative - Use an offset relative to last pattern match big - Process the data as big endian (default) little - Process the data as little endian string - The data is stored in string format inthe packet hex - The converted string data is represented in hexadecimal dec - The converted string data is represented in decimal oct - The
ttl tos id ipopts
Keyword
byte_jump fragoffset
| Appendix B – IPS - Custom Pattern Syntax | 602
Value Usage
converted string data is represented in octal
<bytes_to_convert>, <offset>
[,relative] [,multiplier <multiplier value>] [,big] [,little][,string]
[,hex] [,dec] [,oct] [,align]
[,from_beginning]; oct,dec,hex used with string only For examplecontent:"|00 00 00 bytes_to_convert - The number of bytes to pick up from the packet multiplier value - multiply the number of calculated bytes by value and skip forward that number of byte operator - The operation to perform to test thevalue (<,>,=,!,&) value -
01|";distance:4;within:4;byte_jump:4,12,relative,align against offset - The number of bytes into the payloadto start processing relative - Use an offset relative to last pattern match big - Process the data as big endian (default) little - Process the data as little endian string - The data is stored in string format inthe packet hex - The converted string data is represented in hexadecimal dec - The converted string data is represented in decimal oct - The converted string data is represented in octal align – round the number of converted bytes upto the next 32 bit boundary from_beginning – Skip forward from the beginning of the packet payload instead of from the current position in the packet
<number>;><number>;<<number>; Check the IP time-to-live value againstthe specified value
<number>; Check the IP TOS field for the specifiedValue
<number>;
{rr | eol | nop | ts | sec | lsrr |ssrr | satid
| any}
<number>;
Check the IP ID field for the specifiedValue rr - Check if IP RR (record route) option isPresent ool - Check if IP
EOL (end of list) option is present nop - Check if IP NOP (no op) option is present ts - Check if IP
TS (time stamp) option is present sec - Check if IP SEC (IP security) option is present lsrr - Check if IP
LSRR (loose source routing) option is present ssrr - Check if IP SSRR
(strict source routing) option is present satid - Check if IP SATID
(stream identifier) option is present any - Check if IP any option is present
Allows to compare the IP fragment offset field against the decimal value
flow seq ack window itype icode icmp_id
Keyword
fragbits dsize flags
| Appendix B – IPS - Custom Pattern Syntax | 603
Value Usage
[+*!]<[MDR]>;
[<|>] <number>[ <> number]; For exampledsize:300<>400;
[!|*|
+]<FSRPAU120>[,<FSRPAU120>];
For exampleFlags:SF,12 to_client|to_server|from_client| from_server ];established;bi_direction;
[no_stream|only_stream];
TCP only. The to_server value is equal to the from_client value.
The to_client value is equal to the from_server value. The bi_direction tag makes the signature match traffic for both directions. For example, if you have a signature with "--dst_port
80", and with bi_direction set, the signature checks traffic from and to port 80.
<number>;
Specify the TCP flags to match in a packet. S - Match the SYN flag A -
Match the ACK flag F - Match the
FIN flag R - Match the RST flag U
- Match the URG flag P - Match the
PSH flag 1 - Match Reserved bit 1
2 - Match Reserved bit 2 0 - Match
No TCP flags set + - Match on the specified bits, plus any others * -
Match if any of the specified bits are set ! - Match if the specified bits are not set
<number>;
Check for the specified TCP sequencenumber
Check for the specified
TCPacknowledge number
<number>;
Check if IP fragmentation and reserved bits are set in the IP header.
M - The More Fragments bit D - The
Don't Fragment bit R - The Reserved
Bit + - Match on the specified bits, plus any others * - Match if any of the specified bits are set ! - Match if the specified bits are not set
Test the packet payload size.
With data_size specified, packet reassembly is turned off automatically so a signature with data_size and only_stream values set is wrong. dsize will fail on stream rebuilt packets, regardless of the size of the payload
[<|>]<number>[<>number];
[<|>]<number>[<>number];
<number>;
Check for the specified TCP windowSize
Specify the ICMP type to match
Specify the ICMP code to match
Check for the specified ICMP ID value
Keyword
icmp_seq rpc ip_proto samip
| Appendix B – IPS - Custom Pattern Syntax | 604
Value Usage
<number>;
<application number>,[<version number>|*],[<procedure number>|
*>;
Check for the specified ICMP sequenceValue
Check for RPC application, version,and procedure numbers in
SUNRPCCALL requests. The * wildcard can beused for version and procedurenumbers
<number>;
[!]<number>;><number>;<<number>;
Check the IP protocol header
NULL The source and the destination havethe same IP addresses
| Appendix C – Default File Type Categories | 605
Appendix C – Default File Type Categories
File Type Category Name
Audio Files
File Extensions
gsm, sd2, qcp, kar, smf, midi, mid, ulw, snd, aifc, aif, aiff, m3url, m3u, wav, rm, au, ram, mp3, wmv
Backup Files (The Backup Files category includes individual file backups and files related to backup software. Individual backup files are often generated automatically by software programs. Backup software files include incremental backups and full system backups.)
Compressed Files(Compressed files use file compression in order to save disk space. Compressed archive formats can also be used to compress multiple files into a single archive.) asd, bak, bkp, bup, dba, dbk, fbw, gho, nba, old, ori, sqb, tlg, tmp
7z, alz, deb, gz, pkg, pup, rar, rpm, sea, sfx, sit, sitx, tar.gz, tgz, war, zip, zipx
MIME Headers
audio/x-gsm, audio/vnd.qcelp, audio/ x-midi, application/x-midi, audio/ midi, audio/x-mid, x-music/x-midi, audio/basic, audio/x-adpcm, audio/ aiff, audio/x-aiff, audio/x-mpequrl, audio/wav, audio/x-wav, application/ vnd.rn-realmedia, audio/x-au, audio/ x-pn-realaudio, audio/mpeg3, audio/ x-mpeg-3, audio/x-ms-wmv application/octet-stream application/x-7z-compressed, application/x-alz, application/x-deb, application/x-gzip, application/xnewton-compatible-pkg, application/ x-rar-compressed, application/sea, application/x-sea, application/x-sit, application/x-stuffit, application/ gnutar, application/x-compressed, application/x-zip-compressed, application/zip, multipart/x-zip application/pics-rules, application/ octet-stream, application/vnd.msofficetheme
Configuration Files(Settings files store settings for the operating system and applications. These files are not meant to be opened by the user, but are modified by the corresponding application when the program preferences are changed.
Settings files may also be called preference files or configuration files.)
Database Files(Database files store data in a structured format, organized into tables and fields. Individual entries within a database are called records. Databases are commonly used for storing data referenced by dynamic websites.)
Developer Files (The Developer Files category contains files related to software development. These include cfg, clg, dbb, ini, keychain, prf, prx, psf, rdf, reg, thmx, vmx, wfc accdb, db, dsn, mdb, mdf, pdb, sql, sqlite as, asc, c, cbl, cc, class, cp, cpp, cs, csproj, dev, dtd, f, fs, fsproj, fsx, ftl, gem, h, hpp, ise, ism, java, m, ocx, application/msaccess, application/xmsaccess, application/vnd.msaccess, application/vnd.ms-access, application/mdb, application/x-mdb, chemical/x-pdb text/plain, text/x-c, application/ java, application/java-byte-code, application/x-java-class, text/xml,
| Appendix C – Default File Type Categories | 606
File Type Category Name
programming project files, source code files, code libraries, header files, and class files. Compiled objects and components are also included in this category.)
File Extensions
pas, pod, pro, py, r, rb, sh, src, tcl, trx, v, vbproj, vcproj, vtm, xcodeproj
MIME Headers
text/x-fortran, text/x-h, text/xjava-source, text/x-m, application/ octet-stream, text/pascal, text/xscript.phyton, application/x-bsh, application/x-sh, application/x-shar, text/x-script.sh, application/x-waissource, application/x-tcl, text/xscript.tcl
application/x-cdlink Disk Image Files (Disk image files contain an exact copy of a hard disk or other type of media. They include all the files, as well as the file system information. This allows disk images to be used for duplicating disks, CDs, and DVDs. They are often used for backup purposes as well.)
Document Files(Document file format could be described as a text, or binary data file type, used to store formatted documents (texts, pictures, cliparts, tables, charts, multiple pages, multiple documents etc.).) dmg, iso, mdf, nrg, nri, pvm, toast, vcd, vmdk doc, docx, wbk, xls, xlsx, ppt, pptx, oft, pub, msg, one, xsf, xsn, grv, mpp, mpt, acl, pip, thmx, aw, bld, blg, bvp, cdd, cdf, contact, csv, dat, dif, dmsp, efx, epub, epw, exif, exp, fdb, fxp, gbr, gpi, hdf, id2, lib, mat, mcd, menc, mw, ndx, not, notebook, out, ovf, pdx, pfc, pps, ppsx, pptm, prj, qbw, sdf, svf, tar, tsv, vcf, vdb, vxml, windowslivecontact, wlmp, xfd, xml, xsl, xslt, lit, log, lst, odt, opml, pages, rtf, sig, tex, txt, wpd, wps, pdf application/msword, application/ vnd.openxmlformatsofficedocument.wordprocessingml.document, application/excel, application/ vnd.ms-excel, application/xexcel, application/x-msexcel, application/vnd.openxmlformatsofficedocument.spreadsheetml.sheet, application/mspowerpoint, application/powerpoint, application/vnd.ms-powerpoint, application/x-mspowerpoint, application/vnd.openxmlformatsofficedocument.presentationml.presentation, application/x-mspublisher, application/onenote, application/ octet-stream, application/vnd.msproject, application/x-project, application/vnd.ms-officetheme, application/cdf, application/xcdf, application/x-netcdf, text/ comma-separated-values, text/ csv, application/csv, video/x-dv, application/x-hdf, application/ mcad, application/x-mathcad, application/vnd.openxmlformatsofficedocument.presentationml.slideshow, application/vnd.mspowerpoint.presentation.macroEnabled.12, image/vnd.dwg, image/x-dwg, application/x-tar, text/tab-separatedvalues, text/x-vcard, application/ xml, text/xml, application/x-msreader, text/plain, application/rtf, application/x-rtf, text/richtext, application/x-tex, application/ wordperfect, application/x-
| Appendix C – Default File Type Categories | 607
File Type Category Name
Dynamic Files
Encoded Files (Encoded files are files that store data in an encoded format. These include encrypted files, uncompressed archives, and binary-encoded text files. Files are often encoded for security purposes and to keep them from being corrupted during data transfers.)
Executable Files
Image Files
Page Layout Files (Page layout files are documents that may contain both text and image data. They also include formatting information, which defines the page size, margins, and how content is organized on the page. Page layout documents are often used for creating printable publications, such as newspapers, magazines, and brochures.)
Plugin Files (Plugin files provide extra features and functionality to existing programs. They are commonly used by image, video, and audio editing applications, as well as Web browsers. Plugins are also referred to as add-ons and extensions.)
System Files(The System Files category includes files related to
Mac, Windows, and Linux operating systems. Some examples include system libraries, icons, themes, and device drivers. Files output by the system are also included in this category.)
Video Files
File Extensions MIME Headers
wpwin, application/vnd.ms-works, application/pdf pl, jsp, asp, php, cgi, shtml bin, enc, hex, hqx, mim, mime, uue application/mac-binary, application/ macbinary, application/octet-stream, application/x-binary, application/ x-macbinary, application/binhex, application/binhex4, application/ mac-binhex, application/macbinhex40, application/x-binhex40, application/x-mac-binhex40, message/rfc822, www/mime, text/xuuencode exe, cmd, bat, com text/x-script.perl, text/asp, text/xserver-parsed-html, text/html bmp, gif, jpeg, jpg, pcx, png application/bat, application/x-bat, application/x-msdos-program, application/textedit, application/ octet-stream, text/plain image/bmp, image/x-windows-bmp, image/gif, image/pjpeg, image/jpeg, image/x-pcx, image/png idml, indd, inx, isd, mdi, pct, pdf, pmd, ptx, pub, qxb, qxd, qxp, rels, xps image/x-pict, application/pdf, application/x-mspublisher, application/octet-stream, application/ vnd.ms-xpsdocument
8bi, arx, crx, plugin, vst, xll bashrc, cab, cpl, cur, dll, dmp, drv, hlp, ico, key, lnk, msp, prf, profile, scf, scr, sys dat, mov, avi, qt, smi, sml, smil, flc, fli, vfw, mpeg, mpg, m15, m1u, m1a, application/x-visio, application/ excel,application/vnd.ms-excel, application/x-excel application/vnd.ms-cab-compressed, application/octet-stream, application/ x-msdownload, application/hlp, application/x-helpfile, application/xwinhelp, image/x-icon application/octet-stream, application/ x-troff-msvideo, video/avi, video/ msvideo, video/x-msvideo, video/
| Appendix C – Default File Type Categories | 608
File Type Category Name
Web Files (The Web Files category includes files related to websites and Web servers. These include static and dynamic webpages, Web applications, and files referenced by webpages.)
File Extensions
m75, mls, mp2, mpm, mp, rm, wmv, flv, swf alx, asax, asmx, aspx, atom, att, axd, chm, dwt
MIME Headers
quicktime, application/smil, application/x-simile, Video/flc, video/fli, video/x-fli, video/mpeg, video/x-mpeg, video/x-mpeq2a, application/vnd.rn-realmedia, video/ flv, application/x-shockwave-flash application/atom+xml
Appendix D - Supported Micro-Apps
List of Micro-Apps Supported:
• SkyDrive File Upload
• SkyDrive File Upload
• SkyDrive File Download
• Google Drive File Upload
• Google Drive File Download
• Hotmail Webmail File Attach
• Yahoo Webmail File Attach
• AIM File Transfer
• Facebook Games
• FarmVille-Facebook Games
• Bejeweled-Facebook Games
• Google Drive Base
• Google Earth Application
• YouTube Video Search
• WLM WebChat
• Gmail WebChat
• Facebook Chat
• Google Plus Web Chat
• Freegate Proxy
• Gmail Video Chat Streaming
• YouTube Website
• Youtube Video Streaming
• Facebook Video Playback
• Youtube Video Upload
• Dropbox Download
• Gmail WebMail
• Yahoo WebMail
• Facebook Applications
• Facebook Plugin
• Twitter Website
• Facebook Website
• LinkedIN Compose Webmail
• Facebook Video Chat
• Google Plus Website
• Facebook Pics Download
• Facebook Pics Upload
• Facebook Video Upload
• Facebook Status Update
• LinkedIN Mail Inbox
• LinkedIN Status Update
• LinkedIN Job Search
• LinkedIN Company Search
• Twitter Upload
• Twitter Message
| Appendix D - Supported Micro-Apps | 609
• Twitter Status Update
• Facebook Message
• Facebook Like Plugin
• NinjaSaga FacebookApp
• Gmail Attachment (Browser Only)
• Guilt
• Gmail Android Application
• Google Hangout Android App (Msg Send Only)
• Facebook Post Attachment
• Facebook Questions
• Facebook Commenting
• Facebook Posting
• Facebook Events
• Angry Birds Friends
• Avataria
• Baseball Heroes
• Battlefront Heroes
• BINGO Blitz
• Boule & Bill
• Bubble Island
• Bubble Safari
• Bubble Witch Saga
• Cafeland
• Candy Crush Saga
• Car Town
• ChefVille
• CityVille
• Coco Girl
• Contract Wars
• Cookie Jam
• Criminal Case
• DEAD TRIGGER 2
• Deer Hunter 2014
• Diamond Dash
• Disney City Girl
• DoubleDown Casino - Free Slots
• Dragon City
• 8 Ball Pool
• Buggle
• Bingo Bash
• Marvel: Avengers Alliance
• TeenPatti
• Extreme Road Trip 2
• Family Farm
• Farm Epic
• Farm Heroes Saga
• FarmVille 2
• Fashland – Dress UP for Fashion
• Fish Epic
• Happy Family
| Appendix D - Supported Micro-Apps | 610
• Hit It Rich! Casino Slots
• Jelly Glutton
• Jelly Splash
• Jetpack Joyride
• Juice Cubes
• Jurassic Park Builder
• Kitchen Scramble
• Lost Bubbles
• Lost Jewels
• Mahjong Trails
• Marketland
• Marvel Avengers Alliance Tactics
• Megapolis
• Monster World
• Monster Busters
• Monster Legends
• Mutants: Genetic Galdiators
• Ninja Kingdom
• UNO & Friends
• Online Soccer Manager
• Panda Jam
• Papa Pear Saga
• Pearl's Peril
• Pepper Panic Saga
• Pet City
• Pet Rescue Saga
• Pengle
• Pig & Dragon
• Pudding Pop
• Royal Story
• Suburbia
• Zoo World
• Pool Live Tour
• Puzzle Charms
• Palnts vs. Zombies Advanture
• Red Crucible 2
• Safari Escape
• School of Dragons
• Shadow Fight
• Slotomania Slot Machines
• Social Empires
• Social Wars
• Soliter Arena
• SongPop
• Stardoll
• Stick Run
• StreetRace Rivals
• Tetris Battle
• Texas HoldEm Poker
• Flow Game
| Appendix D - Supported Micro-Apps | 611
• Logo Games
• The Smurfs & Co
• Train Station
• Throne Rush
• Top Eleven Be a Football Manager
• Trial Xtreme 3
• Trivia Crack
• Vector
• Village Life
• Words With Friends
| Appendix D - Supported Micro-Apps | 612
Scarica
Link pubblico aggiornato
Il link pubblico alla tua chat è stato aggiornato. Puoi visualizzare e gestire i tuoi link di chat dopo la registrazione qui.
Link pubblico del documento
Pubblicità
