Sophos v15.01.0 Group-Level Guide Firewall Manager User guide
Publicitate
Publicitate
Sophos XG Firewall v 15.01.0 – Release Notes
Sophos Firewall Manager
Group-Level Guide v15.01.0
For Sophos and Cyberoam Customers
Document Date: November 2015
| Contents | 2
Contents
| Device Configuration | 3
Device Configuration
Sophos Firewalll Manager (SFM) enables the organization to monitor and manage multiple Firewall devices from a central location. Device Configuration allows sorting of the added devices on the basis of different criteria for better visibility and permits enforcement of global policies for security features like Firewall, VPN, Intrusion Prevention
System, Application filter, Anti-spam and Anti-virus on them. It also allows the administrator to create and implement multiple Traffic Shaping policies to stop bandwidth abuse in organization to ensure productivity of the employees.
As soon as an device is added to SFM, SFM connects to the device and starts synchronization process and the status of the device changes to . In the synchronization process, SFM updates its local copy as per the information provided by the device. Once the synchronization is successful, status changes to . SFM maintains the mirror or duplicate copy of the Device configuration. However, the device copy is always considered as the master copy. If due to any reason, if synchronization process fails device status changes to .
Once the device is added and synchronized, the device sends the information like device health, network information, various attacks and threats identified by the device to SFM through heartbeat at the regular interval.
Device Configuration has the following Dashboards to view and manage device groups and individual devices:
•
•
Home
The Home appears as soon as you logon to the SFM Admin Console. Home provides a single screen snapshot of the state and health of the SFM System and the managed devices.
Device Information
All Managed Devices - Total number of devices in the selected device group or subgroup
Synchronized - Total number of synchronized devices in selected devices group or subgroup
Unsynchronized - Number of unsynchronized devices in selected devices group or subgroup
Connected - Total number of devices currently connected to SFM in selected device group or subgroup
Disconnected - Number of devices in selected device group or subgroup, which are currently disconnected.
Device Monitor Summary
Dashboard Monitoring Graph displays critical heath information of the managed Devices in graphical manner. SFM monitors the managed device based on the following heath parameters and statuses:
• Security: HTTP Attacks, Mail Attacks, Spam Mails, Web Usage Health, IPS Alert.
• Resource: CPU, Memory, Disk (Report), Disk (Config).
• Licensing: Base Firewall, Network Protection, Web Protection, Email Protection, Web Server Protection,
Enhanced Support, Enhanced Plus Support.
The Monitoring Dashboard continuously monitors the managed devices for the wide range of security attacks, resource utilization and licensing statuses which helps the administrator to take informed decisions in resolving the risk landscape.
The administrator can set the threshold values for each of the parameters by clicking on Adjust Thresholds hyperlink.
However, if the administrator does not specify the threshold values, the graphs are generated with Device Defaults based on the table below:
| Device Configuration | 4
Gateway Status
Gateway Name - Name of the gateway
Gateway IP address - IP address of the gateway
Gateway Status - Status of the gateway
Model Wise Information
This area provides the name of device model along with total number of devices of that model number.
Click the hyperlink to view following details of device model:
• Device Name – Name of device
• Device Key – Device key of the managed device
• Company Name – Name of the company where the managed device is deployed
• Model – Model number of the managed device
• Status - Current state of the device
System Information
System Time - System (SFM) time in Day Date Mon YYYY HH:MM:SS format
Up Time - SFM device up time duration in day, hours and minutes format
SFM Version - SFM version number along with the link to check the availability of new version
Model - SFM Device model number
Device Key - SFM device key
Peer Device Key - If the device is deployed in HA (High Availability) node then it displays device key of auxiliary device.
Compatible SF Versions - List of SF device versions which are manageable through SFM
Live Connected Users - Number of connected users. Click to view details of connected users
Messages
Time - Time of sending alert in date and time format
Message - Alert message(s) generated by SFM system to notify the administrator regarding any alarming situation or availability of new SFM version.
Device Dashboard
Device Dashboard provides a single screen snapshot of the state and health of the selected managed device. To view the details of individual device, go to Device Configuration and expand the Device Group tree and select any device.
Device Information
Company Name - Name of the company under whose name device is to be registered. For unregistered devices this field will be blank.
Device Name - Name of the device. Click Edit hyperlink to edit the device details.
Device Key - Device key
Model - Model number
Location - Name of the place where SF device is deployed.
| Device Configuration | 5
Firmware Version - Firmware version running on the device
Time Zone - Time zone of the device
Date & Time (Time calculated based on SFM time) - Date and time of device in Day Mon DD YYYY HH:MM:SS format
Last Good Backup - Date and time in Day Mon DD YYYY HH:MM:SS format when last good backup has been taken.
Last Backup - Date and time in Day Mon DD YYYY HH:MM:SS format when last backup has been taken.
Change Detail - Status of Change Control Settings. If the change control is enabled it displays hyperlink to view change control for the device.
Connection Information
Device IP/Domain - Address IP address of the device
Connection Status - Current connectivity status
Synchronization Status - Synchronization status. Click ‘Sync now’ hyperlink to start synchronization process.
Communication Mode - Communication mode to manage SF device from SFM.
Available Modes:
• Central Management will push updates to this Device
• This Device will fetch updates from Central Management Communicate with SF using Communication protocol –
HTTP, HTTPS Port Communication port Test Connection Click “Test Now” to establish the connection between
SF and SFM.
Security
Gives security information on Web Virus, Mail Virus, Spam Mails, Web Usage Health, Intrusion Attacks, IPS
Severity, ATP Events and Endpoint Health.
Resource
Gives resource utilization information on CPU, Memory, Disk (Report) and Disk (Config).
Availability
License
Gives license information on Essential Firewall, Network Protection, Web Protection, Mail Protection, Web Server
Protection, Standard Support and Enhanced Support.
Signature Information (Applicable only if the device is Registered)
IPS Signature Version - IPS signature database version on the device. Click Synchronize button to update IPS signature database with latest available database version at upgrade server.
Anti Virus Version - Anti Virus engine version on the device. Click Synchronize button to update AV signature database with latest available database version at upgrade version.
Device Monitoring
Packet Capture - Displays time in Day, DD Mon YYYY at HH:MM:SS format when packet capture information is fetched from managed devices through SFM.
Connection Capture - Displays time in Day, DD Mon YYYY at HH:MM:SS format when connection list information is fetched from managed devices through SFM. Connection list provides current or live connection snapshot of managed device in the list form.
| Device Configuration | 6
Tools - Click to open Tools page of managed device.
CTR - Displays time in Day, DD Mon YYYY at HH:MM:SS format when CTR is generated for managed devices through SFM. DHCP Lease - Displays time in Day, DD Mon YYYY at HH:MM:SS format when DHCP Lease information is fetched from managed devices through SFM.
Live Users - Displays time in Day, DD Mon YYYY at HH:MM:SS format when Live Users information is fetched from managed devices through SFM.
IPSec Connections - Displays time in Day, DD Mon YYYY at HH:MM:SS format when IPSec Connections information is fetched from managed devices through SFM. SSL VPN Users Displays time in Day, DD Mon YYYY at HH:MM:SS format when SSL VPN Users information is fetched from managed devices through SFM.
Live Connection IPv4 - Displays time in Day, DD Mon YYYY at HH:MM:SS format when IPv4 Live Connections information is fetched from managed devices through SFM.
Live Connection IPv6 - Displays time in Day, DD Mon YYYY at HH:MM:SS format when IPv6 Live Connections information is fetched from managed devices through SFM.
CPU usage for last two hours
Displays line graph for CPU usage for last two hours.
Memory usage for last two hours
Displays line graph for Memory usage for last two hours.
Interface Status
Displays status of managed device’s interfaces with details like Interface Name, MTU, Interface Speed, MAC
Address, Status of the interface.
Policy Configuration Tasks
SFM allows following types of configuration:
Group level configuration - Configuration to be applied to all the devices in the group.
Subgroup level configuration - Configuration to be applied to all the devices in the sub group.
Device level configuration - Configuration to be applied to the individual devices only.
For managing and monitoring purpose, SFM groups all the managed devices into various groups. Use All Managed
Devices drop down to view list of all the groups.
By default, SFM is shipped with three default Device Groups:
• All Managed Devices – Displays list of all the devices by name and their status.
• All Firmware Versions – SFM automatically groups all the devices added in SFM as per the device firmware version.
• All Device Models – To view the device model wise grouping, under the Device Group, click All Device Models
Version.
| Device Configuration | 7
SFM allows you to create custom Device Groups based on various criteria like Department, Country etc. Please refer
System Management > System Settings > Device Settings > Device Group to create and manage Device Groups.
To see the individual devices, use the Manage Policy menu.
Manage Policy drop down menu also displays status of the Devices as:
Connected and synchronized
Disconnected and synchronized
Connected and unsynchronized.
Disconnected and unsynchronized
Disconnected
SFM displays details of all the added devices as soon as you log on to Web Admin Console in the form of Dashboard.
SFM provides two types of dashboards:
•
– Consolidated dashboard for all the devices of selected device group or device subgroup
•
– Dashboard for the selected device only
Please note that type of dashboard displayed changes, based on selected device group, subgroup or device. .
Policies
Policies are security rule-sets to implement control over users, applications or network objects in an organization.
Using Policies, you can create blanket or specialized traffic transit rules based on the requirement. Policies provide centralized management for the entire set of device security policies. Sophos Firewall implements single pane of management to secure all enterprise applications using configuration templates for various types of policies.
Following sections provide more information on the Policies menu.
•
•
•
•
•
Understanding List of Policies
Introduction
Policies are based on the following configurable templates to define the policy rules:
| Device Configuration | 8
1.
2.
Managing Policies
You can see the entire list of added security Policies from the Policies menu. Using the same menu, you can update existing policies or add new policies. To change the processing order, you can re-order policies by drag and drop action.
Note: All custom policies can be re-ordered. The order of processing is top to bottom.
On the Policies page, the following action buttons can be found.
• IPv4: Select to filter only IPv4 policies
• IPv6: Select to filter only IPv6 policies
• Enable Filter: Select to open filter view and apply the following filters for IPv4 or IPv6 policies:
1. Rule Type - Select to filter policies based on Business, User or Network
2. Source Zone - Select to filter policies based on LAN, WAN, DMZ, VPN or WiFi
3. Destination Zone - Select to filter policies based on LAN, WAN, DMZ, VPN or WiFi
4. State - Select to filter policies based on Unused, Disabled, Changed, New
5. Rule ID - Specify Rule ID to see the specific policy.
• Reset Filter (Available if filter is enabled) - Select to reset all filters
• Disable Filter (Available if filter is enabled) - Select to close filter view
• + Add Firewall Rule - Select to add a new policy among Business Application Rule, or User/Network Rule.
Default Policies
The following default policies are created with Network Configuration Wizard during first time deployment.
1. #Default_User_Policy
2. #Default_Network_Policy
Note: Default Policies cannot be disabled, deleted or re-ordered. However, you can edit default policies or insert new policies above them.
Understanding Icons
There are various action icons as well as symbolic icons on the Policies page. Meanings and associated actions of all icons are shown below.
Icons
Icons in Collapsed view
Meaning
Business Application Rule
User Rule
Network Rule
Rule ID
Traffic Shaping
| Device Configuration | 9
Icons Meaning
Schedule
IPS
Security Heartbeat Inactive
Security Heartbeat Active.
Policy Enabled. Click to disable the policy.
Policy Disabled. Click to enable the policy.
Expand Policy for More Information
Icons in Expanded view
Policy ID
Edit Policy
Delete Policy (Not applicable for default policies)
Insert a new Firewall Rule above
Insert a new Firewall Rule below
Move policy. To move the policy, click the icon and drag-and-drop at the required position. (Not applicable for default policies)
Collapse Policy
Understanding List of Policies
All added policies are available in the form of a list. Each policy in the list presents quick snapshot of the policy. To view policy details, click to expand. The items available in the collapsed or expanded view is shown below.
Items in collapsed view:
• Policy Name: Name of the policy
• In/Out: Amount of Traffic (in Bytes) coming in or going out using the particular policy
• Policy features: Status of Schedule, Heartbeat, IPS and Traffic Shaping
• Source: Source Zone
• Destination: Destination Zone
• What: Shows Protected Domains/Services
• Action: Status of Protected Servers, Status of Web and Application Protection for user
| Device Configuration | 10
Additional items in expanded view:
• ID: Policy ID
• User's Policy Applied: Status of Application Filter, Web Filter, AV and AS Scanning, NAT Policy and Route
Through Gateway, if configured
• Policy Summary: Summary of the added policy
User/Network Rule
User/Network Rule is used to define access rights and protection to the network objects/hosts. In a nutshell, if you want to control traffic by source, service, destination, zone, then use a Network Rule. Additionally, administrator has the option to attach user identity to a the rule in order to customize access of assorted hosts/servers. Such identity based rule, is considered a User Rule.
You can view or add a User/Network Policy for IPv4 and IPv6 traffic.
1.
2.
Add User/Network Rule (IPv4)
This page is used to define access rights and protection to the network objects/hosts.
1. Click Policies and select IPv4 using the filter switch. Now, click on +Add Firewall Rule and select User/
Network Rule.
2. Enter policy introduction for About This Rule.
Rule Position
Specify the position of the rule from the available options.
Available Options:
Top Bottom
Rule Name
Specify a name to identify the policy.
Description
Specify Policy Description.
Figure 1: About This Rule
3. Specify Identity details. Follow this step if you want to configure a User Rule.
Match rule based on user identity
Click to enable policy based on user identity.
User or Groups.(Applicable only when Match rule based on user identity is Enabled)
Select the user(s) or group(s) from the list of available options.
Exclude this user activity from data accounting. (Applicable only when Match rule based on user identity is
Enabled)
Click to enable/disable user traffic activity from data accounting.
| Device Configuration | 11
By default, user’s network traffic is considered in data accounting. Select to exclude certain traffic user data accounting. The traffic allowed through this firewall rule will not be accounted towards data transfer for the user.
Figure 2: Identity
4. Specify Source details.
Zone
Select the source zone(s) allowed to the user.
Networks
Select the source network(s) allowed to the user.
A new network host can be created directly from this page itself or from Objects > Hosts and Services > IP
Host page.
Services
Select the services(s) allowed to the user.
A new network host can be created directly from this page itself or from Objects > Hosts and Services >
Services page.
Schedule
Select the schedule allowed to the user.
A new network host can be created directly from this page itself or from Objects > Policies > Schedule page.
| Device Configuration | 12
Figure 3: Source
5. Specify Destination details.
Zone
Select the destination zone(s) allowed to the user.
Networks
Select the destination network(s) allowed to the user.
A new network host can be created directly from this page itself or from Objects > Assets > IP Host page.
Figure 4: Destination
6. Specify the Action for the network traffic.
Action
Specify action for the rule traffic from the available options. Accept – Allow accessDrop – Drop – Silently discardReject – Deny access (“ICMP port unreachable” message is sent to the source)
When sending response it might be possible that the response is sent using a different interface than the one on which request was received. This may happen depending on the Routing configuration done on the device.
| Device Configuration | 13
For example, If the request is received on the LAN port using a spoofed IP Address (public IP Address or the
IP Address not in the LAN zone network) and specific route is not defined, the device will send a response to these hosts using the default route. Hence, response will be sent through the WAN port.
Figure 5: Action
7. Specify Routing details. (Applicable only when Action for the traffic is Accept)
Rewrite source address (Masquerading)
Enable or Disable to re-write the source address or specify a NAT policy.
Use Gateway Specific Default NAT Policy (Applicable only if Masquerading is enabled and Destination Zone
is selected as WAN)_
Click to override the default NAT policy with a gateway specific policy.
Override default NAT policy for specific Gateway (Applicable only if Use Gateway Specific Default NAT
Policy is enabled )
Enable to specify gateway and corresponding NAT policy. Multiple Gateways and NAT Policy can be added.
Use Outbound Address (Applicable when Rewrite source address is enabled)
Select the NAT policy to be applied the list or available NAT policies.
A new NAT policy can be created directly from this page itself or from Objects > Policies > NAT page.
Default NAT policy is Masquerade.
Primary Gateway
Specify the Primary Gateway. This is applicable only if more than one gateway is defined.
Backup Gateway
Specify the Backup Gateway. This is applicable only if more than one gateway is defined.
DSCP Marking
Select the DSCP Marking. Select DSCP Marking.
DSCP (DiffServ Code Point) classifies flow of packets as they enter the local network depending upon QoS.
Flow is defined by 5 elements; Source IP Address, Destination IP Address, Source port, Destination port and the transport protocol.
.
Figure 6: Routing
8. Specify Malware Scanning details.
| Device Configuration | 14
Scan FTP/HTTP
Click to enable FTP/HTTP for the traffic.
Decrypt & Scan HTTPS
Click to enable decryption and scanning for the traffic.
Figure 7: Malware Scanning
9. Specify polices for user applications. (Applicable only when Action for the traffic is Accept)
Application Control (Applicable only if Match rule based on user identity is 'Disabled')
Select Application Filter Policy for the rule. A new Application Filter Policy can be created directly from this page itself or from Objects > Policies > Application Group page.
Apply Application-based Traffic Shaping Policy (Applicable only if Match rule based on user identity is
'Disabled')
Click to restrict bandwidth for the applications categorized under the Application category.
A three step configuration is required as follows:
1. Create Traffic Shaping policy from Objects > Policies > Traffic Shaping. Here, specify the Policy
Association as 'Applications'.
2. Now, assign the created policy for Application Control.
3. Check to enable Apply Web based Traffic Shaping Policy.
Web Filter (Applicable only if Match rule based on user identity is 'Disabled')
Select Web Filter Policy for the rule.
It controls access to application like IM and P2P, VOIP.
A new Web Filter Policy can be created directly from this page itself or from Objects > Policies > Web Filter
Policy page.
Apply Web Category based Traffic Shaping Policy (Applicable only if Match rule based on user identity is
'Disabled')
Click to restrict bandwidth for the URLs categorized under the Web category.
A three step configuration is required as follows:
1. Create Traffic Shaping policy from Objects > Policies > Traffic Shaping. Here, specify the Policy
Association as 'Web Categories'.
2. Now, assign the created policy for Web Filter.
3. Check to enable Apply Web Category based Traffic Shaping Policy.
Intrusion Prevention
Select IPS Policy for the rule. A new Web Filter Policy can be created directly from this page itself or from
Objects > Policies > IPS page.
Traffic Shaping
User's Traffic Shaping policy will be applied automatically.
| Device Configuration | 15
Figure 8: Policy for User Applications
10. Define logging option for the user application traffic.
Log Firewall Traffic
Click to enable logging of permitted and denied traffic.
Figure 9: Log Traffic
11. Configure Security Heartbeat settings. (Applicable only when Action for the traffic is Accept)
Require Security Heartbeat
Heartbeat-capable devices can be required to send information on their health status in defined intervals - this is called a heartbeat.
Based on that information, you can restrict a device's access to certain services and networks.
Enable/disable the option to require the sending of heartbeats.
Minimum Heartbeat Permitted
Select a minimum health status that a device must have to conform to this policy. Health status can be either
Green, Yellow or No Restriction. If the health criterion is not met, access and privileges defined in this policy will not be granted to the user.
Figure 10: Security Heartbeat
12. Click Save to save the settings.
Add User/Network Rule (IPv6)
Use this page to add a new policy for applications accessed by your users.
1. Click Policies and select IPv6 using the filter switch. Now, click on +Add Firewall Rule and select User/
Network Policy.
2. Enter policy introduction for About This Rule.
Rule Position
Specify the position of the rule from the available options.
Available Options:
Top Bottom
| Device Configuration | 16
Rule Name
Specify a name to identify the policy.
Description
Specify Policy Description.
Figure 11: About This Rule
3. Specify Source details.
Zone
Select the source zone(s) allowed to the user.
Networks
Select the source network(s) allowed to the user.
A new network host can be created directly from this page itself or from Objects > Assets > IP Host page.
Services
Select the services(s) allowed to the user.
A new network host can be created directly from this page itself or from Objects > Assets > Services page.
Schedule
Select the schedule allowed to the user.
A new network host can be created directly from this page itself or from Objects > Policy > Schedule page.
| Device Configuration | 17
Figure 12: Source
4. Specify Destination details.
Zone
Select the destination zone(s) allowed to the user.
Networks
Select the destination network(s) allowed to the user.
A new network host can be created directly from this page itself or from Objects > Assets > IP Host page.
Figure 13: Destination
5. Specify the Action for the network traffic.
Action
Specify action for the rule traffic from the available options.
Available Options: Accept – Allow access Drop – Silently discardReject – Deny access (“ICMP port unreachable” message is sent to the source)
When sending response it might be possible that the response is sent using a different interface than the one on which request was received. This may happen depending on the Routing configuration done on the device.
| Device Configuration | 18
For example, If the request is received on the LAN port using a spoofed IP Address (public IP Address or the
IP Address not in the LAN zone network) and specific route is not defined, the device will send a response to these hosts using the default route. Hence, response will be sent through the WAN port.
Figure 14: Action
6. Specify Identity details. (Applicable only when Action for the traffic is Accept)
Match rule based on user identity
Click to enable policy based on user identity.
User or Groups.(Applicable only when Match rule based on user identity is Enabled)
Select the user(s) or group(s) from the list of available options.
Exclude this user activity from data accounting. (Applicable only when Match rule based on user identity is
Enabled)
Click to enable/disable user traffic activity from data accounting.
By default, user’s network traffic is considered in data accounting. Select to exclude certain traffic user data accounting. The traffic allowed through this firewall rule will not be accounted towards data transfer for the user.
Figure 15: Identity
7. Specify Routing details. (Applicable only when Action for the traffic is Accept)
Rewrite source address (Masquerading)
Enable or Disable to re-write the source address or specify a NAT policy.
Use Gateway Specific Default NAT Policy (Applicable only if Masquerading is enabled and Destination Zone
is selected as WAN)_
Click to override the default NAT policy with a gateway specific policy.
Override default NAT policy for specific Gateway (Applicable only if Use Gateway Specific Default NAT
Policy is enabled )
Enable to specify gateway and corresponding NAT policy. Multiple Gateways and NAT Policy can be added.
Use Outbound Address (Applicable when Rewrite source address is enabled)
Select the NAT policy to be applied the list or available NAT policies.
A new NAT policy can be created directly from this page itself or from Objects > Policies > NAT page.
Default NAT policy is Masquerade.
Primary Gateway
Specify the Primary Gateway. This is applicable only if more than one gateway is defined.
| Device Configuration | 19
Backup Gateway
Specify the Backup Gateway. This is applicable only if more than one gateway is defined.
DSCP Marking
Select the DSCP Marking. Select DSCP Marking.
DSCP (DiffServ Code Point) classifies flow of packets as they enter the local network depending upon QoS.
Flow is defined by 5 elements; Source IP Address, Destination IP Address, Source port, Destination port and the transport protocol.
.
Figure 16: Routing
8. Specify Malware Scanning details.
Scan FTP/HTTP
Click to enable FTP/HTTP for the traffic.
Decrypt & Scan HTTPS
Click to enable decryption and scanning for the traffic.
Figure 17: Malware Scanning
9. Specify polices for user applications. (Applicable only when Action for the traffic is Accept)
Application Control (Applicable only if Match rule based on user identity is 'Disabled')
Select Application Filter Policy for the rule. A new Application Filter Policy can be created directly from this page itself or from Objects > Policies > Application Group page.
Apply Application-based Traffic Shaping Policy (Applicable only if Match rule based on user identity is
'Disabled')
Click to restrict bandwidth for the applications categorized under the Application category.
A three step configuration is required as follows:
1. Create Traffic Shaping policy from Objects > Policies > Traffic Shaping. Here, specify the Policy
Association as 'Applications'.
2. Now, assign the created policy for Application Control.
| Device Configuration | 20
3. Check to enable Apply Web based Traffic Shaping Policy.
Web Filter (Applicable only if Match rule based on user identity is 'Disabled')
Select Web Filter Policy for the rule.
It controls access to application like IM and P2P, VOIP.
A new Web Filter Policy can be created directly from this page itself or from Objects > Policies > Web Filter
Policy page.
Apply Web Category based Traffic Shaping Policy (Applicable only if Match rule based on user identity is
'Disabled')
Click to restrict bandwidth for the URLs categorized under the Web category.
A three step configuration is required as follows:
1. Create Traffic Shaping policy from Objects > Policies > Traffic Shaping. Here, specify the Policy
Association as 'Web Categories'.
2. Now, assign the created policy for Web Filter.
3. Check to enable Apply Web Category based Traffic Shaping Policy.
Intrusion Prevention (IPS)
Select IPS Policy for the rule. A new Web Filter Policy can be created directly from this page itself or from
Objects > Policies > IPS page.
Traffic Shaping Policy
User's Traffic Shaping policy will be applied automatically.
Figure 18: Policy for User Applications
10. Define logging option for the user application traffic.
Log Firewall Traffic
Click to enable logging of permitted and denied traffic.
Figure 19: Log Traffic
11. Click Save to save the settings.
Business Application Rule
Business Application Rule
Business Application Rule is used to protect all internally or publicly hosted business applications or servers like
SalesForce, Sharepoint etc. Using Business Application Rule, the administrator can configure protection of the HTTP/
| Device Configuration | 21
Non-HTTP/Public Non-HTTP servers from unauthorized access over the Internet. In a nutshell, if you are securing a server or service, use a Business Application Rule to allow internal or external users to access that service.
Business Application Rule can have three configurable templates:
1.
- HTTP Based policy is used to protect HTTP or generic web application servers hosted in
the network. HTTP Based policy configuration is essentially WAF implementation but with additional benefit of defining WAF objects, rules, exceptions from the same page.
Sophos Firewall offers several pre-configured templates to address commonly used HTTP based applications. You can use these to create policy for the web application, that is close to your configuration, then modify it to fit your needs. Pre-defined HTTP application templates include:
•
•
•
•
on page 40
•
Microsoft Remote Desktop Gateway 2008 and R2
•
Microsoft Remote Desktop Web 2008 and R2
•
Microsoft Sharepoint 2010 and 2013
2.
- Non-HTTP Based policy is used to protect Non-HTTP servers, like mail or other
servers hosted inside the network (LAN or DMZ). Using Non-HTTP Based policy, you can define access rights of such servers to users who require access over the WAN or Internet. Additionally, you can use the following Non-
HTTP application template:
•
3.
- Email Servers (POP and IMAP) policy is used to protect mail servers which
are hosted publicly (WAN) and require protection.
Adding a Business Application Rule
Click Policies and select IPv4 using the filter switch. Now, click on +Add Firewall Rule and select Business
Application Rule. In the About this Rule section, you can select the Application Template from the list of available templates.
The application template allows you to choose the rule which suits the configuration of the required business application. Once you select the template, you can see the configuration page with few fields pre-populated. The prepopulated values eliminate the need to manually specify the configuartion for securing your business application, but you may customize the settings according to your network setup or other requirement.
HTTP Based Policy
Applicable only for IPv4 policy.
The HTTP-Based Policy allows you to configure policy for controlling access to your generic HTTP-based business applications. Sophos Firewall offers several other pre-configured templates to address protection of commonly used HTTP based applications. You can use these to create policy for the web application, that is close to your configuration, then modify it to fit your needs.
Sophos Firewall offers several pre-configured templates to address commonly used HTTP based applications. You can use these to create policy for the web application, that is close to your configuration, then modify it to fit your needs. Pre-defined HTTP application templates include:
•
•
•
•
Microsoft Remote Desktop Gateway 2008 and R2
•
Microsoft Remote Desktop Web 2008 and R2
•
Microsoft Sharepoint 2010 and 2013
| Device Configuration | 22
1. Click Policies and select IPv4 using the filter switch. Now, click on +Add Firewall Rule and select Business
Application Rule.
2. Enter policy introduction for About This Rule.
Rule Position
Specify the position of the rule.
Available Options: TopBottom
Application Template
Select HTTP Based Policy to configure rule for generic HTTP based applications.
Rule Name
Specify a name to identify the policy.
Description
Specify Policy Description.
Figure 20: About This Rule
3. Specify Hosted Server details.
Hosted Address
Specify the address of the hosted server to which the rule applies. It is the public IP Address through which
Internet users access internal server/host.
Available Options:
IP Address – Specified IP Address is mapped to a corresponding mapped single or range of IP Address. If single IP Address is mapped to a range of IP Address, device uses round robin algorithm to load balance the requests.IP Range – Specified IP Address Range is mapped to a corresponding range of mapped IP Address.
The IP range defines the start and end of an address range. The start of the range must be lower than the end of the range.Interface IP – Select when any of the device Port, Alias or Hosted LAN (VLAN) sub interface is required to be mapped to the destination host or network. This option is only available for IPv4 family.
HTTPS
Click to Enable or Disable scanning of HTTPS traffic.
Redirect HTTP (Applicable when HTTPS is enable)
Click to redirect HTTP requests.
Listening Port
Enter a port number on which the Hosted web server can be reached externally, over the Internet. Default is port 80 with Plaintext (HTTP) and port 443 with Encrypted (HTTPS).
Domains (Applicable when HTTPS is disabled)
Enter the domains the web server is responsible for as FQDN, e.g. shop.example.com, or use the Action icon to import a list of domain names. You can use an asterisk (*) as a wildcard for the prefix of the domain, e.g.,*.mydomain.com. Domains with wildcards are considered as fallback settings: The Hosted web server
| Device Configuration | 23 with the wildcard domain entry is only used when no other Hosted web server with a more specific domain name is configured. Example: A client request to a.b.c will match a.b.c before *.b.c before *.c.
HTTPS Certificate (Applicable when HTTPS is enabled)
Select the HTTPS Certificate to be used for scanning.
Figure 21: Hosted Server
4. Specify Protected Application Server(s) details.
Enable path-specific routing
You can enable path-specific routing to define (path) to which Web Servers incoming requests are forwarded.
You can define that all URLs with a specific path, for example, /products/, are sent to a specific web server.
On the other hand you can allow more than one web server for a specific request but add rules how to distribute the requests among the servers. Additionally, you can define that each session is bound to one web server throughout its lifetime (sticky session). This may be necessary if you host an online shop and want to make sure that a user sticks to one server during the shopping session. You can also configure to send all requests to one web server and use the others only as a backup.
For each Hosted web server, one default site path route (with path /) is created automatically. The device automatically applies the site path routes in the most reasonable way: starting with the strictest, i.e., longest paths and ending with the default path route which is only used if no other more specific site path route matches the incoming request. The order of the site path route list is not relevant. If no route matches an incoming request, (in case the default route was deleted), the request will be denied.
Add New Path(Applicable when path-specific routing is enabled)
Click Add Path to define a new path.
Note: Add New Path will be active only after at least one Web Server and one Hosted web server have been created.
Hosts(Applicable when path-specific routing is disabled)
Hosts are the Web Servers that are to be protected. Select from the list of Web Servers or click Add New Item to add a Web Server.
A new Web Server can be created directly from this page itself or from Objects > Assets > Web Servers page.
| Device Configuration | 24
Figure 22: Protected Application Server(s)
5. Specify Access Permission details. This step is applicable if Enable path-specific routing is disabled.
Authentication
Select the web application Authentication profile from the list of available profiles. You can also create new Authentication profile the same page or from Protection > Web Server Protection > Web App
Authentication Policies page.
Allow from
Select the allowed host(s)/network(s).
Block from
Select the blocked host(s)/network(s).
Figure 23: Access Permission
6. Specify path Exceptions for the Web Servers. Click Add New Exception to specify new exception.
Figure 24: Exceptions
| Device Configuration | 25
7. Specify Polices for Business Applications.
Application Protection
Select Application Protection for the server.
A new Application Protection can be created directly from this page itself or from Objects > Policies > Web
App Protection page.
Intrusion Prevention
Select IPS Policy for the rule. A new IPS Policy can be created directly from this page itself or from
Objects > Policies > IPS page.
Traffic Shaping
Select Traffic Shaping policy for the rule.
Traffic Shaping policy allocates & limits the maximum bandwidth usage of the user.
A new Traffic Shaping Policy can be created directly from this page itself or from Objects > Policies >
Traffic Shaping page.
Figure 25: Policies For Business Applications
8. Specify Advanced settings for the added server.
Disable Compression Support
By default, this checkbox is disabled and the content is sent compressed when the client requests compressed data. Compression increases transmission speed and reduces page load time. However, in case of websites being displayed incorrectly or when users experience content-encoding errors accessing your web servers, it can be necessary to disable compression support. When the checkbox is enabled, the WAF will request uncompressed data from the Web Servers of this Hosted web server and will send it on uncompressed to the client, independent of the HTTP request's encoding parameter.
Rewrite HTML
Select this option to have the device rewrite links of the returned webpages in order for the links to stay valid.
Example: One of your Web Server instances has the hostname yourcompany.local but the Hosted web server's hostname on the device is yourcompany.com. Thus, absolute links like [a href="http://yourcompany.local/"] will be broken if the link is not rewritten to [a href="http://yourcompany.com/"] before delivery to the client.
However, you do not need to enable this option if either yourcompany.com is configured on your web server or if internal links on your webpages are always realized as relative links. It is recommended to use the option with Microsoft's Outlook Web Access and/or Sharepoint Portal Server.
Note: HTML rewriting affects all files with a HTTP content type of text/* or *xml*, where * is a wildcard. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the HTML rewriting feature.
Rewrite HTML Cookies (Applicable only if Rewrite HTML is enabled)
Select this option to have the device rewrite cookies of the returned webpages.
Note: If Rewrite HTML is disabled the Rewrite Cookie option will be also disabled.
| Device Configuration | 26
Pass Host Header
When you select this option, the host header as requested by the client will be preserved and forwarded along with the web request to the web server. Whether passing the host header is necessary in your environment however depends on the configuration of your web server.
Figure 26: Advanced
Exchange Autodiscover
Applicable only for IPv4 policy.
This page allows you to configure rule for Exchange Autodiscover.
1. Click Policies and select IPv4 using the filter switch. Now, click on +Add Firewall Rule and Business
Application Rule.
2. Enter policy introduction for About This Rule.
Rule Position
Specify the position of the rule.
Available Options: TopBottom
Application Template
Select Exchange Autodiscover to configure policy for Exchange Autodiscover environment.
Rule Name
Specify a name to identify the policy.
Description
Specify Policy Description.
Figure 27: About This Rule
3. Specify Hosted Server details.
Hosted Address
Specify the address of the hosted server to which the rule applies. It is the public IP Address through which
Internet users access internal server/host.
| Device Configuration | 27
Available Options:
IP Address – Specified IP Address is mapped to a corresponding mapped single or range of IP Address. If single IP Address is mapped to a range of IP Address, device uses round robin algorithm to load balance the requests.IP Range – Specified IP Address Range is mapped to a corresponding range of mapped IP Address.
The IP range defines the start and end of an address range. The start of the range must be lower than the end of the range.Interface IP – Select when any of the device Port, Alias or Hosted LAN (VLAN) sub interface is required to be mapped to the destination host or network. This option is only available for IPv4 family.
HTTPS
Click to Enable or Disable scanning of HTTPS traffic.
Redirect HTTP (Applicable when HTTPS is enable)
Click to redirect HTTP requests.
Listening Port
Enter a port number on which the Hosted web server can be reached externally, over the Internet. Default is port 80 with Plaintext (HTTP) and port 443 with Encrypted (HTTPS).
Domains (Applicable when HTTPS is disabled)
Enter the domains the web server is responsible for as FQDN, e.g. shop.example.com, or use the Action icon to import a list of domain names. You can use an asterisk (*) as a wildcard for the prefix of the domain, e.g.,*.mydomain.com. Domains with wildcards are considered as fallback settings: The Hosted web server with the wildcard domain entry is only used when no other Hosted web server with a more specific domain name is configured. Example: A client request to a.b.c will match a.b.c before *.b.c before *.c.
HTTPS Certificate (Applicable when HTTPS is enabled)
Select the HTTPS Certificate to be used for scanning.
Figure 28: Hosted Server
4. Specify Protected Application Server(s) details.
Enable path-specific routing
You can enable path-specific routing to define (path) to which Web Servers incoming requests are forwarded.
You can define that all URLs with a specific path, for example, /products/, are sent to a specific web server.
On the other hand you can allow more than one web server for a specific request but add rules how to distribute the requests among the servers. Additionally, you can define that each session is bound to one web server throughout its lifetime (sticky session). This may be necessary if you host an online shop and want
| Device Configuration | 28 to make sure that a user sticks to one server during the shopping session. You can also configure to send all requests to one web server and use the others only as a backup.
For each Hosted web server, one default site path route (with path /) is created automatically. The device automatically applies the site path routes in the most reasonable way: starting with the strictest, i.e., longest paths and ending with the default path route which is only used if no other more specific site path route matches the incoming request. The order of the site path route list is not relevant. If no route matches an incoming request, (in case the default route was deleted), the request will be denied.
Default - Enabled.
Add New Path(Applicable when path-specific routing is enabled)
Click Add Path to define a new path.
Note: Add New Path will be active only after at least one Web Server and one Hosted web server have been created.
Default Paths - /autodiscover, /Autodiscover, /AutoDiscover.
Web Server(Applicable when path-specific routing is disabled)
Web Servers are the application servers to be protected. Select from the list of Web Servers or click Add New
Item to add a Web Server.
A new Web Server can be created directly from this page itself or from Objects > Assets > Web Servers page.
Figure 29: Protected Application Server(s)
5. Specify Access Permission details. This step is applicable if Enable path-specific routing is disabled.
Authentication
Select the web application Authentication profile from the list of available profiles. You can also create new Authentication profile the same page or from Protection > Web Server Protection > Web App
Authentication Policies page.
Allow from
Select the allowed host(s)/network(s).
Block from
Select the blocked host(s)/network(s).
| Device Configuration | 29
Figure 30: Access Permission
6. Specify path Exceptions for the Web Servers. Click Add New Exception to specify new exception.
Default - /autodiscover/*,/Autodiscover/*.
Figure 31: Exceptions
7. Specify Polices for Business Applications.
Application Protection
Select Application Protection for the server.
A new Application Protection can be created directly from this page itself or from Objects > Policies > Web
App Protection page.
Default - ExchangeAutoDiscover
Intrusion Prevention
Select IPS Policy for the rule. A new IPS Policy can be created directly from this page itself or from
Objects > Policies > IPS page.
Traffic Shaping
Select Traffic Shaping policy for the rule.
Traffic Shaping policy allocates & limits the maximum bandwidth usage of the user.
A new Traffic Shaping Policy can be created directly from this page itself or from Objects > Policies >
Traffic Shaping page.
Figure 32: Policies For Business Applications
8. Specify Advanced settings for the added server.
| Device Configuration | 30
Disable Compression Support
By default, this checkbox is disabled and the content is sent compressed when the client requests compressed data. Compression increases transmission speed and reduces page load time. However, in case of websites being displayed incorrectly or when users experience content-encoding errors accessing your web servers, it can be necessary to disable compression support. When the checkbox is enabled, the WAF will request uncompressed data from the Web Servers of this Hosted web server and will send it on uncompressed to the client, independent of the HTTP request's encoding parameter.
Default - Disabled.
Rewrite HTML
Select this option to have the device rewrite links of the returned webpages in order for the links to stay valid.
Example: One of your Web Server instances has the hostname yourcompany.local but the Hosted web server's hostname on the device is yourcompany.com. Thus, absolute links like [a href="http://yourcompany.local/"] will be broken if the link is not rewritten to [a href="http://yourcompany.com/"] before delivery to the client.
However, you do not need to enable this option if either yourcompany.com is configured on your web server or if internal links on your webpages are always realized as relative links. It is recommended to use the option with Microsoft's Outlook Web Access and/or Sharepoint Portal Server.
Default - Disabled.
Note: HTML rewriting affects all files with a HTTP content type of text/* or *xml*, where * is a wildcard. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the HTML rewriting feature.
Rewrite HTML Cookies (Applicable only if Rewrite HTML is enabled)
Select this option to have the device rewrite cookies of the returned webpages.
Note: If Rewrite HTML is disabled the Rewrite Cookie option will be also disabled.
Pass Host Header
When you select this option, the host header as requested by the client will be preserved and forwarded along with the web request to the web server. Whether passing the host header is necessary in your environment however depends on the configuration of your web server.
Default - Enabled.
Figure 33: Advanced
9. Click Save to save the settings.
Exchange Outlook Anywhere
Applicable only for IPv4 policy.
This page allows you to configure rule for Exchange Outlook Anywhere.
1. Click Policies and select IPv4 using the filter switch. Now, click on +Add Firewall Rule and select Business
Application Rule.
2. Enter policy introduction for About This Rule.
Rule Position
Specify the position of the rule.
Available Options: TopBottom
Application Template
Select Exchange Outlook Anywhere to configure rule for Exchange Outlook Anywhere.
Rule Name
Specify a name to identify the policy.
Description
Specify Policy Description.
| Device Configuration | 31
Figure 34: About This Rule
3. Specify Hosted Server details.
Hosted Address
Specify the address of the hosted server to which the rule applies. It is the public IP Address through which
Internet users access internal server/host.
Available Options:
IP Address – Specified IP Address is mapped to a corresponding mapped single or range of IP Address. If single IP Address is mapped to a range of IP Address, device uses round robin algorithm to load balance the requests.IP Range – Specified IP Address Range is mapped to a corresponding range of mapped IP Address.
The IP range defines the start and end of an address range. The start of the range must be lower than the end of the range.Interface IP – Select when any of the device Port, Alias or Hosted LAN (VLAN) sub interface is required to be mapped to the destination host or network. This option is only available for IPv4 family.
HTTPS
Click to Enable or Disable scanning of HTTPS traffic.
Redirect HTTP (Applicable when HTTPS is enable)
Click to redirect HTTP requests.
Listening Port
Enter a port number on which the Hosted web server can be reached externally, over the Internet. Default is port 80 with Plaintext (HTTP) and port 443 with Encrypted (HTTPS).
Domains (Applicable when HTTPS is disabled)
Enter the domains the web server is responsible for as FQDN, e.g. shop.example.com, or use the Action icon to import a list of domain names. You can use an asterisk (*) as a wildcard for the prefix of the domain, e.g.,*.mydomain.com. Domains with wildcards are considered as fallback settings: The Hosted web server with the wildcard domain entry is only used when no other Hosted web server with a more specific domain name is configured. Example: A client request to a.b.c will match a.b.c before *.b.c before *.c.
HTTPS Certificate (Applicable when HTTPS is enabled)
Select the HTTPS Certificate to be used for scanning.
| Device Configuration | 32
Figure 35: Hosted Server
4. Specify Protected Application Server(s) details.
Enable path-specific routing
You can enable path-specific routing to define (path) to which Web Servers incoming requests are forwarded.
You can define that all URLs with a specific path, for example, /products/, are sent to a specific web server.
On the other hand you can allow more than one web server for a specific request but add rules how to distribute the requests among the servers. Additionally, you can define that each session is bound to one web server throughout its lifetime (sticky session). This may be necessary if you host an online shop and want to make sure that a user sticks to one server during the shopping session. You can also configure to send all requests to one web server and use the others only as a backup.
For each Hosted web server, one default site path route (with path /) is created automatically. The device automatically applies the site path routes in the most reasonable way: starting with the strictest, i.e., longest paths and ending with the default path route which is only used if no other more specific site path route matches the incoming request. The order of the site path route list is not relevant. If no route matches an incoming request, (in case the default route was deleted), the request will be denied.
Add New Path(Applicable when path-specific routing is enabled)
Click Add Path to define a new path.
Note: Add New Path will be active only after at least one Web Server and one Hosted web server have been created.
Default paths - /rpc, /RPC.
Web Server(Applicable when path-specific routing is disabled)
Web Servers are the application servers that are to be protected. Select from the list of Web Servers or click
Add New Item to add a Web Server.
A new Web Server can be created directly from this page itself or from Objects > Assets > Web Servers page.
| Device Configuration | 33
Figure 36: Protected Application Server(s)
5. Specify Access Permission details. This step is applicable if Enable path-specific routing is disabled.
Authentication
Select the web application Authentication profile from the list of available profiles. You can also create new Authentication profile the same page or from Protection > Web Server Protection > Web App
Authentication Policies page.
Allow from
Select the allowed host(s)/network(s).
Block from
Select the blocked host(s)/network(s).
Figure 37: Access Permission
6. Specify path Exceptions for the Web Servers. Click Add New Exception to specify new exception.
Default - /rpc/*,/RPC/*.
7. Specify Polices for Business Applications.
| Device Configuration | 34
Application Protection
Select Application Protection for the server.
A new Application Protection can be created directly from this page itself or from Objects > Policies > Web
App Protection page.
Default - Exchange Outlook Anywhere.
Intrusion Prevention
Select IPS Policy for the rule. A new IPS Policy can be created directly from this page itself or from
Objects > Policies > IPS page.
Traffic Shaping
Select Traffic Shaping policy for the rule.
Traffic Shaping policy allocates & limits the maximum bandwidth usage of the user.
A new Traffic Shaping Policy can be created directly from this page itself or from Objects > Policies >
Traffic Shaping page.
Figure 38: Policies For Business Applications
8. Specify Advanced settings for the added server.
Disable Compression Support
By default, this checkbox is disabled and the content is sent compressed when the client requests compressed data. Compression increases transmission speed and reduces page load time. However, in case of websites being displayed incorrectly or when users experience content-encoding errors accessing your web servers, it can be necessary to disable compression support. When the checkbox is enabled, the WAF will request uncompressed data from the Web Servers of this Hosted web server and will send it on uncompressed to the client, independent of the HTTP request's encoding parameter.
Default - Disabled.
Rewrite HTML
Select this option to have the device rewrite links of the returned webpages in order for the links to stay valid.
Example: One of your Web Server instances has the hostname yourcompany.local but the Hosted web server's hostname on the device is yourcompany.com. Thus, absolute links like [a href="http://yourcompany.local/"] will be broken if the link is not rewritten to [a href="http://yourcompany.com/"] before delivery to the client.
However, you do not need to enable this option if either yourcompany.com is configured on your web server or if internal links on your webpages are always realized as relative links. It is recommended to use the option with Microsoft's Outlook Web Access and/or Sharepoint Portal Server.
Note: HTML rewriting affects all files with a HTTP content type of text/* or *xml*, where * is a wildcard. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the HTML rewriting feature.
Default - Disabled.
Rewrite HTML Cookies (Applicable only if Rewrite HTML is enabled)
Select this option to have the device rewrite cookies of the returned webpages.
| Device Configuration | 35
Note: If Rewrite HTML is disabled the Rewrite Cookie option will be also disabled.
Pass Host Header
When you select this option, the host header as requested by the client will be preserved and forwarded along with the web request to the web server. Whether passing the host header is necessary in your environment however depends on the configuration of your web server.
Default - Disabled.
Figure 39: Advanced
9. Click Save to save the settings.
Exchange General
Applicable only for IPv4 policy.
This page allows you to configure rule for Exchange General.
1. Click Policies and select IPv4 using the filter switch. Now, click on +Add Firewall Rule and select Business
Application Rule.
2. Enter policy introduction for About This Rule.
Rule Position
Specify the position of the rule.
Available Options: TopBottom
Application Template
Select Exchange General to configure rule for Exchange General.
Rule Name
Specify a name to identify the policy.
Description
Specify Policy Description.
| Device Configuration | 36
Figure 40: About This Rule
3. Specify Hosted Server details.
Hosted Address
Specify the address of the hosted server to which the rule applies. It is the public IP Address through which
Internet users access internal server/host.
Available Options:
IP Address – Specified IP Address is mapped to a corresponding mapped single or range of IP Address. If single IP Address is mapped to a range of IP Address, device uses round robin algorithm to load balance the requests.IP Range – Specified IP Address Range is mapped to a corresponding range of mapped IP Address.
The IP range defines the start and end of an address range. The start of the range must be lower than the end of the range.Interface IP – Select when any of the device Port, Alias or Hosted LAN (VLAN) sub interface is required to be mapped to the destination host or network. This option is only available for IPv4 family.
HTTPS
Click to Enable or Disable scanning of HTTPS traffic.
Redirect HTTP (Applicable when HTTPS is enable)
Click to redirect HTTP requests.
Listening Port
Enter a port number on which the Hosted web server can be reached externally, over the Internet. Default is port 80 with Plaintext (HTTP) and port 443 with Encrypted (HTTPS).
Domains (Applicable when HTTPS is disabled)
Enter the domains the web server is responsible for as FQDN, e.g. shop.example.com, or use the Action icon to import a list of domain names. You can use an asterisk (*) as a wildcard for the prefix of the domain, e.g.,*.mydomain.com. Domains with wildcards are considered as fallback settings: The Hosted web server with the wildcard domain entry is only used when no other Hosted web server with a more specific domain name is configured. Example: A client request to a.b.c will match a.b.c before *.b.c before *.c.
HTTPS Certificate (Applicable when HTTPS is enabled)
Select the HTTPS Certificate to be used for scanning.
| Device Configuration | 37
Figure 41: Hosted Server
4. Specify Protected Application Server(s) details.
Enable path-specific routing
You can enable path-specific routing to define (path) to which Web Servers incoming requests are forwarded.
You can define that all URLs with a specific path, for example, /products/, are sent to a specific web server.
On the other hand you can allow more than one web server for a specific request but add rules how to distribute the requests among the servers. Additionally, you can define that each session is bound to one web server throughout its lifetime (sticky session). This may be necessary if you host an online shop and want to make sure that a user sticks to one server during the shopping session. You can also configure to send all requests to one web server and use the others only as a backup.
For each Hosted web server, one default site path route (with path /) is created automatically. The device automatically applies the site path routes in the most reasonable way: starting with the strictest, i.e., longest paths and ending with the default path route which is only used if no other more specific site path route matches the incoming request. The order of the site path route list is not relevant. If no route matches an incoming request, (in case the default route was deleted), the request will be denied.
Add New Path(Applicable when path-specific routing is enabled)
Click Add Path to define a new path.
Note: Add New Path will be active only after at least one Web Server and one Hosted web server have been created.
Default - /owa, /OWA, /ecp, /ECP, /oab, /OAB, /ews, /EWS, /oma, /OMA, /Microsoft-Server-ActiveSync.
Web Servers (Applicable when path-specific routing is disabled)
Web Servers are the application servers that are to be protected. Select from the list of Web Servers or click
Add New Item to add a Web Server.
A new Web Server can be created directly from this page itself or from Objects > Assets > Web Servers page.
| Device Configuration | 38
Figure 42: Protected Application Server(s)
5. Specify Access Permission details. This step is applicable on if Enable path-specific routing is disabled.
Authentication
Select the web application Authentication profile from the list of available profiles. You can also create new Authentication profile the same page or from Protection > Web Server Protection > Web App
Authentication Policies page.
Allow from
Select the allowed host(s)/network(s).
Block from
Select the blocked host(s)/network(s).
Figure 43: Access Permission
6. Specify path Exceptions for the Web Servers. Click Add New Exception to specify new exception.
Default - /owa/*,/OWA/*,/ews/*,/EWS/*,/ecp/*,/ECP/*,/oab/*,/OAB/*,/oma/*,/OMA/*,/Microsoft-Server-
ActiveSync?*, /owa/ev.owa*.
| Device Configuration | 39
Figure 44: Exceptions
7. Specify Polices for Business Applications.
Application Protection
Select Application Protection for the server.
A new Application Protection can be created directly from this page itself or from Objects > Policies > Web
App Protection page.
Default - Exchange General.
Intrusion Prevention
Select IPS Policy for the rule. A new IPS Policy can be created directly from this page itself or from
Objects > Policies > IPS page.
Traffic Shaping
Select Traffic Shaping policy for the rule.
Traffic Shaping policy allocates & limits the maximum bandwidth usage of the user.
A new Traffic Shaping Policy can be created directly from this page itself or from Objects > Policies >
Traffic Shaping page.
Figure 45: Policies For Business Applications
8. Specify Advanced settings for the added server.
Disable Compression Support
By default, this checkbox is disabled and the content is sent compressed when the client requests compressed data. Compression increases transmission speed and reduces page load time. However, in case of websites being displayed incorrectly or when users experience content-encoding errors accessing your web servers, it can be necessary to disable compression support. When the checkbox is enabled, the WAF will request uncompressed data from the Web Servers of this Hosted web server and will send it on uncompressed to the client, independent of the HTTP request's encoding parameter.
Default - Disabled.
Rewrite HTML
Select this option to have the device rewrite links of the returned webpages in order for the links to stay valid.
Example: One of your Web Server instances has the hostname yourcompany.local but the Hosted web server's hostname on the device is yourcompany.com. Thus, absolute links like [a href="http://yourcompany.local/"]
| Device Configuration | 40 will be broken if the link is not rewritten to [a href="http://yourcompany.com/"] before delivery to the client.
However, you do not need to enable this option if either yourcompany.com is configured on your web server or if internal links on your webpages are always realized as relative links. It is recommended to use the option with Microsoft's Outlook Web Access and/or Sharepoint Portal Server.
Note: HTML rewriting affects all files with a HTTP content type of text/* or *xml*, where * is a wildcard. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the HTML rewriting feature.
Rewrite HTML Cookies (Applicable only if Rewrite HTML is enabled)
Select this option to have the device rewrite cookies of the returned webpages.
Default - Disabled.
Note: If Rewrite HTML is disabled the Rewrite Cookie option will be also disabled.
Pass Host Header
When you select this option, the host header as requested by the client will be preserved and forwarded along with the web request to the web server. Whether passing the host header is necessary in your environment however depends on the configuration of your web server.
Default - Disabled.
Figure 46: Advanced
9. Click Save to save the settings.
Microsoft Lync
Applicable only for IPv4 policy. Use Business Application (HTTP-Based) page to add a Policy for HTTP-based business applications.
The Business Application Policy (HTTP-Based) page allows you to configure policy for controlling access to Non-
HTTP-based business applications.
1. Click Policies and select IPv4 using the filter switch. Now, click on +Add New Policy and select Business
Application Policy.
2. Enter policy introduction for About This Rule.
Rule Position
Specify the position of the rule.
Available Options: TopBottom
Application Template
Select Microsoft Lync to define Application filter policy for HTTP based applications.
Rule Name
Specify a name to identify the policy.
Description
Specify Policy Description.
| Device Configuration | 41
3. Specify Hosted Server details.
Hosted Address
Specify the address of the hosted server to which the rule applies. It is the public IP Address through which
Internet users access internal server/host.
Available Options:
IP Address – Specified IP Address is mapped to a corresponding mapped single or range of IP Address. If single IP Address is mapped to a range of IP Address, device uses round robin algorithm to load balance the requests.IP Range – Specified IP Address Range is mapped to a corresponding range of mapped IP Address.
The IP range defines the start and end of an address range. The start of the range must be lower than the end of the range.Interface IP – Select when any of the device Port, Alias or Hosted LAN (VLAN) sub interface is required to be mapped to the destination host or network. This option is only available for IPv4 family.
HTTPS
Click to Enable or Disable scanning of HTTPS traffic.
Redirect HTTP (Applicable when HTTPS is enable)
Click to redirect HTTP requests.
Listening Port
Enter a port number on which the Hosted web server can be reached externally, over the Internet. Default is port 80 with Plaintext (HTTP) and port 443 with Encrypted (HTTPS).
Domains (Applicable when HTTPS is disabled)
Enter the domains the web server is responsible for as FQDN, e.g. shop.example.com, or use the Action icon to import a list of domain names. You can use an asterisk (*) as a wildcard for the prefix of the domain, e.g.,*.mydomain.com. Domains with wildcards are considered as fallback settings: The Hosted web server with the wildcard domain entry is only used when no other Hosted web server with a more specific domain name is configured. Example: A client request to a.b.c will match a.b.c before *.b.c before *.c.
HTTPS Certificate (Applicable when HTTPS is enabled)
Select the HTTPS Certificate to be used for scanning.
4. Specify Protected Application Server(s) details.
Enable path-specific routing
You can enable path-specific routing to define (path) to which Web Servers incoming requests are forwarded.
You can define that all URLs with a specific path, for example, /products/, are sent to a specific web server.
On the other hand you can allow more than one web server for a specific request but add rules how to distribute the requests among the servers. Additionally, you can define that each session is bound to one web server throughout its lifetime (sticky session). This may be necessary if you host an online shop and want to make sure that a user sticks to one server during the shopping session. You can also configure to send all requests to one web server and use the others only as a backup.
For each Hosted web server, one default site path route (with path /) is created automatically. The device automatically applies the site path routes in the most reasonable way: starting with the strictest, i.e., longest paths and ending with the default path route which is only used if no other more specific site path route matches the incoming request. The order of the site path route list is not relevant. If no route matches an incoming request, (in case the default route was deleted), the request will be denied.
Add New Path(Applicable when path-specific routing is enabled)
Click Add Path to define a new path.
Note: Add New Path will be active only after at least one Web Server and one Hosted web server have been created.
Hosts(Applicable when path-specific routing is disabled)
Hosts are the Web Servers that are to be protected. Select from the list of Web Servers or click Add New Item to add a Web Server.
| Device Configuration | 42
A new Web Server can be created directly from this page itself or from Objects > Assets > Web Servers page.
5. Specify path Exceptions for the Web Servers. Click Add New Exception to specify new exception.
6. Specify Polices for Business Applications.
Application Protection
Select Application Protection for the server.
A new Application Protection can be created directly from this page itself or from Objects > Policies > Web
App Protection page.
Intrusion Prevention (IPS)
Select IPS Policy for the rule. A new IPS Policy can be created directly from this page itself or from
Objects > Policies > IPS page.
Traffic Shaping
Select Traffic Shaping policy for the rule.
Traffic Shaping policy allocates & limits the maximum bandwidth usage of the user.
A new Traffic Shaping Policy can be created directly from this page itself or from Objects > Policies >
Traffic Shaping page.
7. Specify Advanced settings for the added server.
Disable Compression Support
By default, this checkbox is disabled and the content is sent compressed when the client requests compressed data. Compression increases transmission speed and reduces page load time. However, in case of websites being displayed incorrectly or when users experience content-encoding errors accessing your web servers, it can be necessary to disable compression support. When the checkbox is enabled, the WAF will request uncompressed data from the Web Servers of this Hosted web server and will send it on uncompressed to the client, independent of the HTTP request's encoding parameter.
Rewrite HTML
Select this option to have the device rewrite links of the returned webpages in order for the links to stay valid.
Example: One of your Web Server instances has the hostname yourcompany.local but the Hosted web server's hostname on the device is yourcompany.com. Thus, absolute links like [a href="http://yourcompany.local/"] will be broken if the link is not rewritten to [a href="http://yourcompany.com/"] before delivery to the client.
However, you do not need to enable this option if either yourcompany.com is configured on your web server or if internal links on your webpages are always realized as relative links. It is recommended to use the option with Microsoft's Outlook Web Access and/or Sharepoint Portal Server.
Note: HTML rewriting affects all files with a HTTP content type of text/* or *xml*, where * is a wildcard. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the HTML rewriting feature.
Rewrite HTML Cookies (Applicable only if Rewrite HTML is enabled)
Select this option to have the device rewrite cookies of the returned webpages.
Note: If Rewrite HTML is disabled the Rewrite Cookie option will be also disabled.
Pass Host Header
When you select this option, the host header as requested by the client will be preserved and forwarded along with the web request to the web server. Whether passing the host header is necessary in your environment however depends on the configuration of your web server.
Microsoft Remote Desktop Gateway 2008 and R2
Applicable only for IPv4 policy.
| Device Configuration | 43
This page allows you to configure rule for Microsoft Remote Desktop Gateway 2008 and R2.
1. Click Policies and select IPv4 using the filter switch. Now, click on +Add Firewall Rule and select Business
Application Rule.
2. Enter policy introduction for About This Rule.
Rule Position
Specify the position of the rule.
Available Options: TopBottom
Application Template
Select Microsoft Remote Desktop Gateway 2008 and R2 to Microsoft Remote Desktop Gateway 2008 and
R2
Rule Name
Specify a name to identify the policy.
Description
Specify Policy Description.
Figure 47: About This Rule
3. Specify Hosted Server details.
Hosted Address
Specify the address of the hosted server to which the rule applies. It is the public IP Address through which
Internet users access internal server/host.
Available Options:
IP Address – Specified IP Address is mapped to a corresponding mapped single or range of IP Address. If single IP Address is mapped to a range of IP Address, device uses round robin algorithm to load balance the requests.IP Range – Specified IP Address Range is mapped to a corresponding range of mapped IP Address.
The IP range defines the start and end of an address range. The start of the range must be lower than the end of the range.Interface IP – Select when any of the device Port, Alias or Hosted LAN (VLAN) sub interface is required to be mapped to the destination host or network. This option is only available for IPv4 family.
HTTPS
Click to Enable or Disable scanning of HTTPS traffic.
Redirect HTTP (Applicable when HTTPS is enable)
Click to redirect HTTP requests.
Listening Port
Enter a port number on which the Hosted web server can be reached externally, over the Internet. Default is port 80 with Plaintext (HTTP) and port 443 with Encrypted (HTTPS).
| Device Configuration | 44
Domains (Applicable when HTTPS is disabled)
Enter the domains the web server is responsible for as FQDN, e.g. shop.example.com, or use the Action icon to import a list of domain names. You can use an asterisk (*) as a wildcard for the prefix of the domain, e.g.,*.mydomain.com. Domains with wildcards are considered as fallback settings: The Hosted web server with the wildcard domain entry is only used when no other Hosted web server with a more specific domain name is configured. Example: A client request to a.b.c will match a.b.c before *.b.c before *.c.
HTTPS Certificate (Applicable when HTTPS is enabled)
Select the HTTPS Certificate to be used for scanning.
Figure 48: Hosted Server
4. Specify Protected Application Server(s) details.
Enable path-specific routing
You can enable path-specific routing to define (path) to which Web Servers incoming requests are forwarded.
You can define that all URLs with a specific path, for example, /products/, are sent to a specific web server.
On the other hand you can allow more than one web server for a specific request but add rules how to distribute the requests among the servers. Additionally, you can define that each session is bound to one web server throughout its lifetime (sticky session). This may be necessary if you host an online shop and want to make sure that a user sticks to one server during the shopping session. You can also configure to send all requests to one web server and use the others only as a backup.
For each Hosted web server, one default site path route (with path /) is created automatically. The device automatically applies the site path routes in the most reasonable way: starting with the strictest, i.e., longest paths and ending with the default path route which is only used if no other more specific site path route matches the incoming request. The order of the site path route list is not relevant. If no route matches an incoming request, (in case the default route was deleted), the request will be denied.
Add New Path(Applicable when path-specific routing is enabled)
Click Add Path to define a new path.
Note: Add New Path will be active only after at least one Web Server and one Hosted web server have been created.
| Device Configuration | 45
Web Server(Applicable when path-specific routing is disabled)
Web Servers are the application servers that are to be protected. Select from the list of Web Servers or click
Add New Item to add a Web Server.
A new Web Server can be created directly from this page itself or from Objects > Assets > Web Servers page.
Figure 49: Protected Application Server(s)
5. Specify Access Permission details. This step is applicable on if Enable path-specific routing is disabled.
Authentication
Select the web application Authentication profile from the list of available profiles. You can also create new Authentication profile the same page or from Protection > Web Server Protection > Web App
Authentication Policies page.
Allow from
Select the allowed host(s)/network(s).
Block from
Select the blocked host(s)/network(s).
Figure 50: Access Permission
6. Specify path Exceptions for the Web Servers. Click Add New Exception to specify new exception.
| Device Configuration | 46
Figure 51: Exceptions
7. Specify Polices for Business Applications.
Application Protection
Select Application Protection for the server.
A new Application Protection can be created directly from this page itself or from Objects > Policies > Web
App Protection page.
Default - Microsoft RDG 2008.
Intrusion Prevention
Select IPS Policy for the rule. A new IPS Policy can be created directly from this page itself or from
Objects > Policies > IPS page.
Traffic Shaping
Select Traffic Shaping policy for the rule.
Traffic Shaping policy allocates & limits the maximum bandwidth usage of the user.
A new Traffic Shaping Policy can be created directly from this page itself or from Objects > Policies >
Traffic Shaping page.
Figure 52: Policies For Business Applications
8. Specify Advanced settings for the added server.
Disable Compression Support
By default, this checkbox is disabled and the content is sent compressed when the client requests compressed data. Compression increases transmission speed and reduces page load time. However, in case of websites being displayed incorrectly or when users experience content-encoding errors accessing your web servers, it can be necessary to disable compression support. When the checkbox is enabled, the WAF will request uncompressed data from the Web Servers of this Hosted web server and will send it on uncompressed to the client, independent of the HTTP request's encoding parameter.
Rewrite HTML
Select this option to have the device rewrite links of the returned webpages in order for the links to stay valid.
Example: One of your Web Server instances has the hostname yourcompany.local but the Hosted web server's hostname on the device is yourcompany.com. Thus, absolute links like [a href="http://yourcompany.local/"] will be broken if the link is not rewritten to [a href="http://yourcompany.com/"] before delivery to the client.
However, you do not need to enable this option if either yourcompany.com is configured on your web server or if internal links on your webpages are always realized as relative links. It is recommended to use the option with Microsoft's Outlook Web Access and/or Sharepoint Portal Server.
Note: HTML rewriting affects all files with a HTTP content type of text/* or *xml*, where * is a wildcard. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the HTML rewriting feature.
| Device Configuration | 47
Rewrite HTML Cookies (Applicable only if Rewrite HTML is enabled)
Select this option to have the device rewrite cookies of the returned webpages.
Note: If Rewrite HTML is disabled the Rewrite Cookie option will be also disabled.
Pass Host Header
When you select this option, the host header as requested by the client will be preserved and forwarded along with the web request to the web server. Whether passing the host header is necessary in your environment however depends on the configuration of your web server.
Figure 53: Advanced
9. Click Save to save the settings.
Microsoft Remote Desktop Web 2008 and R2
Applicable only for IPv4 policy.
This page allows you to configure rule for Microsoft Remote Desktop Web 2008 and R2.
1. Click Policies and select IPv4 using the filter switch. Now, click on +Add Firewall Rule and select Business
Application Rule.
2. Enter policy introduction for About This Rule.
Rule Position
Specify the position of the rule.
Available Options: TopBottom
Application Template
Select Microsoft Remote Desktop Web 2008 and R2 to configure rule for Microsoft Remote Desktop Web
2008 and R2.
Rule Name
Specify a name to identify the policy.
Description
Specify Policy Description.
Figure 54: About This Rule
| Device Configuration | 48
3. Specify Hosted Server details.
Hosted Address
Specify the address of the hosted server to which the rule applies. It is the public IP Address through which
Internet users access internal server/host.
Available Options:
IP Address – Specified IP Address is mapped to a corresponding mapped single or range of IP Address. If single IP Address is mapped to a range of IP Address, device uses round robin algorithm to load balance the requests.IP Range – Specified IP Address Range is mapped to a corresponding range of mapped IP Address.
The IP range defines the start and end of an address range. The start of the range must be lower than the end of the range.Interface IP – Select when any of the device Port, Alias or Hosted LAN (VLAN) sub interface is required to be mapped to the destination host or network. This option is only available for IPv4 family.
HTTPS
Click to Enable or Disable scanning of HTTPS traffic.
Redirect HTTP (Applicable when HTTPS is enable)
Click to redirect HTTP requests.
Listening Port
Enter a port number on which the Hosted web server can be reached externally, over the Internet. Default is port 80 with Plaintext (HTTP) and port 443 with Encrypted (HTTPS).
Domains (Applicable when HTTPS is disabled)
Enter the domains the web server is responsible for as FQDN, e.g. shop.example.com, or use the Action icon to import a list of domain names. You can use an asterisk (*) as a wildcard for the prefix of the domain, e.g.,*.mydomain.com. Domains with wildcards are considered as fallback settings: The Hosted web server with the wildcard domain entry is only used when no other Hosted web server with a more specific domain name is configured. Example: A client request to a.b.c will match a.b.c before *.b.c before *.c.
HTTPS Certificate (Applicable when HTTPS is enabled)
Select the HTTPS Certificate to be used for scanning.
| Device Configuration | 49
Figure 55: Hosted Server
4. Specify Protected Application Server(s) details.
Enable path-specific routing
You can enable path-specific routing to define (path) to which Web Servers incoming requests are forwarded.
You can define that all URLs with a specific path, for example, /products/, are sent to a specific web server.
On the other hand you can allow more than one web server for a specific request but add rules how to distribute the requests among the servers. Additionally, you can define that each session is bound to one web server throughout its lifetime (sticky session). This may be necessary if you host an online shop and want to make sure that a user sticks to one server during the shopping session. You can also configure to send all requests to one web server and use the others only as a backup.
For each Hosted web server, one default site path route (with path /) is created automatically. The device automatically applies the site path routes in the most reasonable way: starting with the strictest, i.e., longest paths and ending with the default path route which is only used if no other more specific site path route matches the incoming request. The order of the site path route list is not relevant. If no route matches an incoming request, (in case the default route was deleted), the request will be denied.
Add New Path(Applicable when path-specific routing is enabled)
Click Add Path to define a new path.
Note: Add New Path will be active only after at least one Web Server and one Hosted web server have been created.
Web Server(Applicable when path-specific routing is disabled)
Web Servers are the application servers that are to be protected. Select from the list of Web Servers or click
Add New Item to add a Web Server.
A new Web Server can be created directly from this page itself or from Objects > Assets > Web Servers page.
| Device Configuration | 50
Figure 56: Protected Application Server(s)
5. Specify Access Permission details. This step is applicable if Enable path-specific routing is disabled.
Authentication
Select the web application Authentication profile from the list of available profiles. You can also create new Authentication profile the same page or from Protection > Web Server Protection > Web App
Authentication Policies page.
Allow from
Select the allowed host(s)/network(s).
Block from
Select the blocked host(s)/network(s).
Figure 57: Access Permission
6. Specify path Exceptions for the Web Servers. Click Add New Exception to specify new exception.
Figure 58: Exceptions
| Device Configuration | 51
7. Specify Polices for Business Applications.
Application Protection
Select Application Protection for the server.
Default - Microsoft RD Web 2008.
A new Application Protection can be created directly from this page itself or from Objects > Policies > Web
App Protection page.
Intrusion Prevention
Select IPS Policy for the rule. A new IPS Policy can be created directly from this page itself or from
Objects > Policies > IPS page.
Traffic Shaping
Select Traffic Shaping policy for the rule.
Traffic Shaping policy allocates & limits the maximum bandwidth usage of the user.
A new Traffic Shaping Policy can be created directly from this page itself or from Objects > Policies >
Traffic Shaping page.
Figure 59: Policies For Business Applications
8. Specify Advanced settings for the added server.
Disable Compression Support
By default, this checkbox is disabled and the content is sent compressed when the client requests compressed data. Compression increases transmission speed and reduces page load time. However, in case of websites being displayed incorrectly or when users experience content-encoding errors accessing your web servers, it can be necessary to disable compression support. When the checkbox is enabled, the WAF will request uncompressed data from the Web Servers of this Hosted web server and will send it on uncompressed to the client, independent of the HTTP request's encoding parameter.
Default - Disabled.
Rewrite HTML
Select this option to have the device rewrite links of the returned webpages in order for the links to stay valid.
Example: One of your Web Server instances has the hostname yourcompany.local but the Hosted web server's hostname on the device is yourcompany.com. Thus, absolute links like [a href="http://yourcompany.local/"] will be broken if the link is not rewritten to [a href="http://yourcompany.com/"] before delivery to the client.
However, you do not need to enable this option if either yourcompany.com is configured on your web server or if internal links on your webpages are always realized as relative links. It is recommended to use the option with Microsoft's Outlook Web Access and/or Sharepoint Portal Server.
Note: HTML rewriting affects all files with a HTTP content type of text/* or *xml*, where * is a wildcard. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the HTML rewriting feature.
Default - Disabled.
Rewrite HTML Cookies (Applicable only if Rewrite HTML is enabled)
Select this option to have the device rewrite cookies of the returned webpages.
| Device Configuration | 52
Note: If Rewrite HTML is disabled the Rewrite Cookie option will be also disabled.
Pass Host Header
When you select this option, the host header as requested by the client will be preserved and forwarded along with the web request to the web server. Whether passing the host header is necessary in your environment however depends on the configuration of your web server.
Default - Enabled.
Figure 60: Advanced
9. Click Save to save the settings.
Microsoft Sharepoint 2010 and 2013
Applicable only for IPv4 policy.
This page allows you to configure rule for Microsoft Sharepoint 2010 and 2013.
1. Click Policies and select IPv4 using the filter switch. Now, click on +Add Firewall Rule and select Business
Application Rule.
2. Enter policy introduction for About This Rule.
Rule Position
Specify the position of the rule.
Available Options: TopBottom
Application Template
Select Microsoft Sharepoint 2010 and 2013 to configure rule for Microsoft Sharepoint 2010 and 2013.
Rule Name
Specify a name to identify the policy.
Description
Specify Policy Description.
| Device Configuration | 53
Figure 61: About This Rule
3. Specify Hosted Server details.
Hosted Address
Specify the address of the hosted server to which the rule applies. It is the public IP Address through which
Internet users access internal server/host.
Available Options:
IP Address – Specified IP Address is mapped to a corresponding mapped single or range of IP Address. If single IP Address is mapped to a range of IP Address, device uses round robin algorithm to load balance the requests.IP Range – Specified IP Address Range is mapped to a corresponding range of mapped IP Address.
The IP range defines the start and end of an address range. The start of the range must be lower than the end of the range.Interface IP – Select when any of the device Port, Alias or Hosted LAN (VLAN) sub interface is required to be mapped to the destination host or network. This option is only available for IPv4 family.
HTTPS
Click to Enable or Disable scanning of HTTPS traffic.
Redirect HTTP (Applicable when HTTPS is enable)
Click to redirect HTTP requests.
Listening Port
Enter a port number on which the Hosted web server can be reached externally, over the Internet. Default is port 80 with Plaintext (HTTP) and port 443 with Encrypted (HTTPS).
Domains (Applicable when HTTPS is disabled)
Enter the domains the web server is responsible for as FQDN, e.g. shop.example.com, or use the Action icon to import a list of domain names. You can use an asterisk (*) as a wildcard for the prefix of the domain, e.g.,*.mydomain.com. Domains with wildcards are considered as fallback settings: The Hosted web server with the wildcard domain entry is only used when no other Hosted web server with a more specific domain name is configured. Example: A client request to a.b.c will match a.b.c before *.b.c before *.c.
HTTPS Certificate (Applicable when HTTPS is enabled)
Select the HTTPS Certificate to be used for scanning.
| Device Configuration | 54
Figure 62: Hosted Server
4. Specify Protected Application Server(s) details.
Enable path-specific routing
You can enable path-specific routing to define (path) to which Web Servers incoming requests are forwarded.
You can define that all URLs with a specific path, for example, /products/, are sent to a specific web server.
On the other hand you can allow more than one web server for a specific request but add rules how to distribute the requests among the servers. Additionally, you can define that each session is bound to one web server throughout its lifetime (sticky session). This may be necessary if you host an online shop and want to make sure that a user sticks to one server during the shopping session. You can also configure to send all requests to one web server and use the others only as a backup.
For each Hosted web server, one default site path route (with path /) is created automatically. The device automatically applies the site path routes in the most reasonable way: starting with the strictest, i.e., longest paths and ending with the default path route which is only used if no other more specific site path route matches the incoming request. The order of the site path route list is not relevant. If no route matches an incoming request, (in case the default route was deleted), the request will be denied.
Add New Path(Applicable when path-specific routing is enabled)
Click Add Path to define a new path.
Note: Add New Path will be active only after at least one Web Server and one Hosted web server have been created.
Web Server(Applicable when path-specific routing is disabled)
Web Servers are the application servers that are to be protected. Select from the list of Web Servers or click
Add New Item to add a Web Server.
A new Web Server can be created directly from this page itself or from Objects > Assets > Web Servers page.
| Device Configuration | 55
Figure 63: Protected Application Server(s)
5. Specify Access Permission details. This step is applicable if Enable path-specific routing is disabled.
Authentication
Select the web application Authentication profile from the list of available profiles. You can also create new Authentication profile the same page or from Protection > Web Server Protection > Web App
Authentication Policies page.
Allow from
Select the allowed host(s)/network(s).
Block from
Select the blocked host(s)/network(s).
Figure 64: Access Permission
6. Specify path Exceptions for the Web Servers. Click Add New Exception to specify new exception.
Figure 65: Exceptions
| Device Configuration | 56
7. Specify Polices for Business Applications.
Application Protection
Select Application Protection for the server.
A new Application Protection can be created directly from this page itself or from Objects > Policies > Web
App Protection page.
Intrusion Prevention (IPS)
Select IPS Policy for the rule. A new IPS Policy can be created directly from this page itself or from
Objects > Policies > IPS page.
Traffic Shaping
Select Traffic Shaping policy for the rule.
Traffic Shaping policy allocates & limits the maximum bandwidth usage of the user.
A new Traffic Shaping Policy can be created directly from this page itself or from Objects > Policies >
Traffic Shaping page.
8. Specify Advanced settings for the added server.
Disable Compression Support
By default, this checkbox is disabled and the content is sent compressed when the client requests compressed data. Compression increases transmission speed and reduces page load time. However, in case of websites being displayed incorrectly or when users experience content-encoding errors accessing your web servers, it can be necessary to disable compression support. When the checkbox is enabled, the WAF will request uncompressed data from the Web Servers of this Hosted web server and will send it on uncompressed to the client, independent of the HTTP request's encoding parameter.
Default - Disabled.
Rewrite HTML
Select this option to have the device rewrite links of the returned webpages in order for the links to stay valid.
Example: One of your Web Server instances has the hostname yourcompany.local but the Hosted web server's hostname on the device is yourcompany.com. Thus, absolute links like [a href="http://yourcompany.local/"] will be broken if the link is not rewritten to [a href="http://yourcompany.com/"] before delivery to the client.
However, you do not need to enable this option if either yourcompany.com is configured on your web server or if internal links on your webpages are always realized as relative links. It is recommended to use the option with Microsoft's Outlook Web Access and/or Sharepoint Portal Server.
Note: HTML rewriting affects all files with a HTTP content type of text/* or *xml*, where * is a wildcard. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the HTML rewriting feature.
Default - Disabled.
Rewrite HTML Cookies (Applicable only if Rewrite HTML is enabled)
Select this option to have the device rewrite cookies of the returned webpages.
Note: If Rewrite HTML is disabled the Rewrite Cookie option will be also disabled.
Pass Host Header
When you select this option, the host header as requested by the client will be preserved and forwarded along with the web request to the web server. Whether passing the host header is necessary in your environment however depends on the configuration of your web server.
Default - Enabled.
| Device Configuration | 57
Figure 66: Advanced
9. Click Save to save the settings.
Add Path
Add Path page allows you to define (path) to which real web servers incoming requests are forwarded..
1. Enable path-specific routing and click Add New Path.
2. Specify the path details.
Path
Enter the path for which you want to create the site path route, Example: /products/.
Real Web Servers
Select the Real web servers which are to be used for the specified path.
Authentication
Select the Web App Authentication profile. Click Add New Item to create a new authentication profile. You can also create Authentication profile from Objects > Assets > Web App Authentication page.
Allow From
Select or add the allowed networks that should be able to connect to the Hosted web server.
Block From
Select or add the denied networks that should be blocked to your Hosted web server.
Enable sticky session cookie
Select this option to ensure that each session will be bound to one real web server. If enabled, a cookie is passed to the user's browser, which provokes the UTM to route all requests from this browser to the same real web server. If the server is not available, the cookie will be updated, and the session will switch to another web server.
Enable hot-standby mode
Select this option if you want to send all requests to the first selected real web server, and use the other web servers only as a backup. The backup servers are only used in case the main server fails.
As soon as the main server starts functioning, the sessions will switch back - unless you have selected the
Enable sticky session cookie option.
Figure 67: Add Path
3. Click Save to complete.
Add Exception
Use Add Exception page to specify path Exceptions for the Web Servers.
1. Click Add Exceptions.
2. Specify Exception details.
Path
Enter the path which you want to exclude.
Operation
Select the operation among AND or OR for Path and Source.
| Device Configuration | 58
| Device Configuration | 59
Source
Specify the source networks where the client request comes from and which are to be exempted from the selected check(s).
Skip these Checks
Cookie Signing
Click to skip Cookie Signing. Cookie Signing protects a web server against manipulated cookies. When the web server sets a cookie, a second cookie is added to the first cookie containing a hash built of the primary cookie's name, its value and a secret, where the secret is only known by the WAF. Thus, if a request cannot provide a correct cookie pair, there has been some sort of manipulation and the cookie will be dropped.
Static URL Hardening
Protects against URL rewriting. For that, when a client requests a website, all static URLs of the website are signed. The signing uses a similar procedure as with cookie signing. Additionally the response from the web server is analyzed regarding what links can be validly requested next.
Form Hardening
Click to skip Form Hardening. Form Hardening protects against web form rewriting. Form hardening saves the original structure of a web form and signs it. Therefore, if the structure of a form has changed when it is submitted the WAF rejects the request.
Antivirus
Select this option to protect a web server against viruses.
Block clients with bad reputation
Based on GeoIPClosed and RBLClosed information you can block clients which have a bad reputation according to their classification.
Skip these Categories
Path
Select a path from the list or specify a new path fro the specified exception.
Operation
Select the AND/OR operation for the added Path and Source.
Source
Select from the list of added networks as Source
Protocol Violations
Enforces adherence to the RFC standard specification of the HTTP protocol. Violating these standards usually indicates malicious intent.
Protocol Anomalies
Searches for common usage patterns. Lack of such patterns often indicates malicious requests. These patterns include, among other things, HTTP headers like 'Host' and 'User-Agent'.
Request Limits
Enforces reasonable limits on the amount and ranges of request arguments. Overloading request arguments is a typical attack vector.
HTTP Policy
Narrows down the allowed usage of the HTTP protocol. Web browsers typically use only a limited subset of all possible HTTP options. Disallowing the rarely used options protects against attackers aiming at these often less well supported options.
Bad Robots
Checks for usage patterns characteristic of bots and crawlers. By denying them access, possible vulnerabilities on your web servers are less likely to be discovered.
Generic Attacks
Searches for attempted command executions common to most attacks. After having breached a web server, an attacker usually tries to execute commands on the server like expanding privileges or manipulating data
| Device Configuration | 60 stores. By searching for these post-breach execution attempts, attacks can be detected that might otherwise have gone unnoticed, for example because they targeted a vulnerable service by the means of legitimate access.
SQL Injection Attacks
Checks for embedded SQL commands and escape characters in request arguments. Most attacks on web servers target input fields that can be used to direct embedded SQL commands to the database.
XSS Attacks
Checks for embedded script tags and code in request arguments. Typical cross-site scripting attacks aim at injecting script code into input fields on a target web server, often in a legitimate way.
Tight Security
Performs tight security checks on requests, like checking for prohibited path traversal attempts.
Trojans
Checks for usage patterns characteristic of trojans, thus searching for requests indicating trojan activity. It does not, however, prevent the installation of such trojans as this is covered by the antivirus scanners.
Outbound
Prevents web servers from leaking information to the client. This includes, among other things, error messages sent by servers which attackers can use to gather sensitive information or detect specific vulnerabilities.
Never change HTML during Static URL Hardening or Form Hardening
If selected, no data matching the defined exception settings will be modified by the WAF engine. With this option, e.g., binary data wrongly supplied with a text/html content type by the Web Server will not be corrupted. On the other hand, web requests may be blocked due to activated URL hardening, HTML rewriting, or form hardening. Those three features use an HTML parser and therefore to some extent depend on the modification of webpage content. To prevent undesired blocking, skip URL hardening and/or form hardening for requests affected by blocking; you might need to do this in another/new exception to reflect dependencies between web servers and/or webpages.
Accept unhardened form data
Even though having an exception for Form Hardening, it is possible that form data will not be accepted if the
Form Hardening signature is missing. With this option unhardened form data will be accepted anyway.
Figure 68: Add Exception
| Device Configuration | 61
| Device Configuration | 62
Non-HTTP Based Policy
Non-HTTP Based policy is used to protect Non-HTTP servers, like mail or other servers hosted inside the network
(LAN or DMZ). Using Non-HTTP Based policy, you can define access rights of such servers to users who require access over the WAN or Internet. Additionally, you can use the following Non-HTTP application template:
•
1. Click Policies and select among IPv4 or IPv6 using the filter switch. Now, click on +Add Firewall Rule and select Business Application Rule.
2. Enter policy introduction for About This Rule.
Rule Position
Specify the position of the rule.
Available Options: TopBottom
Application Template
Select Non-HTTP Based Policy to configure rule for generic Non-HTTP based applications.
Rule Name
Specify a name to identify the policy.
Description
Specify Policy Description.
Figure 69: About This Rule
3. Specify Source details.
Host
Select the allowed host(s) or add a new one by clicking Add New Item.
Exceptions
Select or add new ones by clicking Add New Item. Exceptions are the hosts on which the policy configurations are not applicable.
| Device Configuration | 63
Figure 70: Source
4. Specify Hosted Server details.
Source Zone
Click to select Source Zone. Click Add New Item to define a new LAN or DMZ zone.
Hosted Address
Specify the address of the hosted server to which the policy applies. It is the public IP Address through which users access internal server/host over the Internet.
Available Options:
IP Address – Specified IP Address is mapped to a corresponding mapped single or range of IP Address. If single IP Address is mapped to a range of IP Address, device uses round robin algorithm to load balance the requests.IP Range – Specified IP Address Range is mapped to a corresponding range of mapped IP Address.
The IP range defines the start and end of an address range. The start of the range must be lower than the end of the range.Interface IP – Select when any of the device Port, Alias or Virtual LAN (VLAN) sub interface is required to be mapped to the destination host or network. This option is only available for IPv4 family.
Figure 71: Hosted Server
5. Specify Protected Application Server(s) details.
Protected Zone
Select the zone to which the Web Server rule applies.
Protected Application Server(s)
Select from the available options on which the Web Server is to be hosted.
Available options: IP Address – External IP Address is mapped to the specified IP Address.IP Range –
External IP Address Range is mapped to the specified IP Address Range.IP List – External IP Address is mapped to the specified IP list.FQDN – External IP Address is mapped to the specified FQDN. Internal mapped server can be accessed by FQDN. This option is only available for IPv4 Virtual Host.
Load Balancing (Applicable when 'IP Range' or 'IP List' is selected for Protected Server. Also, Source Zone
for Hosted Server should be 'WAN')
Select the method for load balancing from the available options.
| Device Configuration | 64
Available Options
Round Robin - In this method, requests are served in a sequential manner where the first request is forwarded to the first server, second request to the second server and so on. When a request is received, the device checks to see which the last server that was assigned a request was. It then assigns this new request to the next available server. This method is can be used when equal distribution of traffic is required and there is no need for session-persistence.
First Alive - In this method, all incoming requests are served by the first server (the first IP Address that is configured in the IP Range). This server is considered as the primary server and all others are considered as backup. Only when the first server fails, the requests are forwarded to the next server in line. This method is used for failover scenarios.
Random -In this method, the requests are forwarded to the servers randomly. Although, the device makes sure that all configured servers receive equally distributed load. Hence, this method is also called uniform random distribution. This method can be used when equal distribution of traffic is required and there is no need for session-persistence or order of distribution.
Sticky IP - In this method, Along with Round Robin distribution of traffic, the device forwards incoming traffic according to the Source IP Address. All traffic from a particular source is forwarded only to its mapped
Server. This means that all requests for a given source IP are sent to the same application server instance. This method is useful in cases where all requests or sessions are required to be processed by the same server. For example: Banking websites, E-Commerce websites.
Health Check (Applicable if Load Balancing is enabled)
Click to enable health check for failover and specify the parameters based on the description shown below.
Probe Method
Select the probe method to check the health of the server from the available options.
Available Options:
TCP Probe ICMP Probe
Port (Applicable if TCP Probe Health Check Method is selected)
Specify the Port number on the server health is monitored.
Acceptable Range - 1 to 65535
Interval
Specify the time interval in seconds after which the health will be monitored.
Acceptable Range (Seconds) - 5 to 65535
Default - 60
Timeout
Specify the time interval in seconds within which the server must respond.
Acceptable Range (Seconds) - 1 to 10
Default - 2
Retries
Specify the number of tries to probe the health of the server, after which the server will be declared unreachable
Acceptable Range - 1 to 10
Default – 3
| Device Configuration | 65
Forward all ports
Click to enable/disable the service of port forwarding. When enabled, all ports are forwarded. To enable custom port forwarding, disable Forward all ports, and specify port forwarding details (shown in step 5).
Default - Disabled.
Figure 72: Protected Application Server(s)
6. Specify Port Forwarding details.
Protocol
Select the protocol TCP or UDP that you want the forwarded packets to use.
External Port Type
Select the type of external port from the available options.
Available Options: PortPort RangePort List
External Port
Specify public port number for which you want to configure port forwarding.
Mapped Port Type
Select the type of mapped port from the available options.
Available Options:PortPort RangePort List
Mapped Port
Specify mapped port number on the destination network to which the public port number is mapped.
Figure 73: Port Forwarding
7. Specify Routing details.
Rewrite source address (Masquerading)
Enable/Disable to re-write the source address or specify a NAT policy.
Use Outbound Address (Applicable when Rewrite source address is enabled)
Select the NAT policy to be applied the list or available NAT policies.
A new NAT policy can be created directly from this page itself or from Objects > Policies > NAT page.
Default NAT policy is Masquerade.
| Device Configuration | 66
Figure 74: Routing
8. Specify Identity details.
Match rule based on user identity
Match rule based on user identity allows you to check whether the specified user/user group from the selected zone is allowed to access the selected service or not.
Click to attach the user identity.
Enable check identity to apply the following policies per user.
User or Groups (Applicable if 'Match rule based on user identity' is disabled)
Select the user(s) or group(s) from the list of available options.
Exclude this user activity from data accounting (Applicable 'if Match rule based on user identity' is disabled)
Click to enable/disable user traffic activity from data accounting.
By default, user’s network traffic is considered in data accounting. Select to exclude certain traffic from user data accounting. The traffic allowed through this firewall rule will not be accounted towards data transfer for the user.
Figure 75: Identity
9. Specify polices for business applications.
Intrusion Prevention
Select the required IPS policy. If Match rule based on user identity is enabled, user’s IPS policy will be applied automatically, but will not be effective till the respective module is subscribed.
A new IPS can be created directly from this page itself or from Objects > Policies > Intrusion Prevention page.
Traffic Shaping Policy
Select the required IPS policy. If Match rule based on user identity is enabled, user’s QoS policy will be applied automatically.
A new Traffic Shaping Policy can be created directly from this page itself or from Objects > Policies >
Traffic Shaping page.
| Device Configuration | 67
Figure 76: Policies for Business Applications
10. Define logging option for the user application traffic.
Log Firewall Traffic
Click to enable logging of permitted and denied traffic.
Figure 77: Log Traffic
11. Specify Reflexive Rule options.
Create Reflexive Rule
Select Yes to automatically create a reflexive firewall rule for the Protected Host.
Reflexive rule has the same policies as those configured for the hosted server but instead of source zone to destination zone, this rule is applicable on traffic from destination zone to source zone.
By default, the reflexive rule is not created.
Figure 78: Reflexive Rule
12. Configure Security Heartbeat settings. (Applicable only if IPv4 is selected.)
Require Security Heartbeat
Heartbeat-capable devices can be required to send information on their health status in defined intervals - this is called a heartbeat.
Based on that information, you can restrict a device's access to certain services and networks.
Enable/disable the option to require the sending of heartbeats.
Minimum Heartbeat Permitted
Select a minimum health status that a device must have to conform to this policy. Health status can be either
Green, Yellow or No Restriction. If the health criterion is not met, access and privileges defined in this policy will not be granted to the user.
Figure 79: Security Heartbeat
13. Click Save to save the settings.
Email Servers (SMTP)
This page allows you to configure rule for Email Servers (SMTP).
1. Click Policies and select among IPv4 or IPv6 using the filter switch. Now, click on +Add Firewall Policy and select Business Application Rule.
2. Enter policy introduction for About This Rule.
Rule Position
Specify the position of the rule.
Available Options: TopBottom
Application Template
Select Email Servers (SMTP) to configure rule for SMTP based Email applications.
Rule Name
Specify a name to identify the policy.
Description
Specify Policy Description.
| Device Configuration | 68
Figure 80: About this Rule
3. Specify Source details.
Zone
Select the allowed source zone(s).
Networks
Select the allowed source network(s) . A new network host can be created directly from this page itself or from Objects > Hosts and Services > IP Host page.
Figure 81: Source
4. Specify Hosted Server details.
Source Zone
Click to select Source Zone. Click Add New Item to define a new LAN or DMZ zone.
Hosted Address
Specify the address of the hosted server to which the policy applies. It is the public IP Address through which users access internal server/host over the Internet.
| Device Configuration | 69
Available Options:
IP Address – Specified IP Address is mapped to a corresponding mapped single or range of IP Address. If single IP Address is mapped to a range of IP Address, device uses round robin algorithm to load balance the requests.IP Range – Specified IP Address Range is mapped to a corresponding range of mapped IP Address.
The IP range defines the start and end of an address range. The start of the range must be lower than the end of the range.Interface IP – Select when any of the device Port, Alias or Virtual LAN (VLAN) sub interface is required to be mapped to the destination host or network. This option is only available for IPv4 family.
Scan SMTP/SMTPS
Click to Enable/Disable scanning of SMTP/SMTPS traffic.
Figure 82: Hosted Server
5. Specify Protected Application Server(s) details.
Protected Zone
Select the zone to which the Web Server rule applies.
Protected Application Server(s)
Select from the available options on which the Web Server is to be hosted.
Available options: IP Address – External IP Address is mapped to the specified IP Address.IP Range –
External IP Address Range is mapped to the specified IP Address Range.IP List – External IP Address is mapped to the specified IP list.FQDN – External IP Address is mapped to the specified FQDN. Internal mapped server can be accessed by FQDN. This option is only available for IPv4 Virtual Host.
Load Balancing (Applicable when 'IP Range' or 'IP List' is selected for Protected Server. Also, Source Zone
for Hosted Server should be 'WAN')
Select the method for load balancing from the available options.
Available Options
Round Robin - In this method, requests are served in a sequential manner where the first request is forwarded to the first server, second request to the second server and so on. When a request is received, the device checks to see which the last server that was assigned a request was. It then assigns this new request to the next available server. This method is can be used when equal distribution of traffic is required and there is no need for session-persistence.
First Alive - In this method, all incoming requests are served by the first server (the first IP Address that is configured in the IP Range). This server is considered as the primary server and all others are considered as backup. Only when the first server fails, the requests are forwarded to the next server in line. This method is used for failover scenarios.
Random -In this method, the requests are forwarded to the servers randomly. Although, the device makes sure that all configured servers receive equally distributed load. Hence, this method is also called uniform
| Device Configuration | 70 random distribution. This method can be used when equal distribution of traffic is required and there is no need for session-persistence or order of distribution.
Sticky IP - In this method, Along with Round Robin distribution of traffic, the device forwards incoming traffic according to the Source IP Address. All traffic from a particular source is forwarded only to its mapped
Server. This means that all requests for a given source IP are sent to the same application server instance. This method is useful in cases where all requests or sessions are required to be processed by the same server. For example: Banking websites, E-Commerce websites.
Health Check (Applicable if Load Balancing is enabled)
Click to enable health check for failover and specify the parameters based on the description shown below.
Probe Method
Select the probe method to check the health of the server from the available options.
Available Options:
TCP Probe ICMP Probe
Port (Applicable if TCP Probe Health Check Method is selected)
Specify the Port number on the server health is monitored.
Acceptable Range - 1 to 65535
Interval
Specify the time interval in seconds after which the health will be monitored.
Acceptable Range (Seconds) - 5 to 65535
Default - 60
Timeout
Specify the time interval in seconds within which the server must respond.
Acceptable Range (Seconds) - 1 to 10
Default - 2
Retries
Specify the number of tries to probe the health of the server, after which the server will be declared unreachable
Acceptable Range - 1 to 10
Default – 3
Forward all ports
Click to enable/disable the service of port forwarding. When enabled, all ports are forwarded. To enable custom port forwarding, disable Forward all ports, and specify port forwarding details (shown in step 5).
Default - Disabled.
Figure 83: Protected Application Server(s)
6. Specify Port Forwarding details.
| Device Configuration | 71
Protocol
Select the protocol TCP or UDP that you want the forwarded packets to use.
External Port Type
Select the type of external port from the available options.
Available Options: PortPort RangePort List
External Port
Specify public port number for which you want to configure port forwarding.
Mapped Port Type
Select the type of mapped port from the available options.
Available Options:PortPort RangePort List
Mapped Port
Specify mapped port number on the destination network to which the public port number is mapped.
Figure 84: Port Forwarding
7. Specify Routing details.
Rewrite source address (Masquerading)
Enable/Disable to re-write the source address or specify a NAT policy.
Use Outbound Address (Applicable when Rewrite source address is enabled)
Select the NAT policy to be applied the list or available NAT policies.
A new NAT policy can be created directly from this page itself or from Objects > Policies > NAT page.
Default NAT policy is Masquerade.
Figure 85: Routing
8. Specify Identity details.
Match rule based on user identity
Match rule based on user identity allows you to check whether the specified user/user group from the selected zone is allowed to access the selected service or not.
Click to attach the user identity.
Enable check identity to apply the following policies per user.
| Device Configuration | 72
User or Groups (Applicable if 'Match rule based on user identity' is disabled)
Select the user(s) or group(s) from the list of available options.
Exclude this user activity from data accounting (Applicable 'if Match rule based on user identity' is disabled)
Click to enable/disable user traffic activity from data accounting.
By default, user’s network traffic is considered in data accounting. Select to exclude certain traffic from user data accounting. The traffic allowed through this firewall rule will not be accounted towards data transfer for the user.
Figure 86: Identity
9. Specify polices for business applications.
Intrusion Prevention
Select the required IPS policy. If Match rule based on user identity is enabled, user’s IPS policy will be applied automatically, but will not be effective till the respective module is subscribed.
A new IPS can be created directly from this page itself or from Objects > Policies > Intrusion Prevention page.
Traffic Shaping Policy
Select the required IPS policy. If Match rule based on user identity is enabled, user’s QoS policy will be applied automatically.
A new Traffic Shaping Policy can be created directly from this page itself or from Objects > Policies >
Traffic Shaping page.
Figure 87: Policies for Business Applications
10. Define logging option for the user application traffic.
Log Firewall Traffic
Click to enable logging of permitted and denied traffic.
Figure 88: Log Traffic
11. Specify Reflexive Rule options.
| Device Configuration | 73
Create Reflexive Rule
Select Yes to automatically create a reflexive firewall rule for the Protected Host.
Reflexive rule has the same policies as those configured for the hosted server but instead of source zone to destination zone, this rule is applicable on traffic from destination zone to source zone.
By default, the reflexive rule is not created.
Figure 89: Reflexive Rule
12. Configure Security Heartbeat settings. (Applicable only if IPv4 is selected.)
Require Security Heartbeat
Heartbeat-capable devices can be required to send information on their health status in defined intervals - this is called a heartbeat.
Based on that information, you can restrict a device's access to certain services and networks.
Enable/disable the option to require the sending of heartbeats.
Minimum Heartbeat Permitted
Select a minimum health status that a device must have to conform to this policy. Health status can be either
Green, Yellow or No Restriction. If the health criterion is not met, access and privileges defined in this policy will not be granted to the user.
Figure 90: Security Heartbeat
13. Click Save to save the settings.
Email Clients (POP and IMAP)
The Business Application Policy (Public Non-HTTP-Based) page allows you to configure policy for controlling access to Public Non-HTTP-based business applications.
1. Click Policies and select among IPv4 or IPv6 using the filter switch. Now, click on +Add Firewall Policy and select Business Application Policy.
2. Enter policy introduction for About This Rule.
Rule Position
Specify the position of the rule.
Available Options: TopBottom
Application Template
Select Email Clients (POP and IMAP) to define Application filter policy for POP and IMAP based Email clients.
Rule Name
Specify a name to identify the policy.
Description
Specify Policy Description.
| Device Configuration | 74
Figure 91: About this Rule
3. Specify Source details.
Zone
Select the allowed source zone(s).
Networks
Select the allowed source network(s) . A new network host can be created directly from this page itself or from Objects > Assets > IP Host page.
Figure 92: Source
4. Specify destination details.
Zone
Select the zone to which the policy applies.
Networks
Select the network(s) to be protected.
A new network host can be created directly from this page itself or from Objects > Assets > IP Host page.
Scan SMTP/SMTPS/IMAP/POP3/POP3S/IMAPS
Click to Enable/Disable scanning of SMTP/SMTPS/IMAP/POP3/POP3S/IMAPS traffic.
| Device Configuration | 75
Figure 93: Destination
5. Specify Routing details.
Rewrite source address (Masquerading)
Enable/Disable to re-write the source address or specify a NAT policy.
Use Outbound Address(Applicable when Rewrite source address is enabled)
Select the NAT policy to be applied the list or available NAT policies.
A new NAT policy can be created directly from this page itself or from Objects > Policies > NAT page.
Default NAT policy is Masquerade.
Primary Gateway (Applicable if multiple WAN links are configured.)
Select the Primary Gateway to route the request.
Backup Gateway (Applicable if multiple WAN links are configured.)
Select the Backup Gateway to route the request.
| Device Configuration | 76
Figure 94: Routing
6. Specify Identity details. This is available only when Action for the traffic is Enabled.
Match rule based on user identity
Click to enable policy based on user identity.
User or Groups (Applicable only when Match rule based on user identity is Enabled)
Select the user(s) or group(s) from the list of available options.
Exclude this user activity from data accounting (Applicable only when Match rule based on user identity is
Enabled)
Click to enable/disable user traffic activity from data accounting.
By default, user’s network traffic is considered in data accounting. Select to exclude certain traffic from user data accounting. The traffic allowed through this firewall rule will not be accounted towards data transfer for the user.
Figure 95: Identity
7. Specify polices for business applications.
Intrusion Prevention
Select IPS policy for the rule. A new IPS can be created directly from this page itself or from Objects >
Policies > IPS page.
Traffic Shaping Policy
Select traffic shaping policy for the rule.
Traffic Shaping policy allocates & limits the maximum bandwidth usage of the user.
A new Traffic Shaping policy can be created directly from this page itself or from Objects > Policies >
Traffic Shaping page.
| Device Configuration | 77
Figure 96: Policies for Business Applications
8. Define logging option for the user application traffic.
Log Firewall Traffic
Click to enable logging of permitted and denied traffic.
Figure 97: Log Traffic
9. Configure Security Heartbeat settings. (Applicable only if IPv4 is selected.)
Require Security Heartbeat
Heartbeat-capable devices can be required to send information on their health status in defined intervals - this is called a heartbeat.
Based on that information, you can restrict a device's access to certain services and networks.
Enable/disable the option to require the sending of heartbeats.
Minimum Heartbeat Permitted
Select a minimum health status that a device must have to conform to this policy. Health status can be either
Green, Yellow or No Restriction. If the health criterion is not met, access and privileges defined in this policy will not be granted to the user.
Figure 98: Security Heartbeat
10. Click Save to save the settings.
DSCP Value
DiffServ Code Point (DSCP) uses the 6 bits, thereby giving 2^6 = 64 different values (0 to 63). describes the standard
DSCP values. Remaining DSCP values can be customized as per the QoS requirement.
Decimal
14
16
18
20
0
8
10
12
DSCP
Default
CS1
AF11
AF12
AF13
CS2
AF21
AF22
Description
Best Effort
Class 1 (CS1)
Class 1, Gold (AF11)
Class 1, Silver (AF12)
Class 1, Bronze (AF13)
Class 2 (CS2)
Class 2, Gold (AF21)
Class 2, Silver (AF22)
| Device Configuration | 78
Decimal
30
32
34
36
22
24
26
28
38
40
46
48
56
DSCP
AF23
CS3
AF31
AF32
AF33
CS4
AF41
AF42
AF43
CS5
EF
CS6
CS7
Description
Class 2, Bronze (AF23)
Class 3 (CS3)
Class 3, Gold (AF31)
Class 3, Silver (AF32)
Class 3, Bronze (AF33)
Class 4 (CS4)
Class 4, Gold (AF41)
Class 4, Silver (AF42)
Class 4, Bronze (AF43)
Class 5 (CS5)
Expedited Forwarding (EF)
Control (CS6)
Control (CS7)
Protection
Protection allows configuration for the following:
Available configurations:
•
- Wireless Protection menu allows you to configure wireless networks, mesh networks, Access
Point (AP) groups, Hotspots and Hotspot Voucher Definition. It also displays overview of the APs known to the device.
• Web Protection
• Application Protection
• Web Server Protection
• Email Protection
Wireless Protection
Wireless Protection allows configuration for the following:
This section covers the following topics:
•
: Create and manage Wireless Networks.
•
: Create and manage Mesh Networks.
•
Access Points
: Provides an overview of the access points known to the device.
•
: This page allows you to organize access points in groups.
•
: Add/Remove Hotspot and apply filtering policies.
•
: Manage different voucher definitions for Hotspot access vouchers.
Wireless Networks
The page provides a list of all configured wireless networks along with their name, SSID, client traffic mode, encryption mode used and frequency band. New wireless networks can be added and existing ones deleted.
Protection > Wireless Protection > Wireless Networks or System > Network > Wireless Networks
Note: You can also view the wireless network status on the System > Current Activity > Wireless Client
List page.
| Device Configuration | 79
The page displays all existing wireless networks. You can add new wireless networks, update or delete them.
Following is a description of the table elements:
Name
Displays the name of the wireless network.
SSID
Displays the SSID of the wireless network.
Status
Displays the Status of the wireless network.
Client traffic
Displays the client traffic of the wireless network.
Encryption Mode
Displays the encryption mode of the wireless network.
Frequency Band
Displays the frequency band of the wireless network.
Manage
Displays the available managing options for the wireless network:
• Edit: Allows you to edit the wireless network.
• Delete: Allows you to delete the wireless network.
To either add or delete a wireless network, click on the corresponding buttons.
Add a New Wireless Network
This page describes how to create a new wireless network.
The Add button on the Wireless Networks page allows to define a new wireless network. This can then be used in definitions for access points and access point groups.
1. Navigate to Protection > Wireless Protection > Wireless Networks or System > Network > Wireless
Networksand click the Add button.
A new page General Settings opens.
2. Make the following settings:
Name
Enter a descriptive name for the network.
Description
Enter a description for the wireless network that helps you to identify it.
SSID
Enter the Service Set Identifier (SSID) for the network which will be seen by clients to identify the wireless network. The SSID may consist of 1-32
ASCII printable characters
. It must not contain a comma and must not begin or end with a space.
Security Mode
Select a security mode from the drop-down list. Default is WPA 2 Personal.
We recommend to prefer WPA2 over WPA, if possible. For security reasons, we recommend to not use WEP unless there are clients using your wireless network that do not support one of the other methods.
When using an enterprise authentication method, you also need to configure a RADIUS server on the
System > Authentication > Authentication Server or Objects > Assets > Authentication Server page. As
NAS ID of the RADIUS server enter the wireless network name.
| Device Configuration | 80
Note: Sophos Firewall OS supports the IEEE 802.11r standard in WPA2 (PSK/Enterprise) networks to reduce roaming times. Clients also need to support the IEEE 802.11r standard.
Passphrase/PSK
Only available with WPA Personal, WPA2Personal and WPA2/WPA Personal security mode.
Key
Enter the passphrase to protect the wireless network from unauthorized access and repeat it in the next field. The passphrase may consist of 8-63 ASCII printable characters.
Only available with WEP Open security mode.
Enter a WEP key here that consists of exactly 26 hexadecimal characters.
Client Traffic
Select a method how the wireless network is to be integrated into your local network.
Separate Zone
Default.
The wireless network is handled as a separate network, having an IP address range of its own. Using this
option, after adding the wireless network, proceed as described in chapter
Note: When switching an existing Separate Zone network to Bridge to AP LAN or Bridge to
VLAN, an already configured WLAN interface will be deleted.
Zone
Select a zone where the wireless network should be broadcasted.
Default: WiFi
IP Address
Assign an IP address to the wireless network.
Netmask
Select a subnet mask for the IP address.
Bridge to AP LAN
You can bridge a wireless network into the network of an access point, that means that wireless clients share the same IP address range. Using this option, after adding the wirless network, proceed as described in chapter
Next Steps for Bridge to AP LAN Networks
.
Bridge to VLAN
Not available for Local WiFi Devices.
You can decide to have this wireless network's traffic bridged to a VLAN of your choice. This is useful when you want access points to be in a common network separate from the wireless clients.
Bridge to VLAN ID
Enter the VLAN ID of the network that the wireless clients should be part of.
Client VLAN ID
Only available with an enterprise security mode.
Select how the VLAN ID is defined.
• Static: Uses the VLAN ID defined in the Bridge to VLAN ID field.
• RADIUS & Static: Uses the VLAN ID delivered by your RADIUS server: When a user connects to one of your wireless networks and authenticates at your RADIUS server, the RADIUS server tells the access point what VLAN ID to use for that user. Thus, when using multiple wireless networks, you can define per user who has access to which internal networks. If a user does not have a VLAN ID attribute assigned, the VLAN ID defined in the Bridge to VLAN ID is used.
3. Optionally, you can make the following Advanced Settings:
| Device Configuration | 81
Encryption
Only available with WPA, WPA2 or WPA2/WPA encryption modes): Select an encryption algorithm which can be either AES, TKIP or TKIP&AES. For security reasons, it is recommended to use AES.
Frequency Band
Access points assigned to this wireless network will transmit on the selected frequency band(s). The 5 GHz band generally has higher performance, lower latency, and is typically less disturbed. Hence it should be preferred for e.g. VoIP communication. For an overview which APs support the 5 GHz band, see chapter
Protection > Wireless Protection > Access Points or Objects > Assets > Access Points.
Time-based Access
Select this option if you want to automatically enable and disable the wireless network according to a time schedule.
Select Active-Time
Select a schedule definition which determines when the wireless network is enabled. You can add a new schedule definition by clicking the Add button.
Client Isolation
Clients within a network usually can communicate with one another. If you want to prevent this, for example in a guest network, select Enabled from the drop-down list.
Hide SSID
If you want to hide the wireless network's SSID, select Yes from the drop-down list. Please note that this is no security feature.
Fast Transition
Only available with WPA2 Personal/Enterprise security mode.
Wireless networks with WPA2 security use the IEEE 802.11r standard. If you want to prevent this, select
Disabled from the drop-down list.
MAC Filtering
To restrict the MAC addresses allowed to connect to this wireless network, select Blacklist or Whitelist.
With Blacklist, all MAC addresses are allowed except those listed on the MAC List. With Whitelist, all
MAC addresses are prohibited except those listed on the MAC List.
MAC Hosts added under Objects > Host and Services > MAC Host will be displayed in the MAC List.
Figure 99: Add Wireless Network
4. Click Save to save your settings and add the wireless network.
| Device Configuration | 82
| Device Configuration | 83
Next Steps for Separate Zone Networks
When you created a wireless network with the option Separate Zone, a new corresponding virtual hardware interface will be created automatically, e.g., wlnet1. To be able to use the wireless network, some further manual configuration steps are required. Proceed as follows:
1. Enable DHCP for the wireless clients on the respective SF device.
For your clients to be able to connect to Sophos Firewall OS, they need to be assigned an IP address and a default gateway on the respective SF device. Therefore, on the System > Network > DHCP page, set up a DHCP server for the interface.
2. Create a Network Policy on the Policies page to provide Internet access to the wireless clients.
Bridge to AP LAN Networks with Local Devices
For Local WiFi Devices you need to make some extra setting on the SF device to make bridging to AP LAN work.
1. Edit the Local WiFi Device on the Protection > Wireless Protection > Access Points or Objects > Assets >
Access Points page and select the wireless network.
2. Create a new bridge interface on the System > Network > Interfaces page to use the wireless interface in Bridge mode or Edit the interface and select zone and provide IP Address to use the interface in Gateway mode.
3. If you want to use the interface in Gateway mode then create a DHCP server on the System > Network > DHCP page so that the client can receive an IP.
Mesh Networks
On this page you can create or delete mesh networks. Additionally, you see an overview of existing mesh networks.
On the Protection > Wireless Protection > Mesh Networks or System > Network > Mesh Networks page you can define mesh networks and associate access points that should broadcast them. In a mesh network, multiple access points communicate with each other and broadcast a common wireless network. On the one hand, access points connected via a mesh network can broadcast the same wireless network to clients, thus working as a single access point, while covering a wider area. On the other hand, a mesh network can be used to bridge Ethernet networks without laying cables. Access points associated with a mesh network can play one of two roles: root access point or mesh access point. Both broadcast the mesh network, thus the amount of other wireless networks they can broadcast is reduced by one.
Access points associated with a mesh network can play one of two roles: root access point or mesh access point. Both broadcast the mesh network, thus the amount of other wireless networks they can broadcast is reduced by one.
• Root access point: It has a wired connection to the Sophos Firewall OS and provides a mesh network. An access point can be root access point for multiple mesh networks.
• Mesh access point: It needs a mesh network to connect to the Sophos Firewall OS via a root access point. An access point can be mesh access point for only one single mesh network at a time.
A mesh network can be used for two main use cases: you can implement a wireless bridge or a wireless repeater:
• Wireless bridge: Using two access points, you can establish a wireless connection between two Ethernet segments. A wireless bridge is useful when you cannot lay a cable to connect those Ethernet segments. While the first Ethernet segment with your Sophos Firewall OS is connected to the Ethernet interface of the root access point, the second Ethernet segment has to be connected to the Ethernet interface of the mesh access point. Using multiple mesh access points, you can connect more Ethernet segments.
| Device Configuration | 84
• Wireless repeater: Your Ethernet with your Sophos Firewall OS is connected to the Ethernet interface of a root access point. The root access point has a wireless connection via the mesh network to a mesh access point, which broadcasts wireless networks to wireless clients.
To create a mesh network, please refer to
on page 84.
Following is a description of the table elements.
Mesh-ID
This is the identifier of the mesh network.
Frequency Band
The frequency band on which the associated access points broadcast the mesh network.
Manage
Displays the available managing options for the mesh networks:
• Edit Allows you to edit the mesh networks.
• Delete Allows you to delete the mesh networks.
To either add or delete a mesh network, click on the corresponding buttons.
Add Mesh Network
On this page you can create mesh networks and assign access points to them.
| Device Configuration | 85
The Add button on the Mesh Networks page allows to define a new mesh network.
1. Navigate to Protection > Wireless Protection > Mesh Networks or System > Network > Mesh Networks and click the Add button.
A new page General Settings opens.
2. Make the following settings:
Mesh ID
Enter a unique ID for the mesh network.
Frequency Band
Access points assigned to this network will transmit the mesh network on the selected frequency band.
Generally, it is a good idea to use a different frequency band for the mesh network than for the broadcasted wireless networks.
Description
Optionally, add a description or other information.
Figure 100: Add Mesh Network
3. Click Save to save your settings and add the mesh network.
Access Point Groups
On the Protection > Wireless Protection > Access Point Groups or Objects > Assets > Access Point Groups page you can organize access points in groups. The list provides an overview of all access point groups and Local WiFi
Devices.
Following is a description of the table elements:
Name
Displays the name of the access point group.
Wireless Networks
Displays the wireless networks the access point group is assigned to.
Access Point
Displays all access points in this group.
Manage
Displays the available managing options for the access point groups:
• Edit Allows you to edit the access point groups.
• Delete Allows you to access point groups.
To either add or delete a access point group, click on the corresponding buttons.
Add an Access Point Group
This page describes how you can add an access point group.
1. Navigate to Protection > Wireless Protection > Access Point Groups or Objects > Assets > Access Point
Groups and click Add.
| Device Configuration | 86
2. Make the following settings for the new access point group.
Name
Enter a descriptive name for the new access point group.
Wireless Networks
Search for wireless networks and select the wireless networks that should be broadcasted by the access points of this group.
Note: For an access point to broadcast a wireless network some conditions have to be fulfilled. They are explained in chapter Protection > Wireless Protection > Access Point Groups or Objects >
Assets > Access Points section Rules for Assigning Networks to APs.
VLAN Tagging
Select Enable if you want to activate VLAN tagging.
Note: Make sure that the VLAN interface is assigned to the zone which is selected in the Allowed
Zone box on the System > System Services > Wireless page.
Access Point
Search for access points and select which you want to add to this group.
Note: Local WiFi Devices cannot be grouped and do not appear in the Access Point box. Local
WiFi Devices appear in the Access Point Groups list.
Figure 101: Add Access Point Group
3. Click Save to save the access point group.
The new access point group will be displayed in the Access Point Groups table.
Hotspots
On this page you can enable the Hotspots feature and define users who are allowed to view and distribute hotspot access information.
Protection > Wireless Protection > Hotspots or System > Authentication > Hotspots
The Hotspot feature allows cafés, hotels, companies, etc. to provide time- and traffic-restricted Internet access to guests. The feature is available within the wireless subscription, but also works with wired networks.
Note: You can also view and manage the hotspot status on the System > Diagnostics > Services page.
Hotspot Generation
In a first step, the administrator creates and enables a hotspot with a specific type of access. The following types are available:
• Terms of use acceptance: The guest is presented a terms of use, which you can define, and has to select a checkbox to get access.
| Device Configuration | 87
• Password of the day: The guest has to enter a password to get access. The password changes on a daily basis.
• Voucher: The guest gets a voucher and has to enter the voucher code to get access. The voucher can be limited in the number of devices, in time, and traffic.
Distribution of Access Information to Guests
With the types Password of the day and Voucher, the access information has to be handed out to the guests.
Therefore you can define users who are allowed to manage and distribute access information. Those users receive and distribute the access information via the Hotspot tab of the User Portal:
• Password of the day: The current password can be sent via email and the users find the password in the User
Portal. The users forward the password to the guests. They can generate or enter a new password. Hereby, the former password automatically becomes invalid and active sessions will be terminated. Potential other users will be informed of the new password, either by email or via the User Portal, depending on what is configured for them.
• Voucher: In the User Portal, users have the possibility to create vouchers, each with a unique code. Different types of vouchers can be available if specified by the administrator. The vouchers can be printed or exported and given to the guests. A list of created vouchers gives an overview about their usage and helps to manage them.
Legal Information
In many countries, operating a public wireless LAN is subject to specific national laws, restricting access to websites of legally questionable content (e.g., file sharing sites, extremist websites, etc.). To meet this requirement, you can combine the hotspot with the web protection capabilities of the Sophos Firewall OS, which allow you to control web access by blocking and allowing everything from an entire website category type to a single URL. The Sophos
Firewall OS gives you complete control over what is allowed to be accessed, by whom, and when. That way you can put the hotspot under heavy restrictions, if national or corporate policies require you to do so. Using the current feature of Sophos Firewall OS also gives you advanced logging and reporting capabilities. The reporting will show who visited what site, when, and how many times, allowing you to identify inappropriate usage in case you want to operate a hotspot without any access restrictions. In addition to that, legal regulations may require you to register your hotspot at the national's regulatory body.
The page displays all existing hotspots. You can add new hotspot, update or delete them. Following is a description of the table elements:
Name
Displays the name of the hotspot.
Hotspot Type
Displays the type of the hotspot.
Manage
Displays the available managing options for the hotspot:
• Edit: Allows you to edit the hotspot.
• Delete: Allows you to delete the hotspot.
To either add or delete a hotspot, click on the corresponding buttons.
Add Hotspot
This page describes how to add a hotspot.
Note: A hotspot has to be assigned to an existing interface, typically a WLAN interface. All hosts using this interface will automatically be restricted by the hotspot. Therefore, before you create a hotspot you would typically create a wireless network with client traffic Separate Zone, then create an interface for the respective WLAN interface hardware. For more information see Protection > Wireless Protection >
Wireless Networks or System > Network > Wireless Networks.
| Device Configuration | 88
1. Navigate to Protection > Wireless Protection > Hotspots or System > Authentication > Hotspots and click
Add.
2. Make the following settings:
Name
Enter a descriptive name for hotspot.
Description (optional)
Enter a description or other information.
Interfaces
Select or add the interfaces which are to be restricted by the hotspot. An interface can only be used by one hotspot.
Note: Hotspots will work only on LAN and DMZ member interfaces of the bridge. You should not select an uplink interface here because traffic to the Internet will completely be blocked afterwards.
Additionally, we strongly advise against using interfaces used by servers which provide essential services like authentication. You may irreversibly lock yourself out of Sophos Firewall OS!
Users
Select or add users for administrative settings. Administrative users are allowed to create vouchers or change the password of the day in the User Portal. By default nobody is allowed to make administrative settings.
Application Filter Policy (optional)
Select or add an application filter policy for the hotspot.
Web Filter Policy (optional)
Select or add a web filter policy for the hotspot.
IPS Policies (optional)
Select or add IPS policies for the hotspot.
Traffic Shaping Policy (optional)
Select or add a traffic shaping policy for the hotspot.
Redirect to HTTPS (optional)
Enable to redirect users to HTTPS.
Hostname Type
Select the hostname type for the hotspot.
• None (IP Address)
• Custom hostname
Hostname
(if Custom hostname is selected)
Add a hostname for the redirect.
Hotspot Type
Select a hotspot type for the selected interfaces.
• Terms of Use Acceptance Customers can access the Internet after accepting the terms of use.
Session Expires
Select the time span after which the access will expire. After that, with the hotspot type Terms of Use
Acceptance, the users have to accept the terms of use again to log in. With the hotspot type Backend
Authentication, the users have to authenticate again.
Terms of Use
Add the text to be displayed as terms of use. Simple HTML markup and hyperlinks are allowed.
• Password of the Day A new password will be created automatically once a day. This password will be available in the User Portal on the Hotspots tab which is available to all users specified for this hotspot.
Additionally it will be sent to the specified email address(es).
| Device Configuration | 89
Password Creation Time
The assigned time of the day at which the new password will be created. At this time the former password will immediately get invalid and current sessions will be cut off.
Send Password by Email to (optional)
Add email addresses to which the password shall be sent.
Synchronize Password with PSK of Wireless Networks (optional)
Select this option to synchronize the new generated/saved password with wireless PSK.
Note: With the new PSK all APs that are configured with a separate zone wireless network that is also used as a hotspot interface will be reconfigured and restarted. This means all connections will be dropped.
• Voucher With this hotspot type, in the User Portal tokens with different limitations and properties can be generated, printed and given to customers. After entering the code, the customers can then directly access the Internet.
Voucher Definitions
Add or select the voucher definitions you want to use for the hotspot. How to add a voucher definition is explained on the Voucher Definitions page.
Devices per Voucher
Enter the number of devices which are allowed to log in with one voucher during its lifetime. It is not recommended to use the unlimited entry.
Terms of Use
(not with hotspot type Terms of Use Acceptance:
Add the text to be displayed as terms of use. Simple HTML markup and hyperlinks are allowed.
Users Have to Accept Terms of Use
(not with hotspot type Terms of Use Acceptance):
Enable this option if you want the hotspot users to accept your terms of use before accessing the Internet.
Redirect to URL After Login
Enable, so that users will be redirected automatically to a particular URL after entering password or voucher data.URLs for example could be your hotel's website or a webpage stating your portal system policies.
URL
Enter URL to which the user will be redirected to.
| Device Configuration | 90
Figure 102: Add Hotspot
3. Optionally, customize the hotspot.
Enable Customization
Enable to use a customized HTML file with your own images and stylesheets. Additionally, you can customize the voucher layout.
Customization Type
Select the customization type.
| Device Configuration | 91
• Basic Uses the default login page template. If required, change logo, title, and text.
Logo
Upload a logo for the login page. Supported image file types are jpg, jpeg, png and gif. A maximum image width of 300 px and height of 100 px is recommended (depending on the title length).
Scale Logo to Recommended Size
If selected, a logo exceeding the recommended width or height will be scaled down and displayed in the recommended size. If not selected, the logo will be displayed in the original size.
Title
Add a title for the login page. Simple HTML markup and hyperlinks are allowed.
Custom Text
Add an additional text for the login page. You can for example enter the SSID of the wireless network to be used. Simple HTML markup and hyperlinks are allowed.
• Full Select an individual login HTML page.
Login Page Template
Select the HTML template you want to use for your individual login page. Clicking Browse... opens a window where you can select and upload the file. In this template, you can use variables that can dynamically insert information for each hotspot. For example, you can add the company name and administrator information, the terms of use and the login form. See detailed information in chapter
Login Page Template.
Images/Stylesheet
Add files that are referenced in your login page template, e.g., images, stylesheets, or JavaScript files.
Clicking Browse... opens a window where you can select and upload the files.
Voucher Template
(only with hotspot type Voucher): Clicking Browse...opens a dialog where you can select and upload a PDF file with the voucher layout. By default, a default template is used. The voucher PDF file has to be of PDF version PDF 1.5 or lower. It may have any page size and format—both size and format will be adjusted during voucher creation in the User Portal, depending on page size and number of vouchers per page specified there.
The PDF file may contain the following variables that will be replaced with the respective values during voucher generation in the User Portal:
• Wireless network name (SSID): <?ssid0?> (and <?ssid1?>, <?ssid2?> and so on, if the WLAN has more than one SSIDs)
• Wireless network password: <?psk0?> (and <?psk1?>, <?psk2?> and so on, if the WLAN has more than one SSIDs)
• Voucher code: <?code?>
• Voucher validity time:
<?validity?>
• Voucher data limit: <?datalimit?>
• Voucher time limit: <?timelimit?>
• Comment: <?comment?>
• QR code with the hotspot access data encoded:
<?qrX?>. The upper left corner of the QR code will be placed on the lower left corner of the variable.
Note: When using variables, the PDF file must include the entire character sets of the fonts used. When a variable is replaced by its value, and one of the substitute characters is not available, it will be displayed incorrectly. We recommend to add the string
<?
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789?> (for
English usage) to your PDF file, which will automatically be removed during voucher generation.
| Device Configuration | 92
Figure 103: Hotspot Customization
4. Click Save to save your settings.
The hotspot is now available and appears in the hotspot list.
You can see if the hotspot is running on the System > Diagnostics > Services page. There you can also stop or start the hotspot.
Login Page Template
This page gives an overview of possible variables of the hotspot login template.
The HTML template for the login page may contain various variables that can dynamically insert information for the hotspot login page. When the UTM processes a template in order to display a login page, it replaces any template variables with the relevant value. Valid variables are:
General variables
•
<?company_text?>: Default company text
• <?company_logo?>: Default company logo (Sophos logo). The variable will be replaced by the path of the logo file, usage e.g., <img src="<?company_logo?>">
• <?admin_contact?>: Administrator name or address as defined on System > Administration > Notification
(Send Notifications to Email Address field)
• <?admin_message?>: Administrator information label (default: For administrative questions please contact:)
•
<?error?>: Error message that arose while trying to log in.
Variables used for all hotspot types
• <?terms?>: Terms of use (as defined on Add Hotspot page)
• <?redirect_host?>: Redirect URL that is specified for the hotspot (as defined on the Add Hotspot page)
•
<?location?>: URL the user requested
• <?location_host?>: Hostname of the URL the user requested
• <?login_form?>: Login form suitable for the respective hotspot type: Password text box, Token text box,
Username and Password text boxes, or Accept checkbox, and Login button.
Note: For creating customized login forms, see User Specific Login Form below.
• <?asset_path?> (only important for customization mode Full): Hotspot specific directory for storage of images or stylesheets (example usage: <img src="<?asset_path?>/logo.png">)
| Device Configuration | 93
Variables only used for voucher type hotspots
•
<?maclimit?> Number of allowed devices per voucher of this hotspot (as defined on the Add Hotspot page)
• <?numdevices?>: Number of devices used for this voucher
• <?timeend?>: Validity period (as defined on the Add/Edit Voucher Definition page)
• <?time_total?>: Total time quota allowed (as defined on the Add/Edit Voucher Definition page)
•
<?traffic_total?>: Total data volume allowed (as defined on the Add/Edit Voucher Definition page)
Templates can contain if variables that make up sections like the ones shown below. Each section has an opening and a closing variable. The contents of an if section is only displayed on a specific condition.
If Section Meaning
Section is displayed when the user has successfully logged in.
<?if_loggedin?>
<?if_loggedin_end?
>
<?if_notloggedin?>
<?
if_notloggedin_end?
>
Section is displayed when the user has not yet logged in, e.g., because terms of use have to be accepted or because an error occurred.
<?
if_authtype_password?
Section is displayed when hotspot type is Password of the Day.
>
<?
if_authtype_password_end?
>
<?
if_authtype_disclaimer?
Section is displayed when hotspot type is Terms of Use Acceptance.
>
<?
if_authtype_disclaimer_end?
>
<?
if_authtype_token?>
<?
if_authtype_token_end?
>
Section is displayed when hotspot type is Voucher.
<?if_location?>
<?if_location_end?>
Section is displayed when the user has been redirected.
Section is displayed when the checkbox Redirect to URL After Login is enabled.
<?if_redirect_url?>
<?
if_redirect_url_end?
>
Section is displayed when the checkbox Redirect to URL After Login is disabled.
<?
if_not_redirect_url?
>
| Device Configuration | 94
If Section Meaning
<?
if_not_redirect_url_end?
>
Section is displayed when a validity period is set for a voucher.
<?if_timelimit?>
<?if_timelimit_end?
>
<?if_trafficlimit?>
<?
if_trafficlimit_end?>
Section is displayed when a data volume is set for a voucher.
<?if_timequota?>
<?if_timequota_end?
>
Section is displayed when a time quota is set for a voucher.
Section is displayed when a Devices per Voucher value is specified.
<?if_maclimit?>
<?if_maclimit_end?
>
<?if_terms?>
<?if_terms_end?>
Section is displayed when Terms of Use are defined and enabled.
<?if_error?>
<?if_error_end?>
Section is displayed when an error occurred while trying to log in.
User-Specific Login Form
If you want to create your own login form instead of using the pre-defined
<?login_form?> variable, consider the following:
• Enclose the form in the following tags:
<form action="?action=login" method="POST"> ... </form>
• For a Terms of Use Acceptance hotspot, add a checkbox named "accept":
<input type="checkbox" name="accept">
• For Password of the Day or Voucher hotspots, add a text box named "token":
<input type="text" name="token">
• Add a means to submit the form, e.g., a Login button:
<input type="submit" name="login" value="Login">
Hotspot Voucher Definition
In this chapter you can manage different voucher definitions for voucher type Hotspots.
Protection > Wireless Protection > Hotspot Voucher Definition or Objects > Policies > Hotspot Voucher
Definition
The page displays all existing voucher definitions. You can add new voucher definitions, update or delete them.
Following is a description of the table elements:
Name
Displays the name of the voucher definition.
Manage
| Device Configuration | 95
Displays the available managing options for the voucher definition:
• Edit: Allows you to edit the voucher definition.
• Delete: Allows you to delete the voucher definition.
To either add or delete a voucher definition, click on the corresponding buttons.
Add Hotspot Voucher
This page describes how to add a voucher definition.
1. Navigate to Protection > Wireless Protection > Hotspot Voucher Definition or Objects > Policies > Hotspot
Voucher Definition and click Add.
2. Make the following settings:
Name
Enter a descriptive name for the voucher definition.
Description
Enter a description or other information.
Validity Period
Enter the time span for which a voucher with this definition will be valid. Counting starts at the first login. It is highly recommended to enter a time period.
Note: The maximum time for the Validity Period is two years.
Time Quota
Here you can restrict the allowed online time. Enter the maximum online time after which a voucher of this definition expires. Counting starts at login and stops at logout. Additionally, counting stops after 5 minutes of inactivity.
Note: The maximum time for the Time Quota is two years.
Data Volume
Here you can restrict the allowed data volume. Enter the maximum data volume to be transmitted with this voucher definition.
Note: The maximum data volume is 100 GB.
Figure 104: Hotspot Voucher Definition
3. Click Save to save your settings.
The voucher definition is now available and appears on the voucher list.
| Device Configuration | 96
Rogue AP Scan
A Rogue Access Point (AP) is any Wi-Fi access point connected to your network without authorization. It can be a setup used by an attacker for the purpose of sniffing wireless network traffic and can be used to conduct a man-in-themiddle attack. It allows anyone with a Wi-Fi-equipped device to connect to your corporate network, leaving your IT assets wide open for the casual snooper or criminal hacker.
Device can alleviate this by recognizing rogue access points potentially attempting to gain access to your network.
Click Schedule system-triggered scan to enable a schedule to scan and discover authorized APs and rogue APs. You can select from the pre-defined schedules or create a custom schedule from Objects > Policies > Schedule.
Discover Access Points
To increase the security capabilities and identify the unauthorized APs, Sophos Wireless Devices provides scanning capability by which nearby APs can be discovered and administrator can take countermeasures against the most common types of illicit wireless activity.
To manually scan for the automatic discovery of APs, click “Scan Now”.
All the discovered Access Points detected are regarded as unrecognized until they are identified as authorized or rogue for operation. To authorize an access point, click the icon against the AP to be marked as authorized in the
Unrecognized AP table. To mark an access point as rogue, click the icon against the AP to be marked as rogue in the Unrecognized AP table.
If you are scanning for the first time after enabling Wireless LAN, all the discovered APs will be listed in
Unrecognized Access Points table. Scanning result is displayed in the form of 3 tables:
Unrecognized Access Points table
Table lists all the discovered nearby APs and displays following information:
Channel
The radio channel used by the access point.
BSSID
The MAC Address of the radio interface of the detected access point.
SSID
The radio SSID of the access point.
Signal Strength
The strength of the detected radio signal
Security Mode
Mode for encrypting the wireless traffic
Wireless Mode
Wireless protocol
Action
Click the icon to mark the AP as authorized AP and move in the Authorized AP table. Click the icon to mark the AP as Rogue AP and move to the Rogue AP table.
Rogue Access Points table
Table lists all the APs marked as “Rogue” and displays following information:
Channel
The radio channel used by the access point.
BSSID
The MAC Address of the radio interface of the detected access point.
| Device Configuration | 97
SSID
The radio SSID of the access point.
Signal Strength
The strength of the detected radio signal
Security Mode
Mode for encrypting the wireless traffic
Wireless Mode
Wireless protocol
Action
Click the icon to mark the AP as authorized AP and move in the Authorized AP table. Click the icon to mark the AP as unrecognized AP and move to the Unrecognized AP table.
Authorized Access Points table
Table lists all the APs marked as “Authorized” and displays following information:
Channel
The radio channel used by the access point.
BSSID
The MAC Address of the radio interface of the detected access point.
SSID
The radio SSID of the access point.
Signal Strength
The strength of the detected radio signal
Security Mode
Mode for encrypting the wireless traffic
Wireless Mode
Wireless protocol
Action
Click the icon to mark the AP as unrecognized AP and move to the Unrecognized AP table. Click the icon to mark the AP as Rogue AP and move to the Rogue AP table.
Web Protection
Web Proxy
Protection > Web Protection > Web Proxy or System > System Services > Web Proxy
The device can also act as a Web Proxy Server. To use your device as a Web Proxy Server, configure the device’s
LAN IP Address as a proxy server IP Address in the browser setting and enable access to Web Proxy services from
Device Access section.
Note: You can also view and manage the Web Proxy status on the System > Diagnostics > Services page.
Below are the screen elements with their description:
Web Proxy Port(Applicable only when the device is configured as Web Proxy)
Specify Port number, which is to be used for Web Proxy.
Default - 3128
| Device Configuration | 98
Trusted Ports
Device allows the access to those sites which are hosted on standard port, only if deployed as Web Proxy. To allow access to the sites hosted on the non-standard ports, you have to define non-standard ports as trusted ports.
Click icon to add the HTTP trusted ports, Cancel icon to delete the trusted ports and Click icon to modify the trusted ports.
Click Apply to configure Web Proxy settings.
Note:
• Web Proxy enforces Web and Application Filter policy and Malware Scanning Rules as configured in
Security Policies.
• IPS policy is applicable on the traffic between proxy and WAN, but not between user and proxy.
• Traffic Shaping policy is not applicable on the direct proxy traffic.
Web Content Filter
Protection > Web Protection > Web Content Filter or System > System Services > Web Content Filter
Web Content Filter menu allows to configure and manage web filtering through the device. It also allows to configure general restrictions for scanning and restricting all the HTTP/HTTPS/FTP traffic. By default, device will not scan HTTP traffic. You can also define the rule to bypass HTTP scanning of the traffic from specific source and destination. If virus scanning is enabled and virus is detected, receiver will receive a notifying message. Similarly, you can define rule to bypass HTTPS scanning based on the web categories.
General Configuration
Use this section to enable the Safe Search feature, caching and Pharming protection useful in filtering Web traffic.
You can also configure Custom Denied Message.
Safe Search - This feature allows you to enforce safe searching into your search engines, thus helping you against malicious sites.
Pharming Protection - This feature allows you to stop Pharming by various attacker sites by Domain Name resolution.
Below are the screen elements with their description:
Scanning
Select the type of scanning to be applied.
Available Options:
• Single Anti-Virus (Maximum Performance): Traffic will be scanned using the Primary Anti-Virus engine.
• Dual Anti-Virus (Maximum Security): Traffic will be scanned using both Anti-Virus Engines, first by Primary and then by the Secondary Engine. This can increase virus detection, but will impact performance.
It is recommended to use Single Anti-Virus engine for scanning for the best balance of Security and
Performance.
Enforce Safe Search
Enable safe search so that web sites containing pornography and explicit sexual content are blocked from the
Google, Yahoo, Altavista and Bing search results.
This will be applicable only when access to Porn, Adult Content and Nudity categories are denied in the Web
Filter Policy.
Enable Pharming Protection
Enable to protect against pharming attacks and direct users to the legitimate websites instead of fraudulent websites.
| Device Configuration | 99
Pharming attacks require no additional action from the user from their regular web surfing activities. Pharming attack succeeds by redirecting the users from legitimate websites instead of similar fraudulent websites that has been created to look like the legitimate site.
Caching
Enable Caching
When enabled the Web Filter keeps a copy of frequently visited sites to improve performance and reduce bandwidth usage
Force caching for Endpoint updates
Use this option to enable caching of update data for Sophos Endpoints.
Note: If this option is disabled you may experience network congestion when many endpoints attempt to download updates from the Internet at the same time.
Denied Message
Specify default deny message to be displayed for all the web categories.
Enable Override Default Denied Message to display a customized message for all the web categories.
Denied Message Image
Specify whether the default or custom image should be displayed on the Denied message page.
Top Image
Specify the image which is to be displayed at the top of the message page.
Dimension of Image should be 125 x 70 pixels and jpg file only.
Bottom Image
Specify the image which is to be displayed at the bottom of the message page.
Dimension of Image should be 700 * 80 pixels and jpg file only.
Preview
Click to view the settings before saving the changes.
HTTP/HTTPS Configurations
The administrator can configure for real time or batch mode scanning of HTTP traffic.
You can configure the maximum file size that can be buffered to the memory for scanning. This will also prevent the unintentional download of virus file hidden in the fragmented files.
Depending on the scanning policy set at the time of deployment through Network configuration Wizard, device will scan HTTP and HTTPS traffic. Enable or disable HTTP and HTTPS scanning from security policy.
Use this section to configure general restrictions for scanning and restricting all the HTTP/HTTPS traffic.
Scan Mode
Specify scanning mode to configure for real time or batch mode scanning for HTTP/HTTPS traffic.
In batch mode, virus scanning will start only after the complete file is downloaded. As complete file is to be downloaded before scanning can start, if the size of the file is large it will take some time.
To avoid the delay, configure scan in real mode if you have to download bulky files.
File Size Threshold
Specify file size threshold (in KB). Files that exceed configured threshold will not be scanned.
Acceptable Range - 1 to25600 KB
Default - 1024 KB
| Device Configuration | 100
Audio & Video File Scanning
Enable Audio & Video File Scanning for scanning of video and audio streams being downloaded.
Default - Disable
HTTPS Scanning CA
Select the CA for HTTPS Scanning from the available options:
Available Options:
• SecurityAppliance_SSL_CA
• SecurityApplianceSelf Signed CA
• List of custom CAs if added
Default - SecurityAppliance_SSL_CA
Deny Unknown Protocol
Enable to deny traffic that does not follow HTTPS protocol.
Allow Invalid Certificate
If you enable HTTPS scanning, you need to import appliance SSL Proxy certificate in Internet Explorer, Firefox
Mozilla or any other browsers for decryption on SSL Inspection otherwise browser will always give a warning page when you try to access any secure site. “Invalid Certificate error” warning appears when the site is using an invalid SSL certificate. Device blocks all such sites.
Enable if you want to allow access to such sites.
FTP Configurations
The administrator can define policies to take the appropriate action based on the protocols. Separate policy can be defined on how to handle SMTP, POP3, FTP and HTTP traffic if infection is detected.
When Device detects a virus, file transfer is stopped and Email message is delivered without the attachment.
Files Greater Than Size
Configure the maximum file size (in KB) for scanning. The files greater than the specified size will not be scanned.
Acceptable Range - 1 to 20480KB
Default – 1024 KB
HTTP Scanning Rules
Apart from mails, virus can infect your network through HTTP downloads also. Define HTTP scanning rules to protect against this. The HTTP Scanning Rules section displays list of all the scanning rules. It also provides option to
a new rule, update the parameters of the existing rules, or delete a rule.
HTTPS Scanning Exceptions
The device allows to bypass the HTTPS scanning for specified web categories. Administrator needs to create an exception rule and include all the web categories which are to be bypassed from HTTPS scanning.
The section displays list of all the configured exception rules. It also provides option to
a new exception rule, update the parameters of the existing rule, and delete the rule.
Add HTTP Rule
You can add HTTP Scanning Rule from this page.
1. Navigate to Protection > Web Protection > Web Content Filter or System > System Services > Web Content
Filterand click Add under HTTP Scanning Rules section.
2. Enter HTTP Rule details.
| Device Configuration | 101
Name
Provide a name for the HTTP Rule.
Source IP Address
Specify Source IP Address.
Destination IP Address
Specify destination IP Address.
Scanning Rule will be applied on the mails received from the sender using specified source IP Address and send to the recipient with the specified destination IP Address.
URL Regex.
Provide URL. You can use regular expression for matching the pattern in URL.
Action
Select whether you want to scan or bypass traffic for the specified source/destination IP Address and URL.
Figure 105: Add HTTP Rule
3. Click Save to add HTTP Scanning Rule.
Add HTTPS Scanning Exception
You can add HTTPS Scanning Exception from this page.
1. Navigate to Protection > Web Protection > Web Content Filter or System > System Services > Web Content
Filterand click Add under HTTPS Scanning Exceptions section.
2. Enter HTTPS Scanning Exception details.
Name
Enter name for the bypass rule.
Bypass
Select the web category to be bypassed for HTTPS scanning.
You can directly add a new web category from this page or from Protection > Web Protection > Custom
Web Category or Objects > Content > Custom Web Category
Figure 106: Add HTTPS Scanning Exception
| Device Configuration | 102
3. Click Save to add HTTPS Scanning Exception.
Web Filter Policies
The Web Filter page allows you to Add, Delete, or Edit web filter policies.
Use the Protection > Web Protection > Web Filter Policies or Objects > Policies > Web Filter page to create and maintain a set of Web Filter policies. Each policy can filter based on a Web Category, File Type, URL Group, or
Dynamic Category. Default policies are included, and you can create and maintain your own.
On this page you can view the list of Web Filter polices. Details of each are listed under the related table heading:
• Name: The name of your existing Web Filter Policies. To edit an existing policy, click the Name, or select the check box and click the wrench icon under Manage.
• Filter icon: Select this icon to filter results. You can limit the policies that are displayed to a keyword search.
• Default Action: Shows the default action configured for the policy.
• Reporting: Displays if reporting is Enabled or Disabled for the policy.
• Description: Provides a short description for the policy.
• Manage: Includes a edit or delete policies.
Add Web Filter Policy
Create a new Web Filter Policy.
On the Add Web Filter Policy page you can create a new Web Filter Policy to include on the Protection > Web
Protection > Web Filter Policies and Objects > Policies > Web Filter page.
1. Enter a Name for the policy.
2. Enter a brief Description for the policy you want to create.
3. Under Template you can select an existing template from the dropdown list.
This will populate categories from the existing template to help create a similar policy.
4. Select the Enable Reporting check box to include this policy in generated reports.
5. Set Download File Size Restriction to the maximum file size that can be downloaded for this policy. Leave this set at zero for no restriction.
6. Under YouTube Education Filter enter your school ID for YouTube for Schools.
Figure 107: Add Web Filter Policy
Note:
If enabled, users trying to open a YouTube video are restricted to videos either belonging to the subsection YouTube EDU or uploaded by your school account.
| Device Configuration | 103
7. Click Add to configure categories associated with this Web Filter Policy.
8. Click Save.
Add Web Filter Policy Category
Create a new Web Filter Policy Category.
On the Add Web Filter Policy Category page you can create a new Web Filter Policy Category to include on the
Protection > Web Protection > Web Filter Policies > Add > Add Web Filter Policy Category page.
1. Select a Category Type from the drop down list.
2. Click Add New Item and select categories you would like included.
3. Select Allow or Deny for both HTTP Action and HTTPS Action.
4. For Web Category and URL Group you can click Exception and configure File Type Category to be excluded from the policy.
5. Select an option from the Schedule drop down list.
Figure 108: Add Web Filter Policy Category
6. Click Add.
Custom Web Category
The Custom Web Category page displays a list of existing Web Categories.
On the Protection > Web Protection > Custom Web Category or Objects > Content > Custom Web Category page you can maintain Categories of sites and assign them a Classification.There are four classifications that can be used in policy decisions to control web usage. These categories are:
• Productive
• UnProductive
• Acceptable
• Objectionable
By default there is a list of web categories with set classifications you can use in your policies. On this page you can edit or delete existing categories, or create and classify a category of your own.
Add Web Category
Create a new Custom Web Category.
| Device Configuration | 104
On the Add Web Category page you can create a new Custom Web Category for use in policy decisions. To create a
Web Category:
1. Enter a Name for your new category.
2. Select a classification from the Classification drop-down menu.
Available classifications include:
• Productive
• UnProductive
• Acceptable
• Objectionable
3. Select an option for Traffic Shaping Policy.
4. Set the Configure Category option to either Local or External URL Database.
• If you selectExternal URL Database you can enter a URL to a list of custom URLs that you want to include in the category.
• If you select Local you can enter a list of domains or keywords, either by uploading a text file or by entering them in the related text box. In the Search/Add text boxes you can enter domains or keywords. The existing list will match what you type so that you can see if an entry already exists.
5. Enter a Description to describe your new Web Category.
Figure 109: Add Custom Web Category
6. Click Advanced Settings to configure policies or override the default message for a category.
a) Next to Action, select one or more policies from the Web Filter Policy list. For each policy selected, set the desired action for both HTTP and HTTPS.
a) Next to Denied Message, select Override Default Denied Message to modify the block page shown if your
Web Category is denied by a policy. This allows you to have present a specific message if a user is blocked.
| Device Configuration | 105
Figure 110: Add Custom Web Category
7. Click Save to create your new Web Category.
Edit Web Category
Modify an existing Web Category.
From the Protection > Web Protection > Custom Web Category or Objects > Content > Custom Web Category page, either click the Name of an existing category or click the related Manage icon on the right. The Edit Web
Category page is displayed.
1. Select the correct Classification for the Web Category.
2. Optionally, from the Traffic Shaping Policy drop-down, select an existing policy, or Create New.
3. Under Advanced Settings you can select Override Default Denied Message to modify the block page shown when your Web Category is denied by a policy. This allows you to have present a specific message if a user is blocked.
4. Click Save.
URL Group
Create a collection of URLs for use in web filter policies.
Use the Protection > Web Protection > URL Group or Objects > Content > URL Group page to create a group of
URLs. These groups can be used in your web filter policies to block or allow custom collections of sites.
On this page you can edit an existing URL Group by either clicking its name under URL Group Name, or by clicking the Manage icon on the right. To delete an existing URL Group, click the Delete icon.
| Device Configuration | 106
Add URL Group
Add a collection of URLs for use in policies.
On the Protection > Web Protection > URL Group or Objects > Content > URL Group , click the Add button to bring up the Add URL Group page.
1. Enter a name for your group in the URL Group Name text box.
2. Enter a description for the group you are creating.
3. Add URLs for this collection.
Figure 111: Add URL Group
Entries must be single domains on separate lines, such as: example.com
foo.com
bar.com
4. Click Save.
Edit URL Group
On the Edit URL Group page you can modify an existing URL Group.
1. Set the Calssification for the URL Group.
2. Chose an existing Traffic Shaping Policy, or select Create New.
3. Under Advanced Settings you can select Override Default Denied Message to modify the block page shown when your URL Group is denied by a policy. This allows you to have present a specific message if a user is blocked.
Surfing Quota
The Surfing Quota Policy page displays the list of all the default as well as custom surfing quota policies.
Surfing quota policy defines the duration of Internet surfing time. Surfing time duration is the allowed time in hours for a Group or an Individual User to access Internet.
Surfing Quota Policy:
• Allows allocating Internet access time on a cyclic or non-cyclic basis.
• Single policy can be applied to number of Groups or Users.
Device is shipped with the following predefined policies: Unlimited Internet Access, 1 Month Unlimited Access, 1 month 100 hours, Monthly 100 hours Cyclic, Daily 1 hour Cyclic, Weekly 7 hours Cyclic. These predefined policies are immediately available for use until configured otherwise. You can also define custom policies to define different levels of access for different users to meet your organization’s requirements.
The page also provides option to add, update, or delete surfing quota policies.
| Device Configuration | 107
Note: Among all the policies applied, device takes into account the policy that first reaches its threshold limit.
Create a New Surfing Quota Policy
Use the Add Surfing Quota page to configure a new surfing quota policy.
The Add Surfing Quota page allows you to manually enter details to configure surfing quota policy.
1. Navigate to Protection > Web Protection > Surfing Quota or Objects > Policies > Surfing Quota and click
Add.
2. Enter the details.
Name
Specify name to identify the Policy. Duplicate names are not allowed.
Cycle Type
Select Cycle type.
Available Options:Cyclic - Once the cycle ends, user is automatically registered for new cycle. Non-Cyclic -
Once the specified time limit ends, user will be disconnected.
Cycle Hours
Specify Cycle Hours. Cycle hours define the upper limit of surfing hours for cyclic types of policies i.e. Daily,
Weekly, Monthly and Yearly.
At the end of each Cycle, cycle hours are reset to zero i.e. for "Weekly" Cycle type, cycle hours will reset to zero every week even if cycle hours are unused.
Validity
Specify Validity in number of days. Validity defines the upper limit of total surfing days allowed i.e. restricts total surfing days to valid allotted days.
OR
Click Unlimited Days, if you do not want to restrict the total surfing days.
Maximum Hours
Specify Maximum Hours. Maximum hours define the upper limit of total surfing hours allowed i.e. restricts total surfing hours to maximum hours.
OR
Click Unlimited Hours, if you do not want to restrict the total surfing hours.
Description
Provide description for Surfing Quota Policy.
Figure 112: Add Surfing Quota Policy
| Device Configuration | 108
3. Click Save to add the surfing quota policy with the options you have configured.
File Type
The File Type page allows you to manage file types to be used in filtering policy.
The Protection > Web Protection > File Type or Objects > Content > File Type page displays list of both built-in and custom file types that you can control in policy expressions. For instance, you can restrict access to certain types of files within an otherwise-permitted category.
A file type group consists of collections of files, identified by either file extenstion or MIME headers. Predefined File
Types are provided, and you can create new collections of file types using templates.
This page lists existing File Type collections. The predefined File Type collections can not be modified. For File
Type groups that you have added, you can edit or delete the by selecting the associated icon under the Manage heading. To delete multiple File Types, select the associated checkboxes under the Name heading and click Delete at the top of the page.
Click the Add button at the top to create a new File Type.
Add File Type Category
Create a File Type collection to be used in Internet filter policies.
Use the Protection > Web Protection > File Type or Objects > Content > File Type page to create collections of
File Types for use in Internet policies. To create a new File Type collection:
1. Enter a Name for the new collection.
2. Under Template, either leave set to Blank or choose an option from the drop-down menu.
Selections under the Template drop-down will populate the File Extension and MIME Header fields with information from our predefined File Types. From there, you can add extensions and MIME headers to extend the definition of your new File Type Category.
3. Add entries to the File Extension and MIME Header text boxes to include those file types in your new category.
4. Add information in the Description text box to provide information about your new category.
Figure 113: Add File Type Category
| Device Configuration | 109
5. Click Save to create your new File Type Category.
Malware Protection
Sophos Firewall offers Dual Anti Virus Scanning, wherein traffic is scanned by Two (2) Anti Virus Engines. Traffic is first scanned by the Primary Engine, and then the Secondary Engine.
Note: Dual Anti Virus is not available in Device Models SF 100 and SF200. For them, ONLY Single Anti
Virus CYREN is available.
Note: You can also view and manage the Anti Virus status on the System > Diagnostics > Services
General Settings
Primary Anti Virus Engine
Select the Primary Anti-Virus Engine to be used for traffic scanning. For Dual Scan, packets are first scanned by the Primary Engine and then by the Secondary Engine. For Single Scan, only the Primary Engine is used.
Available Options
Sophos EngineAvira Engine
Application Protection
Application List
The Application List page displays all the applications available for use.
The device can identify and control applications which use standard port 80, 443, non-standard ports, port hopping or tunnel through encrypted SSL traffic. The feature enables prioritization of applications based on user identity, time, applications, and bandwidth, allowing great flexibility, visibility, and control. The device also provides implementation of application-based bandwidth management, accelerating critical applications while blocking malware-laden sites through Web Filtering. Organizations can group applications as per their requirements into business-critical, entertainment, communication, collaboration and control access through Security policies.
Note: Web Protection is a subscription module that needs to be subscribed before use. Check the features of the module by subscribing free trial subscription of the module. (See System Management > System
Settings > Maintenance > Licensing(Only at appliance level))
The device is shipped with a set of predefined applications. This applications are classified based on their risk level, characteristics and technology, offering more granular controls.
The total number of application signatures included depends on the Application Signatures Database used by the device. Device Information doclet in the Dashboard provides the version of Application Signatures Database used by your device.
The application list can be filtered based on name of the application, category of the application, risk, characteristics, and technology.
Application Filter
The Application Filter page displays list of all the predefined and custom policies.
Application Filter Policy controls user’s application access. It specifies which user has access to which applications and allows defining powerful security policies based on almost limitless policy parameters like:
• Individual users
• Groups of users
• Time of day
The device is shipped with the following predefined policies for application filters:
• Allow: By default, allows access to all the groups except the specified groups. Access to the specified groups depends on the strategy defined for each group.
| Device Configuration | 110
• Deny: By default, denies access to all the groups except the specified group. Access to the specified groups depends on the strategy defined for each group.
These two predefined policies are immediately available for use until configured otherwise. You can also define custom policies to define different levels of access for different users to meet your organization’s requirements.
The page also provides option to add a new policy, update parameters of the exisiting policy, delete a policy, add a filtering rule to a policy or delete a filtering rule attached to a policy.
Application Filter Policy
This page lets you configure custom policies to define different levels of access for different users to meet your organizations's requirements.
The Add page allows you to manually configure policies.
1. Navigate to Protection > Application Protection > Application Filter or Objects > Policies > Application
Filterand click Add.
2. Enter the Application Filter Policy details.
Name
Enter a name to identify the Application Filter Policy.
Description
Enter description for the Application Filter Policy.
Enable Micro App Discovery
Enable to scan and classify microapps using HTTP protocol for communication. Microapps are applications that are used withing web browsers.
To allow/deny microapps, you need to specify action accordingly.
Refer Appendix D - Supported Micro-Apps for more details on supported applications.
Template
Select template for the Application Filter Policy.
Figure 114: Add Application Filter Policy
3. Click Save.
4. Once the policy is added, next step is to add a rule for configuring filtering criteria.
Note:
• Rules can be added for custom policies only.
• If Micro App Discovery is enabled, one has to import SSL CA to avoid Certificate error.
Add a Firewall Rule for Application Filter Policy
Use the Add Firewall Rule page to configure a new rule for Application Filter Policy.
The Add Firewall Rule page allows you to manually configure a new rule.
| Device Configuration | 111
1. Navigate to Protection > Application Protection > Application Filter or Objects > Policies > Application
Filter and click
.
2. Click on the Add button under Application Group Policy.
3. Enter the application filter details.
Category
Select Application Category from the list of available categories.
Risk
Select the level of risk from the available options.Select All1 - VERY LOW 2 - LOW3 - MEDIUM 4 -
HIGH5 - VERY HIGH
Characteristics
Select the characteristics from the available options.Select AllExcessive BandwidthProne to misuseTransfer filesTunnels other appsVulnerabilities Widely usedLoss of productivityCan bypass firewall policy
Technology
Select the technology from the available options.Select AllBrowser BasedClient ServerNetwork ProtocolP2P
4. Enter the list of matching applications.
Select All
Click to select all the Applications from the list.
Applications are available based on the Application Filter Criteria.
Select Individual Application
Click to select the Applications from the list.
Applications are available based on the Application Filter Criteria.
Search
Specify the name of the application in the textbox to be searched.
This option is available, only if option "Select Individual Application" is selected.
Name
Displays name of the Applications under the Category selected. You can also select more than one application using the checkbox.
Description
Displays description of the Application.
Category
Displays category of the Application.
Risk
Displays the risk factor involved with the Application.
Characteristics
Displays the characteristics of the Application.
Technology
Displays the technology utilized for the Application.
5. Enter the action you want to perform.
Action
Select an Action for the Policy from the available options. Allow Deny
Schedule
Select schedule from the list available in the dropdown list.
| Device Configuration | 112
Figure 115: Add Application Filter Policy Rules
6. Click Save.
Traffic Shaping Settings
Use Traffic Shaping Settings page to configure default Traffic Shaping settings. All the bandwidth related data are displayed only with unit KBps (Kilo bytes per second).
Below are the screen elements with their description:
Total Available WAN Bandwidth
Specify maximum bandwidth limit in KB. It is generally a sum of all WAN links maximum limits.
Default - 100000 KB
Acceptable Range (KB) - 1 to 2560000
Optimize for Real-Time (VoIP)
Enable to give priority to real time traffic like VOIP over all other traffic.
If disabled, priority will be applicable only for excess bandwidth i.e. bandwidth remaining after guaranteed bandwidth allocation.
Enforce Guaranteed Bandwidth
Administrator can enforce all internet bound traffic to be handled by any Traffic Shaping Policy applied on it. If there is no policy applied on the traffic then it will be handled by the Default Policy.
Enable to enforce bandwidth restriction on the traffic on which the Traffic Shaping Policy is not applied.
Disable, if you do not want to enforce bandwidth restriction on the traffic on which the Traffic Shaping Policy is not applied. It will only handle traffic on which Traffic Shaping Policy is applied.
Default Policy
Default Policy will be applicable on the traffic which does not have any Traffic Shaping Policy applied.
Guarantee
Specify bandwidth which is the minimum guaranteed bandwidth that the user can use.
Default – 1 KBps
| Device Configuration | 113
Acceptable Range (KBps) - 1 to 2560000
Limit
Specify bandwidth which is the maximum bandwidth that the user can use, if available.
Default – 100000 KBps
Acceptable Range (KBps) - 1 to 2560000
Priority
Set the bandwidth priority. Priority can be set from 1 (highest) to 7 (lowest) depending on the traffic required to be shaped.
Available Options:
1 – Business Critical2 to 5 – Normal6 – Bulky - FTP7 – Best Effort – e.g. P2P
Show Bandwidth Usage
Click to view Bandwidth Usage.
Web Server Protection
Web Servers
On this page you can add the web servers that are to be protected by the WAF.
Protection > Web Server Protection > Web Servers or Objects > Assets > Web Servers
The page displays all existing web servers. You can add new real servers, edit or delete them. Following is a description of the table elements:
Name
Displays the name of the web servers.
Type
Displays the type of the web servers.
Manage
Displays the available managing options for the web servers:
• Edit Allows you to edit the web servers.
• Delete Allows you to delete the web servers.
To either add or delete a web server, click on the corresponding buttons.
Add a Web Server
This page describes how to add a web server.
1. Navigate to Protection > Web Server Protection > Web Servers or Objects > Assets > Web Servers and click
Add.
2. Make the following settings:
Name
Enter a descriptive name for the web server.
Description
Enter a description or other information.
Host
Add or select a host, which can either be of the type Host or DNS Host.
Note: DNS Host is recommended here because hosts listed with their IP address transmit empty host headers which leads to problems with some browsers.
| Device Configuration | 114
Type
Select a real web server type. Whether you want the communication between Sophos Firewall OS and the real server to be encrypted (HTTPS) or plaintext (HTTP).
• Encrypted (HTTPS): Browser-based access to real web server via HTTPS.
• Plaintext (HTTP): Browser-based access to real web server via HTTP. Default.
Port
Enter a port number for the real web server. By default the standard port of the selected real server type is selected.
Keep alive
Enable Keep alive to keep the connection between Sophos Firewall and the real server open instead of opening a new connection for every single request..
Note: In rare cases where the real web server does not support keep alive properly, this feature can provoke reading errors or timeouts and should then be disabled for the affected real server.
Timeout
Enter a timeout for the Keep alive option. Values between 1 and 65535 seconds are allowed. Default is 300 seconds.
Figure 116: Add Web Server
3. Click Save to save your settings.
The server is created and appears in the web servers list.
Web App Protection
With protocol security you can define the modes and levels of protection for your webservers.
Protection > Web Server Protection > Web App Protection Policies or Objects > Policies > Web App Protection
The page displays all existing web application protection objects. You can add new protocol security objects, edit or delete them. Following is a description of the table elements:
Name
Displays the name of the web app protection object.
Manage
| Device Configuration | 115
Displays the available managing options for the web application protection object:
• Edit Allows you to edit the web app protection object.
• Delete Allows you to delete the web app protection object.
To either add or delete a web app protection object, click on the corresponding buttons.
Add Application Protection
This page describes how to add a web app protection object.
1. Navigate to Protection > Web Server Protection > Web App Protection Policies or Objects > Policies > Web
App Protection and click Add.
2. Enter values for the following settings:
Name
Enter a descriptive name for the web app protection object.
Description
Enter a description or other information.
Pass Outlook Anywhere
Enable to allow external Microsoft Outlook clients to access the Microsoft Exchange Server via the WAF.
Microsoft Outlook traffic will not be checked or protected by the WAF.
Mode
Select a mode from the drop-down list:
• Monitor: HTTP requests are monitored and logged.
• Reject: HTTP requests are rejected.
Cookie Signing
Enable to protects a webserver against manipulated cookies. When the webserver sets a cookie, a second cookie is added to the first cookie containing a hash built of the primary cookie's name, its value and a secret, where the secret is only known by the WAF. Thus, if a request cannot provide a correct cookie pair, there has been some sort of manipulation and the cookie will be dropped.
Static URL Hardening
Enable to protect against URL rewriting. For that, when a client requests a website, all static URLs of the website are signed. The signing uses a similar procedure as with cookie signing. Additionally the response from the webserver is analyzed regarding what links can be validly requested next. Static Hardened URLs can furthermore be bookmarked and visited later.
Note: Static URL hardening affects all files with a HTTP content type of text/* or *xml*, where * is a wildcard. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the URL hardening feature. It does not work for dynamic URLs created by client, for example: JavaScript.
Note: You can find more information about Static URL Hardening and Form Hardening under:
Additional Information on Static URL Hardening and Form Hardening
on page 119
Entry URLs
Add URL for static URL hardening:
Form Hardening
Enable to protect against web form rewriting. Form hardening saves the original structure of a web form and signs it. Therefore, if the structure of a form has changed when it is submitted the WAF rejects the request.
Note: Form hardening affects all files with a HTTP content type of text/* or *xml*, where * is a wildcard. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the form hardening feature.
Note: You can find more information about Static URL Hardening and Form Hardening under:
Additional Information on Static URL Hardening and Form Hardening
on page 119
| Device Configuration | 116
Anti Virus
Enable to protect a webserver against viruses.
Mode: Sophos Firewall OS features several antivirus engines for best security.
• Avira
• Sophos
• Dual Scan
Direction: Select from the drop-down list whether to scan only up- or downloads or both.
• Uploads
• Downloads
• Uploads and Downloads
Block unscannable content
Enable to block files that cannot be scanned. The reason for that may be, among other things, that files are encrypted or corrupt.
Limit scan size
Enable to enter the scan size limit into an additional field. Provide the limitation in Megabyte.
Note: Please note that the scan size limit refers to an upload, not to single files. This means, if you for example limit to 50 MB and make an upload with multiple files (45 MB, 5 MB and 10 MB), the last file will not be scanned and a virus cannot be detected caused by the limitation.
Note: If you do not enter a limitation value it will be saved with '0' megabytes which means the limitation is not active.
Block clients with bad reputation
Enable to block clients which have a bad reputation according to their classification, based on GeoIPClosed and RBLClosed information. Sophos uses the following classification providers: RBL sources:
• Commtouch IP Reputation (ctipd.org)
• http.dnsbl.sorbs.net
The GeoIP source is Maxmind. The WAF blocks clients that belong to one of the following Maxmind categories:
• A1: Anonymous proxies or VPN services used by clients to hide their IP address or their original geographical location.
• A2: Satellite providers are ISPs that use satellites to provide Internet access to users all over the world, often from high risk countries.
Skip remote lookups for clients with bad reputation
Enable to use GeoIP-based classification which uses cached information only and is therefore much faster.
As reputation lookups include sending requests to remote classification providers, using reputation-based blocking may slow down your system.
Block clients with bad reputation
Threats Filter
Enable to protect your webservers from several threats. You can specify the threat filter categories you want to use in the Threat Filter Categories section below. All requests will be checked against the rule sets of the selected categories. Depending on the results, a notice or a warning will be shown in the live log or the request will be blocked directly.
Rigid Filtering
Enable to tight several of the selected rules. This may lead to false positives.
Skip Filter Rules
Enable to add the rule number that you want to skip to this box. Some of the selected threat categories may contain rules that lead to false positives. To avoid false positives induced by a specific rule. WAF rule
| Device Configuration | 117 numbers can for example be retrieved on the Logging & Reporting > Webserver Protection > Details page, via the Top Rules filter.
Protocol Violations
Enforces adherence to the RFC standard specification of the HTTP protocol. Violating these standards usually indicates malicious intent.
Protocol Anomalies
Searches for common usage patterns. Lack of such patterns often indicates malicious requests. These patterns include, among other things, HTTP headers like 'Host' and 'User-Agent'.
Request Limits
Enforces reasonable limits on the amount and ranges of request arguments. Overloading request arguments is a typical attack vector.
HTTP Policy
Narrows down the allowed usage of the HTTP protocol. Web browsers typically use only a limited subset of all possible HTTP options. Disallowing the rarely used options protects against attackers aiming at these often less well supported options.
Bad Robots
Checks for usage patterns characteristic of bots and crawlers. By denying them access, possible vulnerabilities on your webservers are less likely to be discovered.
Generic Attacks
Searches for attempted command executions common to most attacks. After having breached a webserver, an attacker usually tries to execute commands on the server like expanding privileges or manipulating data stores. By searching for these post-breach execution attempts, attacks can be detected that might otherwise have gone unnoticed, for example because they targeted a vulnerable service by the means of legitimate access.
SQL Injection Attacks
Checks for embedded SQL commands and escape characters in request arguments. Most attacks on webservers target input fields that can be used to direct embedded SQL commands to the database.
XSS Attacks
Checks for embedded script tags and code in request arguments. Typical cross-site scripting attacks aim at injecting script code into input fields on a target webserver, often in a legitimate way.
Tight Security
Performs tight security checks on requests, like checking for prohibited path traversal attempts.
Trojans
Checks for usage patterns characteristic of trojans, thus searching for requests indicating trojan activity. It does not, however, prevent the installation of such trojans as this is covered by the antivirus scanners.
Outbound
Prevents webservers from leaking information to the client. This includes, among other things, error messages sent by servers which attackers can use to gather sensitive information or detect specific vulnerabilities.
Figure 117: Add Web App Protection
3. Click Save to save your settings.
The web app protection object is created and appears in the web app protection list.
| Device Configuration | 118
| Device Configuration | 119
Additional Information on Static URL Hardening and Form Hardening
It would be best practice to always enable both URL hardening and form hardening because those two functions are complementary, especially in the way that they prevent issues you may have when enabling just one of them:
• Only form hardening is activated: When a webpage contains hyperlinks with appended queries (which is the case with certain CMSs), e.g. http://example.com/?view=article&id=1, such page requests are blocked by form hardening because it expects a signature, which is missing.
• Only URL hardening is activated: When a web browser appends form data to the action URL of the form tag of a web form (which is the case with GET requests), the form data becomes part of the request URL sent to the webserver, by that rendering the URL signature invalid.
The reason why activating both functions solves those issues is that in case either form hardening or URL hardening find that a request is valid, the WAF accepts the request.
Web App Authentication
You can define how to use the Web Application Firewall to authenticate users directly instead of leaving the authentication to the real web servers. Via authentication profiles, the reverse authentication can be used to assign specific authentication settings to each site path route.
Protection > Web Server Protection > Web App Authentication Policies or Objects > Policy > Web App
Authentication
Note: You can also view and manage the WAF status on the System > Diagnostics > Services page.
The page displays all existing web application authentication profiles. You can add new application authentication profiles, edit or delete them. Following is a description of the table elements:
Name
Displays the name of the web app authentication profile.
Manage
Displays the available managing options for the web app authentication profile:
• Edit Allows you to edit the web app authentication profile.
• Delete Allows you to delete the web app authentication profile.
To either add or delete a web app authentication profile, click on the corresponding buttons.
Add Web App Authentication
This page describes how to add a web app authentication profile.
1. Navigate to Protection > Web Server Protection > Web App Authentication Policies or Objects > Policy >
Web App Authenticationand click Add.
2. Enter values for the following settings:
Name
Enter a descriptive name for the web app authentication profile.
Description
Enter a description or other information.
3. Make the settings for the Client Authentication.
Mode
Select how the users should authenticate at the Web Application Firewall.
• Basic: Users authenticate with HTTP basic authentication, entering username and password. As the credentials are sent unencrypted with this mode, it should be used over HTTPS. With this mode, no session cookies will be generated and a dedicated logout is not possible.
• Form: Users will be presented a form where they have to enter their credentials. With this mode, session cookies will be generated and a dedicated logout is possible. The form template to be used can be selected
| Device Configuration | 120 in the Web App Auth Template list. Besides the default form template, the list shows the forms that have been defined on the
page
Basic Prompt
(only with Basic mode)
The realm is a unique string that provides additional information on the login page and is used for user orientation.
Note: These characters are allowed for the Basic Prompt: A-Z a-z 0-9 , ; . : - _ ' + = ) ( & % $ ! ^ <
> | @
Web App Auth Template
Select the form template that will be presented to the users for authentication. Form templates are defined on
page.
User or Groups
Select the users or user groups that should be assigned to this web app authentication profile. After assigning this profile to a site path route, these users will have access to the site path with the authentication settings defined in this profile. Typically, this would be a backend user group.
Note: Sometimes users should be required to use the User Principal Name notation 'user@domain' when entering their credentials, for example when using Exchange servers in combination with
Active Directory servers.
4. Make the settings for the Authentication Forwarding.
Mode
Select how the Web Application Firewall authenticates against the real webservers. The mode has to match the webservers authentication settings.
• Basic: Authentication works with HTTP basic authentication, providing username and password.
• None: There is no authentication between WAF and the webservers. Note that even if your real webservers do not support authentication, users will be authenticated via the frontend mode.
User name affix
(only with Basic Authentication Forwarding mode)
Select an affix for the username and enter it into the concerning field. Affixes are useful when working with domains and email addresses.
• None
• Prefix
• Suffix
• Prefix & Suffix
Note: Prefix and suffix will be added automatically if the user enters their username. Prefix and suffix will not be added if the user enters it. Example: If the suffix is @testdomain.de and the user enters their username test.user the suffix will be added. If they enter [email protected] the suffix will be ignored.
Remove Basic Header
(only with None Authentication Forwarding)
Enable to not send the basic header from Sophos Firewall OS to the real webserver.
5. Make the settings for the User Session.
Session Timeout
Enable to set a timeout for the user session, which will confirm user credentials by having them log in again if they do not perform any action on the virtual webserver.
Limit To
(only if Session Timeout is enabled)
| Device Configuration | 121
Set an interval for the session timeout. Default is 5 minutes.
Session Lifetime
Enable to set a hard limit for how long users may remain logged in, regardless of activity in the meantime.
Limit To
(only if Session Lifetime is enabled)
Set a value for the session lifetime. Default is 8 hours.
Figure 118: Add Web App Authentication Policies
6. Click Save.
The Web App Authentication profile is created and appears in the Web App Authentication list.
Web App Auth Templates
You can upload HTML forms for reverse authentication. A web application authentication template can be assigned to an authentication profile with frontend mode Form. The respective form will be presented when a user tries to access a site path to which the authentication profile is assigned.
| Device Configuration | 122
Protection > Web Server Protection > Web App Auth Templates or Objects > Content > Web App Auth
Templates
The page displays all existing web application authentication templates. You can add new templates, edit or delete them. Following is a description of the table elements:
Name
Displays the name of the template.
Template
Displays the filename of the template.
Manage
Displays the available managing options for the template:
• Edit Allows you to edit the template.
• Delete Allows you to delete the template.
To either add or delete a web app auth template, click on the corresponding buttons.
Add a Web App Auth Template
This page describes how to add a web application authentication template.
1. Navigate to Protection > Web Server Protection > Web App Auth Templates or Objects > Content > Web
App Auth Templates and click Add.
2. Make the following settings:
Name
Enter a descriptive name for the template.
Description
Enter a description or other information.
HTML template
Select and upload an HTML template.
Images/Stylesheet
Select and upload images, stylesheets, or JavaScript files that are used by the selected template.
Figure 119: Add Web App Auth Template
3. Click Save to save your settings.
| Device Configuration | 123
The web app auth template is created and appears in the Web App Auth Templates list.
Certificate
The Certificate page displays list of available certificates.
A digital certificate is a document that guarantees the identity of a person or entity and is issued by the Certificate
Authority (CA). Certificates are generated by the third party trusted CA. They create certificates by signing public keys and identify the information of the communicating parties with their own private keys. This way it is possible to verify that a public key really belongs to the communicating party only and not been forged by someone with malicious intentions.
A certificate signed by a Certificate Authority (CA) identifies the owner of a public key. Each communicating party may be required to present its own certificate signed by a CA verifying the ownership of the corresponding private key. Additionally, the communicating parties need to have a copy of the CA’s public key. In case private key is lost or stolen or the information is changed, CA is responsible for revoking the certificate.CA also maintains the list of valid and revoked certificates.
To use Certificates for authentication, you must have valid CA and a certificate. You need to upload CA if you are using external CA. You can generate a self signed certificate if you want to use it as CA.
You can also use device to act as a certificate authority and sign its own certificates. This eliminates the need of having your own certificate authority. If you are using device as CA, you have to generate a self-signed certificate, which can be used in various VPN policies.
The page also provides option to generate a self-signed certificate, upload a certificate, or generate a Certificate
Signing Request (CSR).This page also provides option to regenerate, revoke, download, or delete the certificates.
If you are using a third party CA, you have to submit a request to CA for issuing a certificate. Once CA issues a certificate, you have to upload to use it in VPN policy.
This page provides option to:
•
•
•
Add Certificate
Use the Certificate page to add a new certificate.
The Certificate page allows you to generate a self-signed certificate, upload a certificate, or generate a Certificate
Signing Request (CSR).
1. Navigate to Protection > Web Server Protection > Certificate or System > VPN > Certificate or Objects >
Identity > Certificate and click Add.
2. Choose the action you want to perform.
Action
Select action from the available options.
Upload CertificateGenerate Self-Signed CertificateGenerate Certificate Signing Request
Upload Certificate
Use the Certificate page to upload a certificate.
1. Enter Upload Certificate details.
Name
Specify a name to identify the Certificate.
Certificate File Format
Select the format of Certificate file from the available options.
Available Options: PEM (.pem): Privacy Enhanced Mail (PEM) is a Base64encoded DER certificate. It is used for encoding the certificate in ASCII code. The certificate and private key are stored in separate
| Device Configuration | 124 files. DER (.der): Distinguished Encoding Rules (DER) is a binary form of ASCII PEM format certificate used on Java platform. The certificate and private key are stored in separate files. CER (.cer): Canonical
Encoding Rules (CER) is a binary format for encoding certificates. It contains information about the owner of certificate, its public and private keys. PKCS7 (.p7b): Public Key Cryptography Standards (PKCS) is a format for encoding the certificate in ASCII code. It contains only certificates and not the private key.
PKCS12 (.pfx or .p12): Public Key Cryptography Standards (PKCS12) is a binary format for encoding certificates. It stores a private key with a public key certificate. It is used on Windows platform.
Certificate
Specify certificate to be uploaded. Use Browse to select the complete path.
Private Key
Specify private key for the certificate. Use Browse to select the complete path.
Passphrase
Specify and re-confirm a passphrase for a certificate used for authentication. Passphrase must be at least 4 characters long.
Figure 120: Upload Certificate
2. Click Save to upload the certificate.
Generate Self-Signed Certificate
Use the Certificate page to generate self-signed certificate.
1. Enter details to generate Self Signed Certificate (Option available only after configuring Default CA Parameters)
Name
Specify a name to identify the Certificate.
Valid From and Valid Up To
Specify certificate validity period using Calendar . Validity period is the certificate life and indicates period up to which the certificate will be considered as valid.
Default - 1 day
Key Length
Select key length. Key length is the number of bits used to construct the key.
Available Options:5121024153620484096
Generally, the larger the key, the less chance that it will be compromised but requires more time to encrypt and decrypt data than smaller keys.
Default - 512
Key Encryption
Click to enable the key encryption.
| Device Configuration | 125
Passphrase
Passphrase for a Certificate used for authentication. Passphrase must be at least 8 characters long. This option is enabled only if the Key Encryption option is selected.
Confirm Passphrase
Re-enter passphrase for confirmation.
Certificate ID
Specify certificate ID. You can specify any one of the following options:
Available Options: DNSIP Address(IPv4/IPv6 Address) Email Address DER ASN1 DN(X.509) (Applicable when Authentication Type is Digital Certificate)
Once the certificate is created, you need to download and send this certificate to the remote peer with whom the connection is to be established.
Country Name
Select the country.
State
Specify the state within the country.
Locality Name
Specify the name of the locality.
Organization Name
Specify the organization name, which will use this certificate and domain name. This domain will be certified to use the Certificate.
Use unique Domain name only.
Organization Unit Name
Specify the department/unit name, which will use this certificate and domain name. This domain will be certified to use the Certificate.
Use unique Domain name only.
Common Name
Specify the common name.
A common name comprises of host + domain name or is a fully qualified domain name that is used to resolve to SSL VPN interface. It must be same as that of the Web address to be accessed when connecting to a secured site.
Email Address
Specify the Email Address of the contact person for communication.
2. Click Save to generate self-signed certificate.
Generate Certificate Signing Request
Use the Certificate page to generate certificate signing request.
1. Enter details to generate Certificate Signing Request (CSR).
Name
Name to identify the certificate.
Valid Upto
Specify certificate validity period using Calendar. Validity period is the certificate life i.e. period up to which the certificate will be considered as valid.
Minimum validity -1 day
Key Length
Select key length. Key length is the number of bits used to construct the key.
| Device Configuration | 126
Generally the larger the key, the less chance that it will be compromised but requires more time to encrypt and decrypt data than smaller keys.
Encryption
Click to enable the key encryption.
Passphrase
Passphrase for a Certificate used for authentication. Passphrase must be at least 4 characters long. This option is available only if the Encryption option is checked.
Confirm Passphrase
Re-enter passphrase for confirmation.
Certificate ID
Specify certificate ID. You can specify any one of the following options:
Available Options: DNS IP AddressEmail Address
DER ASN1 DN(X.509) (Applicable when Authentication Type is Digital Certificate)
Country Name
Select the Country for which the Certificate will be used.
Generally, this would be the name of the country where device is deployed.
State
Select the State for which the Certificate will be used.
Generally, this would be the name of the state where device is deployed.
Locality Name
Select the Locality for which the Certificate will be used.
Generally, this would be the name of the Locality where device is deployed.
Organization Name
Specify your organization name, which will use this certificate and domain name. This domain will be certified to use the Certificate.
Use unique Domain names only.
Organization Unit Name
Specify your department/unit name, which will use this certificate and domain name. This domain will be certified to use the Certificate.
Use unique Domain names only.
Common Name
Specify Common Name.
Email Address
Specify Email Address.
2. Click Save to generate certificate signing request.
Download Certificate
Use the Certificate page to download the certificate.
1. Navigate to Protection > Web Server Protection > Certificate or System > VPN > Certificate or Objects >
Identity > Certificate.
2.
Under the Manage column, click the Download Icon against the certificate you want to download.
Note:
• Only self signed certificate and certificate signing request can be downloaded.
• Certificate is downloaded as a .tar.gz file.
| Device Configuration | 127
Revoke Certificate
Use the Certificate page to revoke the certificate.
1. Navigate to Protection > Web Server Protection > Certificate or System > VPN > Certificate or Objects >
Identity > Certificate.
2.
Under the Manage column, click the Revoke Icon to revoke self-signed certificate if lost, stolen or updated.
Revoked certificate is automatically added to the Certificate Revocation List (CRL). You can download revoked certificate and circulate if required.
Certificate Authority
The Certificate Authority page displays list of all the certificate authority and you can filter list based on the certificate authority name.
Device provides a facility to generate a local certificate authority as well as import certificates, signed by commercial providers, such as VeriSign.
A certificate signed by a Certificate Authority (CA) identifies the owner of a public key. Each communicating party may be required to present its own certificate signed by a CA verifying the ownership of the corresponding private key. Additionally, the communicating parties need to have a copy of the CA’s public key. In case private key is lost or stolen or the information is changed, CA is responsible for revoking the certificate. CA also maintains the list of valid and revoked certificates.
After your CA has issued a certificate or have local certificate, you can upload it for use in VPN.
You can use default CA and can modify and re-generate it as per your requirement if you are not using any external
CA. Using this CA, you can generate self-signed certificate and use it in VPN policy.
Using Third Party CA involves uploading:
• CA and root certificate
• Certificate
• CRL (Certificate Revocation List)
If the remote peer is using certificate issued by the following third party CA, you are not required to upload CA:
• VeriSign
• Entrust
• Microsoft
Note: Default CA is regenerated automatically when it is updated.
The page provides option to:
•
•
•
Download Certificate Authority
Use the Certificate Authority page to download CA.
If you are using a local CA, you need to download CA and forward to the remote peer.
1. Navigate to Protection > Web Server Protection > Certificate Authority or System > VPN > Certificate
Authority or Objects > Identity > Certificate Authority. It displays the details of the default CA.
2.
Click download icon to download the zip file.
Note: Default CA cannot be deleted.
| Device Configuration | 128
Adding a New Certificate Authority
To update and regenerate the default certificate, click on the default certificate.
•
•
CA Parameters
Use the Certificate Authority page to update and regenerate the default certificate.
The Certificate Authority page allows you to manually enter details to add a new certificate authority.
1. Navigate to Protection > Web Server Protection > Certificate Authority or System > VPN > Certificate
Authority or Objects > Identity > Certificate Authority and click Add.
2. Enter Certificate Authority details.
Name
Specify a name to identify the Certificate Authority.
Certificate File Format
Select format of the root certificate to be uploaded.
Available Options:PEM (Privacy Enhanced Mail): A format encoding the certificate in ASCII code.
The certificate, request, and private key are stored in separate files.DER: A binary format for encoding certificates. The certificate, request, and private key are stored in separate files.
Certificate
Specify full path from where the certificate is to be uploaded. Alternately, use Browse button to select the path.
Private Key
Specify full path from where the Private Key is to be uploaded. Alternately, use Browse button to select the path.
CA Passphrase
CA Passphrase for authentication. Passphrase must be at least 4 characters long.
Confirm CA passphrase for authentication.
Figure 121: Certificate Authority
3. Click Save to add the Certificate Authority with the options you have configured.
Default CA Parameters
Use the Add Certificate Authority page to update and regenerate the default certificate.
The Add Certificate Authority page allows you to manually enter certificate authority details.
1. Navigate to Protection > Web Server Protection > Certificate Authority or System > VPN > Certificate
Authority or Objects > Identity > Certificate Authority.
| Device Configuration | 129
2.
Click on the icon under Manage tab of the default certificate that you want to update and regenerate.
3. Enter Certificate Authority Details.
Name
Default. This name cannot be changed.
Country Name
Specify the name of the country where the device is installed.
State
Specify the name of the state where the device is installed.
Locality Name
Specify the name of the locality where the device is installed.
Organization Name
Specify the organization name, which will use this certificate and domain name. This domain will be certified to use the Certificate.
Use unique Domain name only.
Organization Unit Name
Specify the department/unit name, which will use this certificate and domain name. This domain will be certified to use the Certificate.
Use unique Domain name only.
Common Name
Specify the common name.
A common name comprises of host + domain name or is a fully qualified domain name that is used to resolve to SSL VPN interface. It must be same as that of the Web address to be accessed when connecting to a secured site.
Email Address
Specify the Email Address of the contact person for communication.
CA PassPhrase
Specify Passphrase for a Certificate Authority. Passphrase must be at least 4 characters long.
Re-enter passphrase for confirmation.
4. Click Save to update and regenerate the default certificate.
Regenerating Certificate Authority
Use the Certificate Authority page to regenerate the default certificate.
1. Navigate to Protection > Web Server Protection > Certificate Authority or System > VPN > Certificate
Authority or Objects > Identity > Certificate Authority
2.
Under the Manage column, click the Regenerate icon
Note: Default CA is regenerated automatically when it is updated.
Certificate Revocation Lists
CA maintains the list of valid and revoked certificates. The page displays the list of available CRLs.
Certificate Revocation List (CRL) page is a way to check the validity of an existing certificate. Certificates which are stolen, lost or updated are revoked by CA and CA publishes such revoked certificates in Revocation list. VPN connection cannot be established using revoked certificates, hence it is necessary to update the CRL at regular interval.
The page provides option to:
•
| Device Configuration | 130
•
Adding a New CRL
Use the Certificate Revocation List page to add a new CRL.
If you are using External Certificate Authority, you need to upload the CRL obtained from External Certificate
Authority.
1. Navigate to Protection > Web Server Protection > Certificate Revocation List or System > VPN > Certificate
Revocation List or Objects > Identity > Certificate Revocation List and click Add.
2. Enter Certificate Revocation List details.
Name
Name to identify the CRL.
CRL File
Specify CRL file to be uploaded. Use Browse to select the complete path.
Figure 122: Certificate Revocation Lists
3. Click Save.
Downloading CRL
Use the Certificate Revocation List page to download the CRL.
Once CA is generated, default CRL is generated with name Default.tar.gz. Once you revoke the certificate, the details of the revoked certificate are added to the default file and regenerated. You can download and distribute if required.
1. Navigate to Protection > Web Server Protection > Certificate Revocation List or System > VPN > Certificate
Revocation List or Objects > Identity > Certificate Revocation List.
2. Click "Download" link against the CRL name to be downloaded. It downloads the zip file. Unzip the file to check the details.
Email Protection
This feature requires a subscription. It can be configured but cannot be enforced without a valid Email
Protection subscription.
From Email Protection tab, Administrator can configure SMTP/S, POP/S and IMAP/S settings, Malware and Content
Scanning Rules, Secure PDF eXchange (SPX) and Data Protection (DP) Policies.
The device offers comprehensive Email Security, preventing sophisticated forms of zero-hour threats and blended attacks involving spam, botnets, phishing, spyware and more. The basic email protection configuration includes configuring email threshold size for scanning, specifying action to be taken if a virus is detected, blocking mails based on sender or recipient, blocking mails with certain file types.
Email Configuration
This feature requires a subscription. It can be configured but cannot be enforced without a valid Email
Protection subscription.
Email Configuration allows configuring the general settings on Email traffic. This page contains the following sections.
| Device Configuration | 131
General Settings
Append Signature to All Outbound Messages
Enable to add a Signature at the end of all outgoing Email messages.
The signature is appended ONLY when SMTP and SMTPS Scanning is enabled in the relevant Business
Application Policy(s).
Email Signature
Specify signature to be added to all the outgoing Emails. Only text signatures are allowed.
Example:
This email contains confidential information. You are not authorized to copy the contents without the consent of the sender. Please do not print this email unless it is absolutely necessary. Spread environmental awareness.
Figure 123: General Configuration
SMTP/S Settings
Don't Scan Emails Greater Than
Specify maximum file size (in KB) for scanning. Files exceeding this size received through SMTP/S will not be scanned.
Default - 1024 KB
Specify 0 to increase the default file size scanning restriction to 51200 KB.
Action for Oversize Email
Specify the action for Oversize Emails.
Available Options
Accept: All the oversize mails are forwarded to the recipient without scanning.Reject: All the oversize mails are rejected and sender is notified.Drop: All the oversized mails are dropped, without notifying the sender.
Bypass Spam Check for SMTP/S Authenticated Connections
Enable to bypass Spam Scanning for Email messages received over SMTP/S connections authenticated by the
Email Server.
Verify Sender's IP Reputation
Click to verify the reputation of the sender IP Address. When enabled, Device dynamically checks the sender’s
IP Address of all Emails. If the IP Address is found to be responsible for sending Spam Emails or malicious contents, Device takes action as per configured Scanning Rules.
If enabled, specify action for Confirmed Spam Emails and Probable Spam Emails.
Available Options
Accept: All the spam Emails are forwarded to the recipient after scanning as per the configuration. Reject: All the spam mails are rejected and a notification is sent to the Email sender. Drop: All the spam mails are dropped, without notifying the sender.
As it is a global option, if Spam scanning is enabled, all the mails will be first subjected to IP Reputation filtering followed by filtering based on actions configured in Spam policy.
| Device Configuration | 132
Default - Disable
SMTP DoS Settings
Enable to configure SMTP DoS Settings which protect the network from SMTP DoS Attacks.
If enabled, specify values for Maximum Connections, Maximum Connections/Host, Maximum Emails/
Connection, Maximum Recipients/Email, Email Rate per Minute/Host and Connections Rate per Second/Host.
Maximum Connections (Available if SMTP DoS Settings Enabled)
Specify maximum number of connections that can be established with the Email Server.
Default - 1024
Range - 1 - 20000
Maximum Connections/Host (Available if SMTP DoS Settings Enabled)
Specify maximum number of connections allowed to the Email Server from a particular host.
Default - 64
Range - 1 - 10000
Maximum Emails/Connection (Available if SMTP DoS Settings Enabled)
Specify maximum number of Emails that can be sent in a single Connection.
Default - 512
Range - 1 - 1000
Maximum Recipients/Email (Available if SMTP DoS Settings Enabled)
Specify maximum number of Recipients for a single Email.
Default - 100
Range - 1 - 256
Email Rate per Minute/Host (Available if SMTP DoS Settings Enabled)
Specify number of Emails to be sent from a particular host in one Minute.
Default - 512
Range - 1 - 20000
Connection Rate per Second/Host (Available if SMTP DoS Settings Enabled)
Specify number of Connections allowed to the Email Server from a particular host in one Second.
Default - 8
Range - 1 - 20000
| Device Configuration | 133
Figure 124: SMTP/S Settings
POP/S and IMAP/S Settings
Don't Scan Emails Greater Than
Specify maximum file size (in KB) for scanning. Files exceeding this size received through POP/IMAP will not be scanned.
Default - 1024 KB
Specify 0 to increase the default file size restriction to 10240 KB.
Recipient Headers
Specify Header value to detect recipient for POP3/IMAP.
Default - Delivered-To, Received, X-RCPT-TO
| Device Configuration | 134
Figure 125: POP/S and IMAP/S Settings
SMTP TLS Configuration
TLS Certificate
Select the CA for scanning SMTP traffic over SSL from the available options.
Available Options
DefaultSecurityAppliance_SSL_CAList of custom CAs if added. You can create the custom CA from Objects >
Identity > Certificate Authority.
Allow Invalid Certificate
If enabled, SMTP over SSL connections will be allowed with invalid certificate from the Email Server. Disable to reject such connections.
Default - Enable
Require TLS Negotiation with Host/Net
Select the remote host (Email Server) or network from available options on whose connections TLS encryption is to be enforced. In other words, Device will always initiate TLS-secured connections when Emails are to be sent to selected hosts/networks. If TLS is enforced but connection cannot be established, then Emails to that remote host/network are discarded.
Require TLS Negotiation with Sender Domain
Specify the Sender Domain(s) on whose Email connections TLS encryption is to be enforced.
Sender Domain is the Domain of the Email Sender. Emails from the specified Sender Domain will be sent over
TLS-encrypted connections only. If TLS is enforced but connection cannot be established, then Emails from that sender domain are discarded.
Skip TLS Negotiation Hosts/Nets
Select the remote host (Email Server) or network from available options on whose connections TLS encryption is to be skipped or bypassed. When configured, SMTP connections to selected hosts will be established in clear text and unencrypted.
| Device Configuration | 135
Figure 126: SMTP TLS Configuration
POP and IMAP TLS Configuration
TLS Certificate
Select the CA for scanning POP and IMAP traffic over SSL from the available options.
Available Options
DefaultSecurityAppliance_SSL_CAList of custom CAs if added Default - Default
Allow Invalid Certificate
If enabled, POP and IMAP over SSL connections will be allowed with invalid certificate from the Mail Server.
Disable to reject such connections.
Default - Enable
Figure 127: POP and IMAP TLS Configuration
Scanning Rules
This page allows configuration of Malware and Spam Scanning Rules.
This feature requires a subscription. It can be configured but cannot be enforced without a valid Email
Protection subscription.
This page contains the following sections:
•
•
POP3/S and IMAP/S Malware Scanning Rules
•
| Device Configuration | 136
SMTP/S Malware Scanning Rules
Malware Scanning Rules allow you to define action to be taken on Emails if they are virus-infected, suspicious or contain a protected attachment. Based on the action defined in rule, such Emails can be delivered as it is, dropped, or cured and then delivered or quarantined.
A Malware Scanning Rule defines:
• whether to quarantine the Email
• whether sender, receiver or Administrator are to be notified
• whether to block the Email containing a specified file type
• what action is to be taken if Email is infected/suspicious/contains a protected attachment: deliver as it is, drop, cure and then deliver
A default Malware Scanning Rule is pre-configured in the Device and applied to all Email traffic as soon as you subscribe to the Email Protection Module. It is recommended to create separate rules fine tuned to your specific network requirements to minimize the possibility of threats.
The section displays the list of all SMTP/S Malware Scanning Rules. You can filter the list based on Sender and
Recipient. The page also provides option to
,
, or delete a rule.
POP3/S and IMAP/S Malware Scanning Rules
Device applies a single policy on all POP3/S and IMAP/S traffic in which whenever a virus gets detected in an Email, the virus affected attachment is stripped from the Email and the Email body is replaced with a notification message.
Scanning
Specify the type of scanning to be applied.
Available Options:
Disable: No scanning appliedSingle Anti Virus: Traffic will be scanned ONLY by the Primary Anti Virus
Engine. Select the Primary Anti Virus Engine from Protection > Email Protection > Malware Protection or System > System Services > Malware Protection.Dual Anti Virus: Traffic will be scanned using both Anti
Virus Engines, first by Primary and then by the Secondary Engine. Select the Primary Anti Virus Engine from
Protection > Email Protection > Malware Protection or System > System Services > Malware Protection.
Content Scanning Rules
On subscribing Email Protection Module, Content Scanning Rules can be configured for particular senders and recipients.
Rule defines action to be taken if an Email is detected as Spam, Probable Spam, part of Virus Outbreak or Probable
Virus Outbreak, and lets you specify the action to be performed on the Email.
To reduce the risk of losing the legitimate messages, Spam Quarantine repository - a storage location, provides administrators a way to automatically quarantine Emails that are identified as Spam. This helps in managing Spam and probable Spam quarantined mails so that user can take appropriate actions on such mails.
Detection of Spam attributes
Device uses Content Filtering, and premium and standard RBLs - Realtime Blackhole Lists – to check for the Spam attributes in SMTP/S, POP3/S and IMAP/S Emails:
• Premium
• Standard
RBL is a list of IP Addresses whose owners refuse to stop the proliferation of Spam, that is, owners who are responsible for Spam or are hijacked for Spam Relay. Device checks each RBL for the connecting IP Address. If the
IP Address matches to any one on the list, then the specified action in policy is taken.
The Content Scanning Rules section displays list of all the content scanning rules. You can filter list of rules based on mail sender or recipient. It also provides option to
,
updating the parameters of the existing rules
, and deleting a rule.
| Device Configuration | 137
Add SMTP/S Malware Scanning Rules
This feature requires a subscription. It can be configured but cannot be enforced without a valid Email
Protection subscription.
The Add SMTP/S Malware Scanning Rules page allows you to configure scanning policy to detect malware in
Email traffic and take appropriate action.
1. Navigate to Protection > Email Protection > Scanning Rules and click Add under SMTP/S Malware
Scanning Rules.
2. Enter policy details
Name
Enter a unique name to identify the scanning rule.
Sender
Select the sender name from the list of users.
Select Any if the rule is to be applied on all the senders.
You can also add a new Email address by clicking Create New link.
Recipient
Select the recipient name from the list of users.
Select Any if the rule is to be applied on all the recipients.
You can also add a new Email Address by clicking Create New link.
Scanning
Specify the type of scanning to be applied.
Available Options:
Disable: No scanning applied. Single Anti Virus: Traffic will be scanned ONLY by the Primary Anti Virus
Engine. Select the Primary Anti Virus Engine from Protection > Web Protection > Malware Protection or System > System Services > Malware Protection. Dual Anti Virus: Traffic will be scanned by both Anti
Virus Engines, first by Primary and then by the Secondary Engine. Select the Primary Anti Virus Engine from Protection > Web Protection > Malware Protection or System > System Services > Malware
Protection.
Block File Types
Select file types to be blocked as an attachment to remove all the files that are a potential threat and to prevent virus attacks.
More than one file type can be selected using ctrl/shift keys.
Device contains a default list of File Types, with each Type containing relevant file extensions. Refer to
Protection > Web Protection > File Type or Objects > Content > File Type to view the list of file extensions which can be blocked.
Select All to block Emails with any type of attachments.
Select None to allow Emails with any type of attachments.
MIME Whitelist
If one or more File Type is selected in Block File Type, this field is populated with the corresponding MIME
Headers that belong to selected File Type(s).
Select the MIME Header(s) of the selected File Type(s). Only selected headers are to be allowed while the rest in the selected File Type are to be blocked during Anti Virus scanning of Email attachments.
| Device Configuration | 138
Action
Enable action to be taken on the mails received, from the available options: Quarantine: If enabled, copies the
Email to the quarantine file list. Email is either delivered to recipient or dropped, as per configured Recipient
Action.You can view the Email details like sender and receiver of the Email in the Malware Quarantine.
Administrator can access the Quarantine on the SF device from System > Current Activity > Malware
Quarantine while user can access from their respective User Portal.Notify Sender: If enabled, the original message is withheld by the Device and a notification is sent to the sender informing that the Email was infected. The sender will receive the notification only if the Receiver Action is configured as Don't Deliver
Default - Disable
Delivery Option for Infected Attachment/Protected Attachment
Recipient Action
Select the action to be taken on the message that is detected to be Infected, Suspicious or includes a Protected
Attachment.
Available Options:
Don't Deliver: Receiver will not receive the message and will also not receive the notification regarding the infected Email.Deliver Original: Receiver receives the original Email.Remover and Deliver: Infected part of the Email is removed before delivering. Receiver will also receive the notification stating that the Email was infected and infected portion of the Email is removed. Not applicable for Blocked Attachments (Block File
Type).
Note: Protected attachments are not scanned but receiver will be notified, if not specified otherwise.
Notify Administrator
Select the action to notify the Administrator for the message detected to be Infected, Suspicious or includes a
Protected Attachment.
Available Options:
Don't Deliver: Administrator will not be notified about the infected Email.Send Original: Receiver receives the original Email.Remove Attachment: Recipient receives message without attachment and the Administrator receives the notification that the Email attachment was infected and removed before delivering Email.
Note: Protected attachments are not scanned but receiver will be notified, if not specified otherwise.
| Device Configuration | 139
Figure 128: Add Scanning Rules
3. Click Save to add the scanning rule.
Content Scanning Rules
This feature requires a subscription. It can be configured but cannot be enforced without a valid Email
Protection subscription.
The Add Content Scanning Rules page allows you to configure scanning policy to detect incoming and outgoing
Spam in Email traffic and take appropriate action.
1. Navigate to Protection > Email Protection > Scanning Rules and click Add under Content Scanning Rules section.
2. Specify Name for Content Scanning Rule.
3. Enter Email Address/Domain Group details.
Sender
Specify Email Address(es) of the Sender(s). You can select from the variants:
Contains: Specify keywords to be matched with Sender Email Addresses. Rule applies to Address(es) containing those keywords. For example, if keyword "mail" is specified, rule will apply to Sender Email
Addresses [email protected], [email protected], etc.
Equals: Specify the exact Email Address(es) of the Sender(s).
You can also add RBLs, list of Email Addresses or keywords using Create New link.
Recipient
Specify Email Address(es) of the Recipient(s). You can select from the variants:
| Device Configuration | 140
Contains: Specify keywords to be matched with Recipient Email Addresses. Rule applies to Address(es) containing those keywords. For example, if keyword "mail" is specified, rule will apply to Recipient Email
Addresses [email protected], [email protected], etc.
Equals: Specify the exact Email Address(es) of the Recipient(s).
You can also add RBLs, list of Email Addresses or keywords using Create New link.
Sender Email Address
Specify Email Address(es) of the Sender(s). You can select from the variants:
Contains: Specify keywords to be matched with Sender Email Addresses. Rule applies to Address(es) containing those keywords. For example, if keyword "mail" is specified, rule will apply to Sender Email
Addresses [email protected], [email protected], etc.
Equals: Specify the exact Email Address(es) of the Sender(s).
You can also add a list of Email Addresses or keywords using Create New link.
4. Select the Filter Criteria.
Inbound Email is
All the Emails that are received by the users in their inbox are referred as Inbound.
On configuring Inbound Spam, all the Emails received by the users are scanned for spam and viruses by the
Device.
Specified action will be taken if the Device has identified the Inbound Email to be one of the following:
Spam Probable Spam Virus Outbreak Probable Virus Outbreak
Outbound Email is
Emails that are sent by the user in the network to a remote user on another Email system, are referred as
Outbound.
On configuring Outbound Spam, all the Emails sent by the local users are scanned before being delivered to other users on the Internet for spam and viruses by the Device.
Specified action will be taken if the Device has identified the Outbound Email to be one of the following:
Spam Probable Spam Virus Outbreak Probable Virus Outbreak
Source IP/Network Address
Specify action to be taken when the Email sender IP Address matches the specified IP Address.
Destination IP/Network Address
Specify action to be taken when the Email recipient IP Address matches the specified IP Address.
Sender Remote Blacklist
Specify action to be taken when the sender is listed in the specified RBL Group.
Message Size
Specified action will be taken if the Email size matches the specified size.
Message Header
Specified action will be taken if the message header equals or contains the specified text.
Contains: Specify keywords to be matched with Message Header. Rule applies to Header(s) containing those keywords.
Equals: Specify the exact Header(s) to be scanned.
You can scan message header for Spam in:
| Device Configuration | 141
Subject: Specified action will be taken if the header contains the matching subject. From: Specified action will be taken if the header contains the matching text in the From address. To: Specified action will be taken if the header contains the matching text in the To address. Other: Specified action will be taken if the matching text is found in the headers.
Data Protection Policy
Specified action will be taken if message contains data matching with the configured
You can create Data Protection Policies from Protection > Email Protection > Data Protection Policies.
None
Select to create a rule between specific sender and recipient without any conditions. You can set actions for
SMTP/S and POP/S-IMAP/S mails only on the basis of sender and recipient.
5. Select the action.
Then
SMTP/S Action
Select action to be taken for the SMTP/S traffic.
Available Options:
Reject: Email is rejected and rejection notification is sent to the Email sender. Accept (Not available for
Outbound Spam): Email is accepted and delivered to the intended recipient. Administrator can bind an SPX
Template to this action so that the Email is delivered to the intended recipient after being SPX-encypted.
Change Recipient: Email is accepted but is not delivered to the intended recipient for whom the message was originally sent. Email is sent to the recipient specified in the spam policy. Prefix Subject (Not available for
Outbound Spam): Email is accepted and delivered to the intended recipient but after tagging the subject line.
Administrator can bind an SPX Template to this action so that the Email is delivered to the intended recipient after being SPX-encypted.
Tagging content is specified in To field.
You can customize subject tagging in such a way that the recipient knows that the Email is a spam Email.
For Example
Contents to be prefixed to the original subject: ‘Spam notification from the Device –' Original subject: ‘This is a test’
Recipient will receive Email with subject line as: ‘Spam notification from the Device - This is a test’
Drop: Email is rejected but rejection notification is not sent to the Email sender.
SPX Template
If action is selected as Accept or Prefix Subject, select the SPX Template to be applied on the Email. You can create
from Protection > Email Protection > SPX Templates.
Quarantine
If enabled, does not deliver Email but copies the Email to the quarantine file list. You can view the Email details like sender and recipient of the Email in the quarantined file list.
POP3/S-IMAP/S
Select action to be taken for POP3/S and IMAP/S traffic. This option is not available for the parameters
Outbound Email is , Destination IP/Network Address, Sender Remote Blacklist and Data Protection
Policy.
Accept: Email is accepted and delivered to the intended recipient. Prefix Subject: Email is accepted and delivered to the intended recipient but after tagging the subject line.
Tagging content is specified in spam policy.
| Device Configuration | 142
You can customize subject tagging in such a way that the recipient knows that the Email is a spam Email.
For Example
Contents to be prefixed to the original subject: ‘Spam notification from the Device – ‘Original subject: ‘This is a test’
Recipient will receive Email with subject line as: ‘Spam notification from the Device - This is a test’
Figure 129: Add Content Scanning Rules
6. Click Save.
| Device Configuration | 143
SPX Configuration
This feature requires a subscription. It can be configured but cannot be enforced without a valid Email
Protection subscription.
SPX Global Template
Default SPX Template
Select the SPX Template to be used by default. Default Template is used if any user explicitly SPX-encrypts an
Email and no template is selected in Content Scanning Rule.
User can SPX-encrypt an Email by:
• Manually setting the Email header X-Sophos-SPX-Encrypt to yes.
• Installing the Sophos Outlook Add-on and clicking Encrypt before sending the Email.
If Default SPX Template is selected as None, then SPX encryption is not applied on Email.
Password Reset
Reset Password for
Enter the Email Address for the recipient for whom you want to reset the password. New SPX email to this address requires the recipient to obtain a new password from the sender.
SPX Portal Settings
Host Name
Specify the IP Address or Domain on which Password Registration Portal is hosted.
Allowed Network(s)
Specify the networks from which password registration requests will be accepted.
Port
Enter the port on which the SPX reply portal should listen.
Default: 8094
SPX Expiry Settings
Keep Unused Password for
Specify the expiry time in days of an unused password.
For example, if Keep Unused Password for is set to 30 days, the password will expire at 0 o'clock after 30 days from being generated if there was no SPX encrypted message sent for a specific recipient.
Default: 30 days
Allow Password Registration for
Specify the time in days after which the link to Passowrd Registration Portal expires.
Default: 10 days
SPX Notification Settings
Send Error Notification To
Specify whom to send a notification when an SPX error occurs. You can send the notification to the sender or you can send no notification at all. Error messages will always be listed in the SMTP log.
| Device Configuration | 144
Figure 130: SPX Configuration
SPX Templates
This feature requires a subscription. It can be configured but cannot be enforced without a valid Email
Protection subscription.
SPX (Secure PDF Exchange) encryption is a next-generation version of email encryption. It is clientless and extremely easy to set up and customize in any environment. Using SPX encryption, email messages and any attachments sent to the Device are converted to a PDF document, which is then encrypted with a password. You can configure the Device to allow senders to select passwords for the recipients, or the server can generate the password for the recipient and store it for that recipient, or the server can generate one-time passwords for recipients.
When SPX encryption is enabled, there are two ways how emails can be SPX encrypted:
• User can download the Sophos Outlook Add-in from User Portal. After having it installed, an Encrypt button is displayed in the Microsoft Outlook user interface. To encrypt a single message, the user needs to enable the
Encrypt button and then write and send the message. Only if something goes wrong, for example the sender does not enter a valid password, a notification will be sent, if configured.
Note:
If you do not use Outlook you can also trigger SPX encryption by setting the header field
X-Sophos-SPX-Encrypt to yes.
| Device Configuration | 145
• In the Data Protection feature, you can enforce SPX encryption of Emails containing sensitive data (see
Protection > Email Protection > Scanning Rules).
The encrypted message is then sent to the recipient's mail server. Using any PDF reader, the recipient can decrypt the message with the password that was used to encrypt the PDF. SPX-encrypted email messages are accessible on all popular smartphone platforms that have native or third-party PDF file support, including Blackberry and Windows
Mobile devices.
The SPX template defines the layout of the PDF file, password settings and recipient instructions. You can also define different SPX templates. So, if you are managing various customer domains, you can assign them customized SPX templates containing for example different company logos and texts.
Add SPX Templates
This feature requires a subscription. It can be configured but cannot be enforced without a valid Email
Protection subscription.
This page allows you to define new SPX Templates or modify existing templates.
1. Navigate to Protection > Email Protection > SPX Templates and click Add.
2. Enter parameter values for the following basic settings.
Name
Specify the name to uniquely identify the template.
Description
Specify details of the template.
Organization Name
Specify the organization name to be displayed on notifications concerning SPX, sent to the administrator or the email sender, depending on your settings.
PDF Encryption
Select the encryption standard of the PDF file.
Page Size
Select the page size of the PDF file.
3. Enter Password Settings.
Password Type
Select how you want to generate the password for accessing the encrypted email message. Dependent on which type you select, the sender always has to take care of transferring the password in a safe way to the recipient, except for Specified by recipient.
Available Options:
Specified by Sender:
Select if the email sender should provide the password. In this case, the sender has to enter the password into the Subject field, using the following format: [secure:<password>]<subject text> where
<password> is the password to open the encrypted PDF file and <subject text> is the random subject. Of course, the password will be removed by the Device before the email is sent to the recipient.
Generated one-time password for every email:
The Device automatically creates a new password for each affected email. A Notification Email is sent to the
Sender containing instructions and the one-time generated password.
The HTML content of this Email can be customized from Notification Subject and Notification Body. You can reset to the default content by clicking Reset button.
Generated and stored for recipient:
| Device Configuration | 146
The Device automatically creates a recipient-specific password when the first email is sent to a recipient.
This password will be sent to the sender. With the next email, the same password is used automatically. The password will expire when it is not used for a configured time period, and it can be reset by the administrator, see the
.
The HTML content of this Sender Notification Email can be customized from Notification Subject and
Notification Body. You can reset to the default content by clicking Reset button.
Specified by recipient:
Select if the email recipient should provide the password. In this case, the recipient receives a Notification
Email containing link leading to the Password Registration Portal to register a password and Sender receives a failure notification. After registration, the recipient is able to view the current encrypted mail and any future encrypted mails using the same password from this or other senders from the same organization.
Note: The Recipient's password generated via Specified by recipient method and Generated and
stored for recipient are mutually exclusive. Recipient will have to use the respective password when
Email is received after SPX Encryption using different methods.
4. Specify Recipient Instructions:
Instructions for Recipient
The body of the email that is sent from the Device to the email recipient containing instructions concerning the encrypted email. Simple HTML markup and hyperlinks are allowed. You can also use variables, e.g.,
%%ORGANIZATION_NAME%%
| Device Configuration | 147
Figure 131: Add SPX Templates
Tip:
The Default SPX Template on this tab contains all available variables and gives a useful example of recipient instructions. The variables used are:
• ENVELOPE_TO: The Recipient for whom password is generated.
• PASSWORD: The password to open SPX encrypted Email
• ORGANIZATION_NAME: The name provided in Organization Name field.
• SENDER: The Sender of the Email.
• REG_LINK: Link of the Registration Portal for registering the password.
5. Click Save to save the settings.
Data Protection Policy
This feature requires a subscription. It can be configured but cannot be enforced without a valid Email
Protection subscription.
This feature is NOT available in Device Models SF100 and SF200.
| Device Configuration | 148
The Data Protection (DP) feature allows you to reduce accidental data loss from workstations by monitoring and restricting the transfer of files containing sensitive data. Accidental data loss is commonly caused by employees mishandling sensitive data. For example, a user sends a file containing sensitive data home via email (SMTP). DP scans outgoing emails including subject line, message body and attachments for sensitive or confidential information.
Based on the outcome, the email can be encrypted using SPX encryption, or the email can be rejected or sent.
To configure DLP, select one or more rule from the Sophos Content Control List (CCL). CCLs provide expert definitions for common financial and personally identifiable data types, for example, credit card numbers, social security numbers, postal addresses, or email addresses. Advanced techniques, such as checksums, are used in Sophos
CCLs to increase the accuracy of sensitive data detection.
Add Data Protection Policy
This feature requires a subscription. It can be configured but cannot be enforced without a valid Email
Protection subscription.
This feature is NOT available in Device Models SF100 and SF200.
The Add Data Protection Policy page is used to configure policy to scan and detect confidential data in Email traffic and take appropriate action.
1. Go to Protection > Email Protection > Data Protection Policy and click Add.
2. Enter policy details.
Name
Specify name to identify Data Protection Policy.
Signatures
Select one or more Content Control signature(s) to be added to the policy.
Filter the CCL based on Type or Region.
Figure 132: Data Protection Policy
3. Click Save to create policy.
| Device Configuration | 149
Address Group
Scanning Rules are applied on Email Addresses. To make configuration easier and simpler, Administrator can group the addresses that require the same scanning policy. The policy applied to the address group is applicable to all the group members. Hence when group is used in number of rules, it becomes much easier to add or remove addresses from the group rather than updating individual rules. Hence, just with the one update, Administrator can re-align the rules.
Address Group is grouping of:
• Email Address or Domain
• IP Address
• RBL (Real time black hole List) (applicable only for the Spam mails)
An address can be a member of multiple groups.
RBL is a list of IP Addresses whose owners are responsible for Spam or are hijacked for Spam Relay. These IP
Addresses might also be used for spreading virus. The Device checks each RBL for the connecting IP Address and action configured in the policy is taken if IP Address is found in any of the RBL list. Administrator can directly use the two default RBL groups shipped with the Device or update them as per the requirement:
• Premium RBL Services
• Standard RBL Services
The Address Group page displays list of all the default and custom groups and provides option to add a new group, update the parameters, import addresses in the existing group, or delete the group. You can sort the list based on address group name.
Add Address Group
This page allows you to add a new Email Address Group, or edit existing groups.
1. Navigate to Protection > Email Protection > Address Group and click Add.
2. Specify the parameter values of the following Address Group Settings.
Name
Enter a name to identify the Group. A group name must be unique.
Description
Provide the description for the address group.
Group Type
Select type of addresses you want to group from the available options.
Available Options:
RBL (IPv4) and RBL(IPv6):
RBL is a list of IPv4 and IPv6 Addresses, respectively, whose owners refuse to stop the proliferation of spam, i.e. are responsible for spam or are hijacked for spam relay. The Device will check each RBL for the connecting IP Address. If the IP Address matches to the one on the list then the specified action in policy is taken. Specify Domain Name to be added as RBL to the Address Group.
Email Address / Domain:
Import or manually specify Email Address or Domain Name to be added to the Address Group.
Import – Select to browse and import a CSV file or a text file to add the Email Address/Domain to address group.
Manual – Select to manually add the Email Address/Domain to address group.
| Device Configuration | 150
Figure 133: Address Group
3. Click Save to create Address Group.
Email Archiver
This feature requires a subscription. It can be configured but cannot be enforced without a valid Email
Protection subscription.
Email being one of the most important communication and business tool in use by organizations, Email Archiving has become an integral part of every organization. An email archive is a repository to preserve mails for compliance and operational purposes.
Using Device Email Archiver, the administrator can archive all Emails, Emails of a specific recipient or a group of recipients coming into the organization and thereby keep a close watch over data leakage.
The Device can archive all Emails intended for a single or multiple recipients and can forward to the single administrator or multiple administrators.
This section displays list of archivers created and provides option to
update the parameters of existing archiver
, or delete the archiver. You can filter the list based on recipient name.
Add Email Archiver
This feature requires a subscription. It can be configured but cannot be enforced without a valid Email
Protection subscription.
The Add Email Archiver page allows you to specify which Recipient's Email you want to archive.
1. Go to Protection > Email Protection > Email Archiver and click Add.
2. Enter following parameters.
Name
Enter a name for the Email Archiver.
Recipient
Select Any to archive all the incoming Emails or specify Address Group for which Emails need to be archived.
Send Copy of Email To (Only for SMTP/S Protocol)
Specify Email Address to which you want to forward the Email copy.
| Device Configuration | 151
Figure 134: Add Email Archiver
3. Click Save to create archiver.
Quarantine Digest Settings
This feature requires a subscription. It can be configured but cannot be enforced without a valid Email
Protection subscription.
This feature is NOT available in Device Models SF100 and SF200.
Quarantine Digest is an Email containing a list of quarantined Emails filtered by Device and held in the user
Quarantine Area. If configured, user receives Quarantine Digest as per the frequency in Protection > Email
Protection > Quarantine Digest Settings. Digest also provides a link to User Portal from where user can access quarantined Emails and take the required action.
Quarantine Digest settings can be configured globally for all the users or for individual users. User receives
Quarantine Digest as per the configured frequency.
The Quarantine Digest provides following information for each quarantined message:
• Date and time: Date and time when message was received
• Sender: Email Address of the sender
• Recipient: Email Address of the receiver
• Subject: Subject of the message
Configuring Quarantine Digest for All Users
Enable Quarantine Digest
Enable Quarantine Digest to configure digest service for all the users.
Email Frequency
Specify the mailing frequency for digest.
Digest can be mailed every hour, every day at configured time, or every week on the configured day and time.
From Email Address
Specify Email Address from which the mail should be sent. Digest mail will be sent from the configured mail address.
Display Name
Specify mail sender name. Digest mail will be sent with the configured name.
Send Test Email
Click and provide Email Address to which the message is to be sent for Email Address verification.
Reference User Portal IP
Select Interface/Port IP from the ‘Reference User Portal IP’ dropdown list.
| Device Configuration | 152
User Portal link in Digest mail will point to this IP Address. User can click the link to access his quarantined messages and take the required action. The users not falling under the specified Interface will have to access the quarantine mail directly from their MyAccount.
Allow Override
Enable if you want user to override the Digest Settings. If enabled user can disable the digest service so that they do not receive the Quarantine Digest.
Change User's Quarantine Digest Settings
Click to change the digest settings of the individual users.
It allows selecting the group and updating the Quarantine Digest Setting of group members.
Overriding Quarantine Digest Settings for a Specific User(s)
Click Change User’s Quarantine Digest Settings button to change the digest settings for the individual users. It opens a new pop-up window named Manage Quarantine Digest which allows you to search groups and users for updating the Quarantine Digest Settings of group members.
You can individually search for user and user groups.
Select the checkbox against the user to enable the Quarantine Digest. If enabled, configured Quarantine Digest
Settings are applicable for the user.
Figure 135: Quarantine Digest Settings
Trusted Domain
This feature requires a subscription. It can be configured but cannot be enforced without a valid Email
Protection subscription.
To bypass spam scanning of certain Domains, define the domains as Trusted Domains. The page lists all the domains configured as trusted domain.
It also provides option to add a new domain and delete the existing domain.
Malware Protection
Sophos Firewall offers Dual Anti Virus Scanning, wherein traffic is scanned by Two (2) Anti Virus Engines. Traffic is first scanned by the Primary Engine, and then the Secondary Engine.
| Device Configuration | 153
Note: Dual Anti Virus is not available in Device Models SF 100 and SF200. For them, ONLY Single Anti
Virus CYREN is available.
Note: You can also view and manage the Anti Virus status on the System > Diagnostics > Services
General Settings
Primary Anti Virus Engine
Select the Primary Anti-Virus Engine to be used for traffic scanning. For Dual Scan, packets are first scanned by the Primary Engine and then by the Secondary Engine. For Single Scan, only the Primary Engine is used.
Available Options
Sophos EngineAvira Engine
System
System allows configuration for the following:
Available configurations:
•
- Network menu establishes how your device connects, interacts with your network, and allows
configuring network specific settings.
•
- Routing provides options to configure both static and dynamic routes.
•
- VPN menu allows you to configure required IPSec, L2TP, PPTP VPN connections.
•
- Administration provides options to configure general settings of the device.
•
on page 230 - Authentication menu allows to configure Authentication Servers, Groups, Users,
Clientless Users, Guest Users, Hotspots, Hotspot settings and Captive Portal settings. You can also download
Authentication Clients.
•
- Configuration menu allows basic administrative settings for the device.
•
- System Services allows configuration of device components along with the associated services.
•
- Diagnostic menu allows checking the health of your device in a single shot. Information can be used for troubleshooting and diagnosing problems found in your device.
Network
Network allows configuration for the following:
This section covers the following topics:
•
- Manage RED Device configuration.
•
: Create and manage Wireless Networks.
•
: Create and manage Mesh Networks.
•
- Configure DNS settings
•
RED Device Management
RED Device Management page allows you to view and manage added RED devices. To add new or manage added
RED devices go toSystem > Network > RED Device Management page.
The following options are available:
Status
The toggle switch next to the branch name shows the status of the RED device. Click it to turn it on/off.
| Device Configuration | 154
Edit
This link leads you to the page where you can edit the RED device settings. Find further descriptions on the Add
RED page.
Delete RED
With this option you can delete the RED devices from the list. You will get a message which configurations that the deletion will affect.
Add RED
You can configure RED from this page.
1. Ensure that RED is activated. This can be done in System > System Services > RED.
2. Navigate to System > Network > RED Device Management and click Add .
3. Enter the RED settings.
Firewall Device
Select the firewall device from the list of available devices.
Branch Name
Enter the name for the remote location where the RED will be set up.
Client Type
Select the client type from the drop-down list depending on the type of RED device you want to connect:
• RED 10
• RED 15
• RED 50
RED ID
Enter the RED ID.
The RED ID is a 15-character string printed on a sticker located on the back of the RED. If you do not want to open the package, you can also find it on the outer carton sticker.
Unlock Code (optional)
Enter the unlock code.
The Unlock code is an 8-character string that is generated when a RED is added to a UTM. If this RED is now being deployed for the first time, the unlock code is not required. If this RED has been deployed before, you will need to enter the unlock code here. The unlock code is generated during the deployment of a RED device, and is emailed instantly to the address you provided by activating RED. This is a security feature, which ensures that a RED device cannot simply be removed and installed elsewhere.
For manual deployment via USB stick and automatic deployment via Provisioning Service (see below), two separate unlock codes are generated. If you switch a RED device from one deployment method to the other, make sure to use the corresponding unlock code: For manual deployment, provide the unlock code of the last manual deployment; for automatic deployment, provide the unlock code of the last automatic deployment.
UTM Hostname
Enter the hostname of the UTM.
The UTM hostname must be a publicly resolvable DNS name or IP address for this UTM. The RED will use this name or IP to connect back to the UTM.
Description (optional)
Enter a description for the RED settings.
Device Deployment
Select the requested deployment method:
• Automatically via Provisioning Service
• Manually via USB Stick
| Device Configuration | 155
Note: If you select manual deployment, it is extremely important to keep the unlock code, which is sent by email. If you lose the unlock code, you can never again connect the RED device to another UTM.
By default, the UTM provides the RED's configuration data automatically via Sophos' RED Provisioning
Service. In this case, the RED device receives its configuration via Internet. If for example your RED does not have an Internet connection, you can provide the configuration manually, via USB stick. If you deploy a RED device manually, you have to ensure that UTM is acting as NTP server. Therefore activate NTP on the UTM and allow the correct network or at least the IP address of the RED.
Figure 136: RED Setting
4. Enter the uplink settings.
Uplink Connection
Select the connection type for the uplink:
• DHCP: The RED pulls an IP address from a DHCP server.
• Static: Enter an IPv4 address, a corresponding netmask, a gateway and a DNS server.
3G/UMTS Failover
Enable/disable the 3G/UMTS failover function.
Note: The RED device offers a USB port, where you can plug in a 3G/UMTS USB stick. If selected, this stick can serve as Internet uplink failover in case of a WAN interface failure. For the necessary settings please refer to your Internet provider's data sheet.
• Username/Password (optional): If required, enter a username and password for the mobile network.
• PIN (optional): Enter the PIN of the SIM card if a PIN is configured.
Note: If you enter a wrong PIN, in case of a WAN interface failure, the connection via 3G/
UMTS cannot be established. Instead, the 3G/UMTS Failover checkbox of the RED device will automatically be unselected. Thus, the wrong PIN will only be used once. When the WAN interface comes up again, a warning will be displayed for the RED device: A wrong PIN was
entered for 3G/UMTS failover uplink. Please change the login data. When you open the Edit
RED dialog box, a message is displayed which tells you that the 3G/UMTS failover was
| Device Configuration | 156 automatically unselected. Correct the PIN before selecting the checkbox again. Please note that after three connection attempts with a wrong PIN, the SIM card will be locked. Unlocking cannot be done via the RED device or the UTM.
• Mobile Network: Select the mobile network type, which is either GSM or CDMA.
• APN (only with GSM): Enter your provider's access point name information.
• Dial String (optional): If your provider uses a different dial string, enter it here. Default is *99#.
Figure 137: Uplink Settings
5. Enter the RED network settings.
RED Operation Mode
You can define how the remote network will be integrated into your local network:
• Standard/Unified: The UTM completely controls the network traffic of the remote network. Additionally, it serves as DHCP server and as default gateway. All remote network traffic will be routed through the
UTM.
• Standard/Split: The UTM completely controls the network traffic of the remote network. Additionally, it serves as DHCP server and as default gateway. In contrast to the Unified mode, only certain traffic will be routed through the UTM. Define local networks in the Split Networks box below which can be accessed by remote clients.
Note: VLAN tagged frames cannot be handled with this operation mode. If you use a VLAN behind your RED device, use the standard operation mode instead.
• Transparent/Split The UTM does not control the network traffic of the remote network, it does neither serve as DHCP server nor as default gateway. On the contrary, it pulls an IP address from the DHCP server of the remote network to become a part of that network. However, you can enable access for remote clients to your local network. For that you need to define Split Networks that are allowed to be accessed by the remote network. Additionally, you can define one or more Split Domains to be accessible. If your local domains are not publicly resolvable, you need to define a Split DNS Server, which can be queried by remote clients.
Note: VLAN tagged frames cannot be handled with this operation mode. If you use a VLAN behind your RED device, use the standard operation mode instead.
RED IP
(not for Transparent/Split)
Enter the IP address of the RED device.
RED Netmask
(not for Transparent/Split)
Select the netmask from the drop-down menu.
Zone
Select the requested zone:
• LAN
• DMZ
• VPN
• WiFi
Configure DHCP
Enable if you want to configure a DHCP range for RED.
| Device Configuration | 157
RED DHCP Range
(only if Configure DHCP is on)
Enter the DHCP range RED is allowed to use.
Split Network
(not for Standard/Unified)
Add one or more split networks.
Note: Only traffic targeted to networks listed in the Split Network box is redirected to your local
UTM. All traffic not targeted to the defined split networks is directly routed to the Internet.
Example: You have a branch office and you want it to have access to your local intranet or you want to route traffic of the remote network via your UTM for security reasons, e.g. to have the traffic checked for viruses or to use an HTTP proxy.
Split Domains
(only for Transparent/Split)
Add one or more split domains.
Note: Since the UTM is only a client of the remote network, routing traffic to the split networks the same way as with the other modes is not possible. Therefore, the RED device intercepts all traffic:
Traffic targeting to a network listed in the Split Network box or going to a domain listed in the
Split Domain box is redirected to the UTM interface. This is accomplished by replacing the default gateway's MAC address in the respective data packets with the UTM's MAC address.
Example: There is a partner or a service provider who should have access to your intranet or a certain server in your local network. Using a RED device, that partner's network will stay completely independent of your network, but they can access a defined part of your network for certain purposes, as if they were connected via LAN.
MAC Filtering Type
To restrict the MAC addresses allowed to connect to this RED device, select Blacklist or Whitelist. With
Blacklist, all MAC addresses are allowed except those listed on the MAC address list selected below. With
Whitelist, all MAC addresses are prohibited except those listed on the MAC address list selected below.
MAC Address:The list of MAC addresses used to restrict access to the RED device. MAC address lists can be created on the Objects > Host and Services > MAC Host page. Note that for RED 10, a maximum of 200
MAC addresses is allowed, whereas for RED 50, the list may contain up to 400 MAC addresses.
Note: MAC filtering only works for RED rev. 2 or newer.
Tunnel Compression
Enabling tunnel compression will compress all traffic that is sent through the RED tunnel. Data compression might increase the throughput of the RED device in areas with a very slow Internet connection such as 1-2
Mbps. However, any performance increase mainly depends on the entropy of the data being sent (for example, already compressed data such as HTTPS or SSH cannot be compressed any further). In some circumstances it might therefore be possible that enabling data compression could actually reduce the throughput of the RED device. In that case, please disable data compression.
| Device Configuration | 158
Figure 138: RED Network Setting
Note: Tunnel compression is not available for RED 10 rev.1.
6. Click Save to save your settings.
The RED interface is created and appears in the RED Device Management list.
Zones
The Zone page displays list of all the zones including system zones and even lets the administrator manage the zones.
A Zone is a logical grouping of ports/physical interfaces and/or virtual sub-interfaces if defined.
Zones provide a flexible layer of security for the firewall. With the zone-based security, the administrator can group similar ports and apply the same policies to them, instead of having to write the same policy for each interface.
Default Zone Types
LAN - Depending on the device in use and network design, one can group one to six physical ports in this zone.
Group multiple interfaces with different network subnets to manage them as a single entity. Group all the LAN networks under this zone.
By default the traffic to and from this zone is blocked and hence the most secured zone. However, traffic between ports belonging to the same zone will be allowed.
DMZ (DeMilitarized Zone) – This zone is normally used for publicly accessible servers. Depending on the device in use and network design, one can group multiple physical ports in this zone.
WAN - This zone is used for Internet services. It can also be referred as Internet zone.
VPN – This zone is used for simplifying secure, remote connectivity. It is the only zone that does not have an assigned physical port/interface. Whenever the VPN connection is established, port/interface used by the connection is automatically added to this zone and on disconnection; port is automatically removed from the zone. Like all other default zones, scanning and access policies can be applied on the traffic for this zone.
WiFi - This zone is used for wireless Internet services.
The device is shipped with single zone for LAN, WAN, DMZ, VPN and WiFi. These zones are called System Zones.
Administrator can add LAN and DMZ zone types.
Adding a Zone
Use the Add page to create a new Zone.
| Device Configuration | 159
The Add Zone page allows you to enter zone details.
1. Navigate to System > Network > Zones or Objects > Identity > Zone and click Add.
2. Enter the zone details.
Name
Provide a name to identify the zone.
Type
Select the type of Zone from the available options. LAN - Depending on the device in use and network design, one can group one to six physical ports in this zone. Group multiple interfaces with different network subnets to manage them as a single entity. Group all the LAN networks under this zone.
By default the traffic to and from this zone is blocked and hence the highest secured zone. However, traffic between ports belonging to the same zone will be allowed.
DMZ (DeMilitarized Zone) - This zone is normally used for publicly accessible servers. Depending on the device in use and network design, one can group one to five physical ports in this zone.
Note: By default, entire traffic will be blocked except LAN to Local zone service likes
Administration, Authentication, and Network.
Members
Displays all the member ports.
Click the checkbox to select the ports. All the selected ports are moved to 'Selected port' list.
Description
Provide the description for the zone.
Device Access
Device access defines the type of administrative access permitted on zone.
Admin Services - Enable Administrative Services that should be allowed through Zone:
• HTTP - Allow HTTP connection to the Admin Console through this zone
• HTTPS - Allow secure HTTPS connection to the Admin Console through this zone
• Telnet – Allow Telnet connection to CLI through this zone
• SSH – Allow SSH connection to CLI through this zone
Authentication Services – Enable Authentication Services that should be allowed through Zone:
• Windows/Linux Client
• Captive Portal
• NTLM
• Radius SSO
Network Services - Enable Network Services that should be allowed through Zone:
• DNS – Allow this zone to respond to DNS requests
• Ping/Ping6 – Allow this zone to respond to pings
Other Services - Enable other Services that should be allowed through Zone:
• Web Proxy
• SSL VPN
3. Click Save to add Zone with the options you have configured.
Note:
• If DMZ uses Private IP Address, use NATing to make them publicly accessible.
• One cannot add zone if the device is deployed as Bridge.
• Local and VPN zone cannot be updated or deleted.
| Device Configuration | 160
Wireless Networks
The page provides a list of all configured wireless networks along with their name, SSID, client traffic mode, encryption mode used and frequency band. New wireless networks can be added and existing ones deleted.
Protection > Wireless Protection > Wireless Networks or System > Network > Wireless Networks
Note: You can also view the wireless network status on the System > Current Activity > Wireless Client
List page.
The page displays all existing wireless networks. You can add new wireless networks, update or delete them.
Following is a description of the table elements:
Name
Displays the name of the wireless network.
SSID
Displays the SSID of the wireless network.
Status
Displays the Status of the wireless network.
Client traffic
Displays the client traffic of the wireless network.
Encryption Mode
Displays the encryption mode of the wireless network.
Frequency Band
Displays the frequency band of the wireless network.
Manage
Displays the available managing options for the wireless network:
• Edit: Allows you to edit the wireless network.
• Delete: Allows you to delete the wireless network.
To either add or delete a wireless network, click on the corresponding buttons.
Add a New Wireless Network
This page describes how to create a new wireless network.
The Add button on the Wireless Networks page allows to define a new wireless network. This can then be used in definitions for access points and access point groups.
1. Navigate to Protection > Wireless Protection > Wireless Networks or System > Network > Wireless
Networksand click the Add button.
A new page General Settings opens.
2. Make the following settings:
Name
Enter a descriptive name for the network.
Description
Enter a description for the wireless network that helps you to identify it.
SSID
Enter the Service Set Identifier (SSID) for the network which will be seen by clients to identify the wireless network. The SSID may consist of 1-32
ASCII printable characters
. It must not contain a comma and must not begin or end with a space.
| Device Configuration | 161
Security Mode
Select a security mode from the drop-down list. Default is WPA 2 Personal.
We recommend to prefer WPA2 over WPA, if possible. For security reasons, we recommend to not use WEP unless there are clients using your wireless network that do not support one of the other methods.
When using an enterprise authentication method, you also need to configure a RADIUS server on the
System > Authentication > Authentication Server or Objects > Assets > Authentication Server page. As
NAS ID of the RADIUS server enter the wireless network name.
Note: Sophos Firewall OS supports the IEEE 802.11r standard in WPA2 (PSK/Enterprise) networks to reduce roaming times. Clients also need to support the IEEE 802.11r standard.
Passphrase/PSK
Only available with WPA Personal, WPA2Personal and WPA2/WPA Personal security mode.
Key
Enter the passphrase to protect the wireless network from unauthorized access and repeat it in the next field. The passphrase may consist of 8-63 ASCII printable characters.
Only available with WEP Open security mode.
Enter a WEP key here that consists of exactly 26 hexadecimal characters.
Client Traffic
Select a method how the wireless network is to be integrated into your local network.
Separate Zone
Default.
The wireless network is handled as a separate network, having an IP address range of its own. Using this
option, after adding the wireless network, proceed as described in chapter
Note: When switching an existing Separate Zone network to Bridge to AP LAN or Bridge to
VLAN, an already configured WLAN interface will be deleted.
Zone
Select a zone where the wireless network should be broadcasted.
Default: WiFi
IP Address
Assign an IP address to the wireless network.
Netmask
Select a subnet mask for the IP address.
Bridge to AP LAN
You can bridge a wireless network into the network of an access point, that means that wireless clients share the same IP address range. Using this option, after adding the wirless network, proceed as described in chapter
Next Steps for Bridge to AP LAN Networks
.
Bridge to VLAN
Not available for Local WiFi Devices.
You can decide to have this wireless network's traffic bridged to a VLAN of your choice. This is useful when you want access points to be in a common network separate from the wireless clients.
Bridge to VLAN ID
Enter the VLAN ID of the network that the wireless clients should be part of.
Client VLAN ID
Only available with an enterprise security mode.
Select how the VLAN ID is defined.
• Static: Uses the VLAN ID defined in the Bridge to VLAN ID field.
| Device Configuration | 162
• RADIUS & Static: Uses the VLAN ID delivered by your RADIUS server: When a user connects to one of your wireless networks and authenticates at your RADIUS server, the RADIUS server tells the access point what VLAN ID to use for that user. Thus, when using multiple wireless networks, you can define per user who has access to which internal networks. If a user does not have a VLAN ID attribute assigned, the VLAN ID defined in the Bridge to VLAN ID is used.
3. Optionally, you can make the following Advanced Settings:
Encryption
Only available with WPA, WPA2 or WPA2/WPA encryption modes): Select an encryption algorithm which can be either AES, TKIP or TKIP&AES. For security reasons, it is recommended to use AES.
Frequency Band
Access points assigned to this wireless network will transmit on the selected frequency band(s). The 5 GHz band generally has higher performance, lower latency, and is typically less disturbed. Hence it should be preferred for e.g. VoIP communication. For an overview which APs support the 5 GHz band, see chapter
Protection > Wireless Protection > Access Points or Objects > Assets > Access Points.
Time-based Access
Select this option if you want to automatically enable and disable the wireless network according to a time schedule.
Select Active-Time
Select a schedule definition which determines when the wireless network is enabled. You can add a new schedule definition by clicking the Add button.
Client Isolation
Clients within a network usually can communicate with one another. If you want to prevent this, for example in a guest network, select Enabled from the drop-down list.
Hide SSID
If you want to hide the wireless network's SSID, select Yes from the drop-down list. Please note that this is no security feature.
Fast Transition
Only available with WPA2 Personal/Enterprise security mode.
Wireless networks with WPA2 security use the IEEE 802.11r standard. If you want to prevent this, select
Disabled from the drop-down list.
MAC Filtering
To restrict the MAC addresses allowed to connect to this wireless network, select Blacklist or Whitelist.
With Blacklist, all MAC addresses are allowed except those listed on the MAC List. With Whitelist, all
MAC addresses are prohibited except those listed on the MAC List.
MAC Hosts added under Objects > Host and Services > MAC Host will be displayed in the MAC List.
Figure 139: Add Wireless Network
4. Click Save to save your settings and add the wireless network.
| Device Configuration | 163
| Device Configuration | 164
Next Steps for Separate Zone Networks
When you created a wireless network with the option Separate Zone, a new corresponding virtual hardware interface will be created automatically, e.g., wlnet1. To be able to use the wireless network, some further manual configuration steps are required. Proceed as follows:
1. Enable DHCP for the wireless clients on the respective SF device.
For your clients to be able to connect to Sophos Firewall OS, they need to be assigned an IP address and a default gateway on the respective SF device. Therefore, on the System > Network > DHCP page, set up a DHCP server for the interface.
2. Create a Network Policy on the Policies page to provide Internet access to the wireless clients.
Bridge to AP LAN Networks with Local Devices
For Local WiFi Devices you need to make some extra setting on the SF device to make bridging to AP LAN work.
1. Edit the Local WiFi Device on the Protection > Wireless Protection > Access Points or Objects > Assets >
Access Points page and select the wireless network.
2. Create a new bridge interface on the System > Network > Interfaces page to use the wireless interface in Bridge mode or Edit the interface and select zone and provide IP Address to use the interface in Gateway mode.
3. If you want to use the interface in Gateway mode then create a DHCP server on the System > Network > DHCP page so that the client can receive an IP.
Mesh Networks
On this page you can create or delete mesh networks. Additionally, you see an overview of existing mesh networks.
On the Protection > Wireless Protection > Mesh Networks or System > Network > Mesh Networks page you can define mesh networks and associate access points that should broadcast them. In a mesh network, multiple access points communicate with each other and broadcast a common wireless network. On the one hand, access points connected via a mesh network can broadcast the same wireless network to clients, thus working as a single access point, while covering a wider area. On the other hand, a mesh network can be used to bridge Ethernet networks without laying cables. Access points associated with a mesh network can play one of two roles: root access point or mesh access point. Both broadcast the mesh network, thus the amount of other wireless networks they can broadcast is reduced by one.
Access points associated with a mesh network can play one of two roles: root access point or mesh access point. Both broadcast the mesh network, thus the amount of other wireless networks they can broadcast is reduced by one.
• Root access point: It has a wired connection to the Sophos Firewall OS and provides a mesh network. An access point can be root access point for multiple mesh networks.
• Mesh access point: It needs a mesh network to connect to the Sophos Firewall OS via a root access point. An access point can be mesh access point for only one single mesh network at a time.
A mesh network can be used for two main use cases: you can implement a wireless bridge or a wireless repeater:
• Wireless bridge: Using two access points, you can establish a wireless connection between two Ethernet segments. A wireless bridge is useful when you cannot lay a cable to connect those Ethernet segments. While the first Ethernet segment with your Sophos Firewall OS is connected to the Ethernet interface of the root access point, the second Ethernet segment has to be connected to the Ethernet interface of the mesh access point. Using multiple mesh access points, you can connect more Ethernet segments.
| Device Configuration | 165
• Wireless repeater: Your Ethernet with your Sophos Firewall OS is connected to the Ethernet interface of a root access point. The root access point has a wireless connection via the mesh network to a mesh access point, which broadcasts wireless networks to wireless clients.
To create a mesh network, please refer to
on page 84.
Following is a description of the table elements.
Mesh-ID
This is the identifier of the mesh network.
Frequency Band
The frequency band on which the associated access points broadcast the mesh network.
Manage
Displays the available managing options for the mesh networks:
• Edit Allows you to edit the mesh networks.
• Delete Allows you to delete the mesh networks.
To either add or delete a mesh network, click on the corresponding buttons.
Add Mesh Network
On this page you can create mesh networks and assign access points to them.
| Device Configuration | 166
The Add button on the Mesh Networks page allows to define a new mesh network.
1. Navigate to Protection > Wireless Protection > Mesh Networks or System > Network > Mesh Networks and click the Add button.
A new page General Settings opens.
2. Make the following settings:
Mesh ID
Enter a unique ID for the mesh network.
Frequency Band
Access points assigned to this network will transmit the mesh network on the selected frequency band.
Generally, it is a good idea to use a different frequency band for the mesh network than for the broadcasted wireless networks.
Description
Optionally, add a description or other information.
Figure 140: Add Mesh Network
3. Click Save to save your settings and add the mesh network.
DNS
Use DNS page to configure the DNS settings of the Device
DNS server is configured at the time of installation. You can add additional DNS servers to which device can connect for name resolution. If multiple DNS are defined, they are queried in the order as they are entered.
Note: You can also view and manage the DNS server status on the System > Diagnostics > Services page.
When you want external domains names to be resolved through internal DNS Servers in your network, you can add routes to such Servers. This will decrease the Internet traffic over the network and speed up DNS Client requests as queries will not be forwarded outside the network. Also, DNS information would be less exposed on the Internet thus enhancing security.
IPv4
Obtain DNS from DHCP
Click to override the device DNS with the DNS address received from DHCP server.
Option is available if enabled from Network Configuration Wizard or if a DHCP interface is configured.
Obtain DNS from PPPoE
Click to override the device DNS with the DNS address received from PPPoE server.
Option is available if enabled from Network Configuration Wizard or if a DHCP interface is configured.
Static DNS
Select to provide static IPv4 DNS server address.
A maximum of three static DNS IPv4 addresses can be provided.
| Device Configuration | 167
IPv6
Obtain DNS from DHCP
Click to override the device DNS with the DNS address received from DHCP server.
Option is available if enabled from Network Configuration Wizard or if a DHCP interface is configured.
Static DNS
Select to provide static IPv6 DNS server address.
A maximum of three static DNS IPv6 addresses can be provided.
DNS Query Configuration
Choose server based on incoming requests record type
Select to choose the DNS server to be used for resolving the domain name on the basis of the incoming requests record type. Incoming request can be of A or AAAA type.
Choose IPv6 DNS server over IPv4
Select to first choose IPv6 DNS server for resolving the DNS and then IPv4 DNS Server.
If both IPv6 and IPv4 DNS servers are configured, then it first selects IPv6 DNS server for all requests followed by IPv4 DNS server.
Choose IPv4 DNS server over IPv6
Select to first choose IPv4 DNS server for resolving the DNS and then IPv6 DNS Server.
If both IPv6 and IPv4 DNS servers are configured, then it first selects IPv4 DNS server for all requests followed by IPv6 DNS server.
Choose IPv6 if request originator address is IPv6, else IPv4
Select to choose IPv6 DNS server if request is received from IPv6 source or choose IPv4 DNS server, if request is received from IPv4 source.
Test Name Lookup
Click and provide IP Address or host name for testing the connectivity with the DNS server.
DNS Host Entry
The DNS Host Entry page displays the list of all the configured host entries. You can filter list based on Host/Domain
name. The page provides the option to
, or delete the entries.
DNS Request Route
This section displays list of all the configured DNS Request Routes. You can also
update the route configuration
and delete the routes.
Add DNS Host Entry
The Add DNS Host Enry page allows you to create and manage DNS Host Entries.
1. Navigate to System > Network > DNS > DNS Host Entry and click Add.
2. Enter host entry details
Host/Domain Name
Provide a Fully Qualified Domain Name (FQDN) for Host/Domain.
Address
Entry Type
Select DNS Host Entry type.
Available Options:
| Device Configuration | 168
Manual – Manually enter the IP address for the host
Interface IP – Configure Interface as host
Maximum Entries Per Host- 8
IP Address
Specify the IP Address of Host/Domain or select an Interface IP depending on the option selected for Entry
Type.
Time to Live (Seconds)
Specify TTL in seconds.
Default - 60 seconds
Weight
Specify weight for load balancing the traffic. Device distributes traffic across the links in proportion to the ratio of weights assigned to individual link.
This weight determines how much traffic will pass through a particular link relative to the other link.
Default - 1
Publish on WAN
Enable to publish DNS Host Entry on WAN.
Default - Disabled
Reverse DNS Lookup
Reverse DNS lookup is the resolution of an IP address to its designated domain name. Enable to allow reverse
DNS lookup.
Figure 141: Add DNS Host Entry
Note: If there are multiple hosts resolving to same IP Address then Reverse DNS Lookup can be configured only for one of the IP Address.
Note:
• Only A, AAAA, and PTR type of DNS records are supported.
• Address (A) record - points a hostname to an IP address and returns a 32-bit IPv4 address.
• AAAA record - points a hostname to an IP address and returns a 128-bit IPv6 address.
• Pointer records (PTR) - are just the reverse of A records and are used for reverse lookups. It maps IP address to a hostname.
• Maximum DNS entries supported - 1024
• If the device interface is used as a DNS in the Client system then a query is sent to the configured DNS servers prior to querying the ROOT severs.
3. Click Save to create a host entry.
| Device Configuration | 169
DNS Request Route
To configure DNS Request routes to internal DNS Servers.
Add/Edit DNS Request Route
Host/Domain Name
Specify the domain for which you want to use internal DNS Server.
Target Servers
Select DNS Server to resolve the domain specified above. You can also add IP Address from this page.
Maximum of eight IP Addresses can be added.
DHCP Relay
System > Network > DHCP Relay
The DHCP Relay Agent allows to place DHCP clients and DHCP servers on different networks. Deploying DHCP in a single segment network is easy. All DHCP messages are IP broadcast messages, and therefore all the computers on the segment can listen and respond to these broadcasts. But things get complicated when there is more than one subnet on the network. This is because the DHCP broadcast messages do not, by default, cross the router interfaces.
The DHCP Relay Agent makes it possible for DHCP broadcast messages to be sent over routers that do not support forwarding of these types of messages. The DHCP Relay Agent enables DHCP clients to obtain IP Addresses from a
DHCP server on a remote subnet, or which is not located on the local subnet. If DHCP Relay Agent is not configured, clients would only be able to obtain IP Addresses from the DHCP server which is on the same subnet.
The DHCP Relay page displays list of all the interfaces configured as a relay agent and you can filter the list based on relay agent name and IP Family. The page also provides option to:
•
•
• Delete an Agent
Add DHCP Relay Agent
You can configure Interface as DHCP Relay Agent from this page.
1. Navigate to System > Network > DHCP Relay and click Add
2. Enter DHCP Relay Configuration details.
Name
Provide a name to identify DHCP Relay Agent.
IP Family
Select the IP Family for DHCP Relay Agent.
Available Options: IPv4IPv6
Interface
Select Interface.
Interfaces having Static IP Assignment can act as a DHCP Relay Agent. Device cannot act as DHCP server and DHCP Relay Agent simultaneously. Hence if device is configured as DHCP Relay Agent, you will not be able to configure it as a server and vice-versa.
DHCP Relay agent can be configured on virtual sub-interface but cannot be configured on Interface alias.
DHCP Server IP
Specify DHCP Server IP Address. You can also configure multiple DHCP servers. This support deployment where DHCP server running in high availability environment. DHCP Relay will forward packets to all the configured DHCP Servers and active server will serve the request. In case active server goes down, backup server serves the request. DHCP server takes care of leasing the IP Address to a client.
Maximum DHCP servers configures per DHCP Relay - 8
Relay through IPSec (Only if IP Family is IPv4)
Click to enable Relay through IPSec VPN.
| Device Configuration | 170
Figure 142: Add DHCP Relay Configuration
3. Click Save to add DHCP Relay Agent.
Routing
Routing provides options to configure both static and dynamic routes.
Available configurations:
•
- Allows to configure parent proxy settings when the web traffic is blocked by the upstream
Gateway.
•
- Allows to configure packets redirection to a destination other than the configured default gateway.
Upstream Proxy
System > Routing > Upstream Proxy
Enable Parent Proxy when the web traffic is intercepted by an upstream gateway.
When enabled all the HTTP requests will be sent to web parent proxy server via device.
IPv4 Parent Proxy
Parent Proxy
Click to enable the Parent Proxy if the web traffic is intercepted by an upstream gateway.
If enabled, device forwards all the HTTP requests to parent proxy server.
Domain Name/IPv4 Address
Specify Domain Name or IPv4 Address for the Parent Proxy.
Port
Specify Port number, which is to be used for Parent Proxy.
Default - 3128
Username
Specify Username for authentication.
| Device Configuration | 171
Password
Specify Password for authentication.
IPv6 Parent Proxy
Parent Proxy
Click to enable the Parent Proxy if the web traffic is blocked by the upstream gateway.
If enabled, device forwards all the HTTP requests to Parent Proxy.
Domain Name/IPv6 Address
Specify Domain Name or IPv6 Address for the Parent Proxy.
Port
Specify Port number to be used for Parent Proxy.
Default - 3128
Username
Specify Username for authentication.
Password
Specify Password for authentication.
Static Routing
System > Routing > Static Routing
A route provides the device with the information it needs to forward a packet to a particular destination. A static route causes packets to be forwarded to a destination other than the configured default gateway.
By specifying through which interface the packet will leave and to which device the packet should be routed, static routes control the traffic exiting the device.
Static Routing menu allows configuring IPv4 and IPv6 Unicast Routes.
IPv4 Unicast Route
The IPv4 Unicast Route section displays list of all the configured IPv4 unicast routes. You can filter the list based on
IP address, gateway, Interface, or distance. The page also provides option to
, update the route configuration and delete the route.
IPv6 Unicast Route
The IPv6 Unicast Route section displays list of all the configured IPv6 unicast routes. You can filter the list based on
IP address, gateway, Interface, or distance. The page also provides option to
, update the route configuration and delete the route.
Add Unicast Route
You can add Unicast Route from this page.
1. For IPv4 Unicast Route, navigate to System > Routing > Static Routing and click Add under IPv4 Unicast
Route. For IPv6 Unicast Route, navigate to System > Routing > Static Routing and click Add under IPv6
Unicast Route.
2. Enter Unicast Route details.
Destination IP/Prefix
Specify destination IPv4 or IPv6 Address and select the prefix of subnet mask.
Gateway
Specify gateway IPv4 or IPv6 Address. The gateway address specifies the next-hop router to which traffic will be routed.
Interface
Select Interface from the list.
| Device Configuration | 172
Distance
Specify distance for routing.
For IPv4
Default - 0
Acceptable Range - 0 to 255
For IPv6
Default - 1
Acceptable Range - 1 to 255
3. Click Save to add Unicast Route.
VPN
VPN section allows you to configure required IPSec, L2TP, PPTP VPN connections.
A Virtual Private Network (VPN) is a tunnel that carries private network traffic from one endpoint system to another over a public network such as the Internet without the traffic, being aware that there are intermediate hops between the endpoints or the intermediate hops being aware they are carrying the network packets that are traversing the tunnel. The tunnel may optionally compress and/or encrypt the data, providing enhanced performance and some measure of security. VPN allows you to pretend you are using a leased line or a direct telephone call to communicate between the endpoints. VPNs allow users and telecommuters to connect to their corporate intranets or extranets.
VPNs are cost-effective because users can connect to the Internet locally and tunnel back to connect to corporate resources. This not only reduces overhead costs associated with traditional remote access methods, but also improves flexibility and scalability. For all business people traveling or working from home, connecting securely to the corporate network is essential. With the Device, setting up a VPN is almost effortless.
The two endpoints in Device VPN are referred to as:
• Local - First endpoint is the local machine itself.
• Remote - Second endpoint is the remote peer - the machine you are trying to establish a VPN connection to, or the machine which is trying to establish a VPN connection with you.
Device VPN automatically encrypts the data and sends it to the remote site over the Internet, where it is automatically decrypted and forwarded to the intended destination. By encrypting, the integrity and confidentiality of data is protected even when transmitted over the un-trusted public network. Device uses IPSec standard i.e. IPSec protocol to protect traffic. In IPSec, the identity of communicating users is checked with the user authentication based on Digital
Certificates, public keys or Preshared Keys.
Device ensures that all the VPN traffic passing through the VPN tunnels is threat free. All the Firewall Rules and policies are applicable to the traffic going into the VPN tunnels and coming out of the VPN tunnels. Device inspects all the traffic passing through the VPN tunnels and makes sure that there are no viruses, worms, Spam, and inappropriate content or intrusion attempts in the VPN traffic. As VPN traffic is, by default subjected to the DoS inspection, Device provides a facility by which one can bypass scanning of traffic coming from certain hosts from
VPN zone. The above functionality is achieved by adding one additional zone called VPN zone. VPN traffic passes through VPN zone and Firewall Rule can be applied to VPN zone.
Device can be used to establish VPN connection between sites, LAN-to-LAN and Client-to-LAN connection. VPN is the bridge between Local & Remote networks/subnets.
Device supports following protocols to authenticate and encrypt traffic:
• Internet Protocol Security (IPSec)
• Layer Two Tunneling Protocol (L2TP)
• Point-to-Point Tunneling Protocol (PPTP)
• Secure Socket Layer (SSL)
IPsec
IPSec page allows you to create and manage IPSec Connections.
| Device Configuration | 173
IP Security (IPSec) is a suite of protocols designed for cryptographically secure communication at the IP layer (layer
3).
IPSec protocols:
• Authentication Header (AH) – Used for the authentication of packet senders and for ensuring the integrity of packet data. The Authentication Header protocol (AH) checks the authenticity and integrity of packet data. In addition, it checks that the sender and receiver IP Addresses have not been changed in transmission. Packets are authenticated using a checksum created by using a Hash-based Message Authentication Code (HMAC) in connection with a key.
• Encapsulating Security Payload (ESP) – Used for encrypting the entire packet and for authenticating its contents. In addition to encryption, the ESP offers the ability to authenticate senders and verify packet contents.
IPSec Connections
The Connection page displays list of all the IPSec connections. You can filter the list based on policy name, failover group name, policy name, connection type, status of the connection, local subnet, remote subnet, remote gateway, local ID, or remote ID. The page also provides option to add a new connection, update the parameters of the existing policy, or delete a policy. Page also provides option to create a connection manually or through connection wizard. In case of Remote Access Connection export the connection configuration by clicking Export icon under the Manage column.
Note: You can also view and manage active IPSec connections on the System > Current Activity > IPsec
Connections page. (Only at appliance level)
The page displays status of each connection as follows:
Connection Status
Active Connection
Description
Connection is active but not connected. Click to initiate the connection.
Connection is active and connected. Click to disconnect the connection.
When you disconnect, connection will be deactivated and to re-establish the connection, activate connection.
Connection is active but partially connected. Click to disconnect the connection. When multiple subnets are configured for LAN and/or remote network, Device creates sub-connection for each subnet. This status indicates that one of the sub-connections is not active.
Connection is deactive. Click to activate the connection.
Connection
Device supports the following IPSec connections types:
•
– This type of VPN is a user-to-internal network connection via a public or shared network. Many
large companies have employees that need to connect to the internal network from the field. These field agents access the internal network by using remote computers and laptops without static IP Address.
•
– A Site to Site VPN connects an entire network (such as a LAN or WAN) to a remote network via a
network-to-network connection. A network-to-network connection requires routers on each side of the connecting networks to transparently process and route information from one node on a LAN to another node on a remote
LAN.
•
– Host to Host VPN connects one desktop or workstation to another by way of a host-to-host connection. This type of connection uses the network to which each host is connected to create a secure tunnel with each other.
| Device Configuration | 174
Add IPSec Remote Access Connection
Page describes how you can create an IPSec Remote Access Connection
1. Navigate to System > VPN > IPSec and click Add under IPSec Connections. Select Connection Type as
Remote Access.
2. Enter the parameter values as below.
General Settings
Name
Specify a unique name to identify IPSec Connection.
Description
Provide description for IPSec VPN Connection.
Connection Type
Select Remote Access.
Policy
Select policy to be used for connection.
Policy can also be added by clicking on “Create New” link.
Action on VPN Restart
Select the Action to be taken on the connection when VPN services or Device restarts.
Available Options
Respond Only – Keeps connection ready to respond to any incoming request.
Disable – Keeps connection disabled till the user activates.
Figure 143: General Settings
Authentication Details
Authentication Type
Select Authentication Type. Authentication of user depends on the type of connection.
Available Options:
Preshared Key
Preshared Key authentication is a mechanism whereby a single key is used for encryption and decryption.
Both the peers should possess the Preshared Key. Remote peer uses the Preshared Key for decryption. On selecting this option the user shall require to provide the following details:
| Device Configuration | 175
Preshared Key – Specify the Preshared Key to be used. Preshared Key should be of minimum 5 characters.
Confirm Preshared Key – Provide the same Preshared Key to confirm it.
This Preshared Key will have to be shared or communicated to the peer at the remote end. At the remote end, client will have to specify this key for authentication.
If there is a mismatch in the key, user will not be able to establish the connection.
Digital Certificate
Digital Certificate authentication is a mechanism whereby sender and receiver both use Digital Certificate issued by the Certificate Authority. Both sender and receiver must have each other’s Certificate Authority.
Local Certificate – Select the local certificate that should be used for authentication by the Device.
Remote Certificate – Select the remote certificate that should be used for authentication by remote peer.
Figure 144: Authentication Details
Endpoint Details
Local
Select Local WAN port from the list.
IP Aliases created for WAN interfaces will be listed along with the default WAN interfaces.
Remote
Specify an IP Address or domain name of the remote peer.
Figure 145: Endpoints Details
Network Detail
IP Family
IP family will be enabled automatically according to the IP selected in Local WAN port.
Local Subnet
Select Local LAN Address.
Add and Remove LAN Address using Add Button and Remove Button.
Local ID
For Preshared Key and RSA Key, select any type of ID from the available options and specify its value.
Available Options:
DNS IP Address Email Address
DER ASN1 DN(X.509)
| Device Configuration | 176
Note: In case of Local Certificate, ID and its value is displayed automatically as specified in the
Certificate.
Allow NAT Traversal
Enable NAT traversal if a NAT device is located between your VPN endpoints i.e. when remote peer has private/non-routable IP Address.
At a time only one connection can be established behind one NAT-box.
Remote LAN Network
Select IP Hosts from the list of IP Hosts available. You can also add a new IP Host and include in the list by clicking on “Add New Item” link.
Remote ID
For Preshared Key and RSA Key, select any type of ID from the available options and specify its value.
Available Options:
DNS IP Address Email Address
DER ASN1 DN(X.509)
Note: In case of Local Certificate, ID and its value is displayed automatically as specified in the
Certificate.
Figure 146: Network Detail
User Authentication
User Authentication Mode
Select whether User Authentication is required at the time of connection or not from the available options.
Available Options:
Disabled – Click Disable if user authentication is not required.
Enable as Client – If enabled as client, specify username and password.
Enable as Server – If enabled as server, add all the users which are to be allowed to connect.
| Device Configuration | 177
Figure 147: User Authentication
Quick Mode Selectors
Protocol
Select all the protocols that are to be allowed for negotiations.
Tunnel will pass only that data which uses the specified protocol.
Available Options:
All ICMP UDP TCP
Local Port
Specify Local Port number that the local VPN peer uses to transport the traffic related to TCP or UDP protocol.
Local port Range: 1 – 65535
To specify any local port, enter *.
Remote Port
Specify Remote Port number that the remote VPN peer uses to transport the traffic related to TCP or UDP protocol.
Local port Range: 1 – 65535
To specify any local port, enter *.
Figure 148: Quick Mode Selectors
Advanced Settings
Disconnect when tunnel is idle
Click this option to allow Device to delete an Idle VPN Session if it exceeds the specified Idle session time interval.
Default - Disable
Idle session time interval (Only if Disconnect when tunnel is idle option is “Enabled”)
Specify the time limit after which an Idle VPN Session will be deleted by Device.
Acceptable Range - 120 to 999
| Device Configuration | 178
Figure 149: Advanced Settings
3. Click Save to create connection.
Add IPSec Site to Site Connection
Page describes how you can create an IPSec Site to Site Connection
1. Navigate to System > VPN > IPSec and click Add under IPSec Connections. Select Connection Type as Site to
Site.
2. Enter the parameter values as below.
General Settings
Name
Specify a unique name to identify IPSec Connection.
Description
Provide description for IPSec VPN Connection.
Connection Type
Select Site to Site.
Bind With an Interface
Enable to bind the IPSec VPN tunnel with an interface for configuring Route-based VPN.
In Route-based VPN approach, routing decides which packets to route through the VPN tunnel.
On creation of an interface-based tunnel, a virtual tunnel interface will be created which will be displayed along with other interfaces for configuring Static and Dynamic routes.
Policy
Select policy to be used for connection.
Policy can also be added by clicking “Create New” link.
Action on VPN Restart
Select the Action to be taken on the connection when VPN services or Device restarts.
Available Options
Respond Only – Keeps connection ready to respond to any incoming request.
Initiate – Activates connection on system/service start so that the connection can be established whenever required.
Disable – Keeps connection disabled till the user activates.
Route-based IP Address Details (Only if Bind With an Interface is enabled)
Local IP Address
Specify local IP Address for the tunnel interface.
You must configure this interface detail, if you want to use the interface in configuring dynamic routing.
Remote IP Address
Specify remote IP Address for the tunnel interface.
| Device Configuration | 179
You must configure this interface detail, if you want to use the interface in configuring dynamic routing.
Figure 150: General Settings
Authentication Details
Authentication Type
Select Authentication Type. Authentication of user depends on the type of connection.
Available Options:
Preshared Key
Preshared Key authentication is a mechanism whereby a single key is used for encryption and decryption.
Both the peers should possess the Preshared Key. Remote peer uses the Preshared Key for decryption. On selecting this option the user shall require to provide the following details:
Preshared Key – Specify the Preshared Key to be used. Preshared Key should be of minimum 5 characters.
Confirm Preshared Key – Provide the same Preshared Key to confirm it.
This Preshared Key will have to be shared or communicated to the peer at the remote end. At the remote end, client will have to specify this key for authentication. Refer to VPN Client guide, Phase 1 Configuration.
If there is a mismatch in the key, user will not be able to establish the connection.
Digital Certificate
Digital Certificate authentication is a mechanism whereby sender and receiver both use Digital Certificate issued by the Certificate Authority. Both sender and receiver must have each other’s Certificate Authority.
Local Certificate – Select the local certificate that should be used for authentication by the Device.
Remote Certificate – Select the remote certificate that should be used for authentication by remote peer.
RSA Key
RSA Key authentication is a mechanism whereby two keys – Local and Remote RSA - are used for encryption and decryption.
Local RSA Key – It is known only to the owner and never transmitted over network. Displays automatically generated key which cannot be modified.
Remote RSA Key – It can be regenerated from CLI Console. Refer to Console guide for more details.
| Device Configuration | 180
Figure 151: Authentication Details
Endpoint Details
Local
Select Local WAN port from the list.
IP Aliases created for WAN interfaces will be listed along with the default WAN interfaces.
Remote
Specify an IP Address or domain name of the remote peer.
Click Add icon against the option “Remote” to add new endpoint pairs or click Remove icon to remove the endpoint pairs.
Figure 152: Endpoints Details
Network Detail
IP Family
Select IP family to configure IPSec VPN tunnels with mixed IP families.
Available Options:
IPv4 IPv6
By default, IPv4 will be selected.
Four types of IPSec VPN tunnels can be created:
4 in 4 (IPv4 subnets with IPv4 gateway)
6 in 6 (IPv6 subnets with IPv6 gateway)
4 in 6 (IPv4 subnets with IPv6 gateway)
6 in 4 (IPv6 subnets with IPv4 gateway)
Local Subnet
Select Local LAN Address.
Add and Remove LAN Address using Add Button and Remove Button.
NAT Local LAN
Enable to NAT the LAN IP Address.
NATed LAN (only if NAT Local LAN is configured)
Select IP Host or Network Host from the available list. The Device assigns the configured IP address to differentiate between LANs at both the ends of VPN tunnel.
IP Host can also be added by clicking “Add IP Host” link.
| Device Configuration | 181
Local ID
For Preshared Key and RSA Key, select any type of ID from the available options and specify its value.
Available Options:
DNS IP Address Email Address
DER ASN1 DN(X.509)
Note: In case of Local Certificate, ID and its value is displayed automatically as specified in the
Certificate.
Allow NAT Traversal
Enable NAT traversal if a NAT device is located between your VPN endpoints i.e. when remote peer has private/non-routable IP Address.
At a time only one connection can be established behind one NAT-box.
Remote LAN Network
Select IP Addresses and netmask of remote network which is allowed to connect to the Device server through
VPN tunnel. Multiple subnets can be specified. Select IP Hosts from the list of IP Hosts available. You can also add a new IP Host and include in the list.
Remote ID
For Preshared Key and RSA Key, select any type of ID from the available options and specify its value.
Available Options:
DNS IP Address Email Address
DER ASN1 DN(X.509)
Note: In case of Local Certificate, ID and its value is displayed automatically as specified in the
Certificate.
In a single connection, same subnet for LAN and Remote Network cannot be configured.
| Device Configuration | 182
Figure 153: Network Detail
User Authentication
User Authentication Mode
Select whether User Authentication is required at the time of connection or not from the available options.
Available Options:
Disabled – Click Disable if user authentication is not required.
Enable as Client – If enabled as client, specify username and password.
Enable as Server – If enabled as server, add all the users which are to be allowed to connect.
Figure 154: User Authentication
Quick Mode Selectors
Protocol
Select all the protocols that are to be allowed for negotiations.
Tunnel will pass only that data which uses the specified protocol.
Available Options:
All ICMP UDP TCP
| Device Configuration | 183
Local Port
Specify Local Port number that the local VPN peer uses to transport the traffic related to TCP or UDP protocol.
Local port Range: 1 – 65535
To specify any local port, enter *.
Remote Port
Specify Remote Port number that the remote VPN peer uses to transport the traffic related to TCP or UDP protocol.
Local port Range: 1 – 65535
To specify any local port, enter *.
Figure 155: Quick Mode Selectors
Advanced Settings
Disconnect when tunnel is idle
Click this option to allow Device to delete an Idle VPN Session if it exceeds the specified Idle session time interval.
Default - Disable
Idle session time interval (Only if Disconnect when tunnel is idle option is “Enabled”)
Specify the time limit after which an Idle VPN Session will be deleted by Device.
Acceptable Range - 120 to 999
Figure 156: Advanced Settings
3. Click Save to create connection.
Add IPSec Host to Host Connection
Page describes how you can create an IPSec Host to Host Connection
1. Navigate to System > VPN > IPSec and click Add under IPSec Connections. Select Connection Type as Host
to Host.
2. Enter the parameter values as below.
General Settings
Name
Specify a unique name to identify IPSec Connection.
| Device Configuration | 184
Description
Provide description for IPSec VPN Connection.
Connection Type
Select Host to Host.
Policy
Select policy to be used for connection.
Policy can also be added by clicking “Create New” link.
Action on VPN Restart
Select the Action to be taken on the connection when VPN services or Device restarts.
Available Options
Respond Only – Keeps connection ready to respond to any incoming request.
Initiate – Activates connection on system/service start so that the connection can be established whenever required.
Disable – Keeps connection disabled till the user activates.
Figure 157: General Settings
Authentication Details
Authentication Type
Select Authentication Type. Authentication of user depends on the type of connection.
Available Options:
Preshared Key
Preshared Key authentication is a mechanism whereby a single key is used for encryption and decryption.
Both the peers should possess the Preshared Key. Remote peer uses the Preshared Key for decryption. On selecting this option the user shall require to provide the following details:
Preshared Key – Specify the Preshared Key to be used. Preshared Key should be of minimum 5 characters.
Confirm Preshared Key – Provide the same Preshared Key to confirm it.
This Preshared Key will have to be shared or communicated to the peer at the remote end. At the remote end, client will have to specify this key for authentication. Refer to VPN Client guide, Phase 1 Configuration.
If there is a mismatch in the key, user will not be able to establish the connection.
Digital Certificate
| Device Configuration | 185
Digital Certificate authentication is a mechanism whereby sender and receiver both use Digital Certificate issued by the Certificate Authority. Both sender and receiver must have each other’s Certificate Authority.
Local Certificate – Select the local certificate that should be used for authentication by the Device.
Remote Certificate – Select the remote certificate that should be used for authentication by remote peer.
RSA Key
RSA Key authentication is a mechanism whereby two keys – Local and Remote RSA - are used for encryption and decryption.
Local RSA Key – It is known only to the owner and never transmitted over network. Displays automatically generated key which cannot be modified.
Remote RSA Key – It can be regenerated from CLI Console. Refer to Console guide for more details.
Figure 158: Authentication Details
Endpoint Details
Local
Select Local WAN port from the list.
IP Aliases created for WAN interfaces will be listed along with the default WAN interfaces.
Remote
Specify an IP Address or domain name of the remote peer.
Click Add icon against the option “Remote” to add new endpoint pairs or click Remove icon to remove the endpoint pairs.
Figure 159: Endpoints Details
Network Detail
IP Family
IP family will be enabled automatically according to the IP selected in Local WAN port.
Local ID
For Preshared Key and RSA Key, select any type of ID from the available options and specify its value.
Available Options:
DNS IP Address Email Address
DER ASN1 DN(X.509)
Note: In case of Local Certificate, ID and its value is displayed automatically as specified in the
Certificate.
| Device Configuration | 186
Allow NAT Traversal
Enable NAT traversal if a NAT device is located between your VPN endpoints i.e. when remote peer has private/non-routable IP Address.
At a time only one connection can be established behind one NAT-box.
Default-Enabled
Remote LAN Network
Select IP Addresses and netmask of remote network which is allowed to connect to the Device server through
VPN tunnel. Multiple subnets can be specified. Select IP Hosts from the list of IP Hosts available on the Web
Admin Console.
You can also add a new IP Host.
Remote ID
For Preshared Key and RSA Key, select any type of ID from the available options and specify its value.
Available Options:
DNS IP Address Email Address
DER ASN1 DN(X.509)
Note: In case of Local Certificate, ID and its value is displayed automatically as specified in the
Certificate.
Figure 160: Network Detail
User Authentication
| Device Configuration | 187
User Authentication Mode
Select whether User Authentication is required at the time of connection or not from the available options.
Available Options:
Disabled – Click Disable if user authentication is not required.
Enable as Client – If enabled as client, specify username and password.
Enable as Server – If enabled as server, add all the users which are to be allowed to connect.
Figure 161: User Authentication
Quick Mode Selectors
Protocol
Select all the protocols that are to be allowed for negotiations.
Tunnel will pass only that data which uses the specified protocol.
Available Options:
All ICMP UDP TCP
Local Port
Specify Local Port number that the local VPN peer uses to transport the traffic related to TCP or UDP protocol.
Local port Range: 1 – 65535
To specify any local port, enter *.
Remote Port
Specify Remote Port number that the remote VPN peer uses to transport the traffic related to TCP or UDP protocol.
Local port Range: 1 – 65535
To specify any local port, enter *.
Figure 162: Quick Mode Selectors
Advanced Settings
Disconnect when tunnel is idle
Click this option to allow SF to delete an Idle VPN Session if it exceeds the specified Idle session time interval.
Default - Disable
Idle session time interval (Only if Disconnect when tunnel is idle option is “Enabled”)
Specify the time limit after which an Idle VPN Session will be deleted by SF.
Acceptable Range - 120 to 999
| Device Configuration | 188
Figure 163: Advanced Settings
3. Click Save to create new connection.
VPN Wizard
The VPN Connection Wizard takes you step-by-step through the configuration of Site-to-Site IPSec VPN connection between a Head Office (HO) device and multiple Branch Office (BO) devices simultaneously. After the configuration is complete, the wizard creates new IPSec VPN connections on the HO and BOs.
VPN Wizard set-up
The VPN Wizard takes you step-by-step through the configuration of VPN connection between two managed devices simultaneously.
1. Navigate to System > VPN > VPN Wizard and click Add.
On clicking Add, the VPN Wizard starts which contains the following three sections:
1. Select Device
2. Device Details
3. Security Information
2. Select the managed Head Office and Branch Office devices respectively based on the description shown below.
Head Office
Select Device
Select the Head Office device from the drop-down list of available devices.
Note: Only one device can be selected as the Head Office device.
Note: The list of available devices shows only those added devices which are Connected and
Synchronized with Firewall Manager.
Tunnel Name
Specify name to identify the tunnel for Head Office.
IP Family
Specify the IP type of the Head Office device subnet or Local End Point.
Description
Provide description for the Head Office device.
Branch Office
Select Devices
Select the Branch Office device from the drop-down list of available devices. You can select multiple devices at a time.
Description
Provide description for the Branch Office device.
3. Configure connection details for the Head Office and Branch Office devices respectively.
| Device Configuration | 189
Head Office Device
Policy
Select policy to be used for Head Office VPN connection. To create a new policy or go to System > VPN >
IPSec or Object > Policies > IPSec page.
Local End Point
Select Local WAN port of the Head Office device from the list.
IP/Domain
Specify IP Address or domain name of the selected Head Office device.
Subnet
Select Local LAN Address of the Head Office device. Click Add IP Host to create a new IP Host.
Branch Office Devices
Policy
Select policy to be used for Head Office VPN connection. To create a new policy or go to System > VPN >
IPSec or Object > Policies > IPSec page.
Note: Select a policy that is compatible with Head Office Policy.
Local End Point
Select Local WAN port of the Head Office device from the list.
Override End Point
Select to override interface assignment and specify the Default End Point interface for all selected devices.
Alternatively, you can create dynamic interfaces for each device. To add more interfaces, click the icon to add more dynamic interfaces.
Subnet
Specify Local LAN Subnet for each managed Branch Office device.
4. Specify Security Information.
Specify Preshared Key for Head Office and all Branch Office devices.
Note: Preshared Key should be of minimum 5 characters.
5. Click Finish to save the settings. On completing the VPN Wizard, all IPSec connections will be created. The connections can later be managed from the VPN Wizard main page.
L2TP Settings
On this page you can enable L2TP and configure the settings for L2TP connections.
System > VPN > L2TP Settings
Following is a description of the settings of this page:
Enable L2TP
Click this checkbox to enable/disable L2TP.
General Settings
Assign IP From
Set an IP address range which is used to distribute IP addresses to L2TP clients. This should be a private IP address range.
| Device Configuration | 190
Allow leasing IP address from RADIUS server for L2TP, PPTP and CISCO VPN Client
If this option is enabled and if the user is authenticated via a RADIUS server, the configured IP address (static and the IP address range) is overridden with the IP address provided by the RADIUS server. If no IP addresses are configured on the RADIUS server, the static IP address configured for the user will be assigned, else an IP address will be leased from configured IP address range.
Client Information
Primary/Secondary DNS Server
Specify up to two DNS servers of your organization. If there is no DNS server available in the list, you can select
Other and enter the IP address of a DNS server into a textfield.
Primary/Secondary WINS Server
Specify up to two WINS servers of your organization. If there is no WINS server available in the list, you can select Other and enter the IP address of a WINS server into a textfield.
Add L2TP Member
This page describes how to add an L2TP member.
Before you can add L2TP members, L2TP must be enabled. See chapter
on page 189.
1. Navigate to System > VPN > L2TP Settings and click Add Members at the bottom of the page.
2. Select users and groups from the table that should be enabled for L2TP.
Figure 164: Add L2TP Member
3. Click Apply.
All selected entries will be added as LT2P members.
Show/Remove L2TP Member
This page describes how to see which users or groups are members of L2TP and how to remove L2TP members.
Before you can show L2TP members, L2TP must be enabled. See chapter
on page 189.
1. Navigate to System > VPN > L2TP Settings and click Show Members at the bottom of the page.
A dialog opens that shows all current members of L2TP.
2. Select users or groups from the table that should be removed from L2TP.
Figure 165: Show L2TP Members
3. Click Delete.
| Device Configuration | 191
All selected entries will be removed as L2TP members.
L2TP Connections
The L2TP Connections page displays list of all the L2TP connections and you can sort the list based on connection name. The page also provides option to add a new connection, update existing connection, or delete the connection.
The page displays status of each connection as follows:
Connection Status
Active Connection
Description
Connection is active but not connected.
Click to initiate the connection.
Connection is active and connected.
Click to disconnect the connection.
When you disconnect, connection will be deactivated and to re-establish the connection, activate connection.
Connection is deactive. Click to activate the connection.
Add L2TP Connection
Page describes how you can create an L2TP Connection
1. Navigate to System > VPN > L2TP Connections and click Add.
2. Enter the parameter values as below.
General Settings
Name
Specify a unique name to identify L2TP Connection.
Description
Provide description for L2TP Connection.
Policy
Select policy to be used for connection.
Policy can also be added by clicking Create New link.
Action on VPN Restart
Select the Action to be taken on the connection when VPN services or Device restarts.
Available Options
Respond Only – Keeps connection ready to respond to any incoming request.
Disable
Keeps connection disabled till the user activates.
| Device Configuration | 192
Figure 166: General Settings
Authentication Details
Authentication Type
Select Authentication Type. Authentication of user depends on the type of connection.
Available Options:
Preshared Key
Preshared Key authentication is a mechanism whereby a single key is used for encryption and decryption.
Both the peers should possess the Preshared Key. Remote peer uses the Preshared Key for decryption. On selecting this option the user shall require to provide the following details:
Preshared Key – Specify the Preshared Key to be used. Preshared Key should be of minimum 5 characters.
Confirm Preshared Key – Provide the same Preshared Key to confirm it.
This Preshared Key will have to be shared or communicated to the peer at the remote end. At the remote end, client will have to specify this key for authentication.
If there is a mismatch in the key, user will not be able to establish the connection.
Digital Certificate
Digital Certificate authentication is a mechanism whereby sender and receiver both use Digital Certificate issued by the Certificate Authority. Both sender and receiver must have each other’s Certificate Authority.
Local Certificate – Select the local certificate that should be used for authentication by the Device.
Remote Certificate – Select the remote certificate that should be used for authentication by remote peer.
Figure 167: Authentication Details
Local Network Detail
Local WAN Port
Specify the Local Port number that the local VPN peer uses to transport traffic related to TCP or UDP protocol.
| Device Configuration | 193
Acceptable Range - 1 to 65535
To specify any local port, enter *.
Local ID
For Preshared Key and RSA Key, select any type of ID from the available options and specify its value.
Available Options:
DNS IP Address Email Address
DER ASN1 DN(X.509)
(DER ASN1 DN (X.509) is not applicable. In case of Local Certificate, ID and its value is displayed automatically as specified in the Local Certificate)
Figure 168: Local Network Details
Remote Network Details
Remote Host
Specify IP Address or host name of of remote end-point. Specify * for any IP Address.
Allow NAT Traversal
Enable NAT traversal if a NAT device is located between your VPN endpoints i.e. when remote peer has private/non-routable IP Address.
At a time only one connection can be established behind one NAT-box.
Default-Enabled
Remote LAN Network
Select IP Addresses and netmask of remote network which is allowed to connect to the Device server through
VPN tunnel. Multiple subnets can be specified. Select IP Hosts from the list of IP Hosts available on the
Admin Console.
You can also add a new IP Host by click Create New link.
Remote ID
For Preshared Key and RSA Key, select any type of ID from the available options and specify its value.
Available Options:
DNS IP Address Email Address
DER ASN1 DN(X.509) (DER ASN1 DN (X.509) is not applicable.
| Device Configuration | 194
Figure 169: Remote Network Details
Quick Mode Selectors
Local Port
Specify Local Port number that the local VPN peer uses to transport the traffic related to TCP or UDP protocol.
Default: 1701
Local port Range: 1 – 65535
To specify any local port, enter *.
Remote Port
Specify Remote Port number that the remote VPN peer uses to transport the traffic related to TCP or UDP protocol.
Default: *
Local port Range: 1 – 65535
To specify any local port, enter *.
Figure 170: Quick Mode Selectors
Advanced Settings
Disconnect when tunnel is idle
Click this option to allow Device to delete an Idle VPN Session if it exceeds the specified Idle session time interval.
Default - Disable
Idle session time interval (Only if Disconnect when tunnel is idle option is “Enabled”)
Specify the time limit after which an Idle VPN Session will be deleted by Device.
Acceptable Range - 120 to 999 seconds.
| Device Configuration | 195
Figure 171: Advanced Settings
3. Click Save to create new connection.
PPTP
Point-to-Point Tunneling Protocol allows organizations to extend their own private network through private tunnels over the public Internet.
The Device supports several authentication options including Password Authentication Protocol (PAP), Challenge
Handshake Authentication Protocol (CHAP), and Microsoft Challenge Handshake Authentication Protocol (MS-
CHAPv2).
The Configuration page provides option to configure the Device as PPTP server and provide access or disable remote access through PPTP to various users.
Enable PPTP
Click to enable PPTP.
Assign IP From
Specify IP Address range. PPTP server will lease IP Address to the PPTP client from the specified IP Address range. The PPTP client uses the assigned IP Address as its source address for the duration of the connection.
Do not specify the same IP Address range in L2TP configuration and PPTP configuration.
Allow leasing IP Address from Radius server for L2TP, PPTP and CISCO VPN Client
Click to lease IP Address to the PPTP users through the Radius Server.
Radius Server is a protocol that allows network devices to authenticate users against a central database. It can also store technical information used by network devices.
If enabled, the configured IP Address is overridden with the IP Address provided by the Radius Server.
Default - Disable
Primary DNS Server
Specify DNS Server to be used at the client end.
Secondary DNS Server
Specify Alternate DNS server to be used at the client end.
Primary WINS Server
Specify WINS Server to be used at the client end.
Secondary WINS Server
Specify Alternate WINS Server to be used at the client end.
Click to select users who are to be allowed remote access through PPTP.
Click to view list of PPTP members.
Add PPTP Members
The Add PPTP Members page allows you to select users who are to be allowed remote access through PPTP.
1. Click Add Member(s) button to add user or user groups. A window displays list of users and user groups.
| Device Configuration | 196
2. Select users or user groups who are to be allowed remote access through PPTP. You can add single or multiple users or user groups.
Figure 172: Add PPTP Members
3. Click Apply to add these users and user groups to the PPTP members list.
Show PPTP Members
Use Show Members page to view list of PPTP members and remove members for whom remote access through
PPTP is to be disabled.
The Show Members page allows you to view list of PPTP members and remove members for whom remote access through PPTP is to be disabled.
1. Click Show Members button to view list of PPTP members. A window displays list of L2TP users who who are allowed access through PPTP connection.
2. Select the users for whom you want to disable PPTP access. You can select multiple users or user groups.
Figure 173: Show PPTP Members
3. Click Delete button.
SSL VPN Settings
On this page you can configure general SSL VPN settings.
System > VPN > SSL VPN Settings
The remote access SSL feature of Sophos Firewall OS is realized by OpenVPN, a full-featured SSL VPN solution.
You can create point-to-point encrypted tunnels between remote employees and your company, requiring both SSL certificates and a username/password combination for authentication. This enables access to internal resources. In addition, Sophos Firewall OS offers a secure User Portal, which can be accessed by each authorized user. There a customized SSL VPN client software bundle can be downloaded. This bundle includes a free SSL VPN client, SSL certificates and a configuration that can be handled by a simple one-click installation procedure. The SSL VPN client supports most business applications such as native Outlook, native Windows file sharing, and many more.
Note: More information on how to use the SSL VPN client can be found in the
Sophos Knowledgebase
.
Following is a description of the different sections of this page:
Remote Access Settings
Make the following basic remote access settings:
| Device Configuration | 197
Protocol Select the protocol to use. You can choose either TCP or UDP. UDP is recommended because it provides a better performance.
SSL Server Certificate Select a local SSL certificate to be used by the SSL VPN server to identify itself against the clients. Default is DeviceCertificate.
Override Hostname Here you can set the server IP address for client VPN connection. Usually this should be the external IP address of Sophos Firewall OS.
IPv4 Lease Range Set an IP address range which is used to distribute IP addresses to the SSL clients. This should be a private IP address range. There is a default range given.
Subnet Mask Select a netmask for the IP address range above. The netmask must not be greater than 29 bits, because
OpenVPN cannot handle address ranges whose netmask is /30, /31, or /32. The netmask is limited to a minimum of
16.
IPv6 Lease (IPv6 / Prefix) If you want to lease IPv6 addresses to clients, set the IPv6 prefix in the first field and the netmask in the last field.
You then also have to select the option IPv4 and IPv6 both below.
Lease Mode Select if you want to only lease IPv4 addresses to SSL clients or both IPv4 and IPv6 addresses.
IPv4 DNS Specify up to two IPv4 DNS servers of your organization.
IPv6 DNS Specify up to two IPv6 DNS servers of your organization.
IPv4 WINS Specify up to two IPv4 WINS servers of your organization.
Windows Internet Naming Service (WINS) is Microsoft's implementation of NetBIOS Name Server (NBNS) on
Windows operating systems. Effectively, WINS is to NetBIOS names what DNS is to domain names—a central mapping of hostnames to IP addresses.
IPv6 WINS Specify up to two IPv6 WINS servers of your organization.
The IP addresses of the DNS and WINS servers you enter here are provided for the use of remote access clients while establishing a connection to the gateway, thus providing full name resolution for your domain.
Domain Name Enter the hostname of your Sophos Firewall as a Fully Qualified Domain Name (FQDN). The FQDN is an unambiguous domain name that specifies the node's absolute position in the DNS tree hierarchy, for example utm.example.com. A hostname may contain alphanumeric characters, dots, and hyphens. At the end of the hostname there must be a TLD (top level domain) such as com, org, or de. The hostname will be used in notification messages to identify the Sophos Firewall.
Disconnect Dead Peer After Enter a time limit in seconds after which a dead connection will be terminated by
Sophos Firewall. Default is 180 seconds.
Disconnect Idle Peer After Enter a time limit in minutes when an idle connection will be terminated. Default is 15 minutes.
Cryptographic Settings
Make the following cryptographic settings:
Encryption Algorithm Specifies the algorithm used for encrypting the data sent through the VPN tunnel. The following algorithms are supportedand all in Cipher Block Chaining (CBC) mode:
• DES-EDE3-CBC
• AES-128-CBC (128 bit)
• AES-192-CBC (192 bit)
• AES-256-CBC (256 bit)
• BF-CBC (Blowfish (128 bit))
Authentication Algorithm
• SHA-1 (160 bit)
| Device Configuration | 198
• SHA2 256 (256 bit)
• SHA2 384 (384 bit)
• SHA2 512 (512 bit)
• MD5 (128 bit)
Key Size The key size (key length) is the length of the Diffie-Hellman key exchange. The longer this key is, the more secure the symmetric keys are. The length is specified in bits. You can choose between a key size of 1024 or 2048 bits.
Key Lifetime Enter a time period after which the key will expire. The default is 28,800 seconds.
Compression Settings
Make the following compression setting:
Compress SSL VPN Traffic If enabled, all data sent through SSL VPN tunnels will be compressed prior to encryption.
Debug Settings
Make the following debug setting:
Enable Debug Mode When enabling debug mode, the SSL VPN log file will contain extended information useful for debugging purposes.
Click Apply to save your settings.
SSL VPN (Site to Site)
Site-to-site VPN tunnels can be established via an SSL connection. SSL VPN connections have distinct roles attached. The tunnel endpoints act as either client or server. The client always initiates the connection, the server responds to client requests. Keep in mind that this contrasts IPsec where both endpoints normally can initiate a connection.
System > VPN > SSL VPN (Site to Site)
Server Connections
This section lists all existing SSL VPN site-to-site server connections. Following is a description of the table elements:
Status
Displays if the connection is activated or not. You can activate/deactivate the connection with help of the displayed toggle switch.
Connection Name
Displays the name of the connection.
Local Networks
Displays the local networks that are allowed to be accessed remotely.
Remote Networks
Displays the remote networks that are allowed to connect to the local network(s).
Manage
Displays the available managing options for the connection:
• Edit: Allows you to edit the connection.
• Delete: Allows you to delete the connection.
A connection can be added or deleted by pressing the concerning buttons.
| Device Configuration | 199
Client Connections
This section lists all existing SSL VPN site-to-site client connections. Following is a description of the table elements:
Status
Displays if the connection is activated or not. You can activate/deactivate the connection with help of the displayed toggle switch.
Connection Name
Displays the name of the connection.
Use HTTP Proxy Server
Displays the HTTP proxy server which is used for the connection.
Manage
Displays the available managing options for the connection:
• Edit: Allows you to edit the connection.
• Delete: Allows you to delete the connection.
A connection can be added or deleted by pressing the concerning buttons.
Add SSL VPN Site-to-Site Server Connection
This page describes how to add a SSL VPN site-to-site server connection.
1. Navigate to System > VPN > SSL VPN (Site to Site) and click Add in the Server section.
2. Enter values for the following settings:
Connection Name
Enter a descriptive name for the connection.
Use Static Virtual IP Address (optional)
Only select this option if the IP address pool is not compatible with the client's network environment: By default clients are assigned an IP address from a Virtual IP pool. Rarely, it may happen that such an IP address is already in use on the client's host. In that case enter a suitable IP address in the Static Peer IP field which will then be assigned to the client during tunnel setup.
Local Networks
Select or add one or more remote networks that are allowed to connect to the local network(s).
Remote Networks
Select or add one or more remote networks that are allowed to connect to the local network(s).
Description (optional)
Enter a description or other information.
| Device Configuration | 200
Figure 174: Add SSL Connection
3. Click Save to save your settings.
The new SSL server connection appears on the Server list.
To either edit or delete a server connection, click the corresponding buttons in the Server list.
The next step is the client configuration which has to take place on client side and not on server side. Download the client configuration file with help of the provided button in the Server list.
Note: If you want to send the file via mail it is recommended to use the encryption option which is provided in the download dialog.
How to configure the client is described in chapter System > VPN > SSL VPN Site-to-Site > Add Client Site-to-
Site.
Add SSL VPN Site-to-Site Client Connection
This page describes how to add a SSL VPN site-to-site client connection.
1. Navigate to System > VPN > SSL VPN (Site to Site) and click Add in the Client section.
2. Enter values for the following settings:
Connection Name
Enter a descriptive name for the connection.
Configuration File
Click the Browse... icon, browse for the client configuration file and click Open.
Note: The file has to be in .apc or .epc format.
Password (optional)
If the file has been encrypted, enter the password.
Use HTTP Proxy Server (optional)
Activate if the client is located behind a proxy and enter the proxy settings:
• Proxy Server: Select or add a proxy server.
• Proxy Port: Enter a proxy port.
| Device Configuration | 201
•
Proxy Requires Authentication (optional): Select the checkbox if the client needs to authenticate against the proxy and enter Username and Password.
Override Peer Host Name (optional)
Select the checkbox and add or enter a hostname if the server system's regular hostname cannot be resolved from the client host.
Description (optional)
Add a description or other information.
Figure 175: Add SSL Connection
3. Click Save.
The new SSL VPN client connection appears on the Client list.
To either edit or delete a client connection, click the corresponding buttons in the Client list.
SSL VPN (Remote Access)
The remote access SSL feature of SFM is realized by OpenVPN, a full-featured SSL VPN solution. You can create point-to-point encrypted tunnels between remote employees and your company, requiring both SSL certificates and a username/password combination for authentication. This enables access to internal resources. In addition, a secure
User Portal is offered, which can be accessed by each authorized user to download a customized SSL VPN client software bundle. This bundle includes a free SSL VPN client, SSL certificates and a configuration that can be handled by a simple one-click installation procedure. The SSL VPN client supports most business applications such as native
Outlook, native Windows file sharing, and many more.
System > VPN > SSL VPN (Remote Access)
Following is a description of the table elements:
Name
Displays the name of the SSL VPN remote access policy.
Use as Default Gateway
Displays if and which default gateway is used for the policy.
Description
Displays the description which was entered for the policy.
Manage
Displays the available managing options for the policy:
| Device Configuration | 202
• Edit: Allows you to edit the policy.
• Delete: Allows you to delete the policy.
Add SSL VPN Remote Access Policy
This page allows adding SSL VPN remote access policies.
Following is a description of the different sections of this page:
System > VPN > SSL VPN (Remote Access) > Add
General Settings
Name
Enter a descriptive name for the policy.
Description (optional)
Add a description or other information.
Figure 176: General Settings
Identity
Policy Members
Click Add New Item to select available users/groups from a list or search for users/groups. Click Apply Selected
Items afterwards.
Note: You can also view and manage active SSL VPN users on the System > Current Activity > SSL VPN
Users page. (Only at appliance level)
Selected items are displayed in the list. To remove an item from the list, click the Minus icon on the right of the item.
Figure 177: Identity
Tunnel Access
Use as Default Gateway
Activate the toggle switch if you want to use this as default gateway.
Permitted Network Resources (IPv4)
Click Add New Item to select available network resources from a list or search for network resources. Click Apply
Selected Items afterwards.
Selected items are displayed in the list. To remove an item from the list, click the Minus icon on the right of the item.
| Device Configuration | 203
Permitted Network Resources (IPv6)
Click Add New Item to select available users/groups from a list or search for users/groups. Click Apply Selected
Items afterwards.
Selected items are displayed in the list. To remove an item from the list, click the Minus icon on the right of the item.
Figure 178: Tunnel Access
Idle Timeout
Disconnect Idle Clients
Activate/deactivate by clicking the toggle switch. If activated, clients which are idle will be disconnected from the session after a specified time.
Override Global Timeout (Default 15 Minutes) (only if Disconnect Idle Clients is activated.
Enter the value for the idle timeout in minutes.
Note: Values between 15 and 60 minutes are valid.
Figure 179: Idle Timeout
To save the settings click Apply, to cancel, click Cancel.
Note: New remote access policies immediately appear in the SSL VPN (Remote Access) list.
Note: For Remote Access connections to work check that LAN and WAN zones are activated for the User
Portal on the System > Administration > Device Access page.
Clientless Access
For the bookmark function you can define clientless access policies.
Note: With Safari browser on Mac OSX or iOS, users have to import the CA certificate of SF-OS first before they can use clientless access. The CA certificate can be downloaded under Protection > Web Server
Protection > Certificate Authority or System > VPN > Certificate Authority or Objects > Identity >
Certificate Authority. Usually its name is "Default".
System > VPN > Clientless Access
Following is a description of the table elements:
Name
Displays the name of the clientless access policy.
Restrict Web Applications
Displays if the web application restriction is activated (Yes) or not (No).
Description
Displays the description which was entered for the policy.
Manage
Displays the available managing options for the policy:
• Edit: Allows you to edit the policy.
• Delete: Allows you to delete the policy.
Add Clientless Access Policy
The page allows adding clientless access policies.
The Add button on the Clientless Access page allows to define a new clientless access policy.
1. Navigate to System > VPN > Clientless Access and click the Add button.
A new page opens.
2. Make the following settings in the General Settings section:
Name
Enter a descriptive name for the policy.
Description (optional)
Add a description or other information.
| Device Configuration | 204
Figure 180: General Settings
3. Make the following settings in the Identity section:
Policy Members
Select the requested users/groups from the list.
As soon as an item is selected it is displayed in the list.
Figure 181: Identity
Note: With Safari browser on Mac OSX or iOS, users have to import the CA certificate of SF-OS first before they can use clientless access. The CA certificate can be downloaded under Protection >
| Device Configuration | 205
Web Server Protection > Certificate Authority or System > VPN > Certificate Authority or
Objects > Identity > Certificate Authority. Usually its name is "Default".
4. Make the following settings in the Clientless Portal section:
Published Bookmarks
Select the requested bookmark(s) and/or bookmark group(s) from the list.
As soon as an item is selected it is displayed in the list.
Restrict Web Applications
Click the toggle switch to activate/deactivate the restriction of web applications.
Figure 182: Clientless Portal
5. Click Apply to save your settings.
The clientless access policy is now available and appears in the Clientless Access list.
Bookmark
Bookmarks are the resources whose access will be available through the user portal. Bookmarks are applied through the Clientless Access policy and are available to users who have web or application access.
System > VPN > Bookmark
The bookmark feature enables users from external networks to access internal resources via pre-configured connection types, using only a browser as a client, without installing plug-ins. To do so, the user logs in to the User
Portal. On the SSL VPN tab, a list of all connections available to this user is shown. Clicking the Connect button initiates the connection to the defined internal resource. As an administrator you have to generate these connections beforehand, specifying the allowed users, the connection type and other settings. Internal resources can be accessed using different connection types: for example Remote Desktop Protocol (RDP) or Virtual Network Computing
(VNC) to access remote desktops, a browser to use web applications (HTTP/HTTPS), or Telnet/Secure Shell (SSH) for terminal sessions. However, the portal does not permit to download content, e.g. via HTTP, to the user's local computer. Using this feature it is possible to give multiple users access to internal resources which do not support multi-user access themselves (e.g., network hardware like switches) or easily provide very granular access to just one specific service instead of giving access to entire systems or networks.
The page displays all existing bookmarks. You can add new bookmarks, update or delete them. Following is a description of the table elements:
Name
Displays the name of the bookmark.
Type
Displays the type of the bookmark.
URL
Displays the URL which is defined for the bookmark.
Description
| Device Configuration | 206
Displays the description of the bookmark.
Add a Bookmark
This page describes how to add a bookmark.
1. Navigate to System > VPN > Bookmark and click Add.
2. Enter values for the following settings:
Name
Enter a descriptive name for the bookmark.
Type
Select a bookmark type. Depending on the selected connection type, different parameters are displayed. The following types are available:
• HTTPS: Browser-based access to web applications via HTTPS.
• HTTP: Browser-based access to web applications via HTTP.
Note: The URL used for the HTTP/HTTPS connection is composed of the destination, the port and the path options for this connection.
•
RDP: Remote access using the Remote Desktop Protocol (RDP), e.g., to open a remote desktop session to a Windows host.
• TELNET: Terminal access using the Telnet protocol, e.g., to give access to a switch or a printer.
• SSH: Terminal access using SSH.
• FTP: File Transfer Protocol for exchanging files over packet-switched networks.
• FTPS: Extension of FTP. Additionally supports TLS and SSL protocols.
• SFTP: SSH File Transfer Protocol, or Secure File Transfer Protocol, is a separate protocol packaged with
SSH that works in a similar way over a secure connection.
• SMB: The Server Message Block (SMB) Protocol is a network file sharing protocol.
• VNC: Remote access using Virtual Network Computing (VNC), e.g., to open a remote desktop of a Linux/
Unix host.
Note: Currently only VNC classic authentication (password only) is supported. Make sure your server is set up accordingly.
Note: The default port is displayed next to the drop-down menu.
URL
Enter the URL of the website for which the bookmark is to be created.
Note: Note the examples displayed below the text box.
Port
Enter a port number for the bookmark. By default the standard port of the selected bookmark type is given.
Automatic Login
If enabled, users can log in without knowing the authentication data. In this case, you have to provide the authentication data. The displayed options depend on the selected connection type:
Username
Enter the username users should use to connect.
Password
Enter the password users should use to connect.
Note: When using the connection type Telnet, for security reasons automatic login only works when the banner length sent from the Telnet server does not exceed 4096 characters (including the password prompt). If the banner is longer, automatic login fails. In this case reduce the banner length or switch to manual login.
| Device Configuration | 207
Referred Domains
(only with bookmark type HTTPS or HTTP)
Search/add one or more domain(s)/URL(s) which are required by the bookmark URL to render it appropriately.
Domain
(only with bookmark type RDP or SMB)
Enter a domain name.
Protocol Security
(only with bookmark type RDP)
Select the security protocol for the Remote Desktop session. You can choose between RDP, TLS and NLA
(Network Level Authentication). Your settings have to comply with the server settings.
Note: NLA requires to enable Automatic Login above.
Public Host Key
(only with bookmark type SSH, FTPS or SFTP)
Add the public key of the SSH host.
Init Remote Folder
(only with bookmark type FTP, FTPS, SFTP or SMB)
Specify the remote directory path.
Note: After successful authentication the user is redirected to the path on the remote server.
Authentication Method
(only with bookmark type SFTP)
Select the authentication method. You can either provide the Password for the selected username or add the
Private Key for the SFTP connection.
Share Session
Select this option to allow users to use the connection simultaneously and see the same screen.
Description
Enter a description or other information.
| Device Configuration | 208
Figure 183: Add Bookmark
3. Click Save to save your settings.
The bookmark is now available and appears in the Bookmark list.
To either edit or delete a bookmark, click the corresponding buttons.
Bookmark Group
This page displays all bookmark groups. You can update a group to include bookmarks as group members. Single bookmarks can be member of multiple groups. You are not allowed to delete groups which contain bookmarks which are part of any of the SSL VPN policies.
System > VPN > Bookmark Group
You can add new groups, update or delete them. Following is a description of the table elements:
Name
Displays the name of the bookmark group.
Description
Displays the description of the bookmark group.
Manage
Displays the available managing options for the bookmark group:
• Edit: Allows you to edit the bookmark group.
• Delete: Allows you to delete the bookmark group.
To either add or delete a bookmark group, click the corresponding buttons.
Add a Bookmark Group
This page describes how to add a bookmark group.
1. Navigate to System > VPN > Bookmark Group and click Add.
2. Enter values for the following settings:
Name
Enter a descriptive name for the bookmark group.
Select Bookmark
Select the bookmark(s) you want to add to the new bookmark group from the Bookmark List.
Description
Enter a description or other information.
| Device Configuration | 209
Figure 184: Add Bookmark Group
3. Click Save to save your settings.
The bookmark group is saved. It appears in the Bookmark Group list.
To either edit or delete a bookmark group, click the corresponding buttons.
Certificate
The Certificate page displays list of available certificates.
A digital certificate is a document that guarantees the identity of a person or entity and is issued by the Certificate
Authority (CA). Certificates are generated by the third party trusted CA. They create certificates by signing public keys and identify the information of the communicating parties with their own private keys. This way it is possible to verify that a public key really belongs to the communicating party only and not been forged by someone with malicious intentions.
A certificate signed by a Certificate Authority (CA) identifies the owner of a public key. Each communicating party may be required to present its own certificate signed by a CA verifying the ownership of the corresponding private key. Additionally, the communicating parties need to have a copy of the CA’s public key. In case private key is lost or stolen or the information is changed, CA is responsible for revoking the certificate.CA also maintains the list of valid and revoked certificates.
To use Certificates for authentication, you must have valid CA and a certificate. You need to upload CA if you are using external CA. You can generate a self signed certificate if you want to use it as CA.
You can also use device to act as a certificate authority and sign its own certificates. This eliminates the need of having your own certificate authority. If you are using device as CA, you have to generate a self-signed certificate, which can be used in various VPN policies.
| Device Configuration | 210
The page also provides option to generate a self-signed certificate, upload a certificate, or generate a Certificate
Signing Request (CSR).This page also provides option to regenerate, revoke, download, or delete the certificates.
If you are using a third party CA, you have to submit a request to CA for issuing a certificate. Once CA issues a certificate, you have to upload to use it in VPN policy.
This page provides option to:
•
•
•
Add Certificate
Use the Certificate page to add a new certificate.
The Certificate page allows you to generate a self-signed certificate, upload a certificate, or generate a Certificate
Signing Request (CSR).
1. Navigate to Protection > Web Server Protection > Certificate or System > VPN > Certificate or Objects >
Identity > Certificate and click Add.
2. Choose the action you want to perform.
Action
Select action from the available options.
Upload CertificateGenerate Self-Signed CertificateGenerate Certificate Signing Request
Upload Certificate
Use the Certificate page to upload a certificate.
1. Enter Upload Certificate details.
Name
Specify a name to identify the Certificate.
Certificate File Format
Select the format of Certificate file from the available options.
Available Options: PEM (.pem): Privacy Enhanced Mail (PEM) is a Base64encoded DER certificate. It is used for encoding the certificate in ASCII code. The certificate and private key are stored in separate files. DER (.der): Distinguished Encoding Rules (DER) is a binary form of ASCII PEM format certificate used on Java platform. The certificate and private key are stored in separate files. CER (.cer): Canonical
Encoding Rules (CER) is a binary format for encoding certificates. It contains information about the owner of certificate, its public and private keys. PKCS7 (.p7b): Public Key Cryptography Standards (PKCS) is a format for encoding the certificate in ASCII code. It contains only certificates and not the private key.
PKCS12 (.pfx or .p12): Public Key Cryptography Standards (PKCS12) is a binary format for encoding certificates. It stores a private key with a public key certificate. It is used on Windows platform.
Certificate
Specify certificate to be uploaded. Use Browse to select the complete path.
Private Key
Specify private key for the certificate. Use Browse to select the complete path.
Passphrase
Specify and re-confirm a passphrase for a certificate used for authentication. Passphrase must be at least 4 characters long.
| Device Configuration | 211
Figure 185: Upload Certificate
2. Click Save to upload the certificate.
Generate Self-Signed Certificate
Use the Certificate page to generate self-signed certificate.
1. Enter details to generate Self Signed Certificate (Option available only after configuring Default CA Parameters)
Name
Specify a name to identify the Certificate.
Valid From and Valid Up To
Specify certificate validity period using Calendar . Validity period is the certificate life and indicates period up to which the certificate will be considered as valid.
Default - 1 day
Key Length
Select key length. Key length is the number of bits used to construct the key.
Available Options:5121024153620484096
Generally, the larger the key, the less chance that it will be compromised but requires more time to encrypt and decrypt data than smaller keys.
Default - 512
Key Encryption
Click to enable the key encryption.
Passphrase
Passphrase for a Certificate used for authentication. Passphrase must be at least 8 characters long. This option is enabled only if the Key Encryption option is selected.
Confirm Passphrase
Re-enter passphrase for confirmation.
Certificate ID
Specify certificate ID. You can specify any one of the following options:
Available Options: DNSIP Address(IPv4/IPv6 Address) Email Address DER ASN1 DN(X.509) (Applicable when Authentication Type is Digital Certificate)
Once the certificate is created, you need to download and send this certificate to the remote peer with whom the connection is to be established.
Country Name
Select the country.
| Device Configuration | 212
State
Specify the state within the country.
Locality Name
Specify the name of the locality.
Organization Name
Specify the organization name, which will use this certificate and domain name. This domain will be certified to use the Certificate.
Use unique Domain name only.
Organization Unit Name
Specify the department/unit name, which will use this certificate and domain name. This domain will be certified to use the Certificate.
Use unique Domain name only.
Common Name
Specify the common name.
A common name comprises of host + domain name or is a fully qualified domain name that is used to resolve to SSL VPN interface. It must be same as that of the Web address to be accessed when connecting to a secured site.
Email Address
Specify the Email Address of the contact person for communication.
2. Click Save to generate self-signed certificate.
Generate Certificate Signing Request
Use the Certificate page to generate certificate signing request.
1. Enter details to generate Certificate Signing Request (CSR).
Name
Name to identify the certificate.
Valid Upto
Specify certificate validity period using Calendar. Validity period is the certificate life i.e. period up to which the certificate will be considered as valid.
Minimum validity -1 day
Key Length
Select key length. Key length is the number of bits used to construct the key.
Generally the larger the key, the less chance that it will be compromised but requires more time to encrypt and decrypt data than smaller keys.
Encryption
Click to enable the key encryption.
Passphrase
Passphrase for a Certificate used for authentication. Passphrase must be at least 4 characters long. This option is available only if the Encryption option is checked.
Confirm Passphrase
Re-enter passphrase for confirmation.
Certificate ID
Specify certificate ID. You can specify any one of the following options:
Available Options: DNS IP AddressEmail Address
DER ASN1 DN(X.509) (Applicable when Authentication Type is Digital Certificate)
| Device Configuration | 213
Country Name
Select the Country for which the Certificate will be used.
Generally, this would be the name of the country where device is deployed.
State
Select the State for which the Certificate will be used.
Generally, this would be the name of the state where device is deployed.
Locality Name
Select the Locality for which the Certificate will be used.
Generally, this would be the name of the Locality where device is deployed.
Organization Name
Specify your organization name, which will use this certificate and domain name. This domain will be certified to use the Certificate.
Use unique Domain names only.
Organization Unit Name
Specify your department/unit name, which will use this certificate and domain name. This domain will be certified to use the Certificate.
Use unique Domain names only.
Common Name
Specify Common Name.
Email Address
Specify Email Address.
2. Click Save to generate certificate signing request.
Download Certificate
Use the Certificate page to download the certificate.
1. Navigate to Protection > Web Server Protection > Certificate or System > VPN > Certificate or Objects >
Identity > Certificate.
2.
Under the Manage column, click the Download Icon against the certificate you want to download.
Note:
• Only self signed certificate and certificate signing request can be downloaded.
• Certificate is downloaded as a .tar.gz file.
Revoke Certificate
Use the Certificate page to revoke the certificate.
1. Navigate to Protection > Web Server Protection > Certificate or System > VPN > Certificate or Objects >
Identity > Certificate.
2.
Under the Manage column, click the Revoke Icon to revoke self-signed certificate if lost, stolen or updated.
Revoked certificate is automatically added to the Certificate Revocation List (CRL). You can download revoked certificate and circulate if required.
Certificate Authority
The Certificate Authority page displays list of all the certificate authority and you can filter list based on the certificate authority name.
Device provides a facility to generate a local certificate authority as well as import certificates, signed by commercial providers, such as VeriSign.
| Device Configuration | 214
A certificate signed by a Certificate Authority (CA) identifies the owner of a public key. Each communicating party may be required to present its own certificate signed by a CA verifying the ownership of the corresponding private key. Additionally, the communicating parties need to have a copy of the CA’s public key. In case private key is lost or stolen or the information is changed, CA is responsible for revoking the certificate. CA also maintains the list of valid and revoked certificates.
After your CA has issued a certificate or have local certificate, you can upload it for use in VPN.
You can use default CA and can modify and re-generate it as per your requirement if you are not using any external
CA. Using this CA, you can generate self-signed certificate and use it in VPN policy.
Using Third Party CA involves uploading:
• CA and root certificate
• Certificate
• CRL (Certificate Revocation List)
If the remote peer is using certificate issued by the following third party CA, you are not required to upload CA:
• VeriSign
• Entrust
• Microsoft
Note: Default CA is regenerated automatically when it is updated.
The page provides option to:
•
•
•
Download Certificate Authority
Use the Certificate Authority page to download CA.
If you are using a local CA, you need to download CA and forward to the remote peer.
1. Navigate to Protection > Web Server Protection > Certificate Authority or System > VPN > Certificate
Authority or Objects > Identity > Certificate Authority. It displays the details of the default CA.
2.
Click download icon to download the zip file.
Note: Default CA cannot be deleted.
Adding a New Certificate Authority
To update and regenerate the default certificate, click on the default certificate.
•
•
CA Parameters
Use the Certificate Authority page to update and regenerate the default certificate.
The Certificate Authority page allows you to manually enter details to add a new certificate authority.
1. Navigate to Protection > Web Server Protection > Certificate Authority or System > VPN > Certificate
Authority or Objects > Identity > Certificate Authority and click Add.
2. Enter Certificate Authority details.
Name
Specify a name to identify the Certificate Authority.
Certificate File Format
Select format of the root certificate to be uploaded.
| Device Configuration | 215
Available Options:PEM (Privacy Enhanced Mail): A format encoding the certificate in ASCII code.
The certificate, request, and private key are stored in separate files.DER: A binary format for encoding certificates. The certificate, request, and private key are stored in separate files.
Certificate
Specify full path from where the certificate is to be uploaded. Alternately, use Browse button to select the path.
Private Key
Specify full path from where the Private Key is to be uploaded. Alternately, use Browse button to select the path.
CA Passphrase
CA Passphrase for authentication. Passphrase must be at least 4 characters long.
Confirm CA passphrase for authentication.
Figure 186: Certificate Authority
3. Click Save to add the Certificate Authority with the options you have configured.
Default CA Parameters
Use the Add Certificate Authority page to update and regenerate the default certificate.
The Add Certificate Authority page allows you to manually enter certificate authority details.
1. Navigate to Protection > Web Server Protection > Certificate Authority or System > VPN > Certificate
Authority or Objects > Identity > Certificate Authority.
2.
Click on the icon under Manage tab of the default certificate that you want to update and regenerate.
3. Enter Certificate Authority Details.
Name
Default. This name cannot be changed.
Country Name
Specify the name of the country where the device is installed.
State
Specify the name of the state where the device is installed.
Locality Name
Specify the name of the locality where the device is installed.
Organization Name
Specify the organization name, which will use this certificate and domain name. This domain will be certified to use the Certificate.
Use unique Domain name only.
| Device Configuration | 216
Organization Unit Name
Specify the department/unit name, which will use this certificate and domain name. This domain will be certified to use the Certificate.
Use unique Domain name only.
Common Name
Specify the common name.
A common name comprises of host + domain name or is a fully qualified domain name that is used to resolve to SSL VPN interface. It must be same as that of the Web address to be accessed when connecting to a secured site.
Email Address
Specify the Email Address of the contact person for communication.
CA PassPhrase
Specify Passphrase for a Certificate Authority. Passphrase must be at least 4 characters long.
Re-enter passphrase for confirmation.
4. Click Save to update and regenerate the default certificate.
Regenerating Certificate Authority
Use the Certificate Authority page to regenerate the default certificate.
1. Navigate to Protection > Web Server Protection > Certificate Authority or System > VPN > Certificate
Authority or Objects > Identity > Certificate Authority
2.
Under the Manage column, click the Regenerate icon
Note: Default CA is regenerated automatically when it is updated.
Certificate Revocation Lists
CA maintains the list of valid and revoked certificates. The page displays the list of available CRLs.
Certificate Revocation List (CRL) page is a way to check the validity of an existing certificate. Certificates which are stolen, lost or updated are revoked by CA and CA publishes such revoked certificates in Revocation list. VPN connection cannot be established using revoked certificates, hence it is necessary to update the CRL at regular interval.
The page provides option to:
•
•
Adding a New CRL
Use the Certificate Revocation List page to add a new CRL.
If you are using External Certificate Authority, you need to upload the CRL obtained from External Certificate
Authority.
1. Navigate to Protection > Web Server Protection > Certificate Revocation List or System > VPN > Certificate
Revocation List or Objects > Identity > Certificate Revocation List and click Add.
2. Enter Certificate Revocation List details.
Name
Name to identify the CRL.
CRL File
Specify CRL file to be uploaded. Use Browse to select the complete path.
| Device Configuration | 217
Figure 187: Certificate Revocation Lists
3. Click Save.
Downloading CRL
Use the Certificate Revocation List page to download the CRL.
Once CA is generated, default CRL is generated with name Default.tar.gz. Once you revoke the certificate, the details of the revoked certificate are added to the default file and regenerated. You can download and distribute if required.
1. Navigate to Protection > Web Server Protection > Certificate Revocation List or System > VPN > Certificate
Revocation List or Objects > Identity > Certificate Revocation List.
2. Click "Download" link against the CRL name to be downloaded. It downloads the zip file. Unzip the file to check the details.
Administration
System > Administration
Administration provides options to configure general settings of the device.
Available configurations:
•
: Settings allows configuring the port settings, login security settings and Admin Console logon settings.
•
as custom zones. It also allows changing/resetting Administrator Password and Adding/Removing Local Service
ACL Rules.
Settings
System > Administration > Settings
Use Settings page to make modifications in the general port settings and Web Admin Login parameters. Make changes to the login parameters for restricting the local and remote users based on the time.
Admin Port Settings
Web Admin HTTP Port
Provide the port number to configure HTTP Port for Admin Console access.
Default - 80
Web Admin HTTPS Port
Provide the port number to configure HTTPS Port for secured Admin Console access.
Default - 4444
User Portal HTTPS Port
Provide the port number to configure HTTPS Port for Secured User Portal access..
Default - 443
Certificate
Certificate to be used by User Portal and Captive Portal.
Login Security (Remote Admins)
To prevent the unauthorized access to the Admin Console and CLI, configure Admin Session Lock, Admin Session
Logout time and Block Admin Login to block the access after number of failed login attempts.
| Device Configuration | 218
Lock Admin Session After
Configure inactivity time (in minutes) for the administrative session after which the device will be locked automatically. This configuration will be applicable to following components:
• Admin Console
• Telnet Console
• IPSec Connection Wizard
• Network Wizard
• Group Import Wizard
Default - 3 Minutes
Logout Admin Session After
Configure time of admin inactivity in minutes after which the administrator will be logged out automatically.
Default - 10 Minutes
Note: Admin Session Logout time value must be greater than Lock Admin Session time.
Block Admin Login
Enable to block login to the Admin Console and CLI after configured number of failed attempts within configured time span.
Configure number of allowed failed login attempts from the same IP Address within the time limit.
Specify number of minutes for which the administrator will not be allowed to login. The administrator account will locked for the configured minutes if allowed failed login attempts exceeds.
Administrator Password Complexity Settings
Password Complexity can be configured to ensure that administrators are using secure passwords.
Enable Password Complexity Settings to enforce following constraints:
• Minimum Password length. Configure minimum characters required in the password.
Default - 8 Characters
• Require minimum one upper and lower case alphabet
• Require minimum one number (0 - 9)
• Require at least one special character e.g. @, $, %
• Password cannot be same as username.
Note: All the enabled constraints are applied to password of administrator user only.
Login Disclaimer Settings
The Login Disclaimer allows setting a written message that administrators must read and agree prior to logging on to the Admin Console and CLI for device administration. If a disclaimer is set, it must be accepted before administrator can login.
Default disclaimer can be customized as per the requirement from the Messages page System > Administration >
Messages. One can also review the customized message before setting.
Sophos Adaptive Learning
The product sends information periodically to Sophos which is used for the purpose of improving stability, prioritizing feature refinements, and protection effectiveness. It includes configuration and usage information, and
Application usage and threat data.
Configuration and usage data such as Device information (hardware version, vendor), Firmware version and license information (not the owner), Features in use (status, on / off, count, HA status, Central Management status), amount of configured objects (count of hosts, policies), Product errors, CPU, memory and disk usage (in percentage), is collected by default.
| Device Configuration | 219
No user-specific information or personalized information is collected. The information is transmitted to Sophos over
HTTPS.
Send App & Threat data
Following Application usage and Threat data is gathered:
• Unclassified applications to improve and enlarge the network visibility and application control library.
• Data for IPS alerts, virus detected (also URL for which virus found), spam, ATP threats such as threat name, threat URL/IP, source IP, and applications used.
Default - Enable
SFOS Hot-fix
Allow auto-install of important Hot-fixes Hot-fixes are applied automatically if available. Disable if you do not want to apply hot-fix. Default - Enable
Device Access
System > Administration > Device Access
Device access allows limiting the Administrative access of the following device services from various default zones,
LAN, WAN, DMZ, VPN and custom zones :
• Admin Services – HTTP, HTTPS, Telnet, SSH
• Authentication Services – Client Authentication, NTLM, Captive Portal, Radius SSO
• Network Services – DNS, Ping/Ping6
• Other Services – Wireless Protection, SSL VPN, Web Proxy, User Portal, Dynamic Routing
Default ACL
When device is connected and powered on for the first time, it will have a default Access configuration.
Admin Services – HTTP (TCP port 80), HTTPS (TCP port 443), Telnet (TCP port 23) and SSH (TCP port 22) services will be enabled for administrative functions in LAN and WiFi zone. HTTP (TCP port 80), HTTPS (TCP port 443), Telnet (TCP port 23) and SSH (TCP port 22) services will be enabled for administrative functions in WAN zone. HTTP (TCP port 80) services will be enabled for administrative functions in DMZ zone.
Authentication Services – Client Authentication (UDP port 6060), Captive portal Authentication (TCP port 8090) and
Radius SSO will be enabled for User Authentication Services in LAN and WiFi zone. User Authentication Services are not required for any of the Administrative functions but required to apply user based internet surfing, bandwidth, and data transfer restrictions.
Network Services – Ping/Ping6 and DNS services will be enabled for LAN, WAN and WiFi zone.
Other Services – Web Proxy service will be enabled for LAN and WiFi zone. SSL VPN (TCP port 8443) service will be enabled for LAN, WAN, DMZ and WiFi zone. User Portal and Dynamic Routing service will be enabled for LAN and WAN zone.
Local Service ACL
Use access control to limit the access to the device for administrative purposes from the specific authenticated/trusted networks only.
Admin Services – Enable/disable access to the device using following service from the specified zone: HTTP,
HTTPS, Telnet and SSH.
Authentication Services – Enable/disable following service from the specified zone: Client Authentication, Captive
Portal, NTLM, Radius SSO.
Network Services – Enable/disable following service from the specified zone: DNS, Ping/Ping6.
Other Services – Enable/disable following service from specified zone: Wireless Protection, SSL VPN, Web Proxy,
User Portal and Dynamic Routing.
| Device Configuration | 220
Local Service ACL Rule
Use Local Service ACL Rule to allow access to the device Admin Services from specified network/host. The section displays list of all the configured IPv4 and IPv6 Local Service ACL rules. The page provides option to add, update and delete the rules.
Default Admin Password Settings
The device is shipped with one global super admin with the credentials – username & password as “admin”. Both the consoles – Admin Console and CLI, can be accessed with the same credentials. This administrator is always authenticated locally i.e. by device itself.
Note: We recommend you to change the password for this user name immediately after deployment.
You can change the default password from this section. The screen elements and their description are mentioned below:
Username
The default admin username is –“admin”.
Current Password
Enter the current admin password.
New Password
Password - Specify new admin password.
Confirm Password - Confirm the specified new admin password.
Reset to Default
Click to reset the password to factory default password.
Add Local Service ACL Rule
Use Local Service ACL Rule to allow access to the device Admin Services from specified network/host.
You can add Local Service ACL rule from this page.
1. Navigate to System > Administration > Device Access and click Add under Local Service ACL Rule
2. Enter Rule details.
Rule Name
Specify name to identify the rule.
Description
Provide a description for the rule.
IP Family
Select the type of IP Family from the options available:
Available Options:
IPv4IPv6
Network/Host
Click Add New Item button to select host or network address to which the rule applies. You can also create new Network/Host from this page itself by clicking Create New button.
Services
Click Add New Item to select Admin Services to which the rule applies.
Available Options:
HTTPHTTPSTelnetSSH
| Device Configuration | 221
Figure 188: Local Service ACL Exception Rule
3. Click Save to add the rule.
Updates
System > Administration > Updates
By default pattern updates are updated automatically. Updates page displays the status of various patterns for different models like Sophos AV, IPS, WAF. The page also allows to update patterns or set auto-update time interval.
Below are the screen elements with their description:
Updates Status
Pattern
Pattern name whose definitions are updated.
Current Version
Version of the Pattern
Last Successful Update
Status along with date of the last update
Update Pattern Now Button
Click ‘Update Pattern Now’ button to update the pattern definitions.
Pattern Download/Installation
| Device Configuration | 222
Auto Update
To update pattern definitions automatically, enable "Auto Update".
Interval
If "Auto Update" is set as off, set the time limit in which you want to receive updates.
Available Options: Every hourEvery 2 hoursEvery 4 hoursEvery 12 hoursDailyEvery 2 days
Messages
System > Administration > Messages
Messages page allows Administrator to send messages to the various users. Messages help Administrator to notify users about problems as well as Administrative alerts in areas such as access, user sessions, incorrect password, and successful log on and log off etc.
Message, up to 256 characters can be sent to a single user or multiple users simultaneously, whenever an event occurs.
Click the Edit icon against the message to be customized, update the message and click the Apply icon to save the edited message or click Reset icon to reset it to the default message.
Predefined Messages
Authentication
User account blocked (AD Policy)
Login failed. Your AD Server account is locked.
User account disabled (AD Policy)
Login failed. Your account on AD Server is disabled.
User account expired (AD Policy)
Login failed. Your account on AD Server has expired.
Clientless User Login Not Allowed
Clientless user is not required to login.
Data Transfer Exhausted
Your data transfer has been exceeded. Please contact the Administrator.
Deactive User
You have been deactivated by the Administrator.
Delete User
You have been disconnected.
Disconnect User
You have been disconnected by Admin.
Guest User Validity Expired
Guest User validity has expired.
Login not allowed at this time (AD Policy)
Login failed. You are not permitted by AD Server to login at this time.
Invalid Machine
Message is sent if User tries to login from the IP Address not assigned to him/her
| Device Configuration | 223
Login not allowed at this workstation (AD Policy)
Login failed. You are not permitted by AD Server to login at this workstation.
Someone else is logged in from same IP Address
Message is sent if someone else has already logged with the same IP Address.
Logged Off Successful Message
Message is sent when User logs off successfully.
Logged On Successful Message
Message is sent when User logs on successfully.
Max Login Limit
Message is sent if User has reached the maximum login limit.
Not Authenticate
Message is sent if User name or password is incorrect.
Not Currently Allowed
Message is sent if User is not permitted to access at this time
Access Time policy applied to the User account defines the allowed access time and not allowed access at any other time.
User password expired (AD Policy)
Login failed. Your password on AD Server has expired.
User needs to reset the Password (AD Policy)
Login failed. You must reset your AD Server password.
Logged Off Due To Session Time Out
Message is sent when session has timed out and user is logged of automatically.
Surfing Time Exhausted
Message is sent when User is disconnected because his/her allotted surfing time is exhausted
The surfing time duration is the time in hours the User is allowed Internet access that is defined in Surfing time policy. If hours are exhausted, User is not allowed to access.
Surfing Time Expired
Administrator has temporarily deactivated the User and will not be able to log in because User surfing time policy has expired.
Logout Notification
You will be logged off automatically after sometime. If you wish to continue browsing tap this notification.
SMTP
CTIPD Rejection
Message will be sent when Administrator has blacklisted the sender’s IP Address.
CTIPD Temporary Rejection
Message will be sent when Administrator has temporarily blacklisted the sender’s IP Address.
Probable Spam Rejection
Message will be sent when mail is suspected as probable spam mail and is rejected.
| Device Configuration | 224
Probable Virus Outbreak Rejection
Message will be sent when outbreak detection engine rejects mail because it seems to be a Probable Virus outbreak.
Spam Rejection
Message will be sent when spam mail is rejected.
Virus Outbreak Rejection
Message will be sent when outbreak detection engine rejects mail because it is identified as a Virus outbreak.
DPP Rejection
Message will be sent when mail is rejected by Sophos DPP.
Email Domain Rejection
Message will be sent when Administrator has blocked the mail sender domain.
Destination IP Address Rejection
Message will be sent when Administrator has blocked the destination IP.
Spam Mail Rejection
Message will be sent when Administrator has blocked the mail sender.
Mail Header Rejection
Message will be sent when mail is rejected as it contains a restricted mime header.
Mail/Virus Rejection
Message will be sent when virus infected mail is rejected.
IP Address Rejection
Message will be sent when Administrator has blocked the mail sender IP.
Oversized Mail Rejection
Message will be sent when mail is rejected because message size exceeds the maximum allowed size.
Undersized Mail Rejection
Message will be sent when mail is rejected because the message size is less than the allowed size.
Delivery Notification (to Sender)
Message will be sent to the mail sender when mail is successfully delivered to the receiver.
Attachment Infection
Message will be sent when mail is rejected due to virus infected attachment.
RBL Rejection
Message will be sent when the sender IP Address is blacklisted.
Source IP Address Rejection
Message will be sent when mail is rejected because the source IP has been blocked.
Suspected Infection
Message will be sent when mail is suspected as virus infected mail and is rejected.
Administration
Disclaimer Message
Message will be displayed when Administrator logs on to the Admin Console or CLI. Administrator has to accept the disclaimer to proceed further.
| Device Configuration | 225
SMS Customization
Default SMS Text
Default SMS to be sent to Guest User.
Note: A Clientless User is not required to login.
Notification
System > Administration > Notification
Device allows configuration of Email notifications for certain system-generated events and reports (as specified by administrator). Such Email notifications can be configured to inform administrator about:
• Change in gateway status
• Change in HA (high availability) link status (if HA cluster is configured)
• Change in State of IPSec Tunnel(s)
Configure a Mail Server IP Address, Port, and Email Address for the device to send and receive alert Emails. Below are the screen elements with their description:
Mail Server Settings
Mail Server IPv4 Address/ FQDN - Port
Specify the Mail Server IPv4 Address or FQDN Address and Port number.
Default - 25
Authentication Required
Enable to authenticate user before sending an Email.
Specify user credentials.
Username
Specify the User Name, which uniquely identifies user and will be used for login.
Password
Specify the password.
Connection Security
Select Connection Security mode, to be used for establishing a secured connection between SMTP Client and the
SMTP Server for SMTP Mail Notification.
Available Options:
• None – Select if your SMTP Server does not support TLS (Transport Layer Security) or a secured connection between SMTP Client and the SMTP Server is not required. If selected, a normal TCP connection is established, without any security.
• STARTTLS - SMTP Client establishes a TCP connection with the SMTP Server to learn about the TLS capabilities of the server. If the SMTP Server supports STARTTLS, the connection is upgraded to TLS. If the
SMTP Server does not support STARTTLS, the SMTP Client continues to use the normal TCP connection.
• SSL/TLS - SMTP Client establishes a TLS connection with the SMTP Server. In case the SMTP Server does not support TLS, no connection is made between the SMTP Client and the SMTP Server.
Default – None
Certificate
Select a Certificate, to be used for authentication by SMTP Client and the SMTP Server.
Default - ApplicanceCertificate
Email Settings
| Device Configuration | 226
From Email Address
Specify the Email Address from which the notification is to be mailed.
Send Notifications to Email Address
Specify the Email Address to which the notification is to be mailed.
Email Notification
IPSec Tunnel UP/Down
Enable to receive Email notification if the IPSec VPN tunnel connectivity is lost.
Email alerts are sent to Administrator on the configured Email Address. All the IPSec tunnels follow the single configuration done from this page.
An Email is sent only for Host to Host and Site to Site tunnel connections; if it flaps due to one of the following reasons:
• A peer is found dead (DPD)
• Failed to re-establish connection after Dead Peer Detection (DPD)
• IPSec Security Association (SA) is expired and is required to be re-established.
• IPSec Tunnel comes up without administrator intervention after losing the connectivity.
Email shall contain following basic information:
• IPSec Connection name
• IP Addresses of both participating hosts/network
• Current state of the IPSec Tunnel connection, viz, Up or Down
• Time when IPSec Tunnel was disconnected
• Reason for lost of IPSec Tunnel connection
• Device Model Number
• Firmware version and build number
• Device Key (if registered)
• Device LAN IP Address
• HA configuration – Primary/Auxiliary (if configured)
Note:
• An Email is sent for each subnet pair in case of Site to Site connections, having multiple local/remote networks.
• An Email sent with respect to IPSec Tunnel coming up; do not have any reason mentioned within.
• Description of IPSec Tunnel connection is included in the Email, only if the information for same is provided by the Administrator.
Note: Mail Server configuration changes automatically when changed from the Network Configuration
Wizard and vice versa.
Time
System > Administration > Time
Device current date and time can be set according to the device’s internal clock or synchronized with an NTP server.
Device clock can be tuned to show the right time using global Time servers so that logs show the precise time and device internal activities can also happen at a precise time.
Below are the screen elements and their description for setting the Time and Date for the Device:
Current Time
Displays the current system time.
Time Zone
Select time zone according to the geographical region in which the device is deployed.
| Device Configuration | 227
Use pre-defined NTP Server
Select to use the pre-defined NTP servers – asia.pool.ntp.org & in.pool.ntp.org.
NTP stands for Network Time Protocol, and it is an Internet standard protocol used to synchronize the clocks of device to some time reference.
Use Custom NTP Server
Specify the NTP server IPv4 Address or IPv6 Address or domain name to synchronize time with it. If custom
NTP server is defined, time is synchronized with custom server and not with pre-defined servers.
Devices use NTP Version 3 (RFC 1305). One can configure up to 10 NTP servers. At the time of synchronization, it queries each configured NTP server sequentially. When the query to the first server is not successful, device queries second server and so on until it gets a valid reply from one of the NTP servers configured.
Sync Status
Click Sync Now to synchronize device clock with the NTP Server.
Do Not use NTP Server
Select to configure the date and time for device’s clock.
Date
Specify the date by clicking calendar .
Time
Specify the time in HH:MM:SS format.
SNMP
System > Administration > SNMP
Simple Network Management Protocol (SNMP) is used as the transport protocol for network management.
Network management consists of a station or manager communicating with network elements such as hosts, routers, servers, or printers. The agent is the software on the network element (host, router, and printer) that runs the network management software. In other words, agent is the network element. The agent will store information in a Management Information Base (MIB). Management software will poll the various network elements/agents and get the information stored in them. The manager uses UDP port 161 to send requests to the agent and the agent uses
UDP port 162 to send replies or messages to the manager. The manager can ask for data from the agent or set variable values in the agent. Agents can reply and report events.
SNMP collects information in two ways, if SNMP agent is installed on the devices:
• The SNMP management station/manager will poll the network devices/agents.
• Network devices/agents will send trap/alert to SNMP management station/Manager.
| Device Configuration | 228
SNMP terms
• Trap - An alert that is sent to a management station by agents.
• Agent - A program at devices that can be set to watch for some event and send a trap message to a management station if the event occurs
• SNMP community – An SNMP community is the group that devices and management stations running SNMP belong to. It helps define where information is sent. The community name is used to identify the group. A SNMP device or agent may belong to more than one SNMP community. It will not respond to requests from management stations that do not belong to one of its communities.
Use SNMP to configure agent, community and the SNMPv3 users. Device supports SNMPv1& SNMPv2c protocols.
Agent configuration page is used to configure agent name, agent port and the contact person for the program. The community page is used for adding, managing and deleting the communities for protocols SNMPv1 and SNMPv2c.
Use SNMPv3 user page to add, manage and delete v3 users. Apart from IPv4 Addresses, SNMP now supports IPv6
Addresses also.
Below are the screen elements with their description:
Agent Configuration
Use Agent configuration section to configure SNMP agents. The configuration details include name, description, location, contact person, agent port and manager port.
Below are the screen elements with their description:
Enable SNMP Agent
Select to enable SNMP Agent.
Name
Specify a name to identify the agent.
Description
Specify Agent Description.
Location
Specify the physical location of the device.
Contact Person
Specify the contact information for the person responsible for the maintenance of above specified device.
Agent Port
Specify the port which device should use to send traps.
Default - 161
Manager Port
Remote SNMP Management station/Manager uses this port to connect to the device.
Default - 161
Community
Community is a group of SNMP Managers. SNMP Agent may belong to one or more than one community. Agents do not respond to the requests from management stations that do not belong to its communities.
Each Community can support SNMPv1, SNMPv2c or both. Device sends traps to all the communities. You must specify a trap version for each community.
The section provides list of all the communities added and you can sort the list based on community name. The section also provides the option to
a new community, update the parameters of the existing community, or delete the community.
| Device Configuration | 229
v3 User
SNMP version 3 has the capability of using authentication. Only the authenticated user can request the information.
The section displays the list of all the v3 users. The section also provides the option to
a new v3 user, update the password of the user, or delete the user.
Add a new SNMP Community
You can add SNMP Community from this page.
1. Navigate to System > Administration > SNMP > Communityand click Add.
2. Enter Community details.
Name
Enter the name to identify the community.
Description
Enter the description for community.
IP Address
Specify IP Address (IPv4/IPv6 Address) of the SNMP Manager.
Protocol Version
Select the required SNMP protocol version support.
SNMP v1 and v2c compliant SNMP managers have read-only access to device system information and can receive device traps.
Trap Support
Select the required version for trap support.
Traps will be sent to the SNMP Managers who support the specified versions only.
Figure 189: Add Community
3. Click Save to add SNMP community.
Add a new V3 User
You can add V3 user from this page.
1. Navigate to System > Administration > SNMP > v3 Userand click Add.
2. Enter User details.
Name
Enter a name to identify the v3 user.
| Device Configuration | 230
Password
Provide a password for authentication.
Confirm the password for authentication.
3. Click Save to add v3 User.
Netflow
System > Administration > Netflow
Netflow is a flow technology used for network bandwidth monitoring. Details of the traffic passing through the
Security Policies can be exported as Netflow records to the Netflow Server. Based on the records received by the
Netflow Server, data analyzing tools like Open Source Data Analyzer and PRTG software can generate reports.
The Netflow page displays list of configured netflow servers. The page also provides option to add, update, or delete the server.
Below are the screen elements with their description:
Netflow Configuration
Server Name
Specify a unique name for Netflow server.
Netflow Server IP/Domain
Specify IP Address (IPv4 / IPv6) or domain name of the Netflow Server.
Netflow Server Port
Specify the UDP port number for communication with the Netflow Server. NetFlow records will be sent on the specified port.
Default - 2055
Note:
• Only traffic of Security Policies where "Log Firewall Traffic" is enabled will be sent to the NetFlow
Server.
• You can configure maximum five Netflow Servers.
• Sophos supports NetFlow v5 and all the parameters of v5 can be exported.
Authentication
Authentication Server
On this page you can manage databases and backend servers of external user authentication services. External user authentication allows you to validate user accounts against existing user databases or directory services on other servers of your network.
System > Authentication > Authentication Server or Objects > Assets > Authentication Server
Authentication services currently supported are:
• Novell's eDirectory
• Microsoft's Active Directory
• RADIUS
• TACACS+
• LDAP
The page displays all existing authentication servers. You can add an authentication server, update or delete them.
Following is a description of the table elements:
Name
| Device Configuration | 231
Displays the name of the authentication server.
IP
Displays the IP address of the authentication server.
Port
Displays the Port of the authentication server.
Type
Displays the type of the authentication server.
Domain/Admin
Displays the domain or admin of the authentication server.
Manage
Displays the available managing options for the authentication server:
• Edit: Allows you to edit the authentication server.
• Delete: Allows you to delete the authentication server.
To either add or delete a authentication server, click on the corresponding buttons.
Add an External Server
On this page you can create one or more authentication servers. Follow the links to create them:
Active Directory
Active Directory (AD) is Microsoft's implementation of a directory service and is a central component of Windows
2000/2003 servers. It stores information about a broad range of resources residing on a network, including users, groups, computers, printers, applications, services, and any type of user-defined objects. As such it provides a means of centrally organizing, managing, and controlling access to these resources. The Active Directory authentication method allows you to register Sophos Firewall OS at a Windows domain, thus creating an object for Sophos Firewall
OS on the primary domain controller (DC). Sophos Firewall OS is then able to query user and group information from the domain.
Note: Sophos Firewall OS supports Active Directory 2003 and newer.
on page 232
LDAP
LDAP, an abbreviation for Lightweight Directory Access Protocol, is a networking protocol for querying and modifying directory services based on the X.500 standard. Sophos Firewall OS uses the LDAP protocol to authenticate users for several of its services, allowing or denying access based on attributes or group memberships configured on the LDAP server.
RADIUS
RADIUS, the acronym of Remote Authentication Dial In User Service is a widespread protocol for allowing network devices such as routers to authenticate users against a central database. In addition to user information,
RADIUS can store technical information used by network devices, such as supported protocols, IP addresses, routing information, and so on. This information constitutes a user profile, which is stored in a file or database on the RADIUS server. The RADIUS protocol is very flexible, and servers are available for most operating systems.
The RADIUS implementation on Sophos Firewall OS allows you to configure access rights on the basis of proxies and users. Before you can use RADIUS authentication, you must have a running RADIUS server on the network.
Whereas passwords are encrypted using the RADIUS secret, the username is transmitted in plain text.
| Device Configuration | 232
TACACS+
TACACS+ (the acronym of Terminal Access Controller Access Control System) is a proprietary protocol by Cisco
Systems, Inc. and provides detailed accounting information and administrative control over authentication and authorization processes. Whereas RADIUS combines authentication and authorization in a user profile, TACACS
+ separates these operations. Another difference is that TACACS+ utilizes the TCP protocol (port 49) while
RADIUSClosed uses the UDPClosed protocol.
on page 238
eDirectory
Novell eDirectory is an X.500 compatible directory service for centrally managing access to resources on multiple servers and computers within a given network. eDirectory is a hierarchical, object-oriented database that represents all the assets in an organization in a logical tree. Those assets can include people, servers, workstations, applications, printers, services, groups, and so on.
Add Active Directory Server
Use the Add External Server page to configure Active Directory Server settings.
The Add External Server page allows to configure Active Directory which in turn allows the device to map the users and groups from ADS for the purpose of authentication.
1. Navigate to System > Authentication > Authentication Server or Objects > Assets > Authentication Server and click Add.
2. On the Add External Server page, select Active Directory for Server Type. If a user is required to authenticate using ADS, the device needs to communicate with the ADS server for authentication.
3. Enter Active Directory details.
Server Name
Enter a descriptive name for the Active Directory server.
Server IP/Domain
Enter an IP address or domain for the Active Directory server.
Port
Enter the port of the Active Directory server. By default, this is port 389.
NetBIOS Domain
Enter a NetBIOS domain for the Active Directory server.
ADS Username
Enter a username for the admin user of the Active Directory server.
Password
Enter a password for the admin user of the Active Directory server.
Connection Security
Select the type of security to be implemented on the established connection. It provides a method to login to the external server by sending the username and password in encrypted format instead of clear text. We strongly recommend using the encryption method to protect user credentials.
• Simple: User credentials will be send unencrypted, for example, as clear text.
• SSL: Secure Sockets Layer. This is the most common method used for secured connection. The Port will then change from 389 (LDAPClosed) to 636 (ldaps = LDAP over SSL).
• TLS:
Validate Server Certificate
(not with Simple connection security)
Enable to validate the certificate on the external server.
| Device Configuration | 233
Display Name Attribute
(optional)
Enter the name for the AD server which is displayed as AD username.
Email Address Attribute
(optional)
Enter the alias for the configured email address which is displayed to the user.
Domain Name
Specify the domain name for which the query is to be added.
Search Queries
Click Add to enter the search query. Use the Move Up and Move Down buttons to move the search queries in the list. Use Remove to remove the selected item.
If you do not know search DN, refer to NetBIOS name, FQDN and Search DN.
Figure 190: Add External Server
4. Click Test Connection to check the connectivity between Active Directory server and the Sophos Firewall. It also validates Active Directory server user credentials.
5. Click Save.
The AD server is now available and appears in the Authentication Server list.
Add LDAP Server
This page describes how to add a LDAP server.
1. Navigate to System > Authentication > Authentication Server or Objects > Assets > Authentication
Serverand click Add.
2. Select the server type LDAP Server.
| Device Configuration | 234
3. Enter values for the following settings:
Server Name
Enter a descriptive name for the LDAP server.
Server IP/Domain
Enter an IP address or domain for the LDAP server.
Port
Enter the port of the LDAP server. By default, this is port 389.
Version
Select the version of the LDAP server.
Anonymous Login
Enable to send anonymous requests to the LDAP server. Disable to bind user with the server.
Username
(not with Anonymous Login)
Enter a name for the bind user.
Password
(not with Anonymous Login)
Enter a password for the bind user.
Connection Security
Select the connection security for the LDAP server:
• Simple: User credentials will be send unencrypted, for example, as clear text.
• SSL: Secure Sockets Layer. This is the most common method used for secured connection. The Port will then change from 389 (LDAPClosed) to 636 (ldaps = LDAP over SSL).
• TLS: Transport Layer Security. Same secure connection as SSL but uses the default port.
Validate Server Certificate
(not with Simple Connection Security)
Enable to validate the certificate on the external server.
Client Certificate
Select a client certificate from the list to establish a secured connection. If you do not want a client certificate, select None.
Note: You can manage client certificates under ObjectsIdentityCertificate.
Base DN
Enter the Base DN for the LDAP server. The Base DN is the starting point relative to the root of the
LDAP tree where the users are included who are to be authenticated. Note that the Base DN must be specified by the Fully Distinguished Name (FDN) in LDAP notation, using commas as delimiters (e.g.,
O=Example,OU=RnD).
Get Base DN
Click Get Base DN if you are not aware about the Base DN. The Base DN is automatically retrieved from the directory.
Authentication Attribute
Enter an authentication attribute for searching the LDAP directory. The user authentication attribute contains the actual login name each user is prompted for, for example by remote access services.
Display Name Attribute
Enter the name for the LDAP server which is displayed as LDAP username.
Email Address Attribute
Enter the alias for the configured email address which is displayed to the user.
| Device Configuration | 235
Group Name Attribute
Enter the alias for the configured group name which is displayed to the user.
Expire Date Attribute
Enter the user expire date displayed to the user. The attribute specifies how long a user account is valid.
Figure 191: Add External Server
4. Click Test Connection to check the connectivity between LDAP and the Sophos Firewall OS. It also validates
LDAP user credentials.
5. Click Save.
The LDAP server is now available and appears in the Authentication Server list.
Add RADIUS Server
This page describes how to add a RADIUS server.
1. Navigate to System > Authentication > Authentication Server or Objects > Assets > Authentication Server and click Add.
2. Select the server type RADIUS Server.
3. Enter values for the following settings:
Server Name
Enter a descriptive name for the RADIUS server.
Server IP
Enter an IP address for the RADIUS server.
| Device Configuration | 236
Authentication Port
Enter the authentication port of the RADIUS server. By default, this is port 1812.
Enable Accounting
Enable accounting on RADIUS server.
Sophos Firewall OS sends the following information to the RADIUS server as soon as the user logs in:
• Accounting start request
• User login time
Sophos Firewall OS sends the following information to the RADIUS server the moment the user logs out:
• Accounting stop request
• User logout time
Note: Supported client types: Windows Client, HTTP Client, Linux Client, Android, iOS, iOS
HTTP Client, Android HTTP Client, API Client.
Note: The accounting stop message is not sent to the RADIUS server when Sophos Firewall OS shuts down or reboots.
Accounting Port
(only if Enable Accounting is active)
Enter a RADIUS port number through which the Sophos Firewall OS can communicate with RADIUS.
Shared Secret
Enter the shared secret which is a text string that serves as a password between a RADIUS client and a
RADIUS server.
Group Name Attribute
Enter the alias for the configured group name which is displayed to the user.
Figure 192: Add External Server
4. Click Test Connection to check the connectivity between the RADIUS server and the Sophos Firewall. It also validates RADIUS server user credentials.
5. Click Save.
The RADIUS server is now available and appears in the Authentication Server list.
Add eDirectory Server
This page describes how to add a eDirectory server.
| Device Configuration | 237
1. Navigate to System > Authentication > Authentication Server or Objects > Assets > Authentication
Serverand click Add.
2. Select the server type eDirectory.
3. Enter values for the following settings:
Server Name
Enter a descriptive name for the eDirectory server.
Server IP/Domain
Enter an IP address or domain for the eDirectory server.
Port
Enter the port of the eDirectory server. By default, this is port 389.
Connection Security
Select the connection security for the eDirectory server:
• Simple: User credentials will be send unencrypted, for example, as clear text.
• SSL: Secure Sockets Layer. This is the most common method used for secured connection. The Port will then change from 389 (LDAPClosed) to 636 (ldaps = LDAP over SSL).
• TLS: Transport Layer Security. Same secure connection as SSL but uses the default port.
Validate Server Certificate
(not with Simple)
Enable to validate the certificate on the external server.
Client Certificate
Select a client certificate from the list to establish a secured connection. If you do not want a client certificate, select None.
Note: You can manage client certificates under ObjectsIdentityCertificate.
Base DN
Enter the Base DN for the eDirectory server. The Base DN is the starting point relative to the root of the eDirectory tree where the users are included who are to be authenticated. Note that the Base DN must be specified by the Fully Distinguished Name (FDN) in LDAP notation, using commas as delimiters (e.g.,
O=Example,OU=RnD).
Get Base DN
Click Get Base DN if you are not aware about the Base DN. The Base DN is automatically retrieved from the directory.
| Device Configuration | 238
Figure 193: Add External Server
4. Click Test Connection to check the connectivity between the eDirectory server and the Sophos Firewall. It also validates eDirectory server user credentials.
5. Click Save.
The eDirectory server is now available and appears in the Authentication Server list.
Add TACACS+ Server
This page describes how to add a TACACS+ server.
1. Navigate to System > Authentication > Authentication Server or Objects > Assets > Authentication Server and click Add.
2. Select the server type TACACS+ Server.
3. Enter values for the following settings:
Server Name
Enter a descriptive name for the TACACS+ server.
Server IP
Enter an IP address for the TACACS+ server.
Port
Enter the port of the TACACS+ server. By default, this is port 49.
Shared Secret
Enter the shared secret which is a text string that serves as a password between a TACACS+ client and a
TACACS+ server.
| Device Configuration | 239
Figure 194: Add External Server
4. Click Test Connection to check the connectivity between the TACACS+ server and the Sophos Firewall OS. It also validates TACACS+ server user credentials.
5. Click Save.
The TACACS+ server is now available and appears in the Authentication Server list.
Authentication
This menu allows you to configure Authentication for Firewall, VPN and Admin traffic. You can also configure
Global Settings, NTLM Settings, Web Client Settings, Captive Portal parameters and Radius Client settings for Single
Sign-On Server.
Note: You can also view and manage the authentication status on the System > Diagnostics > Services page.
Once you have deployed the device, default access policy is automatically applied which will allow complete network traffic to pass through the device. This will allow you to monitor user activity in your Network based on default policy.
As device monitors and logs user activity based on IP Address, all the reports are also generated based on IP
Address. To monitor and log user activities based on usernames or logon names, you have to configure the device for integrating user information and authentication process. Integration will identify access request based on usernames and generate reports based on usernames.
When the user attempts to access, the device requests a user name and password and authenticates the user’s credentials before giving access. User level authentication can be performed using the local user database on the device, External ADS server, LDAP, RADIUS or TACACS+ server.
To set up user database
1. Integrate ADS, LDAP, RADIUS or TACACS+ if external authentication is required.
2. Configure for local authentication.
3. Register user
The device provides policy-based filtering that allows defining individual filtering plans for various users of your organization. You can assign individual policies to users, or a single policy to a number of users (Group).
Device detects users as they log on to a Windows domain in your network via client machines. Users are allowed or denied access based on username and password. In order to authenticate a user, you must select at least one database against which device should authenticate users.
To filter the Internet requests based on policies assigned, the device must be able to identify a user making a request.
The administrator can configure authentication based on the type of – Administrator, Firewall, VPN, and SSL VPN with multiple servers.
Below are the screen elements with their description:
Firewall Authentication Methods
| Device Configuration | 240
Authentication Server List
Select Authentication server.
Authentication Server List displays all the configured servers while Selected Authentication Server List displays servers that will be used for authentication when the user tries to login.
In case of multiple servers, authentication request is forwarded as per the order configured in the Selected
Authentication Server List.
Default Group
Select the default group for firewall authentication.
VPN (IPSec/L2TP/PPTP) Authentication Methods
Set Authentication Methods Same As Firewall
Enable to use the same authentication method as configured for firewall traffic. If enabled all the authentication servers configured for the firewall traffic will be available for VPN traffic authentication configuration.
Authentication Server List displays all the configured servers while Selected Authentication Server List displays servers that will be used for authentication when user tries to login.
Override authentication method for VPN traffic by selecting or deselecting any Authentication server.
In case of multiple servers, authentication request will be forwarded as per the order configured in the Selected
Authentication server List.
If RADIUS server authenticates users then PPTP and L2TP connections established using MSCHAPv2 or CHAP protocol can be authenticated through RADIUS.
Administrator Authentication Methods
Administrator can configure and manage authentication settings for all the Administrator Users except for the super administrator from this page.
Set Authentication Methods Same As Firewall
Select to use the same authentication method as configured for firewall traffic. If enabled all the authentication servers configured for the firewall traffic will be available for administrator traffic authentication configuration.
Authentication Server List displays all the configured servers while Selected Authentication Server list displays servers that will be used for authentication when user tries to login.
Override authentication method for administrator traffic by selecting or deselecting any Authentication server.
In case of multiple servers, authentication request will be forwarded as per the order configured in the Selected
Authentication server List.
Global Settings
Maximum Session Timeout
Specify the timeout duration in minutes.
Acceptable Range (minutes) - 3 to 1440
Authentication Session timeout is the time in minutes a user is logged into the device. Exceeding the period, the user will be logged out automatically and the user must re-authenticate. This is applicable to administrative sessions only.
Enable “Unlimited” to allow the users to remain logged in.
Simultaneous Logins
Specify the maximum number of concurrent logins allowed to the user.
Acceptable Range – 1 to 99 concurrent logins
OR
Enable “Unlimited” to allow unlimited concurrent logins to the user.
| Device Configuration | 241
Login restriction is applicable to only those users who are added after this configuration.
CTAS Settings
User Inactivity
Select to enable or disable user inactivity setting.
When users logs in the Device and performs no activity, remaining idle for specific time span, they are considered inactive.
By default, User Inactivity is disabled.
Inactivity Time(Only if User Inactivity is enabled)
Specify the inactivity time in minutes.
The user inactivity timeout is the inactive/idle time in minutes after which the user will be logged out and has to re-authenticate.
Acceptable Range (Minutes) - 3 to 1440
Default - 3 minutes
Data Transfer Threshold(Only if User Inactivity is enabled)
Specify the minimum data to be transferred.
Default - 100 bytes
NTLM Settings
Inactivity Time
Specify the inactivity time in minutes.
User Inactivity timeout is the inactive/idle time in minutes after which user will be logged out and has to reauthenticate.
Acceptable Range (Minutes) - 6 to 1440
Default – 6
Data Transfer Threshold
Specify the minimum data to be transferred.
If the minimum data is not transferred within the specified time, the user will be marked as inactive.
Default – 1024 Bytes
HTTP challenge redirect on Intranet Zone
Select to Enable or Disable the redirection of NTLM HTTP challenge on Intranet Zone.
When any site hosted on the Internet initiates the NTLM web proxy challenge for authentication, the client is transparently authenticated by the browser through device by sending credentials over the Internet.
To secure and to prevent the user credential from going out on the Internet, device will redirect NTLM authentication challenge on Intranet Zone. Client will be transparently authenticated through device's Local
Interface IP and credentials will be exchanged in Intranet zone only.
Default - Enable
Web Client Settings (iOS and Android and API)
Inactivity Time
Specify the inactivity time in minutes.
User Inactivity timeout is the inactive/idle time in minutes after which user will be logged out and has to reauthenticate.
Acceptable Range (Minutes) - 6 to 1440
| Device Configuration | 242
Default – 6 minutes
Data Transfer Threshold
Specify the minimum data to be transferred.
If the minimum data is not transferred within the specified time, the user will be marked as inactive.
Default – 1024 Bytes
SSO using radius accounting request
Device can authenticate users transparently who have already authenticated on an external RADIUS server. Click to add, to delete or Edit hyperlink to edit Radius Client configurations.
Radius Client IPv4
Specify IPv4 Address of Radius Client.
Only request from specified IP Address will be considered for SSO.
Shared Secret
Provide Shared Secret for authentication.
Show Shared Secret
Click Show to view the configured Shared Secret.
Captive Portal Settings
Unauthenticated users redirection
Select "Yes" to redirect the access request of unauthenticated user either to the Captive Portal or Custom Message page.
Select "No" to display "Access Denied" message to unauthorized user.
Unauthenticated users settings
Configure where the unauthenticated user access requests should be redirected.
Available Options:
• Captive Portal
• Custom Message
Select Captive Portal, if an unauthenticated user access request is to be forwarded to captive portal.
HTTPS Redirection
Enable to provide access of the Captive portal page through secure channel.
User Portal Link
Enable/Disable to make the “User Portal” link available on the Captive Portal page.
Default – Enable
URL Redirection after Login
Enable to redirect request to the user requested page or custom page.
URL to redirect
If request is to be redirected to the custom page, click Custom URL and specify URL, else click User
requested URL.
Preserve captive portal after login
Select “Yes” to minimize the captive portal popup, once the user is successfully authenticated.
Selecting “No” lets the Captive Portal to be displayed on system screen after successful authentication.
| Device Configuration | 243
Keep Alive Request For Captive Portal
Keep-Alive request is constantly exchanged between the device and user to check whether user has logged out or idle. If the device does not receive the response, user is logged out automatically.
More number of concurrent HTTP Captive Portal users, more number of keep-alive requests. In case of more concurrent HTTP Captive Portal users we recommend to disable it.
Default – Enable
If disabled, user is logged out after the configured inactivity time. If disabled, specify user inactivity time and data transfer threshold.
User Inactivity Timeout
User Inactivity timeout is the inactive/idle time in minutes after which user will be logged out and has to reauthenticate.
Enable and specify timeout duration in minutes.
Acceptable Range (minutes) - 3 to 1440
Default - Disable
Data Transfer Threshold
Specify threshold value in Bytes for Data Transfer.
If the minimum data is not transferred within the specified time, the user will be marked as inactive.
Select Custom Message, if unauthenticated user is to be displayed custom message.
Windows Corporate Client Download Link
Enable to publish a link to download the Windows Corporate Client in the custom message.
Linux Corporate Client Download Link
Enable to publish a link to download the Linux Corporate Client in the custom message.
MAC Corporate Client Download Link
Enable to publish a link to download the MAC Corporate Client in the custom message.
Page Header Image
Display the default image shipped with the device at the top of the custom message page or use Browse and upload the custom image.
Supported Image format - JPG, PNG or GIF
Size - 700 X 80 pixels
Page Footer Image
Display the default image shipped with the device at the bottom of the custom message page or use Browse and upload the custom image.
Supported Image format - JPG, PNG or GIF
Size - 700 X 80 pixels
Custom Message
Specify message. You can customize the message to include client IP Address, category, and URL.
Blink Custom Message
Enable Blink Custom Message to display blinking message.
| Device Configuration | 244
Preview
Preview and check how message will be displayed before saving the configuration.
SSL VPN Authentication Methods
Enable to use the same authentication method as configured for VPN or Firewall or configure authentication server for SSL VPN.
Authentication Server List displays all the configured servers while Selected Authentication server list displays servers that will be used for authentication when user tries to login.
Override authentication method for SSL VPN traffic by selecting or deselecting any Authentication server.
In case of multiple servers, authentication request will be forwarded as per the order configured in the Selected
Authentication server List.
Groups
The Groups page displays list of all the default and custom groups.
Group is a collection of users having common policies that can be managed as a single unit and a mechanism of assigning various policies to a number of users in one operation/step. Users that belong to a particular group are referred to as a group user.
A group can contain default as well as custom policies.
Various policies that can be grouped are:
• Surfing Quota policy which specifies the duration of surfing time and the period of subscription
• Access Time policy which specifies the time period during which the user will be allowed access
• Web Filter Policy which controls and blocks access to inappropriate web sites
• Application Filter Policy which controlling access to application like IM and P2P, VOIP
• QoS policy which specifies the bandwidth usage limit of the user
• Data Transfer Policy which specifies the data transfer quota of the user
• SSL VPN Policy which determines the access mode and controls access to private network resources.
The page also provides option to add new group, update group parameters, add new members to the existing group, view user group membership, or delete a group.
Creating a New User Group
Use the Add Group page to create a group of policies.
The Add Group page allows you to configure a group of policies. Once the appropriate Group is assigned, the user will automatically inherit all the policies added to the group.
1. Navigate to System > Authentication > Groups or Objects > Identity > Groups and click Add.
2. Enter user group details.
Group Name
Provide a name to identify the group.
Description
Provide group description.
Group Type
Select Group Type.
Available Options:
Normal - User of this group needs to log on using the device client to access the Internet. Clientless -
User of this group does not need to log on using the device client to access the Internet and is symbolically represented as Group name(C). Access control is placed on the IP Address.
| Device Configuration | 245
Figure 195: Add Group details
3. Configure the policies.
Surfing Quota
Select the Surfing Quota Policy from the list.
Note: Unlimited policy is automatically applied to Clientless Group.
Access Time (Not applicable to Clientless Group)
Select the Access Time Policy from the list.
Note: Unlimited policy is automatically applied to Clientless Group.
Network Traffic (Not applicable to Clientless Group)
Select the Network Traffic Policy from the list.
Configured policy will be applicable to all the users who are member of this group.
Traffic Shaping
Select the Traffic Shaping policy from the list.
Configured policy will be applicable to all the users who are member of this group.
Remote Access
Clientless
By default, user will inherit its group policy. To override the group policy, select the policy from the list.
You can also create a new policy directly from this page itself or from System > VPN > SSL VPN page.
If user is not to be provided the SSL VPN access then select "No Policy Applied".
Quarantine Digest
Configure Quarantine Digest.
Quarantine digest is an Email containing a list of quarantined spam messages filtered by the device and held in the user quarantine area. If configured, device will mail the digest on hourly, daily or weekly basis to the user. Digest also provides a link to User Portal from where user can access and take the action on quarantined messages.
Available Options:Enable - User will receive the Quarantine Digest on configured frequency and overrides
Group setting. Disable - User will not receive Quarantine Digest and overrides Group setting.
MAC Binding (Not applicable to Clientless Group)
Enable/disable “MAC Binding”. By binding User to MAC Address, you are mapping user with a group of
MAC Addresses.
L2TP (Not applicable to Clientless Group)
Enable if group users can get access through L2TP connection.
PPTP (Not applicable to Clientless Group)
Enable if group users can get access through PPTP connection.
| Device Configuration | 246
Login Restriction (Not applicable to Clientless Group)
Select the appropriate option to specify the login restriction for the user group.
Available Options: Any Node - Select to allow user to login from any of the nodes in the network.Selected
Nodes - Select to allow user to login from the specified nodes only. Specify IP Address and click Add icon
to add more nodes and remove icon to delete nodes. You can even edit the added IP Address by first clicking on the edit icon and then on the save icon .
Note: Editing and removing IP Address options are only provided for the Groups that have been already added.
Node Range - Select to allow range of IP Address. Specify IP Address range.
Only IPv4 Addresses must be provided for options “Selected Nodes” and “Node Range”.
Figure 196: Add Group Policies
4. Click Save to create the new user group.
Note: User Configuration - MAC binding and policies is given precedence over Group configuration.
Adding Users to the Existing Groups
Use Add Group Member page to add a user to the existing groups.
This page allows you to add group member to the existing groups.
1. Navigate to System > Authentication > Groups or Objects > Identity > Groups.
2.
Select the Group in which you want to add the users by clicking Manage icon in the Manage column.
3. Click Add Member(s) button. A pop-up Add Group Member appears providing list all the users along their details that can be added in the group. To search user filter the list based on Username and/or current group.
| Device Configuration | 247
4. Select the user you want to add in the group. You can select single or multiple users on a single page.
5. Click Apply and click OK to confirm adding member in the group.
Viewing List of Group Members
Use this page to view group members.
This page displays the list of group members.
1. Navigate to System > Authentication > Groups or Objects > Identity > Groups.
2.
Click the Group in which you want to add the users by clicking Manage icon in the Manage column.
3. Click Show Group Member(s) button. A pop-up Group Members appears providing the list all the users with the details who are member of the selected group.
4.
Click Close or Close icon to close the Group Member pop-up.
User
The User page displays the list of all the users added in the device.
Users are identified by an IP Address or a Username and assigned to a user group. All the users in a group inherit the policies defined for that group.
Media Access Control (MAC) Address is a unique identifier (hardware address) assigned to a host by the manufacturer for identification and is intended to be immutable. MAC Addresses are 48 bit values that are expressed in 6 byte hex-notation separated by colon for example 01:23:45:67:89:AB.
To improve the security of your network and provide spoofing protection, you can enable User-MAC Address binding. By binding User to MAC Address, you are mapping user with a group of MAC Addresses. It means a user would be able to login through a group of pre-specified machines only making it more difficult for a hacker using random MAC Addresses or spoofing a MAC Address to gain access to your network.
User types
Device supports five types of Users:
• Normal
• Clientless
• Single Sign on
• Thin Client User
• WWAN User
Normal User has to logon to the device. Requires client (client.exe) on the User machine or user can use HTTP Client component and all the policy-based restriction are applied.
Clientless does not require client component (client.exe) on the User machines.
Users are automatically logged to the device if Single sign on settings are configured.
Use the given decision matrix below to choose which type of the user should be created.
Table 1: Decision matrix for adding a User
Feature Normal User
User Login required
Type of Group
Normal
Clientless
Yes
Yes
No
Apply Login restriction Yes
Apply Surfing Quota policy Yes
Clientless User
No
No
Yes
Yes
No
Single Sign On User
No
Yes
No
Yes
Yes
| Device Configuration | 248
Feature Normal User
Apply Access Time policy Yes
Apply Traffic Shaping policy
Yes
Apply Web Filter Policy
Apply Application Group policy
Yes
Yes
Apply Network Traffic policy
Yes
Clientless User
No
Yes
Yes
Yes
No
Single Sign On User
Yes
Yes
Yes
Yes
Yes
You can filter the list of user's Name, Username, Group, Web and Application Filter policy applied to the user, and date on which users were added.
Note: You can also view and manage live users on the System > Current Activity > Live Users page.(Only
at appliance level)
The page also provides options to:
•
•
•
•
Add users by importing user details from the file
•
•
•
Registering a New User
Use the Add User page to enter a new user and quickly configure a related policy.
The Add User page allows you to manually enter user details and configure related policies for a user on your system.
Once a user is registered successfully, the page provides two more options:
•
- Click to reset the usage accounting i.e. internet usage time and data transfer of the user.
•
- Click to view the Internet usage and data transfer usage.
1. Navigate to System > Authentication > User or Objects > Identity > User and click Add.
2. Enter user details.
Username
Enter Username, which uniquely identifies user and to be used for login.
Name
Enter Name of the user.
Password
Enter password and re-enter same password for confirmation.
Password is case-sensitive.
User Type
Select the type of user from the available options. UserAdministrator
Profile (Only when User Type is Administrator)
Select the administrator profile. Administrator will get access of various Admin Console menus as per the configured profile.
Create a new profile directly from this page or from the profile page.
Specify Email Address of the user.
Use comma to seperate multiple Email Addresses.
Description
Provide user description.
| Device Configuration | 249
Figure 197: Add User details
3. Enter policies details.
Group
Select Group in which the user is to be added. User will inherit all the policies assigned to the group.
Surfing Quota
By default, user will inherit its group policy. To override the group policy, select the policy from the list.
You can also create a new policy directly from this page itself or from Protection > Web Protection >
Surfing Quota or Objects > Policy > Surfing Quota page.
Access Time
By default, user will inherit its group policy. To override the group policy, select the policy from the list.
You can also create a new policy directly from this page iteself or from Objects > Policy > Access Time page.
Network Traffic
By default, user will inherit its group policy. To override the group policy, select the policy from the list.
You can also create a new policy directly from this page itself or from Objects > Policy > Data Transfer page.
Traffic Shaping
By default, user will inherit its group policy. To override the group policy, select the policy from the list.
You can also create a new policy directly from this page itself or from Objects > Policy > Traffic Shaping page.
| Device Configuration | 250
Figure 198: Add User Policies
4. Enter SSL VPN Policy details.
Remote Access
By default, the user will inherit its group policy. To override the group policy, select a policy from the list.
You can also create a new policy directly from this page itself or from System > VPN > SSL VPN (Remote
Access) page.
If user is not to be provided SSL VPN access then select No Policy Applied.
Clientless
By default, the user will inherit its group policy. To override the group policy, select a policy from the list.
You can also create a new policy directly from this page itself or from System > VPN > Clientless Access page.
If user is not to be provided clientless access then select No Policy Applied.
L2TP
By default, user is provided remote access through L2TP. Disable if remote access is not to be provided to the user.
Provide the IP Address (IPv4/IPv6) to be leased to the user for L2TP access.
PPTP
By default, user is provided remote access through PPTP. Disable if remote access is not to be provided to the user.
Provide the IP Address (IPv4/IPv6) to be leased to the user for PPTP access.
Quarantine digest is an Email containing a list of quarantined spam messages filtered by the device and held in the user quarantine area. If configured, device will mail the digest daily to the user. Digest also provides a link to User My Account from where user can access and take the action quarantined messages.
CISCO
™
VPN Client
By default, user is provided remote access through CISCO VPN Client. Disable if remote access is not to be provided to the user.
Provide the IP Address (IPv4/IPv6) to be leased to the user for CISCO VPN access.
Note: To use this feature, CISCO
™
VPN Client needs to be configured from VPN > CISCO
Quarantine Digest
Configure Quarantine Digest.
Quarantine digest is an Email containing list of quarantined spam messages filtered by the device and held in the user quarantine area. If configured, device will mail the digest at the configured frequency to the user.
Digest also provides a link to User Portal from where user can access and take the action on quarantined messages.
| Device Configuration | 251
Available Options:Enable - User will receive the Quarantine Digest daily and overrides Group setting.Disable - User will not receive Quarantine Digest and overrides Group setting.
Simultaneous Logins
Specify number of concurrent logins that will be allowed to user OR Click 'Unlimited' for allowing unlimited
Concurrent logins.
Default - 1
Acceptable Range - 1 to 99
Note: The specified setting will override the global setting specified in the client preferences.
MAC Binding
Enable/disable "MAC Binding". By binding User to MAC Address, you are mapping user with a group MAC
Addresses.
If enabled, specify MAC Addresses for example 01:23:45:67:89:AB.
Once you enable MAC binding, user will be able to login through pre-specified machines only.
Use comma to seperate multiple MAC Addresses. For example 01:23:45:67:89:AB, 01:23:45:67:89:AC.
Login Restrictions
Select the appropriate option to specify the login restriction for the user.
Available Options: Any Node - User will be able to login from any of the nodes in the network. User Group
Node(s) - User will be able to login only from the nodes assigned to her group. Selected Nodes - User will be able to login from the specified nodes only.Node Range - User will be able to login from any of the IP
Address from the configured range.
Note: Only IPv4 Addresses must be provided for options "Selected Nodes" and "Node Range".
Figure 199: Add User SSL VPN Policy
5. Select Advanced settings (Only if User Type is Administrator)
Schedule for Device Access
Schedule the device access.
Administrator will be able to access the device only during the time configured in schedule.
Login Restriction for Device Access
Select the appropriate option to specify the login restriction for the user.
| Device Configuration | 252
Available Options:Any Node - Administrator will be able to login from any of the nodes in the network.Selected Nodes - Administrator will be able to login from the specified nodes only. Node Range -
Administrator will be able to login from any of the IP Address from the configured range.
Reset User Accounting (Displayed only after user is added)
Click to reset the usage accounting i.e. internet usage time and network traffic of the user.
View Usage (Displayed only after user is added)
Click to view the Internet usage and data transfer usage.
Figure 200: Add Administrator Advanced Settings
Note: User configuration is given precendence over Group configuration.
6. Click Save to register a new user.
Reset User Accounting
This option lets you reset the usage accounting i.e. internet usage time and data transfer of the user.
1.
Edit the user account of the user whose data accounting you want to reset by clicking Manage icon in the
Manage column.
2. Click Reset User Accounting and OK button to confirm.
Note: You cannot reset user accounting for the liver user.
View Usage
This option lets you view the Internet usage and data transfer usage.
1.
Edit the User account of the user whose data usage you want to view by clicking Manage icon under the
Manage column.
2. Click View Usage button. A pop-up displays information of policies applied on the user account, upload and download data transferred by the user.
Importing User Information
The Import Users page allows you to add new users by importing user details from the file.
Instead of creating users again in the device, if you already have users detail in a csv file, you can upload csv file.
Click the Import Button to import csv file. Select the complete path for migrating user’s information file.
csv file format and processing:
1. Header (first) row should contain field names. Format of header row:
2. Compulsory field: username
3. Optional fields: password, name, group, email address.
4. Fields can be configured in any order.
5. Subsequent rows should contain values corresponding to the each field in header row.
6. Number of fields in each row should be same as in the header row.
7. Error will be displayed if data is not provided for any field specified in the header.
8. Blank rows will be ignored.
9. If password field is not included in the header row then it will set same as username.
10. If group name is not included in the header row, administrator will be able to configure group at the time of migration.
| Device Configuration | 253
Exporting Users
Click the Export button to export the user details in a csv file. csv file is generated with the following headers: Name,
Username, Enc_password, Email Address, and Group.
Purging Active Directory Users
This page allows you to purge AD Users.
Click Purge AD Users button to synchronize the device’s Active Directory users with external Active Directory server.
Note:
• Purge operation will not interrupt user login/logout and accounting events.
• If HA is configured, user details are deleted from both, the Primary Device as well as Auxiliary Device at the same time.
Change Status
Select a user and click on the Change Status button to change the status of the user. If the current status is 'Active', the status of the user will change to 'Inactive' when clicked on this button and vice-versa.
Clientless Users
The Clientless Users page displays list of all the clientless users.
Clientless Users are the users who can bypass Client login to access the Internet and are managed by the device itself. As clientless users can bypass device login, create clientless users when your network has few Non-windows machines, VOIP boxes, or servers.
You can filter the list based on name or username of the user, IP address, group of the user, web and application filter policy, or created date. The page also provides option to add a single clientless user or multiple users, delete or change status of the user. The administrator can also reset user accounting data or view the usage statistics.
The page also provides options to:
•
•
•
•
•
Changing Policies of the Clientless User
Add a Single Clientless User
Use the Add Clientless User page to add a single clientless user.
The Add Clientless User page allows you to manually enter details to add a single clientless user that can bypass device login.
Once a user is registered successfully, the page provides two more options:
•
- Click to reset the usage accounting i.e. internet usage time and data transfer of the user.
•
- Click to view the Internet usage and data transfer usage.
1. Navigate to System > Authentication > Clientless Users or Objects > Identity > Clientless Usersand click
Add.
2. Enter Clientless Users details.
Username
Enter username, which uniquely identifies user and will be used for login.
IP Address
Specify IP Address(IPv4/IPv6) for the Clientless user.
Group
Select Group in which user is to be added. User will inherit all the polices assigned to the group.
| Device Configuration | 254
Change the policies applied to the user by editing the user details.
Name
Enter name of the user.
Enter Email Address.
Quarantine Digest
Configure Quarantine Digest. Quarantine Digest is an Email and contains a list of quarantined spam messages filtered by the device and held in the user quarantine area. If configured, device will mail the Quarantine
Digest every day to the user. Digest provides a link to User Portal from where user can access quarantined messages and take the required action.
Available Options:Enable - User will receive the Quarantine Digest daily and overrides Group setting.Disable - User will not receive Quarantine Digest and overrides Group setting. Apply Group's
Settings - User will receive Quarantine Digests as per configured for the Group user belongs to.
Description
Specify user description.
Figure 201: Add Clientless User
3. Click Save to add a single clientless user.
Reset User Accounting
This option lets you reset the usage accounting i.e. internet usage time and data transfer of the user.
1.
Edit the user account of the user whose data accounting you want to reset by clicking Manage icon in the
Manage column.
2. Click Reset User Accounting and OK button to confirm.
Note: You cannot reset user accounting for the liver user.
View Usage
This option lets you view the Internet usage and data transfer usage.
1.
Edit the User account of the user whose data usage you want to view by clicking Manage icon under the
Manage column.
2. Click View Usage button. A pop-up displays information of policies applied on the user account, upload and download data transferred by the user.
Add Multiple Clientless Users
Use the Add Multiple Clientless Users page to add multiple clientless users.
The Add page allows you to enter details to add multiple clientless users.
1. Navigate to System > Authentication > Clientless Users or Objects > Identity > Clientless Users and click
Add Range.
2. Enter the required details.
From
Specify Starting IP Address for the range.
To
Specify Ending IP Address for the range.
| Device Configuration | 255
Group
You can change the policies applied to the user by editing the user details. If you change the policies for the user, user specific policies will take precedence over user group policies.
Figure 202: Add Clientless User
3. Click Save to add multiple clientless users.
Changing Policies of the Clientless User
This page lets you change the policies configured of the clientless user.
Change the policies applied to the user by updating the user details. If you change the policies for the user, user specific policies will take precedence over user group policies.
1. Navigate to System > Authentication > Clientless Users or Objects > Identity > Clientless Users.
2.
Select the user for which you want to change the policies by clicking Manage icon in the Manage column.
3. Update the user details.
Username
Name with which user logs in.
Name
Name of the User.
IP Address
IP Address (IPv4/IPv6) from which the user logs in.
Group
Group in which user is added. User will inherit all the policies assigned to the group.
Change the group, if required.
Email Address of the user.
Description
Provide the clientless user description.
Internet Usage Time
Displays total Internet usage time information.
4. Update the policy details.
Traffic Shaping
Traffic Shaping policy applied to the user.
Change the policy, if required.
Policy applied here will take the precedence over the group policy.
Quarantine Digest
Configure Quarantine Digest.
Quarantine Digest is an Email and contains a list of quarantined spam messages filtered by the device and held in the user quarantine area. If configured, device will mail the Quarantine Digest every day to the user.
Digest provides a link to User My Account from where user can access his quarantined messages and take the required action.
Available Options:Enable - User will receive the Quarantine Digest daily and overrides Group setting.
Disable - User will not receive Quarantine Digesst and overrides Group setting.
5. Click Save to update the changes made to the user.
| Device Configuration | 256
Captive Portal
System > Authentication > Captive Portal
Device provides flexibility to customize the Captive portal Login page. This page can include your organization name and logo.
External users, who need to use authentication services, are required to log in over the Captive Portal once before they get access to the User Portal. External users can access the Captive Portal by browsing to https://<Sophos
Device IP Address>:8090. After login, external users have access to the User Portal and are listed on the System >
Authentication > User or Objects > Identity > User page. External users can access the User Portal by browsing to https://<Sophos Device IP Address> or clicking "Click here for User My Account" on the Captive Portal page.
Below are the screen elements with their description:
General Settings
Logo
Click "Custom" to upload the custom logo and specify Image file name to be uploaded else click “Default”.
Use “Browse” to browse and select the complete path.
The image size should not exceed 125 X 70 pixels.
Logo URL
Provide a URL to be redirected to on clicking the Logo.
Default -
http://www.sophos.com
.
Page Title
Provide a title to modify the Page title.
Default - Network Authentication
Login Page Header
Provide the text to be displayed on the Captive Portal login page.
Login Page Footer
Provide message to be displayed in the footer of Captive Portal login page.
Username Caption
Provide label for the textbox to be displayed on the Captive Portal login page.
Default - Username
Password Caption
Provide label for textbox to be displayed on the Captive Portal login page.
Default - Password
Login Button Caption
Provide label for the button to be displayed on the Captive Portal login page.
Default – Login
Logout Button Caption
Provide label for the button to be displayed on the Captive Portal login page.
Default - Logout
User Portal Link Caption
Provide a text to be displayed for User Portal login page link. By clicking the link, user will be directed to the
User Portal login page.
| Device Configuration | 257
Default - Click here for User Portal
Color Scheme
Customize the color scheme of the Captive portal if required. Specify the color code or click the square box to pick the color.
Custom HTML Template
Use Custom HTML Template
Select to fully customize captive portal using custom HTML code.
HTML Text
Provide HTML code to render captive portal according to your requirement. Dynamic contents like banners from external web servers, customizable “Message of the day” box and so on can be integrated in the HTML code.
By default, sample HTML will be displayed.
Note:
It is essential to have one HTML div element in the HTML text. Device’s Login box will be placed in this div element.
Preview Button
Click to view the custom settings before saving the changes.
Reset to Default Button
Click to revert to default settings.
Guest Users Settings
System > Authentication > Guest User Settings or System > System Services > Guest User Settings
Guest Users Settings menu allows you to configure general settings, registration settings and SMS Gateway for Guest
Users.
Users without a pre-existing user account wanting to access Internet using a hotspot, or via a network available at airport, hotels, hostels, etc. are called “Guest Users”. These users, that are otherwise considered unauthenticated and/or denied access, are allowed to make request to connect to the Internet for a limited period by authenticating themselves. On being authenticated, these users are authorized to access Internet as Guest Users. At such locations,
Internet access is secured by configuring access policies to restrict any malicious use of the network.
Sophos allows administrator to pre-configure single or multiple Guest Users using Admin Console. The credentials of
Guest Users configured via Admin Console can be printed and handed over to Guest User. Alternately, Guest Users can register themselves using Guest User Portal. The credentials and Internet access details of Guest Users registered via Guest User Portal can either be sent via SMS or can be printed.
In case of successful authentication Guest User is granted access according to applicable group, or else is redirected to captive portal page.
The page allows configuring general parameters to provide secured Internet access for guest users. Below are the screen elements with their description:
Guest User General Settings
Username Prefix
Enter prefix to be used for Auto-Generation of username for guest users.
Group
Select a group of policies to assign to Guest users.
Alternately, you can also add group of policies.
| Device Configuration | 258
Password Length
Specify the length of the auto-generated password for Guest Users.
Minimum password length - 3 characters
Maximum password length - 60 characters
Default - 8 characters
The password length is a basic security parameter, the value of which affects the strength of password against brute force attack.
Password Complexity
Select a type of password from the available options to be used for complexity of an auto-generated password:
Available Options:
• Numeric Password - Password will include only numeric characters.
• Alphabetic Password - Password will include only alphabetic characters.
• Alphanumeric Password - Password will include numeric as well as alphabetic characters.
• Alphanumeric with Special Character Password - Password will include numeric, alphabets and special characters.
The password strength is a function of its length, complexity, and unpredictability. Combining password length with password complexity makes a password difficult to guess.
Disclaimer
Provide the disclaimer message to be printed below every user’s login credentials.
Disclaimer once configured can be edited but cannot be removed.
Auto Purge on Expiry
Check to enable automatic purging of user details on expiry of user validity.
Note: Details of a user who is bound to rules (like firewall, IM, etc.) will not be purged automatically.
Guest User Registration Settings
Enable Guest Users Registration
Enable to allow secured Internet access to guest users.
SMS Gateway
Select the Gateway using which the SMS should be sent.
Alternately you may add the SMS gateway from this page itself by clicking Create New link.
Guest Username
Select the method of generating Username using the following option:
• Use Cell Number as Username
If Guest Username checkbox option is not selected, by default, the new user name will be generated with the value specified in Username Prefix.
User Validity (Duration in Days)
Specify guest user validity in days.
Default Country Code
Enable to configure a default country code on the Guest User Registration page.
Selected country is displayed as default option in Cell Number selection at Guest User registration page.
| Device Configuration | 259
CAPTCHA Verification
Select to Enable or Disable CAPTCHA (Completely Automated Public Turing Test To Tell Computers and
Humans Apart) code verification on Guest User Registration page to ensure the request is received for human being.
By enabling CAPTCHA Verification, the user will be displayed a picture with characters that user must insert in a provided textbox below picture. The administrator can therefore protect device against attacks generated by automated programs.
Default - Enable
SMS Gateway
An SMS Gateway allows sending and receiving Short Message Service (SMS) to/from a home network for Guest
User registration. The device supports HTTP and HTTPS protocol based SMS service.
This section displays list of all the configured SMS Gateways and provides option to
, delete and edit the SMS gateway configuration.
Configure SMS Gateway
You can configure SMS Gateway for Guest User registration from this page.
1. Navigate to System > System Services > Guest User Settings and click Add under SMS Gateway section.
2. Enter SMS Gateway details.
Name
Enter a name of the SMS Gateway.
URL
Specify URL of the SMS Gateway for sending SMS request.
HTTP Method
Select the method for sending SMS request to SMS Gateways from the options available:
Available Options:
Get: Requests data from a specified resource.Post: Submits data to be processed to a specified resource.
Cell Number Format
Select to use country code with cell number.
Number Prefix
Specify the prefix value to be used with the cell number.
Number Prefix can include alpha-numeric and ASCII special characters.
It can be up to 4 characters long.
Request Parameters
Specify the following request parameters to configure the SMS Gateway.
Name
Name is a descriptor used to describe the meaning of the value. E.g. username, password, mobile
Value
Value of variables that are defined against name.
| Device Configuration | 260
Response Format
Response describes delivery status of the message such as success, failed, limit exceeded. Status message can be in various formats. Few of them are described below:
For Example
Response Format
{0} | {1} | {2}
Response Received
success | mbno | msgid/transactionid
Response Format
<status>500</status><transactionid>{0}</transactionid><reason>{1}</reason>
Response Received
<status>500</status><transactionid>2323</transactionid><reason>Limit Exceeded</reason>
When the response format is different for success and failure, it is recommended that the response format string should have a single content holder. E.g. {0}
Response Parameters
Response Parameter is the value presented by content holder {0,1, 2...n} that will be displayed in log viewer.
Parameter Index: Parameter Index is the content holder value {0,1, 2...n}.
Name: Name represents the content holder in the Log Viewer.
For Example 1:
Parameter Index
0
1
2
Name
Status
Recipient
SMSID
For Example 2:
Parameter Index
0
1
| Device Configuration | 261
Name
SMSID - 2323
SMS Status Message – Length Exceeded
Figure 203: Add SMS Gateway
3. Click Save to add SMS Gateway.
Testing Connectivity with SMS Gateway
Once you configure SMS Gateway, check whether you are able to connect with the gateway or not from this page.
1. Navigate to System > System Services > Guest User Settings > SMS Gateway and click Test Connection.
2. Enter Cell Phone Number details.
Cell Phone Number
Provide cell phone number.
You will receive SMS through the gateway configured if you are able to connect to the gateway.
Hotspots
On this page you can enable the Hotspots feature and define users who are allowed to view and distribute hotspot access information.
Protection > Wireless Protection > Hotspots or System > Authentication > Hotspots
The Hotspot feature allows cafés, hotels, companies, etc. to provide time- and traffic-restricted Internet access to guests. The feature is available within the wireless subscription, but also works with wired networks.
| Device Configuration | 262
Note: You can also view and manage the hotspot status on the System > Diagnostics > Services page.
Hotspot Generation
In a first step, the administrator creates and enables a hotspot with a specific type of access. The following types are available:
• Terms of use acceptance: The guest is presented a terms of use, which you can define, and has to select a checkbox to get access.
• Password of the day: The guest has to enter a password to get access. The password changes on a daily basis.
• Voucher: The guest gets a voucher and has to enter the voucher code to get access. The voucher can be limited in the number of devices, in time, and traffic.
Distribution of Access Information to Guests
With the types Password of the day and Voucher, the access information has to be handed out to the guests.
Therefore you can define users who are allowed to manage and distribute access information. Those users receive and distribute the access information via the Hotspot tab of the User Portal:
• Password of the day: The current password can be sent via email and the users find the password in the User
Portal. The users forward the password to the guests. They can generate or enter a new password. Hereby, the former password automatically becomes invalid and active sessions will be terminated. Potential other users will be informed of the new password, either by email or via the User Portal, depending on what is configured for them.
• Voucher: In the User Portal, users have the possibility to create vouchers, each with a unique code. Different types of vouchers can be available if specified by the administrator. The vouchers can be printed or exported and given to the guests. A list of created vouchers gives an overview about their usage and helps to manage them.
Legal Information
In many countries, operating a public wireless LAN is subject to specific national laws, restricting access to websites of legally questionable content (e.g., file sharing sites, extremist websites, etc.). To meet this requirement, you can combine the hotspot with the web protection capabilities of the Sophos Firewall OS, which allow you to control web access by blocking and allowing everything from an entire website category type to a single URL. The Sophos
Firewall OS gives you complete control over what is allowed to be accessed, by whom, and when. That way you can put the hotspot under heavy restrictions, if national or corporate policies require you to do so. Using the current feature of Sophos Firewall OS also gives you advanced logging and reporting capabilities. The reporting will show who visited what site, when, and how many times, allowing you to identify inappropriate usage in case you want to operate a hotspot without any access restrictions. In addition to that, legal regulations may require you to register your hotspot at the national's regulatory body.
The page displays all existing hotspots. You can add new hotspot, update or delete them. Following is a description of the table elements:
Name
Displays the name of the hotspot.
Hotspot Type
Displays the type of the hotspot.
Manage
Displays the available managing options for the hotspot:
• Edit: Allows you to edit the hotspot.
• Delete: Allows you to delete the hotspot.
To either add or delete a hotspot, click on the corresponding buttons.
| Device Configuration | 263
Add Hotspot
This page describes how to add a hotspot.
Note: A hotspot has to be assigned to an existing interface, typically a WLAN interface. All hosts using this interface will automatically be restricted by the hotspot. Therefore, before you create a hotspot you would typically create a wireless network with client traffic Separate Zone, then create an interface for the respective WLAN interface hardware. For more information see Protection > Wireless Protection >
Wireless Networks or System > Network > Wireless Networks.
1. Navigate to Protection > Wireless Protection > Hotspots or System > Authentication > Hotspots and click
Add.
2. Make the following settings:
Name
Enter a descriptive name for hotspot.
Description (optional)
Enter a description or other information.
Interfaces
Select or add the interfaces which are to be restricted by the hotspot. An interface can only be used by one hotspot.
Note: Hotspots will work only on LAN and DMZ member interfaces of the bridge. You should not select an uplink interface here because traffic to the Internet will completely be blocked afterwards.
Additionally, we strongly advise against using interfaces used by servers which provide essential services like authentication. You may irreversibly lock yourself out of Sophos Firewall OS!
Users
Select or add users for administrative settings. Administrative users are allowed to create vouchers or change the password of the day in the User Portal. By default nobody is allowed to make administrative settings.
Application Filter Policy (optional)
Select or add an application filter policy for the hotspot.
Web Filter Policy (optional)
Select or add a web filter policy for the hotspot.
IPS Policies (optional)
Select or add IPS policies for the hotspot.
Traffic Shaping Policy (optional)
Select or add a traffic shaping policy for the hotspot.
Redirect to HTTPS (optional)
Enable to redirect users to HTTPS.
Hostname Type
Select the hostname type for the hotspot.
• None (IP Address)
• Custom hostname
Hostname
(if Custom hostname is selected)
Add a hostname for the redirect.
Hotspot Type
Select a hotspot type for the selected interfaces.
• Terms of Use Acceptance Customers can access the Internet after accepting the terms of use.
| Device Configuration | 264
Session Expires
Select the time span after which the access will expire. After that, with the hotspot type Terms of Use
Acceptance, the users have to accept the terms of use again to log in. With the hotspot type Backend
Authentication, the users have to authenticate again.
Terms of Use
Add the text to be displayed as terms of use. Simple HTML markup and hyperlinks are allowed.
• Password of the Day A new password will be created automatically once a day. This password will be available in the User Portal on the Hotspots tab which is available to all users specified for this hotspot.
Additionally it will be sent to the specified email address(es).
Password Creation Time
The assigned time of the day at which the new password will be created. At this time the former password will immediately get invalid and current sessions will be cut off.
Send Password by Email to (optional)
Add email addresses to which the password shall be sent.
Synchronize Password with PSK of Wireless Networks (optional)
Select this option to synchronize the new generated/saved password with wireless PSK.
Note: With the new PSK all APs that are configured with a separate zone wireless network that is also used as a hotspot interface will be reconfigured and restarted. This means all connections will be dropped.
• Voucher With this hotspot type, in the User Portal tokens with different limitations and properties can be generated, printed and given to customers. After entering the code, the customers can then directly access the Internet.
Voucher Definitions
Add or select the voucher definitions you want to use for the hotspot. How to add a voucher definition is explained on the Voucher Definitions page.
Devices per Voucher
Enter the number of devices which are allowed to log in with one voucher during its lifetime. It is not recommended to use the unlimited entry.
Terms of Use
(not with hotspot type Terms of Use Acceptance:
Add the text to be displayed as terms of use. Simple HTML markup and hyperlinks are allowed.
Users Have to Accept Terms of Use
(not with hotspot type Terms of Use Acceptance):
Enable this option if you want the hotspot users to accept your terms of use before accessing the Internet.
Redirect to URL After Login
Enable, so that users will be redirected automatically to a particular URL after entering password or voucher data.URLs for example could be your hotel's website or a webpage stating your portal system policies.
URL
Enter URL to which the user will be redirected to.
| Device Configuration | 265
Figure 204: Add Hotspot
3. Optionally, customize the hotspot.
Enable Customization
Enable to use a customized HTML file with your own images and stylesheets. Additionally, you can customize the voucher layout.
Customization Type
Select the customization type.
| Device Configuration | 266
• Basic Uses the default login page template. If required, change logo, title, and text.
Logo
Upload a logo for the login page. Supported image file types are jpg, jpeg, png and gif. A maximum image width of 300 px and height of 100 px is recommended (depending on the title length).
Scale Logo to Recommended Size
If selected, a logo exceeding the recommended width or height will be scaled down and displayed in the recommended size. If not selected, the logo will be displayed in the original size.
Title
Add a title for the login page. Simple HTML markup and hyperlinks are allowed.
Custom Text
Add an additional text for the login page. You can for example enter the SSID of the wireless network to be used. Simple HTML markup and hyperlinks are allowed.
• Full Select an individual login HTML page.
Login Page Template
Select the HTML template you want to use for your individual login page. Clicking Browse... opens a window where you can select and upload the file. In this template, you can use variables that can dynamically insert information for each hotspot. For example, you can add the company name and administrator information, the terms of use and the login form. See detailed information in chapter
Login Page Template.
Images/Stylesheet
Add files that are referenced in your login page template, e.g., images, stylesheets, or JavaScript files.
Clicking Browse... opens a window where you can select and upload the files.
Voucher Template
(only with hotspot type Voucher): Clicking Browse...opens a dialog where you can select and upload a PDF file with the voucher layout. By default, a default template is used. The voucher PDF file has to be of PDF version PDF 1.5 or lower. It may have any page size and format—both size and format will be adjusted during voucher creation in the User Portal, depending on page size and number of vouchers per page specified there.
The PDF file may contain the following variables that will be replaced with the respective values during voucher generation in the User Portal:
• Wireless network name (SSID): <?ssid0?> (and <?ssid1?>, <?ssid2?> and so on, if the WLAN has more than one SSIDs)
• Wireless network password: <?psk0?> (and <?psk1?>, <?psk2?> and so on, if the WLAN has more than one SSIDs)
• Voucher code: <?code?>
• Voucher validity time:
<?validity?>
• Voucher data limit: <?datalimit?>
• Voucher time limit: <?timelimit?>
• Comment: <?comment?>
• QR code with the hotspot access data encoded:
<?qrX?>. The upper left corner of the QR code will be placed on the lower left corner of the variable.
Note: When using variables, the PDF file must include the entire character sets of the fonts used. When a variable is replaced by its value, and one of the substitute characters is not available, it will be displayed incorrectly. We recommend to add the string
<?
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789?> (for
English usage) to your PDF file, which will automatically be removed during voucher generation.
| Device Configuration | 267
Figure 205: Hotspot Customization
4. Click Save to save your settings.
The hotspot is now available and appears in the hotspot list.
You can see if the hotspot is running on the System > Diagnostics > Services page. There you can also stop or start the hotspot.
Login Page Template
This page gives an overview of possible variables of the hotspot login template.
The HTML template for the login page may contain various variables that can dynamically insert information for the hotspot login page. When the UTM processes a template in order to display a login page, it replaces any template variables with the relevant value. Valid variables are:
General variables
•
<?company_text?>: Default company text
• <?company_logo?>: Default company logo (Sophos logo). The variable will be replaced by the path of the logo file, usage e.g., <img src="<?company_logo?>">
• <?admin_contact?>: Administrator name or address as defined on System > Administration > Notification
(Send Notifications to Email Address field)
• <?admin_message?>: Administrator information label (default: For administrative questions please contact:)
•
<?error?>: Error message that arose while trying to log in.
Variables used for all hotspot types
• <?terms?>: Terms of use (as defined on Add Hotspot page)
• <?redirect_host?>: Redirect URL that is specified for the hotspot (as defined on the Add Hotspot page)
•
<?location?>: URL the user requested
• <?location_host?>: Hostname of the URL the user requested
• <?login_form?>: Login form suitable for the respective hotspot type: Password text box, Token text box,
Username and Password text boxes, or Accept checkbox, and Login button.
Note: For creating customized login forms, see User Specific Login Form below.
• <?asset_path?> (only important for customization mode Full): Hotspot specific directory for storage of images or stylesheets (example usage: <img src="<?asset_path?>/logo.png">)
| Device Configuration | 268
Variables only used for voucher type hotspots
•
<?maclimit?> Number of allowed devices per voucher of this hotspot (as defined on the Add Hotspot page)
• <?numdevices?>: Number of devices used for this voucher
• <?timeend?>: Validity period (as defined on the Add/Edit Voucher Definition page)
• <?time_total?>: Total time quota allowed (as defined on the Add/Edit Voucher Definition page)
•
<?traffic_total?>: Total data volume allowed (as defined on the Add/Edit Voucher Definition page)
Templates can contain if variables that make up sections like the ones shown below. Each section has an opening and a closing variable. The contents of an if section is only displayed on a specific condition.
If Section Meaning
Section is displayed when the user has successfully logged in.
<?if_loggedin?>
<?if_loggedin_end?
>
<?if_notloggedin?>
<?
if_notloggedin_end?
>
Section is displayed when the user has not yet logged in, e.g., because terms of use have to be accepted or because an error occurred.
<?
if_authtype_password?
Section is displayed when hotspot type is Password of the Day.
>
<?
if_authtype_password_end?
>
<?
if_authtype_disclaimer?
Section is displayed when hotspot type is Terms of Use Acceptance.
>
<?
if_authtype_disclaimer_end?
>
<?
if_authtype_token?>
<?
if_authtype_token_end?
>
Section is displayed when hotspot type is Voucher.
<?if_location?>
<?if_location_end?>
Section is displayed when the user has been redirected.
Section is displayed when the checkbox Redirect to URL After Login is enabled.
<?if_redirect_url?>
<?
if_redirect_url_end?
>
Section is displayed when the checkbox Redirect to URL After Login is disabled.
<?
if_not_redirect_url?
>
| Device Configuration | 269
If Section Meaning
<?
if_not_redirect_url_end?
>
Section is displayed when a validity period is set for a voucher.
<?if_timelimit?>
<?if_timelimit_end?
>
<?if_trafficlimit?>
<?
if_trafficlimit_end?>
Section is displayed when a data volume is set for a voucher.
<?if_timequota?>
<?if_timequota_end?
>
Section is displayed when a time quota is set for a voucher.
Section is displayed when a Devices per Voucher value is specified.
<?if_maclimit?>
<?if_maclimit_end?
>
<?if_terms?>
<?if_terms_end?>
Section is displayed when Terms of Use are defined and enabled.
<?if_error?>
<?if_error_end?>
Section is displayed when an error occurred while trying to log in.
User-Specific Login Form
If you want to create your own login form instead of using the pre-defined
<?login_form?> variable, consider the following:
• Enclose the form in the following tags:
<form action="?action=login" method="POST"> ... </form>
• For a Terms of Use Acceptance hotspot, add a checkbox named "accept":
<input type="checkbox" name="accept">
• For Password of the Day or Voucher hotspots, add a text box named "token":
<input type="text" name="token">
• Add a means to submit the form, e.g., a Login button:
<input type="submit" name="login" value="Login">
Hotspot Settings
On this page you can make additional hotspot settings.
General Voucher Options
Here you can decide if and after which time interval you want to delete expired vouchers from the database. In the hotspot log you will still find information about deleted vouchers.
| Device Configuration | 270
Login Page Certificate
To ensure login over HTTPS you can select certificates for the page login. You can generate and upload new certificates with on the Protection > Web Server Protection > Certificate or System > VPN > Certificate or
Objects > Identity > Certificate page. Select the requested certificate from the drop-down list and click Apply to activate it.
Walled Garden
Add or select specific hosts or networks to be always accessible by all users, without entering a password or a voucher code. Hosts can be added on the Objects > Hosts and Services > IP Hosts page, networks can be added via the System > Network menu.
Clear Walled Garden Configuration
Click Clear Walled Garden Configuration to clear the configuration settings.
System Services
System Services allows configuration of device components along with the associated services.
Available Configurations:
• Security Heartbeat - Allows to configure Heartbeat settings.
• Web Proxy- Web proxy is the engine used to enforce web protection policies.
• Authentication Services - Authentication allows to configure profile attributes for Firewall, VPN and
Administration servers. You can also configure NTLM settings, Captive Portal parameters, Web Client settings,
Radius Client settings for Single Sign-On Server, global settings like Session Timeout and Simultaneous Logins.
• Guest User Settings- Guest User Settings allows configuring general parameters to provide secured internet access for guest user.
• DoS - Configure general settings for DoS protection.
• Web Content Filter - Allows to configure and manage web filtering through the device, includes scanning and restricting all the HTTP/HTTPS/FTP traffic.
• Traffic Shaping Settings - QoS traffic shaping allows network bandwidth to be limited or guaranteed.
• RED - Sophos RED allows seamless, encrypted, and tightly integrated connections between branch locations.
• Wireless - Allows to configure your firewall to act as a wireless controller for Sophos access points.
• Advanced Threat Protection - Allows to enable and configure ATP features to secure ingress and egress traffic.
• Malware Protection - Allows to configure Dual Anti Virus Scanning.
• Log Settings - Provides extensive logging capabilities for traffic, system and network protection functions.
Security Heartbeat
Heartbeat connects cryptographically secure endpoint and Sophos Firewall OS via Sophos Cloud. This allows to exchange information between endpoint devices and Sophos Firewall OS. These information give a comprehensive overview of the network security. The administrator is able to define policies for network access based on the health status of the endpoint.
Endpoint devices and users need to authenticate via Sophos Cloud to connect to Sophos Firewall OS. The authentication works via a client which is available on Sophos Cloud and must be installed on the endpoint device.
After the installation the endpoint uses the Sophos Endpoint Security and Control which is an integrated suite of security software, for example, antivirus, behavior monitoring and live protection. Sophos Endpoint Security and
Control ensures that the endpoint device belongs to the system and has the permission to access the network.
Note: For more information and documentation about Sophos Endpoint Security and Control visit the
SOPHOS Website
.
The endpoint sends a heartbeat signal in regular intervals to the Sophos Firewall OS to show that it is alive.
Furthermore the endpoint also informs the Sophos Firewall OS about potential threats. If Sophos Endpoint Security
and Control detects any threats, the endpoint sends this information to Sophos Firewall OS which declares the
| Device Configuration | 271 endpoints health status. According to the user policy, which defines the permission of the different colors, the endpoint is not able to connect to networks, zones or services.
Note: You can enable Security Heartbeat and set the Minimum Heartbeat Permitted in the User
Application Policy which is managed on the Policies > Policies page in the Security Heartbeat section.
Note: Please find a description of the enpoints health status colors on the Health Status page.
To use security heartbeat you need to register with your Sophos Cloud account. If you do not have an account you can create a new one. You can find more information about Sophos Cloud under:
https://secure2.sophos.com/en-us/ products/cloud.aspx
.
Heartbeat Configuration
This page describes how to login with your Sophos Cloud account and enable Security Heartbeat.
1. Navigate to System > System Services > Security Heartbeat.
2. Enter Sophos Cloud login details in the Registration section.
Email Address
Enter the email address of your Sophos Cloud account.
Password
Enter the password of your Sophos Cloud account.
Figure 206: Registration
3. Click Register to register your Sophos Cloud account to the Sophos Firewall OS.
4. Enable Security Heartbeat and click Apply.
Figure 207: Security HeartBeat
The devices for which the Security Heartbeat is enabled is listed in the Devices enabled for Security Heartbeat.
To clear your registration from Sophos Firewall OS, click Clear Registration.
Web Proxy
Protection > Web Protection > Web Proxy or System > System Services > Web Proxy
The device can also act as a Web Proxy Server. To use your device as a Web Proxy Server, configure the device’s
LAN IP Address as a proxy server IP Address in the browser setting and enable access to Web Proxy services from
Device Access section.
Note: You can also view and manage the Web Proxy status on the System > Diagnostics > Services page.
Below are the screen elements with their description:
Web Proxy Port(Applicable only when the device is configured as Web Proxy)
Specify Port number, which is to be used for Web Proxy.
Default - 3128
| Device Configuration | 272
Trusted Ports
Device allows the access to those sites which are hosted on standard port, only if deployed as Web Proxy. To allow access to the sites hosted on the non-standard ports, you have to define non-standard ports as trusted ports.
Click icon to add the HTTP trusted ports, Cancel icon to delete the trusted ports and Click icon to modify the trusted ports.
Click Apply to configure Web Proxy settings.
Note:
• Web Proxy enforces Web and Application Filter policy and Malware Scanning Rules as configured in
Security Policies.
• IPS policy is applicable on the traffic between proxy and WAN, but not between user and proxy.
• Traffic Shaping policy is not applicable on the direct proxy traffic.
Authentication
This menu allows you to configure Authentication for Firewall, VPN and Admin traffic. You can also configure
Global Settings, NTLM Settings, Web Client Settings, Captive Portal parameters and Radius Client settings for Single
Sign-On Server.
Note: You can also view and manage the authentication status on the System > Diagnostics > Services page.
Once you have deployed the device, default access policy is automatically applied which will allow complete network traffic to pass through the device. This will allow you to monitor user activity in your Network based on default policy.
As device monitors and logs user activity based on IP Address, all the reports are also generated based on IP
Address. To monitor and log user activities based on usernames or logon names, you have to configure the device for integrating user information and authentication process. Integration will identify access request based on usernames and generate reports based on usernames.
When the user attempts to access, the device requests a user name and password and authenticates the user’s credentials before giving access. User level authentication can be performed using the local user database on the device, External ADS server, LDAP, RADIUS or TACACS+ server.
To set up user database
1. Integrate ADS, LDAP, RADIUS or TACACS+ if external authentication is required.
2. Configure for local authentication.
3. Register user
The device provides policy-based filtering that allows defining individual filtering plans for various users of your organization. You can assign individual policies to users, or a single policy to a number of users (Group).
Device detects users as they log on to a Windows domain in your network via client machines. Users are allowed or denied access based on username and password. In order to authenticate a user, you must select at least one database against which device should authenticate users.
To filter the Internet requests based on policies assigned, the device must be able to identify a user making a request.
The administrator can configure authentication based on the type of – Administrator, Firewall, VPN, and SSL VPN with multiple servers.
Below are the screen elements with their description:
Firewall Authentication Methods
Authentication Server List
Select Authentication server.
| Device Configuration | 273
Authentication Server List displays all the configured servers while Selected Authentication Server List displays servers that will be used for authentication when the user tries to login.
In case of multiple servers, authentication request is forwarded as per the order configured in the Selected
Authentication Server List.
Default Group
Select the default group for firewall authentication.
VPN (IPSec/L2TP/PPTP) Authentication Methods
Set Authentication Methods Same As Firewall
Enable to use the same authentication method as configured for firewall traffic. If enabled all the authentication servers configured for the firewall traffic will be available for VPN traffic authentication configuration.
Authentication Server List displays all the configured servers while Selected Authentication Server List displays servers that will be used for authentication when user tries to login.
Override authentication method for VPN traffic by selecting or deselecting any Authentication server.
In case of multiple servers, authentication request will be forwarded as per the order configured in the Selected
Authentication server List.
If RADIUS server authenticates users then PPTP and L2TP connections established using MSCHAPv2 or CHAP protocol can be authenticated through RADIUS.
Administrator Authentication Methods
Administrator can configure and manage authentication settings for all the Administrator Users except for the super administrator from this page.
Set Authentication Methods Same As Firewall
Select to use the same authentication method as configured for firewall traffic. If enabled all the authentication servers configured for the firewall traffic will be available for administrator traffic authentication configuration.
Authentication Server List displays all the configured servers while Selected Authentication Server list displays servers that will be used for authentication when user tries to login.
Override authentication method for administrator traffic by selecting or deselecting any Authentication server.
In case of multiple servers, authentication request will be forwarded as per the order configured in the Selected
Authentication server List.
Global Settings
Maximum Session Timeout
Specify the timeout duration in minutes.
Acceptable Range (minutes) - 3 to 1440
Authentication Session timeout is the time in minutes a user is logged into the device. Exceeding the period, the user will be logged out automatically and the user must re-authenticate. This is applicable to administrative sessions only.
Enable “Unlimited” to allow the users to remain logged in.
Simultaneous Logins
Specify the maximum number of concurrent logins allowed to the user.
Acceptable Range – 1 to 99 concurrent logins
OR
Enable “Unlimited” to allow unlimited concurrent logins to the user.
Login restriction is applicable to only those users who are added after this configuration.
CTAS Settings
| Device Configuration | 274
User Inactivity
Select to enable or disable user inactivity setting.
When users logs in the Device and performs no activity, remaining idle for specific time span, they are considered inactive.
By default, User Inactivity is disabled.
Inactivity Time(Only if User Inactivity is enabled)
Specify the inactivity time in minutes.
The user inactivity timeout is the inactive/idle time in minutes after which the user will be logged out and has to re-authenticate.
Acceptable Range (Minutes) - 3 to 1440
Default - 3 minutes
Data Transfer Threshold(Only if User Inactivity is enabled)
Specify the minimum data to be transferred.
Default - 100 bytes
NTLM Settings
Inactivity Time
Specify the inactivity time in minutes.
User Inactivity timeout is the inactive/idle time in minutes after which user will be logged out and has to reauthenticate.
Acceptable Range (Minutes) - 6 to 1440
Default – 6
Data Transfer Threshold
Specify the minimum data to be transferred.
If the minimum data is not transferred within the specified time, the user will be marked as inactive.
Default – 1024 Bytes
HTTP challenge redirect on Intranet Zone
Select to Enable or Disable the redirection of NTLM HTTP challenge on Intranet Zone.
When any site hosted on the Internet initiates the NTLM web proxy challenge for authentication, the client is transparently authenticated by the browser through device by sending credentials over the Internet.
To secure and to prevent the user credential from going out on the Internet, device will redirect NTLM authentication challenge on Intranet Zone. Client will be transparently authenticated through device's Local
Interface IP and credentials will be exchanged in Intranet zone only.
Default - Enable
Web Client Settings (iOS and Android and API)
Inactivity Time
Specify the inactivity time in minutes.
User Inactivity timeout is the inactive/idle time in minutes after which user will be logged out and has to reauthenticate.
Acceptable Range (Minutes) - 6 to 1440
Default – 6 minutes
| Device Configuration | 275
Data Transfer Threshold
Specify the minimum data to be transferred.
If the minimum data is not transferred within the specified time, the user will be marked as inactive.
Default – 1024 Bytes
SSO using radius accounting request
Device can authenticate users transparently who have already authenticated on an external RADIUS server. Click to add, to delete or Edit hyperlink to edit Radius Client configurations.
Radius Client IPv4
Specify IPv4 Address of Radius Client.
Only request from specified IP Address will be considered for SSO.
Shared Secret
Provide Shared Secret for authentication.
Show Shared Secret
Click Show to view the configured Shared Secret.
Captive Portal Settings
Unauthenticated users redirection
Select "Yes" to redirect the access request of unauthenticated user either to the Captive Portal or Custom Message page.
Select "No" to display "Access Denied" message to unauthorized user.
Unauthenticated users settings
Configure where the unauthenticated user access requests should be redirected.
Available Options:
• Captive Portal
• Custom Message
Select Captive Portal, if an unauthenticated user access request is to be forwarded to captive portal.
HTTPS Redirection
Enable to provide access of the Captive portal page through secure channel.
User Portal Link
Enable/Disable to make the “User Portal” link available on the Captive Portal page.
Default – Enable
URL Redirection after Login
Enable to redirect request to the user requested page or custom page.
URL to redirect
If request is to be redirected to the custom page, click Custom URL and specify URL, else click User
requested URL.
Preserve captive portal after login
Select “Yes” to minimize the captive portal popup, once the user is successfully authenticated.
Selecting “No” lets the Captive Portal to be displayed on system screen after successful authentication.
| Device Configuration | 276
Keep Alive Request For Captive Portal
Keep-Alive request is constantly exchanged between the device and user to check whether user has logged out or idle. If the device does not receive the response, user is logged out automatically.
More number of concurrent HTTP Captive Portal users, more number of keep-alive requests. In case of more concurrent HTTP Captive Portal users we recommend to disable it.
Default – Enable
If disabled, user is logged out after the configured inactivity time. If disabled, specify user inactivity time and data transfer threshold.
User Inactivity Timeout
User Inactivity timeout is the inactive/idle time in minutes after which user will be logged out and has to reauthenticate.
Enable and specify timeout duration in minutes.
Acceptable Range (minutes) - 3 to 1440
Default - Disable
Data Transfer Threshold
Specify threshold value in Bytes for Data Transfer.
If the minimum data is not transferred within the specified time, the user will be marked as inactive.
Select Custom Message, if unauthenticated user is to be displayed custom message.
Windows Corporate Client Download Link
Enable to publish a link to download the Windows Corporate Client in the custom message.
Linux Corporate Client Download Link
Enable to publish a link to download the Linux Corporate Client in the custom message.
MAC Corporate Client Download Link
Enable to publish a link to download the MAC Corporate Client in the custom message.
Page Header Image
Display the default image shipped with the device at the top of the custom message page or use Browse and upload the custom image.
Supported Image format - JPG, PNG or GIF
Size - 700 X 80 pixels
Page Footer Image
Display the default image shipped with the device at the bottom of the custom message page or use Browse and upload the custom image.
Supported Image format - JPG, PNG or GIF
Size - 700 X 80 pixels
Custom Message
Specify message. You can customize the message to include client IP Address, category, and URL.
Blink Custom Message
Enable Blink Custom Message to display blinking message.
| Device Configuration | 277
Preview
Preview and check how message will be displayed before saving the configuration.
SSL VPN Authentication Methods
Enable to use the same authentication method as configured for VPN or Firewall or configure authentication server for SSL VPN.
Authentication Server List displays all the configured servers while Selected Authentication server list displays servers that will be used for authentication when user tries to login.
Override authentication method for SSL VPN traffic by selecting or deselecting any Authentication server.
In case of multiple servers, authentication request will be forwarded as per the order configured in the Selected
Authentication server List.
Guest Users Settings
System > Authentication > Guest User Settings or System > System Services > Guest User Settings
Guest Users Settings menu allows you to configure general settings, registration settings and SMS Gateway for Guest
Users.
Users without a pre-existing user account wanting to access Internet using a hotspot, or via a network available at airport, hotels, hostels, etc. are called “Guest Users”. These users, that are otherwise considered unauthenticated and/or denied access, are allowed to make request to connect to the Internet for a limited period by authenticating themselves. On being authenticated, these users are authorized to access Internet as Guest Users. At such locations,
Internet access is secured by configuring access policies to restrict any malicious use of the network.
Sophos allows administrator to pre-configure single or multiple Guest Users using Admin Console. The credentials of
Guest Users configured via Admin Console can be printed and handed over to Guest User. Alternately, Guest Users can register themselves using Guest User Portal. The credentials and Internet access details of Guest Users registered via Guest User Portal can either be sent via SMS or can be printed.
In case of successful authentication Guest User is granted access according to applicable group, or else is redirected to captive portal page.
The page allows configuring general parameters to provide secured Internet access for guest users. Below are the screen elements with their description:
Guest User General Settings
Username Prefix
Enter prefix to be used for Auto-Generation of username for guest users.
Group
Select a group of policies to assign to Guest users.
Alternately, you can also add group of policies.
Password Length
Specify the length of the auto-generated password for Guest Users.
Minimum password length - 3 characters
Maximum password length - 60 characters
Default - 8 characters
The password length is a basic security parameter, the value of which affects the strength of password against brute force attack.
Password Complexity
Select a type of password from the available options to be used for complexity of an auto-generated password:
Available Options:
| Device Configuration | 278
• Numeric Password - Password will include only numeric characters.
• Alphabetic Password - Password will include only alphabetic characters.
• Alphanumeric Password - Password will include numeric as well as alphabetic characters.
• Alphanumeric with Special Character Password - Password will include numeric, alphabets and special characters.
The password strength is a function of its length, complexity, and unpredictability. Combining password length with password complexity makes a password difficult to guess.
Disclaimer
Provide the disclaimer message to be printed below every user’s login credentials.
Disclaimer once configured can be edited but cannot be removed.
Auto Purge on Expiry
Check to enable automatic purging of user details on expiry of user validity.
Note: Details of a user who is bound to rules (like firewall, IM, etc.) will not be purged automatically.
Guest User Registration Settings
Enable Guest Users Registration
Enable to allow secured Internet access to guest users.
SMS Gateway
Select the Gateway using which the SMS should be sent.
Alternately you may add the SMS gateway from this page itself by clicking Create New link.
Guest Username
Select the method of generating Username using the following option:
• Use Cell Number as Username
If Guest Username checkbox option is not selected, by default, the new user name will be generated with the value specified in Username Prefix.
User Validity (Duration in Days)
Specify guest user validity in days.
Default Country Code
Enable to configure a default country code on the Guest User Registration page.
Selected country is displayed as default option in Cell Number selection at Guest User registration page.
CAPTCHA Verification
Select to Enable or Disable CAPTCHA (Completely Automated Public Turing Test To Tell Computers and
Humans Apart) code verification on Guest User Registration page to ensure the request is received for human being.
By enabling CAPTCHA Verification, the user will be displayed a picture with characters that user must insert in a provided textbox below picture. The administrator can therefore protect device against attacks generated by automated programs.
Default - Enable
SMS Gateway
An SMS Gateway allows sending and receiving Short Message Service (SMS) to/from a home network for Guest
User registration. The device supports HTTP and HTTPS protocol based SMS service.
| Device Configuration | 279
This section displays list of all the configured SMS Gateways and provides option to
, delete and edit the SMS gateway configuration.
Configure SMS Gateway
You can configure SMS Gateway for Guest User registration from this page.
1. Navigate to System > System Services > Guest User Settings and click Add under SMS Gateway section.
2. Enter SMS Gateway details.
Name
Enter a name of the SMS Gateway.
URL
Specify URL of the SMS Gateway for sending SMS request.
HTTP Method
Select the method for sending SMS request to SMS Gateways from the options available:
Available Options:
Get: Requests data from a specified resource.Post: Submits data to be processed to a specified resource.
Cell Number Format
Select to use country code with cell number.
Number Prefix
Specify the prefix value to be used with the cell number.
Number Prefix can include alpha-numeric and ASCII special characters.
It can be up to 4 characters long.
Request Parameters
Specify the following request parameters to configure the SMS Gateway.
Name
Name is a descriptor used to describe the meaning of the value. E.g. username, password, mobile
Value
Value of variables that are defined against name.
| Device Configuration | 280
Response Format
Response describes delivery status of the message such as success, failed, limit exceeded. Status message can be in various formats. Few of them are described below:
For Example
Response Format
{0} | {1} | {2}
Response Received
success | mbno | msgid/transactionid
Response Format
<status>500</status><transactionid>{0}</transactionid><reason>{1}</reason>
Response Received
<status>500</status><transactionid>2323</transactionid><reason>Limit Exceeded</reason>
When the response format is different for success and failure, it is recommended that the response format string should have a single content holder. E.g. {0}
Response Parameters
Response Parameter is the value presented by content holder {0,1, 2...n} that will be displayed in log viewer.
Parameter Index: Parameter Index is the content holder value {0,1, 2...n}.
Name: Name represents the content holder in the Log Viewer.
For Example 1:
Parameter Index
0
1
2
Name
Status
Recipient
SMSID
For Example 2:
Parameter Index
0
1
Name
SMSID - 2323
SMS Status Message – Length Exceeded
| Device Configuration | 281
Figure 208: Add SMS Gateway
3. Click Save to add SMS Gateway.
DoS
System > System Services > DoS
The device provides several security options that cannot be defined by the Security Policies. This includes protection from several kinds of “Denial of Service attacks”. These attacks disable computers and circumvent security.
Denial of Service (DoS) attack is a method that hackers use to prevent or deny legitimate users access to a service.
DoS attacks are typically executed by sending many rkequest packets to a targeted server (usually Web, FTP, or Mail server), which floods the server's resources, making the system unusable. Their goal is not to steal the information but disable or deprive a device or network so that users no longer have access to the network services/resources.
All servers can handle traffic volume up to a maximum, beyond which they become disabled. Hence, attackers send a very high volume of redundant traffic to a system so it cannot examine and allow permitted network traffic. Best way to protect against the DoS attack is to identify and block such redundant traffic. Below are some DoS settings which can be used for identifying DoS attack:
Packet rate per Source
Total number of connections or packets allowed to a particular user.
Burst rate per Source
Maximum number of packets allowed to a particular user at a given time.
Packet rate per Destination
Total number of connections or packets allowed from a particular user.
Burst rate per Destination
| Device Configuration | 282
Maximum of packets allowed from a particular user at a given time.
How it works
When the burst rate is crossed, device considers it as an attack. Device provides DoS attack protection by dropping all the excess packets from the particular source/destination. Device will continue to drop the packets till the attack subsides. Because device applies threshold value per IP Address, traffic from the particular source/destination will only be dropped while the rest of the network traffic will not be dropped at all.
Time taken to re-allow traffic from the blocked source/destination = time taken to subside the attack + 30 seconds
For example:
Packet rate per Source – 100 packets per second
Burst rate per Source – 200 packets per second
When user starts sending requests, initially user will be able to send 200 packets per second but once the 200 packets are received, in the next phase user will be able to send only 100 packets per second. So in the next phase, if user sends 150 packets per second, device will consider it as an attack and drop 50 (150 -100) packets. Device will accept traffic from the user only after 30 seconds of dropping the packets.
Threshold values
Device uses packet rate and burst rate values as a threshold value to detect DoS attack. These values depend on various factors like:
• Network bandwidth
• Nature of traffic
• Capacity of servers in the network
These values are applicable to the individual source or destination requests per user/IP Address and not globally to the entire network traffic. For example, if source rate is 2500 packets/minute and the network consists of 100 users then each user is allowed packet rate of 2500 packets per minute
Configuring high values will degrade the performance and too low values will block the regular requests. Hence it is very important to configure appropriate values for both source and destination IP Address.
DoS Settings
Attack definition can be defined both for source and destination
SYN Flood
SYN Flood is the attack in which large numbers of connections are sent so that the backlog queue overflows.
The connection is created when the victim host receives a connection request and allocates for it some memory resources. A SYN flood attack creates so many half-open connections that the system becomes overwhelmed and cannot handle incoming requests any more.
Configure Packet Rate (packets/minute) and Burst Rate (packets/second) for source and destination.
Select Apply Flag checkbox to apply the SYN flood definition and control the allowed number of packets.
Source Traffic Dropped displays number of source packets dropped in case source packet rate control is applied.
Destination Traffic Dropped displays number of packets dropped in case destination packet rate control is applied.
Click SYN Flood to view the real-time updates on flooding. It displays the source IP Address - which was used for flooding and IP Address which was targeted.
UDP Flood
User Datagram Protocol (UDP) Flood links two systems. It hooks up one system’s UDP character-generating service, with another system’s UDP echo service. Once the link is made, the two systems are tied up exchanging a flood of meaningless data.
| Device Configuration | 283
Configure Packet Rate (packets/minute) and Burst Rate (packets/second) for source and destination.
Select Apply Flag checkbox to apply the UDP flood definition and control the allowed number of packets.
Source Traffic Dropped displays number of source packets dropped in case source packet rate control is applied.
Destination Traffic Dropped displays number of packets dropped in case destination packet rate control is applied.
Click UDP Flood to view the real time updates on flooding. It displays the source IP Address - which was used for flooding and IP Address which was targeted.
TCP Flood
TCP attack sends huge amount of TCP packet so that the host/victim computer cannot handle, thereby denying service to legitimate TCP users.
Configure Packet Rate (packets/minute) and Burst Rate (packets/second) for source and destination.
Select Apply Flag checkbox to apply the TCP flood definition and control the allowed number of packets.
Source Traffic Dropped displays number of source packets dropped in case source packet rate control is applied.
Destination Traffic Dropped displays number of packets dropped in case destination packet rate control is applied.
ICMP/ICMPv6 Flood
ICMP/ICMPv6 attack sends huge amount of packet/traffic so that the protocol implementation of the host/victim computer cannot handle, thereby preventing legitimate packets from getting through to their destination.
Configure Packet Rate (packets/minute) and Burst Rate (packets/second) for source and destination.
Select Apply Flag checkbox to apply the ICMP flood definition and control the allowed number of packets.
Click ICMP/ICMPv6 Flood to view the real time updates on flooding. It displays the source IP Address - which was used for flooding and IP Address which was targeted.
Dropped Source Routed Packets
Select Apply Flag checkbox to enable. This will block any source routed connections or any packets with internal address from entering your network.
Disable ICMP/ICMPv6 Redirect Packet
An ICMP redirect packet is used by routers to inform the hosts what the correct route should be. If an attacker is able to forge ICMP redirect packets, he or she can alter the routing tables on the host and possibly weaken the security of the host by causing traffic to flow via another path.
Disable the option to prevent the attacker from forging ICMP redirect packet.
Default - Enabled
ARP Hardening
If enabled, device will send an ARP reply only if the destination IP address is a local address configured on the incoming interface and both the sender and destination IP address are in the same subnet.
DoS Bypass Rule
The device allows to bypass the DoS rule in case you are sure that the specified source will not be used for flooding or ignore if flooding occurs from the specified source. By default, VPN zone traffic is also subjected to DoS inspection. You can also bypass DoS inspection of the traffic coming from certain hosts of VPN zone.
The DoS Bypass Rule page displays list of all the bypass rule. You can filter the list based on IP Family. The page provides option to add a new rule, update the existing rule, or delete a rule.
| Device Configuration | 284
Create a DoS Bypass Rule
You can create a DoS Bypass Rule from this page.
1. System > System Services > DoSand click Add under DoS Bypass Rule section.
2. Enter Bypass Rule details.
IP Family
Select the IP Family of the traffic to be bypassed.
Source IP/Netmask (only IPv4)
Specify Source IP/Netmask.
Specify * if you want to bypass entire network.
Destination IP/Netmask (only IPv4)
Specify Destination IP/Netmask.
Specify * if you want to bypass entire network.
Source IP/Prefix (only IPv6)
Specify Source IP/Prefix.
Specify * if you want to bypass entire network.
Destination IP/Prefix (only IPv6)
Specify Destination IP/Prefix.
Specify * if you want to bypass entire network.
Protocol
Select protocol whose traffic is to be bypassed if generated from the specified source to destination.
Available Options:
TCPUDPICMPAll Protocols
For example, if you select TCP protocol then DoS rules will not be applied on the TCP traffic from the specified source to destination.
Source Port
Specify Port Number for Source.
Specify * if you want to bypass entire network.
Destination Port
Specify Port Number for Destination.
Specify * if you want to bypass entire network.
| Device Configuration | 285
Figure 209: Add DoS Bypass Rule
3. Click Save to add a DoS Bypass Rule.
Web Content Filter
Protection > Web Protection > Web Content Filter or System > System Services > Web Content Filter
Web Content Filter menu allows to configure and manage web filtering through the device. It also allows to configure general restrictions for scanning and restricting all the HTTP/HTTPS/FTP traffic. By default, device will not scan HTTP traffic. You can also define the rule to bypass HTTP scanning of the traffic from specific source and destination. If virus scanning is enabled and virus is detected, receiver will receive a notifying message. Similarly, you can define rule to bypass HTTPS scanning based on the web categories.
General Configuration
Use this section to enable the Safe Search feature, caching and Pharming protection useful in filtering Web traffic.
You can also configure Custom Denied Message.
Safe Search - This feature allows you to enforce safe searching into your search engines, thus helping you against malicious sites.
Pharming Protection - This feature allows you to stop Pharming by various attacker sites by Domain Name resolution.
Below are the screen elements with their description:
Scanning
Select the type of scanning to be applied.
Available Options:
• Single Anti-Virus (Maximum Performance): Traffic will be scanned using the Primary Anti-Virus engine.
• Dual Anti-Virus (Maximum Security): Traffic will be scanned using both Anti-Virus Engines, first by Primary and then by the Secondary Engine. This can increase virus detection, but will impact performance.
It is recommended to use Single Anti-Virus engine for scanning for the best balance of Security and
Performance.
Enforce Safe Search
Enable safe search so that web sites containing pornography and explicit sexual content are blocked from the
Google, Yahoo, Altavista and Bing search results.
This will be applicable only when access to Porn, Adult Content and Nudity categories are denied in the Web
Filter Policy.
| Device Configuration | 286
Enable Pharming Protection
Enable to protect against pharming attacks and direct users to the legitimate websites instead of fraudulent websites.
Pharming attacks require no additional action from the user from their regular web surfing activities. Pharming attack succeeds by redirecting the users from legitimate websites instead of similar fraudulent websites that has been created to look like the legitimate site.
Caching
Enable Caching
When enabled the Web Filter keeps a copy of frequently visited sites to improve performance and reduce bandwidth usage
Force caching for Endpoint updates
Use this option to enable caching of update data for Sophos Endpoints.
Note: If this option is disabled you may experience network congestion when many endpoints attempt to download updates from the Internet at the same time.
Denied Message
Specify default deny message to be displayed for all the web categories.
Enable Override Default Denied Message to display a customized message for all the web categories.
Denied Message Image
Specify whether the default or custom image should be displayed on the Denied message page.
Top Image
Specify the image which is to be displayed at the top of the message page.
Dimension of Image should be 125 x 70 pixels and jpg file only.
Bottom Image
Specify the image which is to be displayed at the bottom of the message page.
Dimension of Image should be 700 * 80 pixels and jpg file only.
Preview
Click to view the settings before saving the changes.
HTTP/HTTPS Configurations
The administrator can configure for real time or batch mode scanning of HTTP traffic.
You can configure the maximum file size that can be buffered to the memory for scanning. This will also prevent the unintentional download of virus file hidden in the fragmented files.
Depending on the scanning policy set at the time of deployment through Network configuration Wizard, device will scan HTTP and HTTPS traffic. Enable or disable HTTP and HTTPS scanning from security policy.
Use this section to configure general restrictions for scanning and restricting all the HTTP/HTTPS traffic.
Scan Mode
Specify scanning mode to configure for real time or batch mode scanning for HTTP/HTTPS traffic.
In batch mode, virus scanning will start only after the complete file is downloaded. As complete file is to be downloaded before scanning can start, if the size of the file is large it will take some time.
To avoid the delay, configure scan in real mode if you have to download bulky files.
| Device Configuration | 287
File Size Threshold
Specify file size threshold (in KB). Files that exceed configured threshold will not be scanned.
Acceptable Range - 1 to25600 KB
Default - 1024 KB
Audio & Video File Scanning
Enable Audio & Video File Scanning for scanning of video and audio streams being downloaded.
Default - Disable
HTTPS Scanning CA
Select the CA for HTTPS Scanning from the available options:
Available Options:
• SecurityAppliance_SSL_CA
• SecurityApplianceSelf Signed CA
• List of custom CAs if added
Default - SecurityAppliance_SSL_CA
Deny Unknown Protocol
Enable to deny traffic that does not follow HTTPS protocol.
Allow Invalid Certificate
If you enable HTTPS scanning, you need to import appliance SSL Proxy certificate in Internet Explorer, Firefox
Mozilla or any other browsers for decryption on SSL Inspection otherwise browser will always give a warning page when you try to access any secure site. “Invalid Certificate error” warning appears when the site is using an invalid SSL certificate. Device blocks all such sites.
Enable if you want to allow access to such sites.
FTP Configurations
The administrator can define policies to take the appropriate action based on the protocols. Separate policy can be defined on how to handle SMTP, POP3, FTP and HTTP traffic if infection is detected.
When Device detects a virus, file transfer is stopped and Email message is delivered without the attachment.
Files Greater Than Size
Configure the maximum file size (in KB) for scanning. The files greater than the specified size will not be scanned.
Acceptable Range - 1 to 20480KB
Default – 1024 KB
HTTP Scanning Rules
Apart from mails, virus can infect your network through HTTP downloads also. Define HTTP scanning rules to protect against this. The HTTP Scanning Rules section displays list of all the scanning rules. It also provides option to
a new rule, update the parameters of the existing rules, or delete a rule.
HTTPS Scanning Exceptions
The device allows to bypass the HTTPS scanning for specified web categories. Administrator needs to create an exception rule and include all the web categories which are to be bypassed from HTTPS scanning.
The section displays list of all the configured exception rules. It also provides option to
a new exception rule, update the parameters of the existing rule, and delete the rule.
| Device Configuration | 288
Add HTTP Rule
You can add HTTP Scanning Rule from this page.
1. Navigate to Protection > Web Protection > Web Content Filter or System > System Services > Web Content
Filterand click Add under HTTP Scanning Rules section.
2. Enter HTTP Rule details.
Name
Provide a name for the HTTP Rule.
Source IP Address
Specify Source IP Address.
Destination IP Address
Specify destination IP Address.
Scanning Rule will be applied on the mails received from the sender using specified source IP Address and send to the recipient with the specified destination IP Address.
URL Regex.
Provide URL. You can use regular expression for matching the pattern in URL.
Action
Select whether you want to scan or bypass traffic for the specified source/destination IP Address and URL.
Figure 210: Add HTTP Rule
3. Click Save to add HTTP Scanning Rule.
Add HTTPS Scanning Exception
You can add HTTPS Scanning Exception from this page.
1. Navigate to Protection > Web Protection > Web Content Filter or System > System Services > Web Content
Filterand click Add under HTTPS Scanning Exceptions section.
2. Enter HTTPS Scanning Exception details.
Name
Enter name for the bypass rule.
Bypass
Select the web category to be bypassed for HTTPS scanning.
You can directly add a new web category from this page or from Protection > Web Protection > Custom
Web Category or Objects > Content > Custom Web Category
| Device Configuration | 289
Figure 211: Add HTTPS Scanning Exception
3. Click Save to add HTTPS Scanning Exception.
Traffic Shaping Settings
Use Traffic Shaping Settings page to configure default Traffic Shaping settings. All the bandwidth related data are displayed only with unit KBps (Kilo bytes per second).
Below are the screen elements with their description:
Total Available WAN Bandwidth
Specify maximum bandwidth limit in KB. It is generally a sum of all WAN links maximum limits.
Default - 100000 KB
Acceptable Range (KB) - 1 to 2560000
Optimize for Real-Time (VoIP)
Enable to give priority to real time traffic like VOIP over all other traffic.
If disabled, priority will be applicable only for excess bandwidth i.e. bandwidth remaining after guaranteed bandwidth allocation.
Enforce Guaranteed Bandwidth
Administrator can enforce all internet bound traffic to be handled by any Traffic Shaping Policy applied on it. If there is no policy applied on the traffic then it will be handled by the Default Policy.
Enable to enforce bandwidth restriction on the traffic on which the Traffic Shaping Policy is not applied.
Disable, if you do not want to enforce bandwidth restriction on the traffic on which the Traffic Shaping Policy is not applied. It will only handle traffic on which Traffic Shaping Policy is applied.
Default Policy
Default Policy will be applicable on the traffic which does not have any Traffic Shaping Policy applied.
Guarantee
Specify bandwidth which is the minimum guaranteed bandwidth that the user can use.
Default – 1 KBps
Acceptable Range (KBps) - 1 to 2560000
Limit
Specify bandwidth which is the maximum bandwidth that the user can use, if available.
Default – 100000 KBps
Acceptable Range (KBps) - 1 to 2560000
Priority
Set the bandwidth priority. Priority can be set from 1 (highest) to 7 (lowest) depending on the traffic required to be shaped.
Available Options:
| Device Configuration | 290
1 – Business Critical2 to 5 – Normal6 – Bulky - FTP7 – Best Effort – e.g. P2P
Show Bandwidth Usage
Click to view Bandwidth Usage.
RED
This chapter describes how to configure RED. RED is short for Remote Ethernet Device and is a means to connect remote branch offices and the like to your main office as if the branch office is part of your local network.
System > System Services > RED
The setup consists of Sophos Firewall OS in your main office and a Remote Ethernet Device (RED) in your remote office. Establishing a connection between the two is utmost easy as the RED appliance itself does not need to be configured at all. As soon as the RED appliance is connected to Sophos Firewall OS it behaves like any other
Ethernet device on Sophos Firewall OS. All traffic of your branch office is safely routed via Sophos Firewall OS which means that your branch office is as secure as your local network.
The page shows the RED status. It is deactivated by default.
Disable RED
Disabling RED will not cause the deletion of the REDs. If you disable the RED functionality, RED devices will be deactivated and lose their connection. If you re-enable the RED functionality, the REDs will be activated again.
To disable RED, click the toggle switch on the RED page and confirm by clicking the Confirm removal of RED
configuration button.
Configure RED
This page describes how to configure RED.
1. Navigate to System > System Services > RED.
2. Make the following settings:
Organization Name
City
Enter the name of the organization.
Enter the city where the organization is located.
Country
Select the country where the organization is located.
Enter an email address.
Figure 212: RED Configuration
| Device Configuration | 291
3. Click Apply to Managed Devices to apply the settings to managed Devices. On clicking Apply to Managed
Devices, Set Schedule page opens where the settings can be pushed to all or selected devices..
You can enable the Automatic Device Deauthorization.
Automatic Device Deauthorization
When RED is enabled, you can specify if disconnected RED appliances should automatically be deauthorized after a certain time span. With this feature, you can prevent stolen RED appliances from connecting to Sophos Firewall OS.
Note: The Automatic Device Deauthorization does not work for a RED Tunnel between 2 Sophos Firewall
Devices.
1. Ensure that RED is activated.
2. Select Enable next to Automatic Device Deauthorization.
3. Enter a time span for Deauthorize After.
4. Click Apply.
Automatic Device Deauthorization has been successfully configured.
When a RED appliance reconnects after being disconnected for a time span longer than the defined time span, it will automatically be disabled.
Wireless
The page allows general configuration of wireless networks.
System > System Services > Wireless
Following is a description of the different sections of this page:
Download AP Firmware (Displayed only if AP firmware is not available on the device)
Click to download AP firmware.
Note: Wireless Protection can be used after AP firmware is successfully downloaded.
Global Settings
Enable Wireless Protection
Select the checkbox to enable Wireless Protection.
Allowed Zone
Select network zones that are to be allowed for access point connectivity. These are the zones where access points are deployed to.
Note: If the wireless network uses WPA/WPA2 Enterprise Authentication as encryption mode then a
RADIUS server needs to be specified.
Advanced Settings
Notification Timeout
If an access point goes offline you get a notification. The Notification Timeout lets you configure a timeout for the notification. This means, if you set a delay of 2 minutes, the notification will be sent only if the access point is offline for at least 2 minutes. After the specified time, the AP will be considered inactive.
Timeout (in minutes)
The notification timeout requires an integer. The default timeout is 0 minutes.
Enterprise Authentication
For enterprise authentication, you need to provide some information of your RADIUS server. Note that access points do not communicate with the RADIUS server for authentication but only the Sophos Firewall OS. Port 414 is used for the RADIUS communication between the Sophos Firewall OS and the access points.
| Device Configuration | 292
RADIUS Server
Select the required RADIUS server from the drop-down list. Servers can be added and configured on Objects >
Assets > Authentication Server.
Note: When your RADIUS server is connected to the Sophos Firewall OS via an IPsec tunnel, you have to configure an additional SNAT rule to ensure that the communication works correctly. On the Objects >
Policy > NAT Policypage, add the following SNAT rule: For traffic from the APs' network(s), using service
RADIUS, and going to the RADIUS server, replace the source address with the IP address of Sophos Firewall
OS used to reach the RADIUS server.
Wireless Client List
The overview page displays a live snapshot of currently managed APs, broadcasted SSIDs (wireless networks), wireless clients connected through SSID to AP and mesh networks.
System > Current > Wireless Client List
Following is a description of the table elements:
Show by SSID
The administrator can filter currently connected clients by Access Point or SSID.
Name
Displays the name of the wireless connection.
IP Address
Displays IP address leased for the wireless connection.
MAC Address
Displays the MAC address of the wireless client.
Signal
Displays the signal strength.
Last-TX Rate
Displays the data transfer rate of the wireless client.
Connection Time
Displays the connection time of the wireless client.
Frequency
Displays the frequency of the wireless network to which the AP is connected.
Vendor
Displays the vendor name of the client connected to the access point.
Advanced Threat Protection
This page allows the administrator to configure the Advanced Threat Protection feature.
ATP can help rapidly detect infected or compromised clients inside the network and raise an alert or drop the respective traffic.
The Advanced Threat Protection analyzes network traffic, e.g., DNS requests, HTTP requests, or IP packets in general, coming from and going to all networks. It also incorporates Intrusion Prevention and Antivirus data if the respective features are activated.
Note: Advanced Threat Protection module is a subscription module that needs to be subscribed before use.
By default Advanced Threat Protection is disabled. To enable Advanced Threat Protection, click on the slider. This will make different setting fields editable.
| Device Configuration | 293
Policy: Select the security policy that the Advanced Threat Protection system should use if a threat has been detected.
Available Options:
• Log and Drop: The data packet will be dropped and logged.
• Log Only: The data packet will be logged.
Network/Host Exceptions: Add or select the source networks or hosts that should be exempt from being scanned for threats by Advanced Threat Protection. How to add an IP host is explained on the Objects > Host and Services > IP
Host page.
Threat Exceptions: Add destination IP addresses or domain names that you want to skip from being scanned for threats by Advanced Threat Protection.
Caution - Be careful with specifing exceptions. By excluding sources or destinations you may expose your network to severe risks.
Malware Protection
Sophos Firewall offers Dual Anti Virus Scanning, wherein traffic is scanned by Two (2) Anti Virus Engines. Traffic is first scanned by the Primary Engine, and then the Secondary Engine.
Note: Dual Anti Virus is not available in Device Models SF 100 and SF200. For them, ONLY Single Anti
Virus CYREN is available.
Note: You can also view and manage the Anti Virus status on the System > Diagnostics > Services
General Settings
Primary Anti Virus Engine
Select the Primary Anti-Virus Engine to be used for traffic scanning. For Dual Scan, packets are first scanned by the Primary Engine and then by the Secondary Engine. For Single Scan, only the Primary Engine is used.
Available Options
Sophos EngineAvira Engine
Log Settings
System > System Services > Log Settings
Device provides extensive logging capabilities for traffic, system and network protection functions. Detailed log information and reports provide historical as well as current analysis of network activity to help identify security issues and reduce network abuse. To view logs, relevant modules must be subscribed.
Device can log many different network activities and traffic including:
• Security Policies log
• Anti Virus infection and blocking
• Web filtering, URL and HTTP content blocking
• Signature and anomaly attack and prevention
• Spam filtering
• Administrator logs
• User Authentication logs
• SSL VPN logs
• WAF logs
• Advanced Threat Protection logs
Device can either store logs locally or send logs to external syslog servers for storage and archival purposes. Traffic
Discovery logs can be stored locally only.
Syslog is an industry standard protocol/method for collecting and forwarding Logs from devices to a server running a syslog daemon usually via UDP Port 514. Logging to a central syslog server helps in aggregation of logs and alerts.
| Device Configuration | 294
If configured, device sends a detailed log to an external syslog server in addition to the standard event log. Device
Syslog support requires an external server running a syslog daemon on any of the UDP Port. When configuring logging to a syslog server, one needs to configure the facility, severity and log file format. One can also specify logging location if multiple syslog servers are defined.
Device logs all activity and includes every connection source and destination IP Address (IPv4 / IPv6), IP service, and number of bytes transferred.
A Syslog service simply accepts messages, and store them in files or prints. This form of logging is the best as it provides a central logging facility and a protected long-term storage for logs. This is useful both in routine troubleshooting and in incident handling.
Use this page to configure below settings:
• Syslog Servers - Configure Syslog server for logs storage and archival purposes.
• Log Settings - Configure logs to be sent to the Syslog server.
Syslog Servers
The Syslog Servers section displays list of configured syslog servers. You can sort the list based on server name. The page also provides option to add, update, or delete the server.
Log Settings
After configuring syslog server, configure logs to be sent to the syslog server. If multiple syslog servers are configured, you can send various logs on different servers.
To record logs you must enable the respective log and specify logging location. Administrator can choose between
On-Device (local) logging or Syslog logging. Administrator can also disable logging temporarily. Below are the screen elements with their description:
Log Type (System)
Security Policy
Security Policy Log records invalid traffic, local ACL traffic, DoS attack, ICMP redirected packets, source routed and fragmented traffic.
• Policy Rules
Log records the entire traffic for Firewall.
• Invalid Traffic
Log records the dropped traffic that does not follow the protocol standards, invalid fragmented traffic and the traffic whose packets or device is not able to relate to any connection.
• Local ACLs
Log records the entire (allowed and dropped) incoming traffic.
• DoS Attack
The DoS Attack Log records attacks detected and prevented by the device i.e. dropped TCP, UDP and ICMP packets.
To generate logs, go to System > System Services > DoS and click Apply Flag against SYN Flood, UDP Flood,
TCP Flood, and ICMP/ICMPv6 Flood individually.
• Dropped ICMP Redirected Packet
Log records all the dropped ICMP redirect packets.
To generate log, go to System > System Services > DoS and click Apply Flag against Disable ICMP/ICMPv6
Redirect Packet.
• Dropped Source Routed Packet
Log records all the dropped source routed packets.
| Device Configuration | 295
To generate log, go to System > System Services > DoS and click Apply Flag against Drop Source Routed
Packets.
• Dropped Fragmented Traffic
Log records the dropped fragmented traffic.
• MAC Filtering
Log records the dropped packets when filtering is enabled from Spoof prevention.
• IP-MAC Pair Filtering
Log records the dropped packets when filtering is enabled from Spoof prevention.
• IP Spoof Prevention
Log records the dropped packets when filtering is enabled from Spoof prevention.
• SSL VPN Tunnel
Log records of SSL VPN traffic.
• Virtual Host
IPS
Log records of Virtual Host traffic.
Records detected and dropped attacks based on unknown or suspicious patterns (anomaly) and signatures.
Anti Virus
Virus detected in HTTP, SMTP, FTP, POP3, IMAP4, HTTPS, SMTPS, IMAPS and POPS traffic.
Anti Spam
SMTP, POP3, IMAP4, SMTPS, POPS, IMAPS spam and probable spam mails.
Content Filtering
Web filtering and Application Filtering logs.
Log records of the name of applications/URLs accessed and their categories.
Note: To view the logs:
• Web Filter and Application Filter Policies should be applied in Security Policy.
• Log Firewall Traffic under Policies should be enabled.
Events
Admin Events: Log records of configurations done through Admin Console.
Authentication Events: Log records of all authentication related events.
System Events: Log records of all system related events like Gateway Up/Down, Anti Virus updates etc.
WAF
WAF Events.
Note: WAF logs are not available in CR10iNG, CR15i, CR15wi, CR15iNG, CR15wiNG, CR25ia, CR25wi,
CR35ia and CR35wi Sophos Devices.
Advanced Threat Protection
ATP Events: Log records of drop or alert event.
Heartbeat
Endpoint Status: Log records of the health status of the endpoint.
System Health
Usage: Log records of CPU usage, memory usage, no. of live users, interface and disk partition information.
| Device Configuration | 296
Add Syslog Server
You can add Syslog server from this page.
1. Navigate to System > System Services > Log Settingsand click Add under Syslog Servers section.
2. Enter server details.
Name
Enter a unique name for syslog server.
IP Address / Domain
Specify IP Address (IPv4 / IPv6) or domain name of the Syslog Server. Logs from the device will be sent to the server.
Port
Specify the port number for communication with the Syslog Server. Device will send logs using the configured port.
Facility
Select syslog facility for logs to be sent to the Syslog Server.
Facility indicates to the Syslog Server the source of a log such as operating system, the process or an application. It is defined by the syslog protocol.
Device supports following syslog facilities for received logs:
Available Options:
DAEMON
Daemon logs (Information of Services running in device as daemon).
KERNEL
Kernel log
LOCAL0 – LOCAL7
Log level information.
USER
Logging based on users who are connected to the Server.
Severity Level
Specify severity levels of logs.
Severity level is the severity of the log that has been generated.
Device logs all the messages at and above the logging severity level you select. For example, select ‘ERROR’ to log all messages tagged as ‘ERROR,’ as well as any messages tagged with ‘CRITICAL,’ ‘ALERT’ and
‘EMERGENCY’ and select ‘DEBUG’ to log all messages.
Device supports following severity levels:
EMERGENCY - System is not usable ALERT – Action must be taken immediately CRITICAL - Critical condition ERROR -Error condition WARNING - Warning condition NOTIFICATION - Normal but significant condition INFORMATION - Informational DEBUG - Debug level messages.
Format
Device produces logs in the specified format. Device currently produces logs in Device Standard Format.
Note: You can configure maximum five syslog servers.
| Device Configuration | 297
Figure 213: Log Settings
3. Click Save to add Syslog server.
Once you add the server, go to System > System Services > Log Settings page and enable all those logs, which are to be sent to the syslog server.
Diagnostics
System > Diagnostics
Diagnostic menu allows checking the health of your device in a single shot. Information can be used for troubleshooting and diagnosing problems found in your device.
Use this menu to configure below details:
•
- View the current status and manage all the configured services
•
- Allow and manage remote support .
Services
Services page allows you to view and manage the status of configured Services.
You can view the current status and manage all the configured services:
• Anti Spam
• Anti Spam Center Connectivity
• Anti Virus
• Authentication
• DNS Server
• IPS
• Web Proxy
• WAF
• DHCP Server
• DHCPv6 Server
• Router Advertisement Service
• Hotspot
Parameters
Services
Name of the configured service.
| Device Configuration | 298
Status
Current status of the service.
Manage
Click to start or stop or restart the respective service.
Actions
Start Button
Start the service whose status is ‘Stopped’.
Stop Button
Stop the service whose status is ‘Started’.
Restart Button
Restart service: Only for Authentication Service and Web Proxy Service.
Status
No Web Server configured
No Web Server is configured.
Note: The “Start” button is disabled in this case.
Connected
When Internet connectivity available for the Gateway.
Running
Service has successfully started.
Disconnect
When Internet connectivity unavailable for the Gateway.
Stopped
When a service is stopped or when the respective Subscription Module is not subscribed.
Support Access
The Support Access function enables support staff to connect to the WebAdmin of Sophos Firewall OS without knowing a certain login account. The HTTPS traffic of the Sophos Firewall OS session is proxied by the Support
Access function. Identification of Sophos Firewall OS happens through an access ID which the admin of Sophos
Firewall OS must tell the support staff. All connections between Sophos Firewall OS and the Support Access function are initiated by Sophos Firewall OS on TCP port 22.
The general process of the access can be described in the following steps:
1. Enable the Support Access on Sophos Firewall OS under System > Diagnostics > Support Access and click the toggle switch.
2. Confirm the upcoming message with OK.
3. From the drop-down menu Grant Access For select the time the access is valid.
4. Click Apply to update the settings.
5. Confirm the upcoming message with OK.
Sophos Firewall OS establishes a secure control connection to APU and negotiates a unique Access ID.
6. Communicate the Access ID to the support.
The support uses this Access ID to login to Sophos Firewall OS. The control connection remains established until the specified time, which is displayed next to Access Until.
| Device Configuration | 299
You can disable the connection manually any time by clicking the toggle switch and confirming the disable message with OK.
Configuration
System > Configuration
Configuration menu allows basic administrative settings for the device.
Use this menu to configure below details:
•
- Configure messages to notify users about problems or for sending alerts.
•
- Configure Mail Server and Email settings for sending/receiving alert Emails.
•
- Customize Captive Portal page.
•
- Set Time and Date for the device.
•
- Configure SNMP agent, community and community and SNMPv3 users.
•
- Configure Syslog server and logs to be sent to the Syslog server.
•
- Configure Hotspot settings.
•
•
- Configure transparent authentication for users.
CLI Configuration
To configure SFM CLI settings go to Device Configuration > System > Configuration > CLI Configuration.
IPS MAX Packets
Set IPS MAX Packets
Set number of packets to be sent for Application Classification.
• All - pass all of the session packets for application classification
• Default - pass first 8 packets of the session of each direction for application classification (total 16)
• Value – any number between 8 and 65535
Route Precedence
Route List
• Static System Routes
• VPN Routes
Change the Order
Use Move Up & Move Down buttons to change the order of routes.
Note: Do not forget to click Apply after changing the order.
HTTPS Unknown Protocol
Deny HTTPS Unknown Protocol
Select action for HTTPS unknown protocol.
Available options:
On : Deny invalid traffic through HTTPS port Off : Allow invalid traffic through HTTPS port
By default, it is On.
Note: Do not forget to click Apply after changing the action.
HTTPS Certificate
| Device Configuration | 300
Invalid HTTPS Certificate
If you enable HTTPS scanning, you need to import SSL Proxy certificate in Internet Explorer, Firefox Mozilla or any other browsers for decryption on SSL Inspection otherwise browser will always give a warning page when you try to access any secure site. “Invalid Certificate error” warning appears when the site is using an invalid SSL certificate. The device blocks all such sites. Allow or block access to such sites.
Note: Do not forget to click Apply after changing the action.
Thin Client
Add
Click to add IP address of a Citrix server.
IP Address
List of added Citrix servers IP addresses.
Manage
Click to remove Citrix server.
Transparent Authentication
CTA
Sophos Transparent Authentication
Enable or disable Sophos Transparent Authentication.
Apply
Click to apply configuration changes.
CTA Collector
Add
CTA Collector collects the user authentication request from multiple agents, processes the request and sends to SFM for authentication. Click to add CTA collector IP address and Port for clientless single sign on configuration.
Collector IP Address
List of added Collector IP addresses.
Collector Port
List of added Collector Ports.
Collector Group
Name of Collector group.
VPN Zone Network
Add
Click to add VPN zone network IP address and netmask.
Source IP
List of added source IP addresses.
Source Netmask
List of added source netmasks.
Add CTA Collector
Use the Add CTA Collectors.
CTA Collector
1. Navigate to Device Configuration > System > Configuration > Transparent Authentication > CTA Collector and click Add.
| Device Configuration | 301
2. Enter CTA Collector details:
Collector IP
Enter IP for CTA Collector.
Collector Port
Enter port for CTA Collector.
Collector Group
Enter group for CTA Collector.
Figure 214: Add CTA Collector
3. Click Save.
Add VPN Zone Network
Use this to add VPN Zone Networks.
VPN Zone Network
1. Navigate toDevice Configuration > System > Configuration > Transparent Authentication > VPN Zone
Network and click Add.
2. Enter VPN Zone Network details:
Network
Enter network name for VPN Zone.
NetMask
Select net mask for VPN Zone.
Figure 215: VPN Zone Network
3. Click Save.
Objects
Objects are the logical building blocks of various policies and rule, which include:
•
- Assets allows defining and managing system hosts, services, authentication servers and WAF.
•
traffic shaping policy.
•
- Identity allows configuring Identity and authentication attributes for certificates, users and groups.
•
- Policy describes the security parameters used for establishing and maintaining a secure connection between two peers.
Assets
Objects > Assets
| Device Configuration | 302
Assets allows defining and managing authentication servers, access point groups and Web servers.
This section covers the following topics:
•
- The page allows you to create one or more authentication servers.
•
- This page allows you to organize access points in groups.
•
web servers.
Authentication Server
On this page you can manage databases and backend servers of external user authentication services. External user authentication allows you to validate user accounts against existing user databases or directory services on other servers of your network.
System > Authentication > Authentication Server or Objects > Assets > Authentication Server
Authentication services currently supported are:
• Novell's eDirectory
• Microsoft's Active Directory
• RADIUS
• TACACS+
• LDAP
The page displays all existing authentication servers. You can add an authentication server, update or delete them.
Following is a description of the table elements:
Name
Displays the name of the authentication server.
IP
Displays the IP address of the authentication server.
Port
Displays the Port of the authentication server.
Type
Displays the type of the authentication server.
Domain/Admin
Displays the domain or admin of the authentication server.
Manage
Displays the available managing options for the authentication server:
• Edit: Allows you to edit the authentication server.
• Delete: Allows you to delete the authentication server.
To either add or delete a authentication server, click on the corresponding buttons.
Add an External Server
On this page you can create one or more authentication servers. Follow the links to create them:
Active Directory
Active Directory (AD) is Microsoft's implementation of a directory service and is a central component of Windows
2000/2003 servers. It stores information about a broad range of resources residing on a network, including users, groups, computers, printers, applications, services, and any type of user-defined objects. As such it provides a means of centrally organizing, managing, and controlling access to these resources. The Active Directory authentication method allows you to register Sophos Firewall OS at a Windows domain, thus creating an object for Sophos Firewall
| Device Configuration | 303
OS on the primary domain controller (DC). Sophos Firewall OS is then able to query user and group information from the domain.
Note: Sophos Firewall OS supports Active Directory 2003 and newer.
on page 232
LDAP
LDAP, an abbreviation for Lightweight Directory Access Protocol, is a networking protocol for querying and modifying directory services based on the X.500 standard. Sophos Firewall OS uses the LDAP protocol to authenticate users for several of its services, allowing or denying access based on attributes or group memberships configured on the LDAP server.
RADIUS
RADIUS, the acronym of Remote Authentication Dial In User Service is a widespread protocol for allowing network devices such as routers to authenticate users against a central database. In addition to user information,
RADIUS can store technical information used by network devices, such as supported protocols, IP addresses, routing information, and so on. This information constitutes a user profile, which is stored in a file or database on the RADIUS server. The RADIUS protocol is very flexible, and servers are available for most operating systems.
The RADIUS implementation on Sophos Firewall OS allows you to configure access rights on the basis of proxies and users. Before you can use RADIUS authentication, you must have a running RADIUS server on the network.
Whereas passwords are encrypted using the RADIUS secret, the username is transmitted in plain text.
TACACS+
TACACS+ (the acronym of Terminal Access Controller Access Control System) is a proprietary protocol by Cisco
Systems, Inc. and provides detailed accounting information and administrative control over authentication and authorization processes. Whereas RADIUS combines authentication and authorization in a user profile, TACACS
+ separates these operations. Another difference is that TACACS+ utilizes the TCP protocol (port 49) while
RADIUSClosed uses the UDPClosed protocol.
on page 238
eDirectory
Novell eDirectory is an X.500 compatible directory service for centrally managing access to resources on multiple servers and computers within a given network. eDirectory is a hierarchical, object-oriented database that represents all the assets in an organization in a logical tree. Those assets can include people, servers, workstations, applications, printers, services, groups, and so on.
Add Active Directory Server
Use the Add External Server page to configure Active Directory Server settings.
The Add External Server page allows to configure Active Directory which in turn allows the device to map the users and groups from ADS for the purpose of authentication.
1. Navigate to System > Authentication > Authentication Server or Objects > Assets > Authentication Server and click Add.
2. On the Add External Server page, select Active Directory for Server Type. If a user is required to authenticate using ADS, the device needs to communicate with the ADS server for authentication.
3. Enter Active Directory details.
| Device Configuration | 304
Server Name
Enter a descriptive name for the Active Directory server.
Server IP/Domain
Enter an IP address or domain for the Active Directory server.
Port
Enter the port of the Active Directory server. By default, this is port 389.
NetBIOS Domain
Enter a NetBIOS domain for the Active Directory server.
ADS Username
Enter a username for the admin user of the Active Directory server.
Password
Enter a password for the admin user of the Active Directory server.
Connection Security
Select the type of security to be implemented on the established connection. It provides a method to login to the external server by sending the username and password in encrypted format instead of clear text. We strongly recommend using the encryption method to protect user credentials.
• Simple: User credentials will be send unencrypted, for example, as clear text.
• SSL: Secure Sockets Layer. This is the most common method used for secured connection. The Port will then change from 389 (LDAPClosed) to 636 (ldaps = LDAP over SSL).
• TLS:
Validate Server Certificate
(not with Simple connection security)
Enable to validate the certificate on the external server.
Display Name Attribute
(optional)
Enter the name for the AD server which is displayed as AD username.
Email Address Attribute
(optional)
Enter the alias for the configured email address which is displayed to the user.
Domain Name
Specify the domain name for which the query is to be added.
Search Queries
Click Add to enter the search query. Use the Move Up and Move Down buttons to move the search queries in the list. Use Remove to remove the selected item.
If you do not know search DN, refer to NetBIOS name, FQDN and Search DN.
Figure 216: Add External Server
| Device Configuration | 305
4. Click Test Connection to check the connectivity between Active Directory server and the Sophos Firewall. It also validates Active Directory server user credentials.
5. Click Save.
The AD server is now available and appears in the Authentication Server list.
Add LDAP Server
This page describes how to add a LDAP server.
1. Navigate to System > Authentication > Authentication Server or Objects > Assets > Authentication
Serverand click Add.
2. Select the server type LDAP Server.
3. Enter values for the following settings:
Server Name
Enter a descriptive name for the LDAP server.
Server IP/Domain
Enter an IP address or domain for the LDAP server.
Port
Enter the port of the LDAP server. By default, this is port 389.
Version
Select the version of the LDAP server.
| Device Configuration | 306
Anonymous Login
Enable to send anonymous requests to the LDAP server. Disable to bind user with the server.
Username
(not with Anonymous Login)
Enter a name for the bind user.
Password
(not with Anonymous Login)
Enter a password for the bind user.
Connection Security
Select the connection security for the LDAP server:
• Simple: User credentials will be send unencrypted, for example, as clear text.
• SSL: Secure Sockets Layer. This is the most common method used for secured connection. The Port will then change from 389 (LDAPClosed) to 636 (ldaps = LDAP over SSL).
• TLS: Transport Layer Security. Same secure connection as SSL but uses the default port.
Validate Server Certificate
(not with Simple Connection Security)
Enable to validate the certificate on the external server.
Client Certificate
Select a client certificate from the list to establish a secured connection. If you do not want a client certificate, select None.
Note: You can manage client certificates under ObjectsIdentityCertificate.
Base DN
Enter the Base DN for the LDAP server. The Base DN is the starting point relative to the root of the
LDAP tree where the users are included who are to be authenticated. Note that the Base DN must be specified by the Fully Distinguished Name (FDN) in LDAP notation, using commas as delimiters (e.g.,
O=Example,OU=RnD).
Get Base DN
Click Get Base DN if you are not aware about the Base DN. The Base DN is automatically retrieved from the directory.
Authentication Attribute
Enter an authentication attribute for searching the LDAP directory. The user authentication attribute contains the actual login name each user is prompted for, for example by remote access services.
Display Name Attribute
Enter the name for the LDAP server which is displayed as LDAP username.
Email Address Attribute
Enter the alias for the configured email address which is displayed to the user.
Group Name Attribute
Enter the alias for the configured group name which is displayed to the user.
Expire Date Attribute
Enter the user expire date displayed to the user. The attribute specifies how long a user account is valid.
| Device Configuration | 307
Figure 217: Add External Server
4. Click Test Connection to check the connectivity between LDAP and the Sophos Firewall OS. It also validates
LDAP user credentials.
5. Click Save.
The LDAP server is now available and appears in the Authentication Server list.
Add RADIUS Server
This page describes how to add a RADIUS server.
1. Navigate to System > Authentication > Authentication Server or Objects > Assets > Authentication Server and click Add.
2. Select the server type RADIUS Server.
3. Enter values for the following settings:
Server Name
Enter a descriptive name for the RADIUS server.
Server IP
Enter an IP address for the RADIUS server.
Authentication Port
Enter the authentication port of the RADIUS server. By default, this is port 1812.
Enable Accounting
Enable accounting on RADIUS server.
Sophos Firewall OS sends the following information to the RADIUS server as soon as the user logs in:
| Device Configuration | 308
• Accounting start request
• User login time
Sophos Firewall OS sends the following information to the RADIUS server the moment the user logs out:
• Accounting stop request
• User logout time
Note: Supported client types: Windows Client, HTTP Client, Linux Client, Android, iOS, iOS
HTTP Client, Android HTTP Client, API Client.
Note: The accounting stop message is not sent to the RADIUS server when Sophos Firewall OS shuts down or reboots.
Accounting Port
(only if Enable Accounting is active)
Enter a RADIUS port number through which the Sophos Firewall OS can communicate with RADIUS.
Shared Secret
Enter the shared secret which is a text string that serves as a password between a RADIUS client and a
RADIUS server.
Group Name Attribute
Enter the alias for the configured group name which is displayed to the user.
Figure 218: Add External Server
4. Click Test Connection to check the connectivity between the RADIUS server and the Sophos Firewall. It also validates RADIUS server user credentials.
5. Click Save.
The RADIUS server is now available and appears in the Authentication Server list.
Add eDirectory Server
This page describes how to add a eDirectory server.
1. Navigate to System > Authentication > Authentication Server or Objects > Assets > Authentication
Serverand click Add.
2. Select the server type eDirectory.
3. Enter values for the following settings:
Server Name
Enter a descriptive name for the eDirectory server.
| Device Configuration | 309
Server IP/Domain
Enter an IP address or domain for the eDirectory server.
Port
Enter the port of the eDirectory server. By default, this is port 389.
Connection Security
Select the connection security for the eDirectory server:
• Simple: User credentials will be send unencrypted, for example, as clear text.
• SSL: Secure Sockets Layer. This is the most common method used for secured connection. The Port will then change from 389 (LDAPClosed) to 636 (ldaps = LDAP over SSL).
• TLS: Transport Layer Security. Same secure connection as SSL but uses the default port.
Validate Server Certificate
(not with Simple)
Enable to validate the certificate on the external server.
Client Certificate
Select a client certificate from the list to establish a secured connection. If you do not want a client certificate, select None.
Note: You can manage client certificates under ObjectsIdentityCertificate.
Base DN
Enter the Base DN for the eDirectory server. The Base DN is the starting point relative to the root of the eDirectory tree where the users are included who are to be authenticated. Note that the Base DN must be specified by the Fully Distinguished Name (FDN) in LDAP notation, using commas as delimiters (e.g.,
O=Example,OU=RnD).
Get Base DN
Click Get Base DN if you are not aware about the Base DN. The Base DN is automatically retrieved from the directory.
Figure 219: Add External Server
4. Click Test Connection to check the connectivity between the eDirectory server and the Sophos Firewall. It also validates eDirectory server user credentials.
| Device Configuration | 310
5. Click Save.
The eDirectory server is now available and appears in the Authentication Server list.
Add TACACS+ Server
This page describes how to add a TACACS+ server.
1. Navigate to System > Authentication > Authentication Server or Objects > Assets > Authentication Server and click Add.
2. Select the server type TACACS+ Server.
3. Enter values for the following settings:
Server Name
Enter a descriptive name for the TACACS+ server.
Server IP
Enter an IP address for the TACACS+ server.
Port
Enter the port of the TACACS+ server. By default, this is port 49.
Shared Secret
Enter the shared secret which is a text string that serves as a password between a TACACS+ client and a
TACACS+ server.
Figure 220: Add External Server
4. Click Test Connection to check the connectivity between the TACACS+ server and the Sophos Firewall OS. It also validates TACACS+ server user credentials.
5. Click Save.
The TACACS+ server is now available and appears in the Authentication Server list.
Access Point Groups
On the Protection > Wireless Protection > Access Point Groups or Objects > Assets > Access Point Groups page you can organize access points in groups. The list provides an overview of all access point groups and Local WiFi
Devices.
Following is a description of the table elements:
Name
Displays the name of the access point group.
Wireless Networks
Displays the wireless networks the access point group is assigned to.
Access Point
Displays all access points in this group.
Manage
| Device Configuration | 311
Displays the available managing options for the access point groups:
• Edit Allows you to edit the access point groups.
• Delete Allows you to access point groups.
To either add or delete a access point group, click on the corresponding buttons.
Add an Access Point Group
This page describes how you can add an access point group.
1. Navigate to Protection > Wireless Protection > Access Point Groups or Objects > Assets > Access Point
Groups and click Add.
2. Make the following settings for the new access point group.
Name
Enter a descriptive name for the new access point group.
Wireless Networks
Search for wireless networks and select the wireless networks that should be broadcasted by the access points of this group.
Note: For an access point to broadcast a wireless network some conditions have to be fulfilled. They are explained in chapter Protection > Wireless Protection > Access Point Groups or Objects >
Assets > Access Points section Rules for Assigning Networks to APs.
VLAN Tagging
Select Enable if you want to activate VLAN tagging.
Note: Make sure that the VLAN interface is assigned to the zone which is selected in the Allowed
Zone box on the System > System Services > Wireless page.
Access Point
Search for access points and select which you want to add to this group.
Note: Local WiFi Devices cannot be grouped and do not appear in the Access Point box. Local
WiFi Devices appear in the Access Point Groups list.
Figure 221: Add Access Point Group
3. Click Save to save the access point group.
The new access point group will be displayed in the Access Point Groups table.
Web Servers
On this page you can add the web servers that are to be protected by the WAF.
Protection > Web Server Protection > Web Servers or Objects > Assets > Web Servers
| Device Configuration | 312
The page displays all existing web servers. You can add new real servers, edit or delete them. Following is a description of the table elements:
Name
Displays the name of the web servers.
Type
Displays the type of the web servers.
Manage
Displays the available managing options for the web servers:
• Edit Allows you to edit the web servers.
• Delete Allows you to delete the web servers.
To either add or delete a web server, click on the corresponding buttons.
Add a Web Server
This page describes how to add a web server.
1. Navigate to Protection > Web Server Protection > Web Servers or Objects > Assets > Web Servers and click
Add.
2. Make the following settings:
Name
Enter a descriptive name for the web server.
Description
Enter a description or other information.
Host
Add or select a host, which can either be of the type Host or DNS Host.
Note: DNS Host is recommended here because hosts listed with their IP address transmit empty host headers which leads to problems with some browsers.
Type
Select a real web server type. Whether you want the communication between Sophos Firewall OS and the real server to be encrypted (HTTPS) or plaintext (HTTP).
• Encrypted (HTTPS): Browser-based access to real web server via HTTPS.
• Plaintext (HTTP): Browser-based access to real web server via HTTP. Default.
Port
Enter a port number for the real web server. By default the standard port of the selected real server type is selected.
Keep alive
Enable Keep alive to keep the connection between Sophos Firewall and the real server open instead of opening a new connection for every single request..
Note: In rare cases where the real web server does not support keep alive properly, this feature can provoke reading errors or timeouts and should then be disabled for the affected real server.
Timeout
Enter a timeout for the Keep alive option. Values between 1 and 65535 seconds are allowed. Default is 300 seconds.
| Device Configuration | 313
Figure 222: Add Web Server
3. Click Save to save your settings.
The server is created and appears in the web servers list.
Content
Objects > Content
Content allows defining and managing attributes for traffic based on file, URL and web/app category.
This section covers the following topics:
•
provides option to add a new category, update the parameters of the existing category, or delete a category.
•
- The Custom IPS Patterns page displays list of all the custom signatures. The page provides option to add a new signature, update the parameters of existing signature, or delete the signature.
•
- This page allows you to manage the default web categories and create custom web
categories. You can also add or remove specific domains or keywords in the category.
•
- The URL Group page displays list of all the URL groups and you can sort the list based on URL
group name. The page provides option to add, update, or delete the group.
•
- The Application List page displays total number of applications available for use and related information like category it belongs to, risk factors, its characteristics and technology.
•
- The page displays all existing web application authentication templates. This page provides options to add new templates, edit or delete them.
File Type
The File Type page allows you to manage file types to be used in filtering policy.
The Protection > Web Protection > File Type or Objects > Content > File Type page displays list of both built-in and custom file types that you can control in policy expressions. For instance, you can restrict access to certain types of files within an otherwise-permitted category.
A file type group consists of collections of files, identified by either file extenstion or MIME headers. Predefined File
Types are provided, and you can create new collections of file types using templates.
This page lists existing File Type collections. The predefined File Type collections can not be modified. For File
Type groups that you have added, you can edit or delete the by selecting the associated icon under the Manage
| Device Configuration | 314 heading. To delete multiple File Types, select the associated checkboxes under the Name heading and click Delete at the top of the page.
Click the Add button at the top to create a new File Type.
Add File Type Category
Create a File Type collection to be used in Internet filter policies.
Use the Protection > Web Protection > File Type or Objects > Content > File Type page to create collections of
File Types for use in Internet policies. To create a new File Type collection:
1. Enter a Name for the new collection.
2. Under Template, either leave set to Blank or choose an option from the drop-down menu.
Selections under the Template drop-down will populate the File Extension and MIME Header fields with information from our predefined File Types. From there, you can add extensions and MIME headers to extend the definition of your new File Type Category.
3. Add entries to the File Extension and MIME Header text boxes to include those file types in your new category.
4. Add information in the Description text box to provide information about your new category.
Figure 223: Add File Type Category
5. Click Save to create your new File Type Category.
Custom IPS Patterns
The Custom IPS Patterns page displays the list of all the custom IPS patterns.
Custom IPS Patterns provide the flexibility to customize IPS for diverse network environments. Predefined IPS patterns included in the device cover common attacks while Custom IPS Patterns protect your network from uncommon attacks that are due to the use of proprietary server, custom protocol, or specialized applications used in the corporate network.
Note: User will be able to create Custom IPS Pattern and configure policies using them, however, the IPS scanning will work only if 'Network Protection' module is subscribed.
The page provides option to add a new IPS pattern, update the parameters of existing pattern, or delete the pattern.
| Device Configuration | 315
Adding IPS Pattern
Use Add IPS Pattern page to add Custom IPS Pattern.
The Add IPS Pattern page allows you to add a new Custom IPS Pattern.
1. Navigate to Objects > Content > Custom IPS Patterns and click Add.
2. Enter the IPS Pattern details.
Name
Enter a name to identify the Custom IPS Pattern.
Protocol
Select IPS protocol from the list.
Available Options:TCPUDPICMPALL
Custom Rule
Specify IPS Pattern definition.
Signature definition must begin with a keyword followed by the value enclosed between the double quotes and must end with semicolon (;)
Format: Keyword: "value";
For example, content: "USER JOHN";
If traffic with the content USER JOHN is detected, action defined in the policy will be taken.
Refer to Appendix B – IPS - Custom IPS Pattern Syntax for more details on creating IPS Pattern.
Severity
Select the level of severity from the available options.CriticalMajorModerateMinorWarning
Recommended Action
Specify action to be taken on the selected policy when matching pattern is found.
Available Actions:
Allow Packet - Check each packet before taking action.Drop Packet - Drop packets.Drop Session -
Terminate entire session instead of scanning all the session packets to save resources and avoid getting high number of alerts. Reset - Send TCP reset packet to the originator.Bypass Session - Scan initial packets only.
If the initial packets match the pattern then the rest of the session packets are not scanned and the traffic is allowed to pass.
In all the cases, device generates the log and alerts the Network Administrator.
Figure 224: Custom IPS Patterns
3. Click Save to add the IPS pattern with the options you have configured.
| Device Configuration | 316
Custom Web Category
The Custom Web Category page displays a list of existing Web Categories.
On the Protection > Web Protection > Custom Web Category or Objects > Content > Custom Web Category page you can maintain Categories of sites and assign them a Classification.There are four classifications that can be used in policy decisions to control web usage. These categories are:
• Productive
• UnProductive
• Acceptable
• Objectionable
By default there is a list of web categories with set classifications you can use in your policies. On this page you can edit or delete existing categories, or create and classify a category of your own.
Add Web Category
Create a new Custom Web Category.
On the Add Web Category page you can create a new Custom Web Category for use in policy decisions. To create a
Web Category:
1. Enter a Name for your new category.
2. Select a classification from the Classification drop-down menu.
Available classifications include:
• Productive
• UnProductive
• Acceptable
• Objectionable
3. Select an option for Traffic Shaping Policy.
4. Set the Configure Category option to either Local or External URL Database.
• If you selectExternal URL Database you can enter a URL to a list of custom URLs that you want to include in the category.
• If you select Local you can enter a list of domains or keywords, either by uploading a text file or by entering them in the related text box. In the Search/Add text boxes you can enter domains or keywords. The existing list will match what you type so that you can see if an entry already exists.
5. Enter a Description to describe your new Web Category.
| Device Configuration | 317
Figure 225: Add Custom Web Category
6. Click Advanced Settings to configure policies or override the default message for a category.
a) Next to Action, select one or more policies from the Web Filter Policy list. For each policy selected, set the desired action for both HTTP and HTTPS.
a) Next to Denied Message, select Override Default Denied Message to modify the block page shown if your
Web Category is denied by a policy. This allows you to have present a specific message if a user is blocked.
| Device Configuration | 318
Figure 226: Add Custom Web Category
7. Click Save to create your new Web Category.
Edit Web Category
Modify an existing Web Category.
From the Protection > Web Protection > Custom Web Category or Objects > Content > Custom Web Category page, either click the Name of an existing category or click the related Manage icon on the right. The Edit Web
Category page is displayed.
1. Select the correct Classification for the Web Category.
2. Optionally, from the Traffic Shaping Policy drop-down, select an existing policy, or Create New.
3. Under Advanced Settings you can select Override Default Denied Message to modify the block page shown when your Web Category is denied by a policy. This allows you to have present a specific message if a user is blocked.
4. Click Save.
URL Group
Create a collection of URLs for use in web filter policies.
Use the Protection > Web Protection > URL Group or Objects > Content > URL Group page to create a group of
URLs. These groups can be used in your web filter policies to block or allow custom collections of sites.
On this page you can edit an existing URL Group by either clicking its name under URL Group Name, or by clicking the Manage icon on the right. To delete an existing URL Group, click the Delete icon.
| Device Configuration | 319
Add URL Group
Add a collection of URLs for use in policies.
On the Protection > Web Protection > URL Group or Objects > Content > URL Group , click the Add button to bring up the Add URL Group page.
1. Enter a name for your group in the URL Group Name text box.
2. Enter a description for the group you are creating.
3. Add URLs for this collection.
Figure 227: Add URL Group
Entries must be single domains on separate lines, such as: example.com
foo.com
bar.com
4. Click Save.
Edit URL Group
On the Edit URL Group page you can modify an existing URL Group.
1. Set the Calssification for the URL Group.
2. Chose an existing Traffic Shaping Policy, or select Create New.
3. Under Advanced Settings you can select Override Default Denied Message to modify the block page shown when your URL Group is denied by a policy. This allows you to have present a specific message if a user is blocked.
Application List
The Application List page displays all the applications available for use.
The device can identify and control applications which use standard port 80, 443, non-standard ports, port hopping or tunnel through encrypted SSL traffic. The feature enables prioritization of applications based on user identity, time, applications, and bandwidth, allowing great flexibility, visibility, and control. The device also provides implementation of application-based bandwidth management, accelerating critical applications while blocking malware-laden sites through Web Filtering. Organizations can group applications as per their requirements into business-critical, entertainment, communication, collaboration and control access through Security policies.
Note: Web Protection is a subscription module that needs to be subscribed before use. Check the features of the module by subscribing free trial subscription of the module. (See System Management > System
Settings > Maintenance > Licensing(Only at appliance level))
The device is shipped with a set of predefined applications. This applications are classified based on their risk level, characteristics and technology, offering more granular controls.
| Device Configuration | 320
The total number of application signatures included depends on the Application Signatures Database used by the device. Device Information doclet in the Dashboard provides the version of Application Signatures Database used by your device.
The application list can be filtered based on name of the application, category of the application, risk, characteristics, and technology.
Web App Auth Templates
You can upload HTML forms for reverse authentication. A web application authentication template can be assigned to an authentication profile with frontend mode Form. The respective form will be presented when a user tries to access a site path to which the authentication profile is assigned.
Protection > Web Server Protection > Web App Auth Templates or Objects > Content > Web App Auth
Templates
The page displays all existing web application authentication templates. You can add new templates, edit or delete them. Following is a description of the table elements:
Name
Displays the name of the template.
Template
Displays the filename of the template.
Manage
Displays the available managing options for the template:
• Edit Allows you to edit the template.
• Delete Allows you to delete the template.
To either add or delete a web app auth template, click on the corresponding buttons.
Add a Web App Auth Template
This page describes how to add a web application authentication template.
1. Navigate to Protection > Web Server Protection > Web App Auth Templates or Objects > Content > Web
App Auth Templates and click Add.
2. Make the following settings:
Name
Enter a descriptive name for the template.
Description
Enter a description or other information.
HTML template
Select and upload an HTML template.
Images/Stylesheet
Select and upload images, stylesheets, or JavaScript files that are used by the selected template.
| Device Configuration | 321
Figure 228: Add Web App Auth Template
3. Click Save to save your settings.
The web app auth template is created and appears in the Web App Auth Templates list.
Identity
Objects > Identity
Identity allows configuring Identity and authentication attributes for certificates, groups and users.
This section covers the following topics:
•
a self-signed certificate, upload a certificate, or generate a Certificate Signing Request (CSR). This page also provides option to regenerate, revoke, download, or delete the certificates.
•
- Device provides a facility to generate a local certificate authority as well as import
certificates, signed by commercial providers, such as VeriSign.This page displays list of all the certificate authority. It also provides option to download, regenerate CA, update the parameters of the existing CA, or delete the CA.
•
- Certificate Revocation List (CRL) page is a way to check the validity of an existing certificate. This page displays the list of available CRLs and also provides options to manage these CRLs.
•
- A Zone is a logical grouping of ports/physical interfaces and/or virtual sub-interfaces if defined. This page displays list of all the zones including system zones and the administrator can manage the zones from this page.
•
appropriate users. Groups let you assign various policies to a number of users in single step. The Groups page displays list of all the default and custom groups and provides option to manage these groups.
•
users manually or by importing user details from the file, exporting user details, purging AD users, changing status of the user, or deleting user.
•
- Clientless Users are the users who can bypass Client login to access the Internet and are managed by the device itself. The page displays list of all the clientless users. The page also provides option to add a single clientless user or multiple users, delete or change status of the user.
Certificate
The Certificate page displays list of available certificates.
A digital certificate is a document that guarantees the identity of a person or entity and is issued by the Certificate
Authority (CA). Certificates are generated by the third party trusted CA. They create certificates by signing public keys and identify the information of the communicating parties with their own private keys. This way it is possible
| Device Configuration | 322 to verify that a public key really belongs to the communicating party only and not been forged by someone with malicious intentions.
A certificate signed by a Certificate Authority (CA) identifies the owner of a public key. Each communicating party may be required to present its own certificate signed by a CA verifying the ownership of the corresponding private key. Additionally, the communicating parties need to have a copy of the CA’s public key. In case private key is lost or stolen or the information is changed, CA is responsible for revoking the certificate.CA also maintains the list of valid and revoked certificates.
To use Certificates for authentication, you must have valid CA and a certificate. You need to upload CA if you are using external CA. You can generate a self signed certificate if you want to use it as CA.
You can also use device to act as a certificate authority and sign its own certificates. This eliminates the need of having your own certificate authority. If you are using device as CA, you have to generate a self-signed certificate, which can be used in various VPN policies.
The page also provides option to generate a self-signed certificate, upload a certificate, or generate a Certificate
Signing Request (CSR).This page also provides option to regenerate, revoke, download, or delete the certificates.
If you are using a third party CA, you have to submit a request to CA for issuing a certificate. Once CA issues a certificate, you have to upload to use it in VPN policy.
This page provides option to:
•
•
•
Add Certificate
Use the Certificate page to add a new certificate.
The Certificate page allows you to generate a self-signed certificate, upload a certificate, or generate a Certificate
Signing Request (CSR).
1. Navigate to Protection > Web Server Protection > Certificate or System > VPN > Certificate or Objects >
Identity > Certificate and click Add.
2. Choose the action you want to perform.
Action
Select action from the available options.
Upload CertificateGenerate Self-Signed CertificateGenerate Certificate Signing Request
Upload Certificate
Use the Certificate page to upload a certificate.
1. Enter Upload Certificate details.
Name
Specify a name to identify the Certificate.
Certificate File Format
Select the format of Certificate file from the available options.
Available Options: PEM (.pem): Privacy Enhanced Mail (PEM) is a Base64encoded DER certificate. It is used for encoding the certificate in ASCII code. The certificate and private key are stored in separate files. DER (.der): Distinguished Encoding Rules (DER) is a binary form of ASCII PEM format certificate used on Java platform. The certificate and private key are stored in separate files. CER (.cer): Canonical
Encoding Rules (CER) is a binary format for encoding certificates. It contains information about the owner of certificate, its public and private keys. PKCS7 (.p7b): Public Key Cryptography Standards (PKCS) is a format for encoding the certificate in ASCII code. It contains only certificates and not the private key.
PKCS12 (.pfx or .p12): Public Key Cryptography Standards (PKCS12) is a binary format for encoding certificates. It stores a private key with a public key certificate. It is used on Windows platform.
| Device Configuration | 323
Certificate
Specify certificate to be uploaded. Use Browse to select the complete path.
Private Key
Specify private key for the certificate. Use Browse to select the complete path.
Passphrase
Specify and re-confirm a passphrase for a certificate used for authentication. Passphrase must be at least 4 characters long.
Figure 229: Upload Certificate
2. Click Save to upload the certificate.
Generate Self-Signed Certificate
Use the Certificate page to generate self-signed certificate.
1. Enter details to generate Self Signed Certificate (Option available only after configuring Default CA Parameters)
Name
Specify a name to identify the Certificate.
Valid From and Valid Up To
Specify certificate validity period using Calendar . Validity period is the certificate life and indicates period up to which the certificate will be considered as valid.
Default - 1 day
Key Length
Select key length. Key length is the number of bits used to construct the key.
Available Options:5121024153620484096
Generally, the larger the key, the less chance that it will be compromised but requires more time to encrypt and decrypt data than smaller keys.
Default - 512
Key Encryption
Click to enable the key encryption.
Passphrase
Passphrase for a Certificate used for authentication. Passphrase must be at least 8 characters long. This option is enabled only if the Key Encryption option is selected.
Confirm Passphrase
Re-enter passphrase for confirmation.
Certificate ID
Specify certificate ID. You can specify any one of the following options:
| Device Configuration | 324
Available Options: DNSIP Address(IPv4/IPv6 Address) Email Address DER ASN1 DN(X.509) (Applicable when Authentication Type is Digital Certificate)
Once the certificate is created, you need to download and send this certificate to the remote peer with whom the connection is to be established.
Country Name
Select the country.
State
Specify the state within the country.
Locality Name
Specify the name of the locality.
Organization Name
Specify the organization name, which will use this certificate and domain name. This domain will be certified to use the Certificate.
Use unique Domain name only.
Organization Unit Name
Specify the department/unit name, which will use this certificate and domain name. This domain will be certified to use the Certificate.
Use unique Domain name only.
Common Name
Specify the common name.
A common name comprises of host + domain name or is a fully qualified domain name that is used to resolve to SSL VPN interface. It must be same as that of the Web address to be accessed when connecting to a secured site.
Email Address
Specify the Email Address of the contact person for communication.
2. Click Save to generate self-signed certificate.
Generate Certificate Signing Request
Use the Certificate page to generate certificate signing request.
1. Enter details to generate Certificate Signing Request (CSR).
Name
Name to identify the certificate.
Valid Upto
Specify certificate validity period using Calendar. Validity period is the certificate life i.e. period up to which the certificate will be considered as valid.
Minimum validity -1 day
Key Length
Select key length. Key length is the number of bits used to construct the key.
Generally the larger the key, the less chance that it will be compromised but requires more time to encrypt and decrypt data than smaller keys.
Encryption
Click to enable the key encryption.
Passphrase
Passphrase for a Certificate used for authentication. Passphrase must be at least 4 characters long. This option is available only if the Encryption option is checked.
| Device Configuration | 325
Confirm Passphrase
Re-enter passphrase for confirmation.
Certificate ID
Specify certificate ID. You can specify any one of the following options:
Available Options: DNS IP AddressEmail Address
DER ASN1 DN(X.509) (Applicable when Authentication Type is Digital Certificate)
Country Name
Select the Country for which the Certificate will be used.
Generally, this would be the name of the country where device is deployed.
State
Select the State for which the Certificate will be used.
Generally, this would be the name of the state where device is deployed.
Locality Name
Select the Locality for which the Certificate will be used.
Generally, this would be the name of the Locality where device is deployed.
Organization Name
Specify your organization name, which will use this certificate and domain name. This domain will be certified to use the Certificate.
Use unique Domain names only.
Organization Unit Name
Specify your department/unit name, which will use this certificate and domain name. This domain will be certified to use the Certificate.
Use unique Domain names only.
Common Name
Specify Common Name.
Email Address
Specify Email Address.
2. Click Save to generate certificate signing request.
Download Certificate
Use the Certificate page to download the certificate.
1. Navigate to Protection > Web Server Protection > Certificate or System > VPN > Certificate or Objects >
Identity > Certificate.
2.
Under the Manage column, click the Download Icon against the certificate you want to download.
Note:
• Only self signed certificate and certificate signing request can be downloaded.
• Certificate is downloaded as a .tar.gz file.
Revoke Certificate
Use the Certificate page to revoke the certificate.
1. Navigate to Protection > Web Server Protection > Certificate or System > VPN > Certificate or Objects >
Identity > Certificate.
| Device Configuration | 326
2.
Under the Manage column, click the Revoke Icon to revoke self-signed certificate if lost, stolen or updated.
Revoked certificate is automatically added to the Certificate Revocation List (CRL). You can download revoked certificate and circulate if required.
Certificate Authority
The Certificate Authority page displays list of all the certificate authority and you can filter list based on the certificate authority name.
Device provides a facility to generate a local certificate authority as well as import certificates, signed by commercial providers, such as VeriSign.
A certificate signed by a Certificate Authority (CA) identifies the owner of a public key. Each communicating party may be required to present its own certificate signed by a CA verifying the ownership of the corresponding private key. Additionally, the communicating parties need to have a copy of the CA’s public key. In case private key is lost or stolen or the information is changed, CA is responsible for revoking the certificate. CA also maintains the list of valid and revoked certificates.
After your CA has issued a certificate or have local certificate, you can upload it for use in VPN.
You can use default CA and can modify and re-generate it as per your requirement if you are not using any external
CA. Using this CA, you can generate self-signed certificate and use it in VPN policy.
Using Third Party CA involves uploading:
• CA and root certificate
• Certificate
• CRL (Certificate Revocation List)
If the remote peer is using certificate issued by the following third party CA, you are not required to upload CA:
• VeriSign
• Entrust
• Microsoft
Note: Default CA is regenerated automatically when it is updated.
The page provides option to:
•
•
•
Download Certificate Authority
Use the Certificate Authority page to download CA.
If you are using a local CA, you need to download CA and forward to the remote peer.
1. Navigate to Protection > Web Server Protection > Certificate Authority or System > VPN > Certificate
Authority or Objects > Identity > Certificate Authority. It displays the details of the default CA.
2.
Click download icon to download the zip file.
Note: Default CA cannot be deleted.
Adding a New Certificate Authority
To update and regenerate the default certificate, click on the default certificate.
•
•
| Device Configuration | 327
CA Parameters
Use the Certificate Authority page to update and regenerate the default certificate.
The Certificate Authority page allows you to manually enter details to add a new certificate authority.
1. Navigate to Protection > Web Server Protection > Certificate Authority or System > VPN > Certificate
Authority or Objects > Identity > Certificate Authority and click Add.
2. Enter Certificate Authority details.
Name
Specify a name to identify the Certificate Authority.
Certificate File Format
Select format of the root certificate to be uploaded.
Available Options:PEM (Privacy Enhanced Mail): A format encoding the certificate in ASCII code.
The certificate, request, and private key are stored in separate files.DER: A binary format for encoding certificates. The certificate, request, and private key are stored in separate files.
Certificate
Specify full path from where the certificate is to be uploaded. Alternately, use Browse button to select the path.
Private Key
Specify full path from where the Private Key is to be uploaded. Alternately, use Browse button to select the path.
CA Passphrase
CA Passphrase for authentication. Passphrase must be at least 4 characters long.
Confirm CA passphrase for authentication.
Figure 230: Certificate Authority
3. Click Save to add the Certificate Authority with the options you have configured.
Default CA Parameters
Use the Add Certificate Authority page to update and regenerate the default certificate.
The Add Certificate Authority page allows you to manually enter certificate authority details.
1. Navigate to Protection > Web Server Protection > Certificate Authority or System > VPN > Certificate
Authority or Objects > Identity > Certificate Authority.
2.
Click on the icon under Manage tab of the default certificate that you want to update and regenerate.
3. Enter Certificate Authority Details.
Name
Default. This name cannot be changed.
| Device Configuration | 328
Country Name
Specify the name of the country where the device is installed.
State
Specify the name of the state where the device is installed.
Locality Name
Specify the name of the locality where the device is installed.
Organization Name
Specify the organization name, which will use this certificate and domain name. This domain will be certified to use the Certificate.
Use unique Domain name only.
Organization Unit Name
Specify the department/unit name, which will use this certificate and domain name. This domain will be certified to use the Certificate.
Use unique Domain name only.
Common Name
Specify the common name.
A common name comprises of host + domain name or is a fully qualified domain name that is used to resolve to SSL VPN interface. It must be same as that of the Web address to be accessed when connecting to a secured site.
Email Address
Specify the Email Address of the contact person for communication.
CA PassPhrase
Specify Passphrase for a Certificate Authority. Passphrase must be at least 4 characters long.
Re-enter passphrase for confirmation.
4. Click Save to update and regenerate the default certificate.
Regenerating Certificate Authority
Use the Certificate Authority page to regenerate the default certificate.
1. Navigate to Protection > Web Server Protection > Certificate Authority or System > VPN > Certificate
Authority or Objects > Identity > Certificate Authority
2.
Under the Manage column, click the Regenerate icon
Note: Default CA is regenerated automatically when it is updated.
Certificate Revocation Lists
CA maintains the list of valid and revoked certificates. The page displays the list of available CRLs.
Certificate Revocation List (CRL) page is a way to check the validity of an existing certificate. Certificates which are stolen, lost or updated are revoked by CA and CA publishes such revoked certificates in Revocation list. VPN connection cannot be established using revoked certificates, hence it is necessary to update the CRL at regular interval.
The page provides option to:
•
•
Adding a New CRL
Use the Certificate Revocation List page to add a new CRL.
If you are using External Certificate Authority, you need to upload the CRL obtained from External Certificate
Authority.
| Device Configuration | 329
1. Navigate to Protection > Web Server Protection > Certificate Revocation List or System > VPN > Certificate
Revocation List or Objects > Identity > Certificate Revocation List and click Add.
2. Enter Certificate Revocation List details.
Name
Name to identify the CRL.
CRL File
Specify CRL file to be uploaded. Use Browse to select the complete path.
Figure 231: Certificate Revocation Lists
3. Click Save.
Downloading CRL
Use the Certificate Revocation List page to download the CRL.
Once CA is generated, default CRL is generated with name Default.tar.gz. Once you revoke the certificate, the details of the revoked certificate are added to the default file and regenerated. You can download and distribute if required.
1. Navigate to Protection > Web Server Protection > Certificate Revocation List or System > VPN > Certificate
Revocation List or Objects > Identity > Certificate Revocation List.
2. Click "Download" link against the CRL name to be downloaded. It downloads the zip file. Unzip the file to check the details.
Zones
The Zone page displays list of all the zones including system zones and even lets the administrator manage the zones.
A Zone is a logical grouping of ports/physical interfaces and/or virtual sub-interfaces if defined.
Zones provide a flexible layer of security for the firewall. With the zone-based security, the administrator can group similar ports and apply the same policies to them, instead of having to write the same policy for each interface.
Default Zone Types
LAN - Depending on the device in use and network design, one can group one to six physical ports in this zone.
Group multiple interfaces with different network subnets to manage them as a single entity. Group all the LAN networks under this zone.
By default the traffic to and from this zone is blocked and hence the most secured zone. However, traffic between ports belonging to the same zone will be allowed.
DMZ (DeMilitarized Zone) – This zone is normally used for publicly accessible servers. Depending on the device in use and network design, one can group multiple physical ports in this zone.
WAN - This zone is used for Internet services. It can also be referred as Internet zone.
VPN – This zone is used for simplifying secure, remote connectivity. It is the only zone that does not have an assigned physical port/interface. Whenever the VPN connection is established, port/interface used by the connection is automatically added to this zone and on disconnection; port is automatically removed from the zone. Like all other default zones, scanning and access policies can be applied on the traffic for this zone.
WiFi - This zone is used for wireless Internet services.
The device is shipped with single zone for LAN, WAN, DMZ, VPN and WiFi. These zones are called System Zones.
Administrator can add LAN and DMZ zone types.
Adding a Zone
Use the Add page to create a new Zone.
| Device Configuration | 330
The Add Zone page allows you to enter zone details.
1. Navigate to System > Network > Zones or Objects > Identity > Zone and click Add.
2. Enter the zone details.
Name
Provide a name to identify the zone.
Type
Select the type of Zone from the available options. LAN - Depending on the device in use and network design, one can group one to six physical ports in this zone. Group multiple interfaces with different network subnets to manage them as a single entity. Group all the LAN networks under this zone.
By default the traffic to and from this zone is blocked and hence the highest secured zone. However, traffic between ports belonging to the same zone will be allowed.
DMZ (DeMilitarized Zone) - This zone is normally used for publicly accessible servers. Depending on the device in use and network design, one can group one to five physical ports in this zone.
Note: By default, entire traffic will be blocked except LAN to Local zone service likes
Administration, Authentication, and Network.
Members
Displays all the member ports.
Click the checkbox to select the ports. All the selected ports are moved to 'Selected port' list.
Description
Provide the description for the zone.
Device Access
Device access defines the type of administrative access permitted on zone.
Admin Services - Enable Administrative Services that should be allowed through Zone:
• HTTP - Allow HTTP connection to the Admin Console through this zone
• HTTPS - Allow secure HTTPS connection to the Admin Console through this zone
• Telnet – Allow Telnet connection to CLI through this zone
• SSH – Allow SSH connection to CLI through this zone
Authentication Services – Enable Authentication Services that should be allowed through Zone:
• Windows/Linux Client
• Captive Portal
• NTLM
• Radius SSO
Network Services - Enable Network Services that should be allowed through Zone:
• DNS – Allow this zone to respond to DNS requests
• Ping/Ping6 – Allow this zone to respond to pings
Other Services - Enable other Services that should be allowed through Zone:
• Web Proxy
• SSL VPN
3. Click Save to add Zone with the options you have configured.
Note:
• If DMZ uses Private IP Address, use NATing to make them publicly accessible.
• One cannot add zone if the device is deployed as Bridge.
• Local and VPN zone cannot be updated or deleted.
| Device Configuration | 331
Groups
The Groups page displays list of all the default and custom groups.
Group is a collection of users having common policies that can be managed as a single unit and a mechanism of assigning various policies to a number of users in one operation/step. Users that belong to a particular group are referred to as a group user.
A group can contain default as well as custom policies.
Various policies that can be grouped are:
• Surfing Quota policy which specifies the duration of surfing time and the period of subscription
• Access Time policy which specifies the time period during which the user will be allowed access
• Web Filter Policy which controls and blocks access to inappropriate web sites
• Application Filter Policy which controlling access to application like IM and P2P, VOIP
• QoS policy which specifies the bandwidth usage limit of the user
• Data Transfer Policy which specifies the data transfer quota of the user
• SSL VPN Policy which determines the access mode and controls access to private network resources.
The page also provides option to add new group, update group parameters, add new members to the existing group, view user group membership, or delete a group.
Creating a New User Group
Use the Add Group page to create a group of policies.
The Add Group page allows you to configure a group of policies. Once the appropriate Group is assigned, the user will automatically inherit all the policies added to the group.
1. Navigate to System > Authentication > Groups or Objects > Identity > Groups and click Add.
2. Enter user group details.
Group Name
Provide a name to identify the group.
Description
Provide group description.
Group Type
Select Group Type.
Available Options:
Normal - User of this group needs to log on using the device client to access the Internet. Clientless -
User of this group does not need to log on using the device client to access the Internet and is symbolically represented as Group name(C). Access control is placed on the IP Address.
Figure 232: Add Group details
3. Configure the policies.
Surfing Quota
Select the Surfing Quota Policy from the list.
| Device Configuration | 332
Note: Unlimited policy is automatically applied to Clientless Group.
Access Time (Not applicable to Clientless Group)
Select the Access Time Policy from the list.
Note: Unlimited policy is automatically applied to Clientless Group.
Network Traffic (Not applicable to Clientless Group)
Select the Network Traffic Policy from the list.
Configured policy will be applicable to all the users who are member of this group.
Traffic Shaping
Select the Traffic Shaping policy from the list.
Configured policy will be applicable to all the users who are member of this group.
Remote Access
Clientless
By default, user will inherit its group policy. To override the group policy, select the policy from the list.
You can also create a new policy directly from this page itself or from System > VPN > SSL VPN page.
If user is not to be provided the SSL VPN access then select "No Policy Applied".
Quarantine Digest
Configure Quarantine Digest.
Quarantine digest is an Email containing a list of quarantined spam messages filtered by the device and held in the user quarantine area. If configured, device will mail the digest on hourly, daily or weekly basis to the user. Digest also provides a link to User Portal from where user can access and take the action on quarantined messages.
Available Options:Enable - User will receive the Quarantine Digest on configured frequency and overrides
Group setting. Disable - User will not receive Quarantine Digest and overrides Group setting.
MAC Binding (Not applicable to Clientless Group)
Enable/disable “MAC Binding”. By binding User to MAC Address, you are mapping user with a group of
MAC Addresses.
L2TP (Not applicable to Clientless Group)
Enable if group users can get access through L2TP connection.
PPTP (Not applicable to Clientless Group)
Enable if group users can get access through PPTP connection.
Login Restriction (Not applicable to Clientless Group)
Select the appropriate option to specify the login restriction for the user group.
Available Options: Any Node - Select to allow user to login from any of the nodes in the network.Selected
Nodes - Select to allow user to login from the specified nodes only. Specify IP Address and click Add icon
to add more nodes and remove icon to delete nodes. You can even edit the added IP Address by first clicking on the edit icon and then on the save icon .
Note: Editing and removing IP Address options are only provided for the Groups that have been already added.
Node Range - Select to allow range of IP Address. Specify IP Address range.
Only IPv4 Addresses must be provided for options “Selected Nodes” and “Node Range”.
| Device Configuration | 333
Figure 233: Add Group Policies
4. Click Save to create the new user group.
Note: User Configuration - MAC binding and policies is given precedence over Group configuration.
Adding Users to the Existing Groups
Use Add Group Member page to add a user to the existing groups.
This page allows you to add group member to the existing groups.
1. Navigate to System > Authentication > Groups or Objects > Identity > Groups.
2.
Select the Group in which you want to add the users by clicking Manage icon in the Manage column.
3. Click Add Member(s) button. A pop-up Add Group Member appears providing list all the users along their details that can be added in the group. To search user filter the list based on Username and/or current group.
4. Select the user you want to add in the group. You can select single or multiple users on a single page.
5. Click Apply and click OK to confirm adding member in the group.
Viewing List of Group Members
Use this page to view group members.
This page displays the list of group members.
1. Navigate to System > Authentication > Groups or Objects > Identity > Groups.
2.
4.
Click the Group in which you want to add the users by clicking Manage icon in the Manage column.
3. Click Show Group Member(s) button. A pop-up Group Members appears providing the list all the users with the details who are member of the selected group.
Click Close or Close icon to close the Group Member pop-up.
| Device Configuration | 334
User
The User page displays the list of all the users added in the device.
Users are identified by an IP Address or a Username and assigned to a user group. All the users in a group inherit the policies defined for that group.
Media Access Control (MAC) Address is a unique identifier (hardware address) assigned to a host by the manufacturer for identification and is intended to be immutable. MAC Addresses are 48 bit values that are expressed in 6 byte hex-notation separated by colon for example 01:23:45:67:89:AB.
To improve the security of your network and provide spoofing protection, you can enable User-MAC Address binding. By binding User to MAC Address, you are mapping user with a group of MAC Addresses. It means a user would be able to login through a group of pre-specified machines only making it more difficult for a hacker using random MAC Addresses or spoofing a MAC Address to gain access to your network.
User types
Device supports five types of Users:
• Normal
• Clientless
• Single Sign on
• Thin Client User
• WWAN User
Normal User has to logon to the device. Requires client (client.exe) on the User machine or user can use HTTP Client component and all the policy-based restriction are applied.
Clientless does not require client component (client.exe) on the User machines.
Users are automatically logged to the device if Single sign on settings are configured.
Use the given decision matrix below to choose which type of the user should be created.
Table 2: Decision matrix for adding a User
Feature Normal User
User Login required
Type of Group
Normal
Clientless
Yes
Yes
No
Apply Login restriction Yes
Apply Surfing Quota policy Yes
Apply Access Time policy Yes
Apply Traffic Shaping policy
Yes
Apply Web Filter Policy
Apply Application Group policy
Yes
Yes
Apply Network Traffic policy
Yes
Clientless User
No
No
Yes
Yes
No
No
Yes
Yes
Yes
No
Single Sign On User
No
Yes
No
Yes
Yes
Yes
Yes
Yes
Yes
Yes
You can filter the list of user's Name, Username, Group, Web and Application Filter policy applied to the user, and date on which users were added.
| Device Configuration | 335
Note: You can also view and manage live users on the System > Current Activity > Live Users page.(Only
at appliance level)
The page also provides options to:
•
•
•
•
Add users by importing user details from the file
•
•
•
Registering a New User
Use the Add User page to enter a new user and quickly configure a related policy.
The Add User page allows you to manually enter user details and configure related policies for a user on your system.
Once a user is registered successfully, the page provides two more options:
•
- Click to reset the usage accounting i.e. internet usage time and data transfer of the user.
•
- Click to view the Internet usage and data transfer usage.
1. Navigate to System > Authentication > User or Objects > Identity > User and click Add.
2. Enter user details.
Username
Enter Username, which uniquely identifies user and to be used for login.
Name
Enter Name of the user.
Password
Enter password and re-enter same password for confirmation.
Password is case-sensitive.
User Type
Select the type of user from the available options. UserAdministrator
Profile (Only when User Type is Administrator)
Select the administrator profile. Administrator will get access of various Admin Console menus as per the configured profile.
Create a new profile directly from this page or from the profile page.
Specify Email Address of the user.
Use comma to seperate multiple Email Addresses.
Description
Provide user description.
| Device Configuration | 336
Figure 234: Add User details
3. Enter policies details.
Group
Select Group in which the user is to be added. User will inherit all the policies assigned to the group.
Surfing Quota
By default, user will inherit its group policy. To override the group policy, select the policy from the list.
You can also create a new policy directly from this page itself or from Protection > Web Protection >
Surfing Quota or Objects > Policy > Surfing Quota page.
Access Time
By default, user will inherit its group policy. To override the group policy, select the policy from the list.
You can also create a new policy directly from this page iteself or from Objects > Policy > Access Time page.
Network Traffic
By default, user will inherit its group policy. To override the group policy, select the policy from the list.
You can also create a new policy directly from this page itself or from Objects > Policy > Data Transfer page.
Traffic Shaping
By default, user will inherit its group policy. To override the group policy, select the policy from the list.
You can also create a new policy directly from this page itself or from Objects > Policy > Traffic Shaping page.
| Device Configuration | 337
Figure 235: Add User Policies
4. Enter SSL VPN Policy details.
Remote Access
By default, the user will inherit its group policy. To override the group policy, select a policy from the list.
You can also create a new policy directly from this page itself or from System > VPN > SSL VPN (Remote
Access) page.
If user is not to be provided SSL VPN access then select No Policy Applied.
Clientless
By default, the user will inherit its group policy. To override the group policy, select a policy from the list.
You can also create a new policy directly from this page itself or from System > VPN > Clientless Access page.
If user is not to be provided clientless access then select No Policy Applied.
L2TP
By default, user is provided remote access through L2TP. Disable if remote access is not to be provided to the user.
Provide the IP Address (IPv4/IPv6) to be leased to the user for L2TP access.
PPTP
By default, user is provided remote access through PPTP. Disable if remote access is not to be provided to the user.
Provide the IP Address (IPv4/IPv6) to be leased to the user for PPTP access.
Quarantine digest is an Email containing a list of quarantined spam messages filtered by the device and held in the user quarantine area. If configured, device will mail the digest daily to the user. Digest also provides a link to User My Account from where user can access and take the action quarantined messages.
CISCO
™
VPN Client
By default, user is provided remote access through CISCO VPN Client. Disable if remote access is not to be provided to the user.
Provide the IP Address (IPv4/IPv6) to be leased to the user for CISCO VPN access.
Note: To use this feature, CISCO
™
VPN Client needs to be configured from VPN > CISCO
Quarantine Digest
Configure Quarantine Digest.
Quarantine digest is an Email containing list of quarantined spam messages filtered by the device and held in the user quarantine area. If configured, device will mail the digest at the configured frequency to the user.
Digest also provides a link to User Portal from where user can access and take the action on quarantined messages.
| Device Configuration | 338
Available Options:Enable - User will receive the Quarantine Digest daily and overrides Group setting.Disable - User will not receive Quarantine Digest and overrides Group setting.
Simultaneous Logins
Specify number of concurrent logins that will be allowed to user OR Click 'Unlimited' for allowing unlimited
Concurrent logins.
Default - 1
Acceptable Range - 1 to 99
Note: The specified setting will override the global setting specified in the client preferences.
MAC Binding
Enable/disable "MAC Binding". By binding User to MAC Address, you are mapping user with a group MAC
Addresses.
If enabled, specify MAC Addresses for example 01:23:45:67:89:AB.
Once you enable MAC binding, user will be able to login through pre-specified machines only.
Use comma to seperate multiple MAC Addresses. For example 01:23:45:67:89:AB, 01:23:45:67:89:AC.
Login Restrictions
Select the appropriate option to specify the login restriction for the user.
Available Options: Any Node - User will be able to login from any of the nodes in the network. User Group
Node(s) - User will be able to login only from the nodes assigned to her group. Selected Nodes - User will be able to login from the specified nodes only.Node Range - User will be able to login from any of the IP
Address from the configured range.
Note: Only IPv4 Addresses must be provided for options "Selected Nodes" and "Node Range".
Figure 236: Add User SSL VPN Policy
5. Select Advanced settings (Only if User Type is Administrator)
Schedule for Device Access
Schedule the device access.
Administrator will be able to access the device only during the time configured in schedule.
Login Restriction for Device Access
Select the appropriate option to specify the login restriction for the user.
| Device Configuration | 339
Available Options:Any Node - Administrator will be able to login from any of the nodes in the network.Selected Nodes - Administrator will be able to login from the specified nodes only. Node Range -
Administrator will be able to login from any of the IP Address from the configured range.
Reset User Accounting (Displayed only after user is added)
Click to reset the usage accounting i.e. internet usage time and network traffic of the user.
View Usage (Displayed only after user is added)
Click to view the Internet usage and data transfer usage.
Figure 237: Add Administrator Advanced Settings
Note: User configuration is given precendence over Group configuration.
6. Click Save to register a new user.
Reset User Accounting
This option lets you reset the usage accounting i.e. internet usage time and data transfer of the user.
1.
Edit the user account of the user whose data accounting you want to reset by clicking Manage icon in the
Manage column.
2. Click Reset User Accounting and OK button to confirm.
Note: You cannot reset user accounting for the liver user.
View Usage
This option lets you view the Internet usage and data transfer usage.
1.
Edit the User account of the user whose data usage you want to view by clicking Manage icon under the
Manage column.
2. Click View Usage button. A pop-up displays information of policies applied on the user account, upload and download data transferred by the user.
Importing User Information
The Import Users page allows you to add new users by importing user details from the file.
Instead of creating users again in the device, if you already have users detail in a csv file, you can upload csv file.
Click the Import Button to import csv file. Select the complete path for migrating user’s information file.
csv file format and processing:
1. Header (first) row should contain field names. Format of header row:
2. Compulsory field: username
3. Optional fields: password, name, group, email address.
4. Fields can be configured in any order.
5. Subsequent rows should contain values corresponding to the each field in header row.
6. Number of fields in each row should be same as in the header row.
7. Error will be displayed if data is not provided for any field specified in the header.
8. Blank rows will be ignored.
9. If password field is not included in the header row then it will set same as username.
10. If group name is not included in the header row, administrator will be able to configure group at the time of migration.
| Device Configuration | 340
Exporting Users
Click the Export button to export the user details in a csv file. csv file is generated with the following headers: Name,
Username, Enc_password, Email Address, and Group.
Purging Active Directory Users
This page allows you to purge AD Users.
Click Purge AD Users button to synchronize the device’s Active Directory users with external Active Directory server.
Note:
• Purge operation will not interrupt user login/logout and accounting events.
• If HA is configured, user details are deleted from both, the Primary Device as well as Auxiliary Device at the same time.
Change Status
Select a user and click on the Change Status button to change the status of the user. If the current status is 'Active', the status of the user will change to 'Inactive' when clicked on this button and vice-versa.
Clientless Users
The Clientless Users page displays list of all the clientless users.
Clientless Users are the users who can bypass Client login to access the Internet and are managed by the device itself. As clientless users can bypass device login, create clientless users when your network has few Non-windows machines, VOIP boxes, or servers.
You can filter the list based on name or username of the user, IP address, group of the user, web and application filter policy, or created date. The page also provides option to add a single clientless user or multiple users, delete or change status of the user. The administrator can also reset user accounting data or view the usage statistics.
The page also provides options to:
•
•
•
•
•
Changing Policies of the Clientless User
Add a Single Clientless User
Use the Add Clientless User page to add a single clientless user.
The Add Clientless User page allows you to manually enter details to add a single clientless user that can bypass device login.
Once a user is registered successfully, the page provides two more options:
•
- Click to reset the usage accounting i.e. internet usage time and data transfer of the user.
•
- Click to view the Internet usage and data transfer usage.
1. Navigate to System > Authentication > Clientless Users or Objects > Identity > Clientless Usersand click
Add.
2. Enter Clientless Users details.
Username
Enter username, which uniquely identifies user and will be used for login.
IP Address
Specify IP Address(IPv4/IPv6) for the Clientless user.
Group
Select Group in which user is to be added. User will inherit all the polices assigned to the group.
| Device Configuration | 341
Change the policies applied to the user by editing the user details.
Name
Enter name of the user.
Enter Email Address.
Quarantine Digest
Configure Quarantine Digest. Quarantine Digest is an Email and contains a list of quarantined spam messages filtered by the device and held in the user quarantine area. If configured, device will mail the Quarantine
Digest every day to the user. Digest provides a link to User Portal from where user can access quarantined messages and take the required action.
Available Options:Enable - User will receive the Quarantine Digest daily and overrides Group setting.Disable - User will not receive Quarantine Digest and overrides Group setting. Apply Group's
Settings - User will receive Quarantine Digests as per configured for the Group user belongs to.
Description
Specify user description.
Figure 238: Add Clientless User
3. Click Save to add a single clientless user.
Reset User Accounting
This option lets you reset the usage accounting i.e. internet usage time and data transfer of the user.
1.
Edit the user account of the user whose data accounting you want to reset by clicking Manage icon in the
Manage column.
2. Click Reset User Accounting and OK button to confirm.
Note: You cannot reset user accounting for the liver user.
View Usage
This option lets you view the Internet usage and data transfer usage.
1.
Edit the User account of the user whose data usage you want to view by clicking Manage icon under the
Manage column.
2. Click View Usage button. A pop-up displays information of policies applied on the user account, upload and download data transferred by the user.
Add Multiple Clientless Users
Use the Add Multiple Clientless Users page to add multiple clientless users.
The Add page allows you to enter details to add multiple clientless users.
1. Navigate to System > Authentication > Clientless Users or Objects > Identity > Clientless Users and click
Add Range.
2. Enter the required details.
From
Specify Starting IP Address for the range.
To
Specify Ending IP Address for the range.
| Device Configuration | 342
Group
You can change the policies applied to the user by editing the user details. If you change the policies for the user, user specific policies will take precedence over user group policies.
Figure 239: Add Clientless User
3. Click Save to add multiple clientless users.
Changing Policies of the Clientless User
This page lets you change the policies configured of the clientless user.
Change the policies applied to the user by updating the user details. If you change the policies for the user, user specific policies will take precedence over user group policies.
1. Navigate to System > Authentication > Clientless Users or Objects > Identity > Clientless Users.
2.
Select the user for which you want to change the policies by clicking Manage icon in the Manage column.
3. Update the user details.
Username
Name with which user logs in.
Name
Name of the User.
IP Address
IP Address (IPv4/IPv6) from which the user logs in.
Group
Group in which user is added. User will inherit all the policies assigned to the group.
Change the group, if required.
Email Address of the user.
Description
Provide the clientless user description.
Internet Usage Time
Displays total Internet usage time information.
4. Update the policy details.
Traffic Shaping
Traffic Shaping policy applied to the user.
Change the policy, if required.
Policy applied here will take the precedence over the group policy.
Quarantine Digest
Configure Quarantine Digest.
Quarantine Digest is an Email and contains a list of quarantined spam messages filtered by the device and held in the user quarantine area. If configured, device will mail the Quarantine Digest every day to the user.
Digest provides a link to User My Account from where user can access his quarantined messages and take the required action.
Available Options:Enable - User will receive the Quarantine Digest daily and overrides Group setting.
Disable - User will not receive Quarantine Digesst and overrides Group setting.
5. Click Save to update the changes made to the user.
| Device Configuration | 343
Policies
Objects > Policy
Policy describes the security parameters used for establishing and maintaining a secure connection between two peers.
This section covers the following topics:
•
- Schedule defines a time schedule for applying Firewall Rule or Web & Application Filter policy. This page displays a list of schedules and also provides various options to manage it.
•
- Schedule Internet access for individual users by defining Access Time policy. This page displays list of all the default as well as custom policies.
•
- Control individual user surfing time by defining Surfing Quota policy. This page displays the list of all policies and also provides option to add, update or delete surfing quota policies.
•
- Limit total as well as individual upload and/or download data transfer by defining
Network Traffic Quota. This page displays default as well as custom policies. The page also provides option to manage these policies.
•
- The Network Address Translation page displays list of all the NAT policies
and you can sort the list based on policy name.The page also provides option to add a new policy, update the parameters of the existing policy, or delete a policy.
•
- An IPsec policy defines IKE (Internet Key Exchange) and IPsec proposal parameters of an IPsec connection.This page displays list all the preconfigured and custom IPsec policies. It also provides option to add a new policy, update the parameters of an existing policy, or delete the policy.
•
- Create and deploy IPS Policies to block malicious or suspicious traffic and increase security and productivity. This page displays the list of all the pre-defined and custom IPS policies.
•
- Configure and manage web filtering through the device with Web Filter policies. This page displays
the list which includes predefined and custom policies. You can filter or sort the list based on the policy name.
•
- Traffic Shaping policy allocates & limits the maximum bandwidth usage of the user and
controls the web and network traffic. This page displays list of predefined and custom policies and also provides various options to manage it.
•
- The page displays all existing web application protection objects. The page also provides
option to add new protocol security objects, edit or delete them.
•
- The page displays all existing web application authentication profiles. The page also provides option to add new application authentication profiles, edit or delete them.
•
- This page shows the default and custom profiles and also provides options to manage
these profiles.
•
- This page displays list of all the global application traffic shaping policies. The
page provides option to edit the category or application to apply the traffic shaping policy.
•
- This page displays list of all the predefined and custom policies. The page also provides option to add a new policy, update parameters of the exisiting policy, delete a policy, add a filtering rule to a policy or delete a filtering rule attached to a policy.
•
- This page displays a list of hotspot voucher definition and also provides various
options to manage it.
Schedule
The Schedule page displays the list of all the predefined and custom schedules.
Schedule defines a time schedule for applying Security Policies or Web & Application Filter policy. It is used to control when these policies are active or inactive.
Schedule also defines the system triggered scan for Rogue AP Scan.
Types of Schedules:
• Recurring - use to create policies that are effective only at specified times of the day or on specified days of the week.
• One-time - use to create Security Policies that are effective once for the period of time specified in the schedule.
| Device Configuration | 344
The device is shipped with the following predefined schedules which can be applied to various security policies:
Work hours (5 Day week), Work hours (6 Day week), All Time on Weekdays, All Time on Weekends, All Time on Sunday, All Days 10:00 to 19:00. You can also create new schedule, modify the existing schedules or delete a schedule.
Note: Schedule used by Security Policies or any policies cannot be deleted.
Add a New Schedule
Use the Add Schedule page to add a new schedule.
The Add Schedule page allows you to manually configure a new schedule.
1. Navigate to Objects > Policies > Schedule and click Add.
2. Enter the details.
Name
Enter a name to identify a Schedule.
Description
Specify schedule description.
Recurrence
Select recurrence type.
Available Options: Recurring - Use to create policies that are effective only at specified times of the day or on specified days of the week. One Time - Use to create policies that are effective once for the period of time specified in the schedule. It can be implemented from Policies > User Application Policy or Policies >
Network Policy page.Start & End Date - Specify Start and Stop date. This is applicable for the one time schedule only.
Also, select the days of the week and specify time for the schedule to be active. Stop time cannot be greater than start time.
Figure 240: Add Schedule
3. Click Save to add the schedule with the options you have configured.
Access Time
The Access Time page displays list of all the default as well as custom policies.
Access time is the time period during a day in which user can be allowed/denied the Internet access. An example would be “only office hours access” for a certain set of users.
Access time policy enables to set time interval - days and time - for the Internet access with the help of schedules. See
for more details.
A time interval defines days of the week and times of each day of the week when the user will be allowed/denied the
Internet access.
| Device Configuration | 345
Two strategies based on which Access time policy can be defined:
• Allow strategy - By default, allows access during the schedule
• Deny strategy - By default, denies access during the schedule
Device is shipped with the following predefined policies: Allowed all the time, Denied all the time, Allowed only during Work Hours, Denied during Work hours. These predefined policies are immediately available for use until configured otherwise. You can also define custom policies to define different levels of access for different users to meet your organization’s requirements.
The page also provides option to add, update, or delete the access time policies.
Note: Among all the policies applied, device takes into account the policy that first reaches its threshold limit.
Create a New Access Time Policy
Use the Add Access Time Policy page to add a new access time policy.
The Add Access Time Policy page allows you to manually add an access time policy.
1. Navigate to Objects > Policies > Access Time and click Add.
2. Enter the details.
Name
Enter name to identify the policy.
Strategy
Specify strategy to be applied during the scheduled time interval.
Available Options:Allow - Allows the Internet access during the scheduled time interval.Deny - Denies
Internet access during the scheduled time interval.
Schedule
Select schedule from the available options. Only Recurring schedule can be applied.
Available Options:All the TimeWork hours (5 Day Week)Work hours (6 Day Week)All time on WeekdaysAll time on WeekndsAll time on SundayAll Days 10:00 to 19:00
Depending on the policy strategy, access will be allowed/denied for the scheduled time interval.
Description
Provide policy description.
Figure 241: Add Access Time Policy
Note: Changes made in the policy becomes effective immediately on saving the changes.
3. Click Save to add the access time policy with the options you have configured.
Surfing Quota
The Surfing Quota Policy page displays the list of all the default as well as custom surfing quota policies.
| Device Configuration | 346
Surfing quota policy defines the duration of Internet surfing time. Surfing time duration is the allowed time in hours for a Group or an Individual User to access Internet.
Surfing Quota Policy:
• Allows allocating Internet access time on a cyclic or non-cyclic basis.
• Single policy can be applied to number of Groups or Users.
Device is shipped with the following predefined policies: Unlimited Internet Access, 1 Month Unlimited Access, 1 month 100 hours, Monthly 100 hours Cyclic, Daily 1 hour Cyclic, Weekly 7 hours Cyclic. These predefined policies are immediately available for use until configured otherwise. You can also define custom policies to define different levels of access for different users to meet your organization’s requirements.
The page also provides option to add, update, or delete surfing quota policies.
Note: Among all the policies applied, device takes into account the policy that first reaches its threshold limit.
Create a New Surfing Quota Policy
Use the Add Surfing Quota page to configure a new surfing quota policy.
The Add Surfing Quota page allows you to manually enter details to configure surfing quota policy.
1. Navigate to Protection > Web Protection > Surfing Quota or Objects > Policies > Surfing Quota and click
Add.
2. Enter the details.
Name
Specify name to identify the Policy. Duplicate names are not allowed.
Cycle Type
Select Cycle type.
Available Options:Cyclic - Once the cycle ends, user is automatically registered for new cycle. Non-Cyclic -
Once the specified time limit ends, user will be disconnected.
Cycle Hours
Specify Cycle Hours. Cycle hours define the upper limit of surfing hours for cyclic types of policies i.e. Daily,
Weekly, Monthly and Yearly.
At the end of each Cycle, cycle hours are reset to zero i.e. for "Weekly" Cycle type, cycle hours will reset to zero every week even if cycle hours are unused.
Validity
Specify Validity in number of days. Validity defines the upper limit of total surfing days allowed i.e. restricts total surfing days to valid allotted days.
OR
Click Unlimited Days, if you do not want to restrict the total surfing days.
Maximum Hours
Specify Maximum Hours. Maximum hours define the upper limit of total surfing hours allowed i.e. restricts total surfing hours to maximum hours.
OR
Click Unlimited Hours, if you do not want to restrict the total surfing hours.
Description
Provide description for Surfing Quota Policy.
| Device Configuration | 347
Figure 242: Add Surfing Quota Policy
3. Click Save to add the surfing quota policy with the options you have configured.
Network Traffic Quota
The Network Traffic Quota page displays list of all the default as well as custom network traffic policies.
Once the user logs on, the bandwidth is available and the total available bandwidth is shared among all the active users at the particular time. Bandwidth being the limited resource, bandwidth shortage and congestion problems is common. The device facilitates limiting data transfer allowed to individual user according to the requirement.
Bandwidth is limited using the Traffic Shaping policy while network traffic quota policy defines the upper limit for data transfer carried out by the user.
Network Traffic Quota policy:
• Allows limiting data transfer on a cyclic or non-cyclic basis.
• Single policy can be applied to number of Groups or Users.
Data transfer restriction can be based on:
• Total Data transfer (Upload + Download)
• Individual Upload and/or Download
Device is shipped with the following predefined policies: 100 MB Total Data Transfer policy, Daily 10 MB. These predefined policies are immediately available for use until configured otherwise. You can also define custom policies to define different levels of access for different users to meet your organization’s requirements.
The page also provides option to add, update, or delete network traffic quota policies.
Note: Among all the policies applied, device takes into account the policy that first reaches its threshold limit.
Create a New Network Traffic Quota Policy
Use the Add Network Traffic Quota page to quickly configure a new network traffic policy.
The Add Network Traffic Quota page allows you to manually enter details to configure network traffic policy.
1. Navigate to Objects > Policies > Network Traffic Quota and click Add.
2. Enter the details.
Name
Enter a name to identify the Policy. Duplicate names are not allowed.
Description
Specify Network Traffic Policy description.
| Device Configuration | 348
Restriction Based On
Specify whether the network traffic restriction is on Total Network Traffic or on Individual Network Traffic
(Upload and Download).
Cycle Type
Select Cycle Type.
Available Options: Cyclic - Once the cycle ends, user is automatically registered for new cycle. Non Cyclic -
On reaching the upper limit of the network traffic quota specified, user will be unable to send or receive data.
3. Restriction based on Total Network Traffic and Cyclic Policy.
Cycle Period
Specify Cycle Period. Cycle period defines the duration for cyclic types of policies i.e. Day, Week, Month and
Year.
Cycle Network Traffic
Specify Cycle Network Traffic limit. It is the limit of network traffic allowed to the user per cycle. User will be disconnected if limit is reached.
Maximum Network Traffic
Specify Maximum Network Traffic limit. It is the network traffic allowed to the user and if the limit is reached user will not be able to log on until the policy is renewed.
OR
If you do not want to restrict amount of network traffic, click Unlimited Maximum Network Traffic.
4. Restriction based on Total Network Traffic and Non-Cyclic Policy.
Maximum Network Traffic
Specify Maximum Network Traffic limit. It is the network traffic allowed to the user and if the limit is reached user will not be able to log on until the policy is renewed.
OR
If you do not want to restrict amount of network traffic, click Unlimited Maximum Network Traffic.
5. Restriction based on Individual Network Traffic and Cyclic Policy.
Cycle Period
Specify Cycle Period. Cycle period defines the duration for cyclic type of policies i.e. Day, Week, Month and
Year.
Cycle Upload Network Traffic
Specify Cycle Upload Network Traffic limit. It is the upper upload network traffic limit allowed to the user per cycle. User will be disconnected if the limit is reached.
OR
If you do not want to restrict amount of network traffic per cycle, click Unlimited Cycle Upload Network
Traffic.
Cycle Download Network Traffic
Specify Cycle Download Network Traffic limit. It is the upper limit of download network traffic allowed to the user per cycle. User will be disconnected if limit is reached.
OR
If you do not want to restrict amount of download network traffic per cycle, click Unlimited Cycle Download
Network Traffic.
Maximum Upload Network Traffic
Specify Maximum Upload Network Traffic limit. It is the maximum upload network traffic allowed to the user and if the limit is reached user will not be able to log on until the policy is renewed.
OR
If you do not want to restrict amount of upload network traffic, click Unlimited Upload Network Traffic.
| Device Configuration | 349
Maximum Download Network Traffic
Specify Maximum Download Network Traffic limit. It is the maximum download network traffic allowed to the user and if the limit is reached user will not be able to log on until the policy is renewed.
OR
If you do not want to restrict amount of download network traffic, click Unlimited Download Network
Traffic.
6. Restriction based on Individual Network Traffic and Non-Cyclic Policy.
Maximum Upload Network Traffic
Specify Maximum Upload Network Traffic allowed to the user. Once the limit is reached user will not be able to log on until the policy is renewed.
OR
If you do not want to restrict amount of upload network traffic, click Unlimited Upload Network Traffic.
Maximum Download Network Traffic
Specify Maximum Download Network Traffic allowed to the user. Once the limit is reached user will not be able to log on until the policy is renewed.
OR
If you do not want to restrict amount of download network traffic, click Unlimited Download Network
Traffic.
Description
Provide Policy Description.
Figure 243: Add Network Traffic Quota
Note: Cycle Network Traffic limit cannot be greater than Maximum Network Traffic limit.
7. Click Save to add the network traffic policy with the options you have configured.
Network Address Translation
The Network Address Translation Policy page displays list of all the NAT policies and you can sort the list based on the policy name.
Network Address Translation (NAT) is the process of rewriting the source addresses of IP packets as they pass through a router or Firewall. Mostly NAT is used to enable multiple hosts on a private network to access the Internet using a single public IP Address. When a client sends an IP packet to the router, NAT translates the sending address to
| Device Configuration | 350 a different, public IP Address before forwarding the packet to the Internet. When a response packet is received, NAT translates the public address into the original address and forwards it to the client.
NAT policy tells Securities Policies to allow access but only after replacing the source IP Address with the IP Address specified in the NAT policy. Use NAT to change or remap source or destination address of the packet.
Using NAT eliminates the need for public IP Addresses for all computers on your LAN. It is a way to conserve
IP Addresses available from the pool of Public IP Addresses for the Internet. NAT also allows you to conceal the addressing scheme of your network.
The page also provides option to add a new policy, update the parameters of the existing policy, or delete a policy.
Add a NAT Policy
Use the Add NAT Policy page to quickly configure a new NAT policy.
The Add NAT Policy page allows you to manually enter details to configure NAT policy.
1. Navigate to Objects > Policies > NAT and click Add.
2. Enter the details.
Name
Enter a name to identify the NAT Policy.
IP Address
Select IP Address for source NATing.
Available Options: IP Address - It will replace source IP Address with the specified IP Address. IP Range -
It will replace source IP Address with any of the IP Address from the specified range.
You can search and select a particular IP Address based on the Host name. If IP Host or range is not already added, it can be added from here itself or can be added from Objects > Assets > IP Hosts.
Figure 244: Add NAT Policy
Note: MASQ is a default NAT policy and cannot be updated or deleted.
3. Click Save to add the NAT policy with the options you have configured.
IPSec
The IPSec Policy displays list all the preconfigured and custom IPSec policies.
Policy describes the security parameters used for negotiations to establish and maintain a secure tunnel between two peers.
Before you set up your secure tunnels, to make their configuration faster and easier, you can create VPN policies that work on a global level. Rather than configuring the policy parameters for every tunnel you create, you can configure general policies and then later apply them to your secure tunnels.
Authentication mode
To ensure secure communication, there are two phases to every IKE (Internet Key Exchange) negotiation - Phase 1
(Authentication) and Phase 2 (Key exchange).
The Phase 1 negotiation establishes a secure channel between peers and determines a specific set of cryptographic protocols, exchanges shared secret keys and encryption and authentication algorithm that will be used for generating keys.
| Device Configuration | 351
The Phase 2 negotiation establishes a secure channel between peers to protect data. During Phase 2 negotiation, the protocol security association for the tunnel is established. Either of the peers can initiate Phase 1 or Phase 2 renegotiation at any time. Both can specify intervals after which to negotiate.
Key life
Lifetime of key is specified as Key life.
Once the connection is established after exchanging authenticated and encrypted keys, connection is not dropped till the key life. If the key life of both the peers is not same then negotiation will take place whenever the key life of any one peer is over. This means intruder has to decrypt only one key to break in your system.
Key generation and key rotation are important because the longer the life of the key, the larger the amount of data at risk, and the easier it becomes to intercept more ciphered text for analysis.
Perfect Forward Secrecy (PFS)
It becomes difficult for a network intruder to get the big picture if keys are changing and they have to keep cracking keys for every negotiation. This is achieved by implementing PFS. By selecting PFS, new key will be generated for every negotiation and a new DH key exchange is included. So every time intruder will have to break yet another key even though he already knows the key. This enhances security.
Diffie-Hellman (DH) Group (IKE group)
Diffie-Hellman is a public-key cryptography scheme that allows peers to establish a shared secret over an insecure communications channel. Diffie-Hellman Key Exchange uses a complex algorithm and public and private keys to encrypt and then decrypt the data.
The Diffie-Hellmann Group describes the key length used in encryption. Group number is also termed as Identifiers.
14
15
16
2
5
DH Group
1
Key length (bits)
768
1024
1536
2048
3072
4096
If mismatched groups are specified on each peer, negotiation fails. The group cannot be switched during the negotiation.
Re-key Margin
Time before the next key is exchanged. Time is calculated by subtracting the time elapsed since the last key exchange from the key life. By turning Re-keying ‘Yes’, negotiation process starts automatically without interrupting service before key expiry.
Dead Peer Detection settings
Use to check whether device is able to connect the IP Address or not. Set time interval after which the status of peer is to be checked and what action to take, if peer is not alive.
Tunnel Negotiation
Negotiation process starts to establish the connection when local or remote peer wants to communicate with each other. Depending on the connection parameters defined, the key is generated which is used for negotiations. Lifetime of key is specified as Key life. Once the connection is established, connection is alive/active and data can be transferred up to the specified key life. Connection will be closed/deactivated once the key expires.
If the connection is to be activated again then the entire negotiation process is to be started all over again. Negotiation process can be started again automatically by either local or remote peer only if Allow Re-keying is set to ‘Yes’.
| Device Configuration | 352
Set the re-keying time in terms of the remaining key life when negotiation is to be started automatically without interrupting the communication before key expiry. For example, if key life is 8 hours and Re-key margin time is 10 minutes then negotiation process will automatically start after 7 hours 50 minutes of key usage.
Negotiation process will generate new key only if Perfect Forward Secrecy (PFS) is set to ‘Yes’. PFS will generate a new key from scratch and there will be no dependency between old and new key.
Re-keying
Yes
No
Result
Local and remote peer both will be able to initiate request for connection. Depending on PFS, negotiation process will use same key or generate a new key.
Only remote peer will be able to initiate request for connection. Depending on PFS, negotiation process will use same key or generate a new key.
Device provides 5 default policies and you can also create a custom policy to meet your organization’s requirement.
To make VPN connection configuration an easy task, following five preconfigured VPN policies are included for the frequently used VPN deployment scenarios:
• Road warrior
• L2TP
• Head office connectivity
• Branch office connectivity
• Default
It also provides option to add a new policy, update the parameters of an existing policy, or delete the policy. Instead of creating a policy from scratch, you can also create a new policy based on the already created policy by duplicating its parameters.
Duplicate - Click the duplicate icon in the Manage column against the VPN Policy to be duplicated. Add VPN
Policy window is displayed which has the same values for parameters as the existing policy. Click OK to add a new policy with modification in values for parameters.
Note: Default policy can be updated but cannot be deleted.
Create a New IPSec Policy
Use the Add page to quickly configure a new IPSec policy.
The Add page allows you to manually enter details to add IPSec policy.
1. Navigate to Objects > Policies > IPSec and click Add.
2. Enter General Settings Details.
Name
Specify a name to identify the IPSec Policy.
Description
Provide description for the IPSec Policy.
Allow Re-keying
Enable Re-Keying to start the negotiation process automatically before key expiry. Process will start automatically at the specified time in re-key margin.
If enabled, negotiation process can be initiated by both the local or remote peer. Depending on PFS, negotiation process will use same key or generate a new key.
Key Negotiation Tries
Specify maximum key negotiation trials allowed. Set 0 for unlimited number of trials.
Authentication Mode
Select Authentication Mode. Authentication Mode is used for exchanging authentication information.
| Device Configuration | 353
Available Options:Main Mode - Main mode consists of 6 messages. It processes and validates the diffiehellman in 3 exchanges. Aggressive Mode - Agressive mode consists of 3 messages. With Aggressive
Mode, tunnel can be established faster than using Main Mode as less number of messages are exchanged during authentication and no cryptographic algorithm is used to encrypt the authentication information. Use
Aggressive Mode when remote peer has dynamic IP Addresses.
Depending on Authentication Mode, the phase 1 parameters are exchanged for authentication purpose.
In Main Mode, the phase 1 parameters are exchanged in multiple rounds with encrypted authentication information while in Aggressive Mode phase1 parameters are exchanged in single message without encrypted information.
Pass Data In Compressed Format
Enable to pass data in compressed format to increase throughput.
Figure 245: IPSec General Settings
3. Enter PHASE 1 details.
Encryption Algorithm
Select encryption algorithm that would be used by communicating parties for integrity of exchanged data for phase 1.
Supported Encryption algorithms: DES, 3DES, AES128, AES192, AES256, TwoFish, BlowFish, and Serpent.
3DES – Triple DES is a symmetric strong encryption algorithm that is compliant with the OpenPGP standard.
It is the application of DES standard where three keys are used in succession to provide additional security.
AES – Advanced Encryption Standard offers the highest standard of security. The effective key lengths that can be used with AES are 128, 192 and 256 Bits. This security system supports a number of encryption algorithms.
Serpent – Serpent is a 128-bit block cipher i.e. data is encrypted and decrypted in 128-bit chunks variable key length to be 128, 192, or 256 bits. The Serpent algorithm uses 32 rounds, or iterations of the main algorithm.
Serpent is faster than DES and more secure than Triple DES.
BlowFish – BlowFish is a symmetric encryption algorithm which uses the same secret key to both encrypt and decrypt messages. It is also a block cipher which divides a message into fixed length blocks during encryption and decryption. It has a 64-bit block size and a key length of anywhere from 32 bits to 448 bits and uses 16 rounds of main algorithm.
TwoFish – TwoFish is a symmetric key block cipher with a block size of 128 bits and key sizes up to 256 bits.
Authentication Algorithm
Select Authentication Algorithm that would be used by communicating parties for integrity of exchanged data for phase 1.
| Device Configuration | 354
Supported Authentication algorithms: MD5, SHA1
Maximum three combinations of Encryption and Authentication Algorithm can be selected. The remote peer must be configured to use at least one of the defined combinations.
Click Add icon to add more than one combination of Encryption and Authentication Algorithm.
Default - MD5
DH Group (Key Group)
Select one Diffie-Hellman Group from 1, 2, 5, 14, 15 or 16. DH Group specifies the key length used for encryption.
DH Group 1 uses 768-bit encryption
DH Group 2 uses 1024-bit encryption
DH Group 5 uses 1536-bit encryption
DH Group 14 uses 2048-bit encryption
DH Group 15 uses 3072-bit encryption
DH Group 16 uses 4096-bit encryption
The remote peer must be configured to use the same group. If mismatched groups are specified on each peer, negotiation fails.
Key Life
Specify Key Life in terms of seconds. Key Life is the amount of time that will be allowed to pass before the key expires.
Default - 3600 seconds
ReKey Margin
Specify ReKey Margin. Set time in terms of the remaining Key Life. Re-Key Margin is the time when the negotiation process should be started automatically without interrupting the communication before the key expiry.
For example, if Key Life is 8 hours and Re-key Margin is 10 minutes then negotiation process will automatically start after 7 hours 50 minutes usage of Key Life.
Default - 120 seconds
Randomize Re-Keying Margin By
Specify Randomize Re-Keying time.
For example, if Key Life is 8 hours, Re-Key Margin is 10 minutes and Randomize Re-Keying time is 20% then the Re-Key Margin will be 8 to 12 minutes and negotiation process will start automatically 8 minutes before the key expiry and will try up to 2 minutes after key expiry.
Default - 0%
Dead Peer Detection
Enable to check at regular interval whether peer is live or not.
Default - Enabled
Check Peer After Every (Only if Dead Peer Detection option is "Enabled")
Specify time after which the peer should be checked for its status. Once the connection is established, peer which initiated the connection checks whether another peer is live or not.
Default - 30 seconds
Wait For Response Upto (Only if Dead Peer Detection option is "Enabled")
Specify till what time (seconds) initiated peer should wait for the status response. If the response is not received within the specified time, the peer is considered to be inactive.
Default - 120 seconds
Action When Peer Unreachable (Only if Dead Peer Detection option is "Enabled")
Specify what action should be taken if peer is not active.
| Device Configuration | 355
Available Options: Hold - Holds the connectionDisconnect - Closes the connectionRe-initiate - Reestablishes the connection
Default - Disconnect
Figure 246: IPSec Phase 1
4. Enter Phase 2 Details
Encryption Algorithm
Select encryption algorithm that would be used by communicating parties for integrity of exchanged data for phase 2.
Supported Encryption algorithms: DES, 3DES, AES128, AES192, AES256, TwoFish, BlowFish, and Serpent.
3DES – Triple DES is a symmetric strong encryption algorithm that is compliant with the OpenPGP standard.
It is the application of DES standard where three keys are used in succession to provide additional security.
AES – Advanced Encryption Standard offers the highest standard of security. The effective key lengths that can be used with AES are 128, 192 and 256 Bits. This security system supports a number of encryption algorithms.
Serpent – Serpent is a 128-bit block cipher i.e. data is encrypted and decrypted in 128-bit chunks variable key length to be 128, 192, or 256 bits. The Serpent algorithm uses 32 rounds, or iterations of the main algorithm.
Serpent is faster than DES and more secure than Triple DES.
BlowFish – BlowFish is a symmetric encryption algorithm which uses the same secret key to both encrypt and decrypt messages. It is also a block cipher which divides a message into fixed length blocks during encryption and decryption. It has a 64-bit block size and a key length of anywhere from 32 bits to 448 bits and uses 16 rounds of main algorithm.
TwoFish – TwoFish is a symmetric key block cipher with a block size of 128 bits and key sizes up to 256 bits.
Authentication Algorithm
Select Authentication Algorithm that would be used by communicating parties for integrity of exchanged data for phase 2.
Supported Authentication algorithms: MD5, SHA1
Maximum three combinations of Encryption and Authentication Algorithm can be selected. The remote peer must be configured to use at least one of the defined combinations.
Click Add icon to add more than one combination of Encryption and Authentication Algorithm.
Default - MD5
| Device Configuration | 356
PFS Group (DH Group)
Select one Diffie-Hellman Group from 1, 2, 5, 14, 15 or 16. DH Group specifies the key length used for encryption.
DH Group 1 uses 768-bit encryption
DH Group 2 uses 1024-bit encryption
DH Group 5 uses 1536-bit encryption
DH Group 14 uses 2048-bit encryption
DH Group 15 uses 3072-bit encryption
DH Group 16 uses 4096-bit encryption
The remote peer must be configured to use the same group. If mismatched groups are specified on each peer, negotiation fails.
If “Same as Phase 1” is selected PFS group specified at connection initiator’s end will be used.
If No PFS is selected, this security parameter cannot be added for Phase 2.
Key Life
Specify Key Life in terms of seconds. Key Life is the amount of time that will be allowed to pass before the key expires.
Default - 3600 seconds
Figure 247: IPSec Phase 1
5. Click Save to add the IPSec policy with the options you have configured.
Intrusion Prevention
The IPS page displays the list of all the pre-defined and custom IPS policies.
The device is a real time Intrusion Prevention System (IPS) system that protects your network from known and unknown attacks by worms and viruses, hackers and other Internet risks.
The device at the perimeter of your network analyzes entire traffic and prevents attacks from reaching your network.
Whether it is a worm, a suspicious web request, a hacker targeting your mail server or any other attack - it simply does not get through.
Note: Intrusion Prevention System module is a subscription module that needs to be subscribed before use.
Note: You can also view and manage the IPS status on the System > Diagnostics > Services page.
IPS consists of a signature engine with a predefined set of signatures. Signatures are the patterns that are known to be harmful. IPS compares traffic to these signatures and responds at a high rate of speed if it finds a match. Signatures included within the device are not editable.
As per your network requirements, device allows you to define multiple policies instead of one global policy, to decrease packet latency and reduce the false positives.
IPS policy allows you to view predefined signatures and customize the intrusion prevention configuration at the category as well as individual signature level. Categories are signatures grouped together based on the application and protocol vulnerabilities.
| Device Configuration | 357
The device instead of providing only a single policy (global) for managing multiple networks/hosts, allows to tailor policy per network/host i.e. allows to define multiple policies for managing multiple networks/hosts.
To enable the Intrusion Prevention System, apply IPS policy from Security Policies. You can create rule to apply:
• single policy for all the users/networks
• different policies for different users/networks or hosts
As Security Policies control all traffic passing through the device and decide whether to allow or drop the connection,
IPS rule will be applied to only that traffic/packet which passes through Firewall.
Category
Signatures are organized in categories such as DNS, Finger, P2P, DDOS, and others. These signature categories are listed in the policy. You can configure these categories to change the prevention and/or detection settings. To perform
Intrusion Prevention, you need to enable IPS services for each category i.e. you will be able to configure attack threats for individual signature only if an IPS service for the category is “Enabled”.
Each IPS policy contains a set of signatures that device searches for, logs, blocks and allows to:
• Enable or disable category from IPS protection.
• Enable or disable individual signature in a category to tailor IPS protection based on your network environment.
• Define an action to be taken when the matching traffic pattern is found. Device can either detect or drop the connection. In either of the case, device generates the log and alerts the Network Administrator.
IPS provides six actions for managing attack threats: (action if signature matches)
• Allow Packet - Allows the packet to its intended destination.
• Drop Packet - Drops packets if detects any traffic that matches the signature.
• Disable - Disables the signature, if it detects any traffic that matches the signature.
• Drop Session - Drops the entire session if detects any traffic that matches the signature.
• Reset - Resets entire session if detects any traffic that matches the signature.
• Bypass Session - Allows the entire session if detects any traffic that matches the signature.
In packet-based actions, the device checks each packet before taking an action while for session-based action, only the first packet is checked and an action is taken. In case of Reset, TCP reset packet is sent to the originator. In all the cases, the device generates the log and alerts the Network Administrator.
To save resources and avoid latency, set action as “Bypass Session” as in this, if the initial packets match the signature then the rest of the session packets will not be scanned at all.
To avoid getting high number of Alerts and save resources, set action as “Drop session” as in this, if the device identifies attack in the initial packets then it will terminate the entire session instead of scanning all the session packets.
The page provides option to add a new policy, configure the handling of signatures by category or on a signature-bysignature basis, or delete the policy.
The device provides following pre-defined policies. You can directly use policies 1 to 6 without any modifications while policies 7 to 10 can either be used directly or, can be modified as per your requirements:
1. DMZ TO LAN
2. DMZ TO WAN
3. LAN TO DMZ
4. LAN TO WAN
5. WAN TO DMZ
6. WAN TO LAN
7. generalpolicy
8. lantowan strict policy
9. lantowan general policy
10. dmzpolicy
| Device Configuration | 358
Create an IPS Policy
Use the Add page to quickly configure a new IPS policy.
The Add page allows you to manually enter details to create an IPS policy.
1. Navigate to Objects > Policies > Intrusion Prevention and click Add.
2. Enter details.
Name
Enter a name to identify the IPS Policy.
Template
Select the IPS Policy to be used as a template from the available list.
Available Options:generalpolicylantowan_strictlantowan_generaldmzpolicyLAN to WANLAN to
DMZWAN to DMZWAN to LANDMZ to WANDMZ to LAN
Description
Enter IPS Policy description.
Figure 248: Add IPS Policy
3. Click Save to add the IPS Policy.
4. Once the policy is created, policy rules can be added to take appropriate action for signatures in the policy. Define rule to configure action to be taken when the matching traffic pattern is found. If the rules are already added, list of rules are displayed along with its details like signature filtering criteria, action. You can add, update, or delete the rules.
IPS Policy Rules
Use the Add Policy Rules page to quickly configure IPS Policy Rules.
The Add Policy Rules page allows you to manually configure policy rules.
Once the policy is created, policy rules can be added to take appropriate action for signatures in the policy. Define rule to configure action to be taken when the matching traffic pattern is found. If the rules are already added, list of rules are displayed along with its details like signature filtering criteria, action. You can add, update, or delete the rules.
1. Navigate to Objects > Policies > Intrusion Prevention .
2.
Click on the Manage icon under the Manage column for the particular IPS Policy for which you want to add the policy rule.
3. Click on the Add button.
4. Enter details.
Rule Name
Enter a name for IPS Policy Rule.
5. Enter signature details.
| Device Configuration | 359
Default
Select to view a list of default signatures.
Custom Signature
Select to view a list of custom signatures.
Category
Select IPS signature category from the list of available categories.
Severity
Severity is the level of threat posed by the attack. Select the type of severity from the available options.
Available Options:Select All1 - Critical2 - Major3 - Moderate4 - Minor5 - Warning
Platform
Platform is the OS affected by the attack. Select the platform from the available options:
Available Options: Select AllWindowsLinuxUnixMACSolarisBSDOther
Target
Target is the type of device targeted by the attack.Select the target from available options:
Available Options:Select AllClientServer
6. List of Matching Signature. Displays list of signature as per the filter criteria along with the Signature name,
Category, Severity, Platform, Target and Recommended Action
Select All
Select to choose all the signatures listed for the selected criteria.
Based on the Signature Criteria the signatures are made available.
Select Individual Signature
Select to customize the choice of Signatures list for the selected criteria.
Based on the Signature Criteria the signatures are made available.
Search
Specify Signature Name in the textbox to search a Signature.
This option is available, only if option “Select Individual Signature” is selected.
7. Enter Action details.
Action
Select an action to be taken from the available options:
Available Options:Recommended - This action means that you want the OS to handle this alert level according to best-fit recommendations. Allow Packet - Allows the packet to its intended destination.Drop
Packet - Drops packets if it detects any traffic that matches the signature. Disable - Disables the signature, if it detects any traffic that matches the signature. Drop Session - Drops the entire session if detects any traffic that matches the signature. Reset – Resets entire session if detects any traffic that matches the signature.Bypass Session – Allows the entire session if detects any traffic that matches the signature.
| Device Configuration | 360
Figure 249: Add IPS Policy Rules
8. Click Save to add the policy rules.
Web Filter Policies
The Web Filter page allows you to Add, Delete, or Edit web filter policies.
Use the Protection > Web Protection > Web Filter Policies or Objects > Policies > Web Filter page to create and maintain a set of Web Filter policies. Each policy can filter based on a Web Category, File Type, URL Group, or
Dynamic Category. Default policies are included, and you can create and maintain your own.
On this page you can view the list of Web Filter polices. Details of each are listed under the related table heading:
• Name: The name of your existing Web Filter Policies. To edit an existing policy, click the Name, or select the check box and click the wrench icon under Manage.
• Filter icon: Select this icon to filter results. You can limit the policies that are displayed to a keyword search.
• Default Action: Shows the default action configured for the policy.
• Reporting: Displays if reporting is Enabled or Disabled for the policy.
• Description: Provides a short description for the policy.
• Manage: Includes a edit or delete policies.
Add Web Filter Policy
Create a new Web Filter Policy.
On the Add Web Filter Policy page you can create a new Web Filter Policy to include on the Protection > Web
Protection > Web Filter Policies and Objects > Policies > Web Filter page.
1. Enter a Name for the policy.
2. Enter a brief Description for the policy you want to create.
3. Under Template you can select an existing template from the dropdown list.
This will populate categories from the existing template to help create a similar policy.
4. Select the Enable Reporting check box to include this policy in generated reports.
| Device Configuration | 361
5. Set Download File Size Restriction to the maximum file size that can be downloaded for this policy. Leave this set at zero for no restriction.
6. Under YouTube Education Filter enter your school ID for YouTube for Schools.
Figure 250: Add Web Filter Policy
Note:
If enabled, users trying to open a YouTube video are restricted to videos either belonging to the subsection YouTube EDU or uploaded by your school account.
7. Click Add to configure categories associated with this Web Filter Policy.
8. Click Save.
Traffic Shaping
The Traffic Shaping Policy page displays list of predefined and custom policies and provides option to create a new traffic shaping policy, schedule traffic shaping policy, update parameters or delete the policy.
Bandwidth is the amount of data passing through a media over a period of time and is measured in terms of kilobytes per second (KBps) or kilobits per second (kbits) (1 Byte = 8 bits). The primary objective of traffic shaping policy is to manage and distribute the total bandwidth on certain parameters and user attributes. Traffic shaping policy allocates & limits the maximum bandwidth usage of the user and controls the web and network traffic.
To configure traffic shaping policy:
• Define for whom you want to create policy
• Define policy type
• Define the implementation strategy of the policy
• Define bandwidth usage
Policy can be defined/created for:
• Users - It restricts the bandwidth of a particular user.
• Rules - It restricts the bandwidth for any entity to which the rule is applied.
• Web Categories - It restricts the bandwidth for the URL categorized under the Web Categories. To implement restriction, policy is to be assigned through Security Policies.
• Applications - It restricts the bandwidth for the application. To implement restriction, policy is to be assigned through Security Policies.
Types of policies
Two types of bandwidth restriction can be placed:
| Device Configuration | 362
1. Limit - user cannot exceed the defined bandwidth limit.
2. Guarantee - user is allocated the guaranteed amount of bandwidth and can draw bandwidth up to the defined burst-able limit, if available.
It enables to assign fixed minimum and maximum amounts of bandwidth to the users. By borrowing the excess bandwidth when available, users are able to burst above guaranteed minimum limits, up to the burst-able rate.
Guaranteed rates also assure minimum bandwidth to critical users for receiving constant levels of bandwidth during peak and non-peak traffic periods.
Guaranteed represents the minimum guaranteed bandwidth and burst-able represents the maximum bandwidth that the user can use, if available.
Limit Upload/Download Seperately:
Policy can be implemented in two ways depending on the policy Type:
• Total (Upload + Download)
• Individual Upload and Individual Download
Limit Policy
In this type of bandwidth restriction, user cannot exceed the defined bandwidth limit. Two ways to implement strict policy:
• Total (Upload + Download)
• Individual Upload and Individual Download
Implementation Strategy
Total (Upload + Download)
Individual (Upload / Download)
Bandwidth specified
Total bandwidth
Individual bandwidth i.e. separate for both
Example
Total bandwidth is 20 kbps upload and download combined cannot cross
20 kbps
Upload and Download bandwidth is
20 kbps then either cannot cross 20 kbps
Guarantee Policy
Implementation Strategy
Total (Upload + Download)
Individual (Upload / Download)
Bandwidth specified
Guaranteed bandwidth Burst-able bandwidth
Individual Guaranteed and Burstable bandwidth i.e. separate for both
Example
Guaranteed bandwidth is 20 kbps upload and download combined will get 20 kbps guaranteed (minimum) bandwidth. Burst-able bandwidth is 50 kbps upload and download combined can get up to 50 kbps of bandwidth (maximum), if available.
Individual guaranteed bandwidth is 20 kbps Individually get 20 kbps guaranteed (minimum) bandwidth.
Individual burstable bandwidth is
50 kbps Individually get maximum bandwidth up to 50 kbps, if available.
Bandwidth Usage Type
Policy can be configured for two types of bandwidth usage:
• Individual - Allocated bandwidth is for the particular User/Rule/Web Category/Application only.
• Shared - Allocated bandwidth is shared among all the Users/Rules/Web Categories/Applications who have been assigned this policy.
| Device Configuration | 363
The device is shipped with predefined traffic shaping policies. These predefined policies are immediately available for use until configured otherwise. You can also define custom policies to meet your organization’s requirements.
Create a New Traffic Shaping Policy
Use the Add Traffic Shaping (QoS) Policy page to quickly configure a new traffic shaping policy.
The Add Traffic Shaping (QoS) Policy page allows you to manually enter details to create a traffic shaping policy.
1. Navigate to Objects > Policies > Traffic Shaping and click Add.
2. Enter Traffic Shaping Policy details.
Name
Enter a name to identify the Policy.
Policy Association
Select an option to specify for whom the policy is to be created.
Available Options:Users - Restricts the bandwidth for a particular user.Rules - Restricts the bandwidth of any entry to which Security Policies is applied.Web Categories - Restricts the bandwidth for the URL categorized under the Web category.Applications - Restricts the bandwidth for the applications categorized under the Application category.
Policy Type
Select the type of policy.
Available Options:Limit - In this type of policy, user cannot exceed the defined bandwidth limit.Guarantee-
In this type of policy, user is allocated the guaranteed amount of bandwidth and can draw bandwidth up to the defined Limit, if available.
It enables to assign fixed minimum and maximum amounts of bandwidth to the users. By borrowing excess bandwidth when available, users are able to burst above guaranteed minimum limits, up to the defined Limit.
Guaranteed rates also assure minimum bandwidth to critical users to receive constant levels of bandwidth during peak and non-peak traffic periods.
Guarantee represents the minimum guaranteed bandwidth and Limit represents the maximum bandwidth that the user can use, if available.
Limit Upload/Download Separately
Select from the available options.
Available Options:
Disable - Limits total (Upload + Download) bandwidth.
Enable - Limits Upload and Download bandwidth separately.
Priority
Set the bandwidth priority. Priority can be set from 0 (highest) to 7 (lowest) depending on the traffic required to be shaped.
0 - Real Time for example, VOIP1 - Business Critical2 to 5 - Normal6 - Bulky - FTP7 - Best Effort for
Example, P2P
By default, priority is given to the real time traffic. However, if administrator does not want this preference, feature can be disabled from System > System Services > Traffic Shaping Settings page.
If Optimize for Real-Time (VoIP), under System > System Services > Traffic Shaping Settings page is disabled then priority will be applicable only for excess bandwidth i.e. bandwidth remaining after guaranteed bandwidth allocation.
If Optimize for Real-Time (VoIP), under System > System Services > Traffic Shaping Settings page is enabled then Real-time traffic (Traffic Shaping policy with priority 0) like VOIP will be given precedence over all other traffic.
As priority is given to the real time traffic, it is possible that some non real-time traffic will not get their minimum guaranteed bandwidth. Specifically, if sum of Limit (max allowed) of all Traffic Shaping policies
(real-time and non real-time) is greater than total max-limit then guaranteed bandwidth of the real-time policies will be fulfilled but non real-time might not get the minimum guaranteed bandwidth.
| Device Configuration | 364
Limit (in KBps) (Only if Policy Type is 'Limit' and Limit Upload/Download Separately is disabled)
Specify allowed total bandwidth.
Total Bandwidth Range: 2 – 2560000KBps
Limit bandwidth should be greater than or equal to guaranteed bandwidth.
Upload Bandwidth (in KBps) (Only if Policy Type is 'Limit' and Limit Upload/Download Separately is enabled)
Specify upload bandwidth.
Total Bandwidth Range: 2 – 2560000KBps
Download Bandwidth (in KBps) (Only if Policy Type is 'Limit' and Limit Upload/Download Separately is enabled)
Specify download bandwidth.
Total Bandwidth Range: 2 - 2560000KBps
Guarantee -Limit (in KBps) (Only if Policy Type is 'Guarantee' and Limit Upload/Download Separately is disabled)
Specify range for guaranteed bandwidth limit.
Total Bandwidth Range: 2 – 2560000KBps
Guarantee - Limit Upload (in KBps) (Only if Policy Type is 'Guarantee' and Limit Upload/Download
Separately is enabled)
Specify range for guaranteed upload bandwidth.
Total Bandwidth Range: 2 – 2560000KBps
Guarantee - Limit Download (in KBps) (Only if Policy Type is 'Guarantee' and Limit Upload/Download
Separately is enabled)
Specify range for guaranteed download bandwidth.
Total Bandwidth Range: 2 - 2560000KBps
Bandwidth Usage Type
Select the type of bandwidth usage.
Available Options:Individual - Allocated bandwidth is for the particular User/Rule/Web Category/
Application only.Shared - Allocated bandwidth is shared among all the Users/Rules/Web Categories/
Applications who have been assigned this policy.
Description
Provide description for the policy.
| Device Configuration | 365
Figure 251: Add Traffic Shaping (QoS) Policy
3. Select Save to add the traffic shaping policy with the options you have configured.
Schedule Traffic Shaping Policy
Use the Add Traffic Shaping (QoS) Policy Detail page to schedule a traffic shaping policy.
The page allows you to add a schedule-wise traffic shaping policy to override default traffic shaping policy details.
1. Navigate to Objects > Policies > Traffic Shaping.
2.
Click on the Manage icon under the Manage column.
3. Click on the Add button.
4. Enter Traffic Shaping Policy details.
Name
Displays policy name.
Policy Type
Displays default Policy Type set at the time of creation of policy, modify if required.
Note: Configured policy type will override the default policy and will be applicable only for the selected scheduled time interval.
Limit Upload/Download Separately
Displays default implementation strategy set at the time of creation of policy, modify if required.
Note: Configured policy type will override the default policy and will be applicable only for the selected scheduled time interval.
Limit (in KBps) (Only if Policy Type is 'Limit'and Limit Upload/Download Seperately is disabled)
Displays allocated Total bandwidth. Modify if required.
Note: The modified bandwidth restriction is applicable only for the selected time interval.
| Device Configuration | 366
Upload Bandwidth (in KBps) (Only if Policy Type is 'Limit'and Limit Upload/Download Seprately is enabled)
Displays allocated Individual upload bandwidth. Modify if required.
Note: The modified bandwidth restriction is applicable only for the selected time interval.
Download Bandwidth (in KBps) (Only if Policy Type is 'Limit'and Limit Upload/Download Seprately is enabled)
Displays allocated Individual download bandwidth. Modify if required.
Note: The modified bandwidth restriction is applicable only for the selected time interval.
Guarantee -Limit (in KBps) (Only if Policy Type is 'Guarantee' and Limit Upload/Download Seprately is disabled)
Displays range for total guaranteed bandwidth. Modify if required.
Total Bandwidth Range: 2 – 2560000KBps
Guarantee - Limit Upload (in KBps) (Only if Policy Type is 'Guarantee' and Limit Upload/Download
Seprately is enabled)
Displays range for guaranteed upload bandwidth. Modify if required.
Total Bandwidth Range: 2 – 2560000KBps
Guarantee - Limit Download (in KBps) (Only if Policy Type is 'Guarantee' and Limit Upload/Download
Seprately is enabled)
Displays range for guaranteed download bandwidth. Modify if required.
Total Bandwidth Range: 2 - 2560000KBps
Schedule
Select Schedule from the available list during which the traffic shaping policy will be applied.
Only Recurring Schedule can be applied.
If you are not sure about the Schedule details, check
Figure 252: Add Traffic Shaping (QoS) Policy Detail
5. Click Save to add a schedule-wise traffic shaping policy.
| Device Configuration | 367
Web App Protection
With protocol security you can define the modes and levels of protection for your webservers.
Protection > Web Server Protection > Web App Protection Policies or Objects > Policies > Web App Protection
The page displays all existing web application protection objects. You can add new protocol security objects, edit or delete them. Following is a description of the table elements:
Name
Displays the name of the web app protection object.
Manage
Displays the available managing options for the web application protection object:
• Edit Allows you to edit the web app protection object.
• Delete Allows you to delete the web app protection object.
To either add or delete a web app protection object, click on the corresponding buttons.
Add Application Protection
This page describes how to add a web app protection object.
1. Navigate to Protection > Web Server Protection > Web App Protection Policies or Objects > Policies > Web
App Protection and click Add.
2. Enter values for the following settings:
Name
Enter a descriptive name for the web app protection object.
Description
Enter a description or other information.
Pass Outlook Anywhere
Enable to allow external Microsoft Outlook clients to access the Microsoft Exchange Server via the WAF.
Microsoft Outlook traffic will not be checked or protected by the WAF.
Mode
Select a mode from the drop-down list:
• Monitor: HTTP requests are monitored and logged.
• Reject: HTTP requests are rejected.
Cookie Signing
Enable to protects a webserver against manipulated cookies. When the webserver sets a cookie, a second cookie is added to the first cookie containing a hash built of the primary cookie's name, its value and a secret, where the secret is only known by the WAF. Thus, if a request cannot provide a correct cookie pair, there has been some sort of manipulation and the cookie will be dropped.
Static URL Hardening
Enable to protect against URL rewriting. For that, when a client requests a website, all static URLs of the website are signed. The signing uses a similar procedure as with cookie signing. Additionally the response from the webserver is analyzed regarding what links can be validly requested next. Static Hardened URLs can furthermore be bookmarked and visited later.
Note: Static URL hardening affects all files with a HTTP content type of text/* or *xml*, where * is a wildcard. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the URL hardening feature. It does not work for dynamic URLs created by client, for example: JavaScript.
Note: You can find more information about Static URL Hardening and Form Hardening under:
Additional Information on Static URL Hardening and Form Hardening
on page 119
| Device Configuration | 368
Entry URLs
Add URL for static URL hardening:
Form Hardening
Enable to protect against web form rewriting. Form hardening saves the original structure of a web form and signs it. Therefore, if the structure of a form has changed when it is submitted the WAF rejects the request.
Note: Form hardening affects all files with a HTTP content type of text/* or *xml*, where * is a wildcard. Make sure that other file types, e.g. binary files, have the correct HTTP content type, otherwise they may get corrupted by the form hardening feature.
Note: You can find more information about Static URL Hardening and Form Hardening under:
Additional Information on Static URL Hardening and Form Hardening
on page 119
Anti Virus
Enable to protect a webserver against viruses.
Mode: Sophos Firewall OS features several antivirus engines for best security.
• Avira
• Sophos
• Dual Scan
Direction: Select from the drop-down list whether to scan only up- or downloads or both.
• Uploads
• Downloads
• Uploads and Downloads
Block unscannable content
Enable to block files that cannot be scanned. The reason for that may be, among other things, that files are encrypted or corrupt.
Limit scan size
Enable to enter the scan size limit into an additional field. Provide the limitation in Megabyte.
Note: Please note that the scan size limit refers to an upload, not to single files. This means, if you for example limit to 50 MB and make an upload with multiple files (45 MB, 5 MB and 10 MB), the last file will not be scanned and a virus cannot be detected caused by the limitation.
Note: If you do not enter a limitation value it will be saved with '0' megabytes which means the limitation is not active.
Block clients with bad reputation
Enable to block clients which have a bad reputation according to their classification, based on GeoIPClosed and RBLClosed information. Sophos uses the following classification providers: RBL sources:
• Commtouch IP Reputation (ctipd.org)
• http.dnsbl.sorbs.net
The GeoIP source is Maxmind. The WAF blocks clients that belong to one of the following Maxmind categories:
• A1: Anonymous proxies or VPN services used by clients to hide their IP address or their original geographical location.
• A2: Satellite providers are ISPs that use satellites to provide Internet access to users all over the world, often from high risk countries.
Skip remote lookups for clients with bad reputation
Enable to use GeoIP-based classification which uses cached information only and is therefore much faster.
As reputation lookups include sending requests to remote classification providers, using reputation-based blocking may slow down your system.
| Device Configuration | 369
Block clients with bad reputation
Threats Filter
Enable to protect your webservers from several threats. You can specify the threat filter categories you want to use in the Threat Filter Categories section below. All requests will be checked against the rule sets of the selected categories. Depending on the results, a notice or a warning will be shown in the live log or the request will be blocked directly.
Rigid Filtering
Enable to tight several of the selected rules. This may lead to false positives.
Skip Filter Rules
Enable to add the rule number that you want to skip to this box. Some of the selected threat categories may contain rules that lead to false positives. To avoid false positives induced by a specific rule. WAF rule numbers can for example be retrieved on the Logging & Reporting > Webserver Protection > Details page, via the Top Rules filter.
Protocol Violations
Enforces adherence to the RFC standard specification of the HTTP protocol. Violating these standards usually indicates malicious intent.
Protocol Anomalies
Searches for common usage patterns. Lack of such patterns often indicates malicious requests. These patterns include, among other things, HTTP headers like 'Host' and 'User-Agent'.
Request Limits
Enforces reasonable limits on the amount and ranges of request arguments. Overloading request arguments is a typical attack vector.
HTTP Policy
Narrows down the allowed usage of the HTTP protocol. Web browsers typically use only a limited subset of all possible HTTP options. Disallowing the rarely used options protects against attackers aiming at these often less well supported options.
Bad Robots
Checks for usage patterns characteristic of bots and crawlers. By denying them access, possible vulnerabilities on your webservers are less likely to be discovered.
Generic Attacks
Searches for attempted command executions common to most attacks. After having breached a webserver, an attacker usually tries to execute commands on the server like expanding privileges or manipulating data stores. By searching for these post-breach execution attempts, attacks can be detected that might otherwise have gone unnoticed, for example because they targeted a vulnerable service by the means of legitimate access.
SQL Injection Attacks
Checks for embedded SQL commands and escape characters in request arguments. Most attacks on webservers target input fields that can be used to direct embedded SQL commands to the database.
XSS Attacks
Checks for embedded script tags and code in request arguments. Typical cross-site scripting attacks aim at injecting script code into input fields on a target webserver, often in a legitimate way.
Tight Security
Performs tight security checks on requests, like checking for prohibited path traversal attempts.
Trojans
Checks for usage patterns characteristic of trojans, thus searching for requests indicating trojan activity. It does not, however, prevent the installation of such trojans as this is covered by the antivirus scanners.
Outbound
Prevents webservers from leaking information to the client. This includes, among other things, error messages sent by servers which attackers can use to gather sensitive information or detect specific vulnerabilities.
Figure 253: Add Web App Protection
3. Click Save to save your settings.
The web app protection object is created and appears in the web app protection list.
| Device Configuration | 370
| Device Configuration | 371
Additional Information on Static URL Hardening and Form Hardening
It would be best practice to always enable both URL hardening and form hardening because those two functions are complementary, especially in the way that they prevent issues you may have when enabling just one of them:
• Only form hardening is activated: When a webpage contains hyperlinks with appended queries (which is the case with certain CMSs), e.g. http://example.com/?view=article&id=1, such page requests are blocked by form hardening because it expects a signature, which is missing.
• Only URL hardening is activated: When a web browser appends form data to the action URL of the form tag of a web form (which is the case with GET requests), the form data becomes part of the request URL sent to the webserver, by that rendering the URL signature invalid.
The reason why activating both functions solves those issues is that in case either form hardening or URL hardening find that a request is valid, the WAF accepts the request.
Web App Authentication
You can define how to use the Web Application Firewall to authenticate users directly instead of leaving the authentication to the real web servers. Via authentication profiles, the reverse authentication can be used to assign specific authentication settings to each site path route.
Protection > Web Server Protection > Web App Authentication Policies or Objects > Policy > Web App
Authentication
Note: You can also view and manage the WAF status on the System > Diagnostics > Services page.
The page displays all existing web application authentication profiles. You can add new application authentication profiles, edit or delete them. Following is a description of the table elements:
Name
Displays the name of the web app authentication profile.
Manage
Displays the available managing options for the web app authentication profile:
• Edit Allows you to edit the web app authentication profile.
• Delete Allows you to delete the web app authentication profile.
To either add or delete a web app authentication profile, click on the corresponding buttons.
Add Web App Authentication
This page describes how to add a web app authentication profile.
1. Navigate to Protection > Web Server Protection > Web App Authentication Policies or Objects > Policy >
Web App Authenticationand click Add.
2. Enter values for the following settings:
Name
Enter a descriptive name for the web app authentication profile.
Description
Enter a description or other information.
3. Make the settings for the Client Authentication.
Mode
Select how the users should authenticate at the Web Application Firewall.
• Basic: Users authenticate with HTTP basic authentication, entering username and password. As the credentials are sent unencrypted with this mode, it should be used over HTTPS. With this mode, no session cookies will be generated and a dedicated logout is not possible.
• Form: Users will be presented a form where they have to enter their credentials. With this mode, session cookies will be generated and a dedicated logout is possible. The form template to be used can be selected
| Device Configuration | 372 in the Web App Auth Template list. Besides the default form template, the list shows the forms that have been defined on the
page
Basic Prompt
(only with Basic mode)
The realm is a unique string that provides additional information on the login page and is used for user orientation.
Note: These characters are allowed for the Basic Prompt: A-Z a-z 0-9 , ; . : - _ ' + = ) ( & % $ ! ^ <
> | @
Web App Auth Template
Select the form template that will be presented to the users for authentication. Form templates are defined on
page.
User or Groups
Select the users or user groups that should be assigned to this web app authentication profile. After assigning this profile to a site path route, these users will have access to the site path with the authentication settings defined in this profile. Typically, this would be a backend user group.
Note: Sometimes users should be required to use the User Principal Name notation 'user@domain' when entering their credentials, for example when using Exchange servers in combination with
Active Directory servers.
4. Make the settings for the Authentication Forwarding.
Mode
Select how the Web Application Firewall authenticates against the real webservers. The mode has to match the webservers authentication settings.
• Basic: Authentication works with HTTP basic authentication, providing username and password.
• None: There is no authentication between WAF and the webservers. Note that even if your real webservers do not support authentication, users will be authenticated via the frontend mode.
User name affix
(only with Basic Authentication Forwarding mode)
Select an affix for the username and enter it into the concerning field. Affixes are useful when working with domains and email addresses.
• None
• Prefix
• Suffix
• Prefix & Suffix
Note: Prefix and suffix will be added automatically if the user enters their username. Prefix and suffix will not be added if the user enters it. Example: If the suffix is @testdomain.de and the user enters their username test.user the suffix will be added. If they enter [email protected] the suffix will be ignored.
Remove Basic Header
(only with None Authentication Forwarding)
Enable to not send the basic header from Sophos Firewall OS to the real webserver.
5. Make the settings for the User Session.
Session Timeout
Enable to set a timeout for the user session, which will confirm user credentials by having them log in again if they do not perform any action on the virtual webserver.
Limit To
(only if Session Timeout is enabled)
| Device Configuration | 373
Set an interval for the session timeout. Default is 5 minutes.
Session Lifetime
Enable to set a hard limit for how long users may remain logged in, regardless of activity in the meantime.
Limit To
(only if Session Lifetime is enabled)
Set a value for the session lifetime. Default is 8 hours.
Figure 254: Add Web App Authentication Policies
6. Click Save.
The Web App Authentication profile is created and appears in the Web App Authentication list.
Device Access Profile
Objects > Policies > Device Access Profile
Role-based administration capabilities are provided to offer greater granular access control and flexibility.
| Device Configuration | 374
It allows an organization to separate super administrator's capabilities and assign through Profiles. Profiles are a function of an organization's security needs and can be set up for special-purpose administrators in areas such as policy administration, network administration, and logs administration. Profiles allow granting permissions to individual administrators depending on their role or job need in the organization.
The profile separates device features into access control categories for which you can enable none, read only, or readwrite access.
The Profiles list shows the default and custom profiles you have created and enables you to add, edit, and delete the profiles.
For ease of use, by default the device provides 5 profiles:
• Administrator – super administrator with full privileges
• Audit Admin – read-write privileges for Logs & Reports only
• Crypto Admin – read-write privileges for Certificate configuration only
• HA Profile – read-only privileges. If HA is configured, any user accessing Web Admin Console of Auxiliary device will have privileges as defined in HA Profile.
• Security Admin – read-write privileges for all features except Profiles and Log & Reports
An Administrator with full privileges can create other custom administrators and assign them restricted/full privileges.
A custom administrator so created, if has restricted privileges, can only update their Email Address and password.
Note:
• You cannot delete the default profiles.
• You cannot delete the profile which is already assigned to administrator.
Access Denied page
Device provides role-based administration capabilities and privileges are assigned to the Administrator through
Profiles. Administrator can have read only, read-write or no access privilege for the pages of Web Admin Console.
Access denied page is displayed when the Administrator tries to access a page or perform the operation, which is not allowed to him/her.
Add a new Profile
The Add Profile page allows you to add administrator profiles.
1. Navigate to Objects > Policies > Device Access Profile and click Add.
2. Enter Profile details.
Profile Name
Specify a name to identify the profile.
Configuration
Click on the access level you want to provide to a profile. There are three levels of access each of the created profile can have.
Available Options:
None: No access to any page Read-Only: View the pages Read-Write:Modify the details
Access levels can be set for individual menus as well. You can either set a common access level for all the menus or individually select the access level for each of the menu.
Click icon against a menu to view the items under that menu.
For example, if you set access level as Read-Only against the Web Filter, the profile user would only be able to view the Web Filter menu but would not be able to make any modifications. To make modifications, Read-
Write option is to be used.
Figure 255: Add Device Access Profile
3. Click Save to save the settings.
Global App Traffic Shaping
Use the Global App Traffic Shaping page to view the list of all the categories.
| Device Configuration | 375
| Device Configuration | 376
The applications shipped with the device are grouped into categories. These categories can be used in filtering policy and bandwidth restriction can be applied. Bandwidth restriction can be applied on the category or on the individual application within the category.
The categories list can be filtered based on name of the category. Use or toggle besides the category name to expand and collapse list of applications grouped in the respective category.
This page also provides option to edit the category or application to apply the traffic shaping policy.
Configure Traffic Shaping Policy for Category or Application
Use this page to configure traffic shaping policy.
This page allows you to configure Traffic Shaping Policy for Category or Application.
1.
Navigate to Objects > Policies > Global App Traffic Shaping and click on .
2. Enter the details.
Name
Name of the Application Filter Category or Application.
Traffic Shaping Policy
Click ‘Create New’ to create a new Traffic Shaping Policy for the application/application category.
Traffic Shaping policy allocates and limits the maximum bandwidth usage of the user, rule, web category, app category.
Figure 256: Global App Traffic Shaping
3. Click Save to accept and configure the Traffic Shaping Policy.
Application Filter
The Application Filter page displays list of all the predefined and custom policies.
Application Filter Policy controls user’s application access. It specifies which user has access to which applications and allows defining powerful security policies based on almost limitless policy parameters like:
• Individual users
• Groups of users
• Time of day
The device is shipped with the following predefined policies for application filters:
• Allow: By default, allows access to all the groups except the specified groups. Access to the specified groups depends on the strategy defined for each group.
• Deny: By default, denies access to all the groups except the specified group. Access to the specified groups depends on the strategy defined for each group.
These two predefined policies are immediately available for use until configured otherwise. You can also define custom policies to define different levels of access for different users to meet your organization’s requirements.
The page also provides option to add a new policy, update parameters of the exisiting policy, delete a policy, add a filtering rule to a policy or delete a filtering rule attached to a policy.
| Device Configuration | 377
Application Filter Policy
This page lets you configure custom policies to define different levels of access for different users to meet your organizations's requirements.
The Add page allows you to manually configure policies.
1. Navigate to Protection > Application Protection > Application Filter or Objects > Policies > Application
Filterand click Add.
2. Enter the Application Filter Policy details.
Name
Enter a name to identify the Application Filter Policy.
Description
Enter description for the Application Filter Policy.
Enable Micro App Discovery
Enable to scan and classify microapps using HTTP protocol for communication. Microapps are applications that are used withing web browsers.
To allow/deny microapps, you need to specify action accordingly.
Refer Appendix D - Supported Micro-Apps for more details on supported applications.
Template
Select template for the Application Filter Policy.
Figure 257: Add Application Filter Policy
3. Click Save.
4. Once the policy is added, next step is to add a rule for configuring filtering criteria.
Note:
• Rules can be added for custom policies only.
• If Micro App Discovery is enabled, one has to import SSL CA to avoid Certificate error.
Add a Firewall Rule for Application Filter Policy
Use the Add Firewall Rule page to configure a new rule for Application Filter Policy.
The Add Firewall Rule page allows you to manually configure a new rule.
1. Navigate to Protection > Application Protection > Application Filter or Objects > Policies > Application
Filter and click .
2. Click on the Add button under Application Group Policy.
3. Enter the application filter details.
Category
Select Application Category from the list of available categories.
| Device Configuration | 378
Risk
Select the level of risk from the available options.Select All1 - VERY LOW 2 - LOW3 - MEDIUM 4 -
HIGH5 - VERY HIGH
Characteristics
Select the characteristics from the available options.Select AllExcessive BandwidthProne to misuseTransfer filesTunnels other appsVulnerabilities Widely usedLoss of productivityCan bypass firewall policy
Technology
Select the technology from the available options.Select AllBrowser BasedClient ServerNetwork ProtocolP2P
4. Enter the list of matching applications.
Select All
Click to select all the Applications from the list.
Applications are available based on the Application Filter Criteria.
Select Individual Application
Click to select the Applications from the list.
Applications are available based on the Application Filter Criteria.
Search
Specify the name of the application in the textbox to be searched.
This option is available, only if option "Select Individual Application" is selected.
Name
Displays name of the Applications under the Category selected. You can also select more than one application using the checkbox.
Description
Displays description of the Application.
Category
Displays category of the Application.
Risk
Displays the risk factor involved with the Application.
Characteristics
Displays the characteristics of the Application.
Technology
Displays the technology utilized for the Application.
5. Enter the action you want to perform.
Action
Select an Action for the Policy from the available options. Allow Deny
Schedule
Select schedule from the list available in the dropdown list.
| Device Configuration | 379
Figure 258: Add Application Filter Policy Rules
6. Click Save.
Hotspot Voucher Definition
In this chapter you can manage different voucher definitions for voucher type Hotspots.
Protection > Wireless Protection > Hotspot Voucher Definition or Objects > Policies > Hotspot Voucher
Definition
The page displays all existing voucher definitions. You can add new voucher definitions, update or delete them.
Following is a description of the table elements:
Name
Displays the name of the voucher definition.
Manage
Displays the available managing options for the voucher definition:
• Edit: Allows you to edit the voucher definition.
• Delete: Allows you to delete the voucher definition.
To either add or delete a voucher definition, click on the corresponding buttons.
Add Hotspot Voucher
This page describes how to add a voucher definition.
1. Navigate to Protection > Wireless Protection > Hotspot Voucher Definition or Objects > Policies > Hotspot
Voucher Definition and click Add.
2. Make the following settings:
Name
Enter a descriptive name for the voucher definition.
Description
Enter a description or other information.
| Device Configuration | 380
Validity Period
Enter the time span for which a voucher with this definition will be valid. Counting starts at the first login. It is highly recommended to enter a time period.
Note: The maximum time for the Validity Period is two years.
Time Quota
Here you can restrict the allowed online time. Enter the maximum online time after which a voucher of this definition expires. Counting starts at login and stops at logout. Additionally, counting stops after 5 minutes of inactivity.
Note: The maximum time for the Time Quota is two years.
Data Volume
Here you can restrict the allowed data volume. Enter the maximum data volume to be transmitted with this voucher definition.
Note: The maximum data volume is 100 GB.
Figure 259: Hotspot Voucher Definition
3. Click Save to save your settings.
The voucher definition is now available and appears on the voucher list.
Hosts and Services
Objects > Hosts and Services
Hosts and Services allows defining and managing system hosts and services.
This section covers the following topics:
•
host, update the existing host, or delete a host.
•
- Host Group is a grouping of hosts. Security Policies can be created for the individual host or host groups. This page displays the list of all the host groups. It also provides options to manage these host groups.
•
- Device allows creating a host based on MAC Address. One can create a MAC Host of either a single
MAC Address or multiple MAC Addresses. This page displays the list of all the available MAC host. The page also provides option to add a new MAC host, update the existing host, or delete a host.
•
- This page displays the list of all the available FQDN host.
•
- FQDN Host Group is a grouping of FQDN hosts. This page displays the list of all the
available FQDN host groups.
| Device Configuration | 381
•
- The device allows to create Country based Host. With Country based Host one can apply all
Security and UTM Policies based on the traffic coming from the country and/or going out of the country. This page displays the list of all the available Country hosts.
•
- Country Host Group is a grouping of Country Hosts. Multiple countries can be selected to block or allow incoming traffic by using Country Host Group. This page displays the list of all the available
Country host groups.
•
displays the list of all the default and custom services. It also provides options to manage services.
•
- Service Group is a grouping of services. Custom and default services can be grouped in a single group. The page displays the list of all the default and custom groups.
IP Host
The IP Host page displays the list of all the dynamic hosts, default hosts and manually added hosts.
Hosts allow the entities to be defined once and be re-used in multiple referential instances throughout the configuration. For example, consider an internal Mail Server with an IP Address 192.168.1.15. Rather than repeated use of the IP Address while configuring Security Policies or NAT Policies, it allows to create a single entity Internal
Mail Server as a Host name with an IP Address 192.168.1.15. This host, Internal Mail Server can then be selected in any configuration that uses Host as a defining criterion.
By using host name instead of numerical address, you only need to make changes in a single location, rather than in each configuration where the IP Address appears.
Using Hosts, reduces the error of entering incorrect IP Addresses, makes it easier to change IP Addresses, and increases readability.
The IP Host page displays the list of all the dynamic hosts which are automatically added on creation of VPN
Remote access connections (IPSec and SSL) and the default hosts (IPv6 and IPv4) for remote access connection -
##ALL_RW, ##WWAN1, ##ALL_IPSEC_RW and ##ALL_SSLVPN_RW along the manually added hosts. The page also provides option to add a new host, update the existing host, or delete a host.
Note:
• System hosts cannot be updated or deleted.
• Dynamic hosts which are automatically added on creation of VPN Remote Access connections cannot be deleted.
• Default hosts (IPv6 and IPv4) for remote access connection - ##ALL_RW, ##WWAN1,
##ALL_IPSEC_RW and ##ALL_SSLVPN_RW cannot be updated or deleted.
Adding a IP Host
The Add IP Host page allows you to manually add IP host.
1. Navigate to Objects > Hosts and Services > IP Host and click Add.
2. Enter IP Host details.
Name
Enter a name to identify the IP Host.
IP Family
Select the type of IP Family from the options available:
Available Options:IPv4IPv6
Type
Select the type of host.
Available Options: Single IP AddressNetwork IP Address with subnetIP RangeIP List - To add assorted IP
Addresses. Use comma to specify assorted multiple IP Addresses. Create IP list to configure single policy for multiple IP Address which are not in a range.
Note: Only Class B IP Addresses can be added in IP list. IP Addresses can be added or removed from IP list.
| Device Configuration | 382
IP Address
Specify IPv4 Address or IPv6 Address based on the Host Type selected.
IP Host Group
Select host group. Single host can be member of multiple host groups.
You can also add a host group from Add Host page itself or from Objects > Assets > IP Host Group page.
Note:
• Single host can be member of multiple host groups.
• A Group with IPv4 and IPv6 hosts cannot be created.
• IP Host Group is not available for "IP List" Type.
Figure 260: Add IP Host
3. Click Save to add the IP Host with the options you have configured.
IP Host Group
The IP Host Group page displays the list of all the host groups.
Host Group is a grouping on hosts. Security policies can be created for the individual host or host groups.
Note: Dynamic host groups which are automatically added on creation of VPN Remote Access Connections cannot be deleted.
The page also provides option to add a new host group, update the parameters of the existing host group, add members to the existing host group, or delete a host group.
Adding a IP Host Group
Use the Add IP Host Group page to create a new Host Group.
The Add IP Host Group page allows you to configure an IP Host Group.
1. Navigate to Objects > Hosts and Services > IP Host Group and click Add.
2. Enter IP Host Group details.
Name
Enter a name to identify the IP Host Group.
IP Family
Select the type of IP Family from the options available:
Available Options:IPv4IPv6
Description
Describe the IP Host Group.
Select Host
'Host List' displays all the hosts including default hosts.
Click the checkbox to select the hosts. All the selected hosts are moved to 'Selected host' list.
Single host can be a member of multiple host groups.
A Group with IPv4 and IPv6 hosts cannot be created.
| Device Configuration | 383
Figure 261: Add IP Host Group
3. Click Save to add the IP Host Group with the options you have configured.
MAC Host
The MAC Host page displays the list of all the available MAC hosts.
Device allows to create a host based on MAC Address. One can create a MAC Host of either a single MAC Address or multiple MAC Addresses.
MAC Hosts allow entities to be defined once and be re-used in multiple referential instances throughout the configuration. For example, test has a MAC Address as 00:16:76:49:33:CE or 00-16-76-49-33-CE. Rather than remembering the MAC Address of the intended machine while applying policies, you can simply provide its MAC
Host name.
By using MAC hosts, you only need to make changes in a single location, rather than in each configuration where the
MAC Address appears.
Using MAC Hosts reduces the error of entering incorrect MAC Addresses, makes it easier to change addresses, and increases readability.
The page also provides option to add a new MAC host, update the existing host, or delete a host.
Adding a MAC Host
Use the Add MAC Host page to create a MAC Host.
The Add MAC Host page allows you to manually create a MAC Host of either a single MAC Address or multiple
MAC Addresses.
1. Navigate to Objects > Hosts and Services > MAC Host and click Add.
2. Enter MAC Host details.
Name
Enter a name to identify a MAC Host.
Type
Select the MAC Host Type.
| Device Configuration | 384
Available Options:MAC Address - Select to add a single MAC Address.MAC List - Select to add multiple
MAC Addresses.
MAC Address (Applicable only if Type is selected as MAC Address)
Specify MAC Address based on the Host Type selected in the form of 00:16:76:49:33:CE or 00-16-76-49-33-
CE.
List of MAC Addresses (Applicable only if Type is selected as MAC List)
Specify MAC Address based on the Host Type selected in the form of 00:16:76:49:33:CE or 00-16-76-49-33-
CE.
Use comma to configure multiple MAC Addresses.
Figure 262: Add MAC Host
3. Click Save to add a MAC Host.
FQDN Host
The FQDN Host page displays the list of all the available FQDN host.
FQDN (Fully Qualified Domain Name) Hosts allow entities to be defined once and be re-used in multiple referential instances throughout the configuration. For example,
www.example.com
has an IP Address as 192.168.1.15.
Rather than remembering the IP Address of the intended website while accessing it, you can simply provide
www.example.com
in the browser. The FQDN
www.example.com
will now be mapped to its respective IP Address, and the intended webpage opens.
The page also provides option to add a new FQDN host, update the existing host, or delete a host.
Adding a FQDN Host
Use the Add FQDN Host page to create a new FQDN host.
The Add FQDN Host page allows you to manually configure a new FQDN host.
1. Navigate to Objects > Hosts and Services > FQDN Host and click Add.
2. Enter FQDN Host details.
Name
Specify a name to identify the FQDN Host.
FQDN
Specify FQDN Address.
FQDN Host Group
Select FQDN Host Group. Single FQDN Host can be member of multiple host groups.
You can add a new FQDN Host Group from this page itself or from Objects > Assets > FQDN Host Group page.
| Device Configuration | 385
Figure 263: Add FQDN Host
3. Click Save to add a FQDN Host.
FQDN Host Group
The FQDN Host Group page displays the list of all the available FQDN host groups.
FQDN Host Group is a grouping of FQDN hosts. Security Policies can be created for the individual FQDN host or host group to allow or deny access to any website.
The page also provides option to add a new FQDN host group, update the parameters of the existing host group, add members to the existing host group, or delete a group.
Adding a FQDN Host Group
Use the Add FQDN Host Group page to create a new FQDN host group.
The Add FQDN Host Group page allows you to configure a new FQDN host group.
1. Navigate to Objects > Hosts and Services > FQDN Host Group and select Add.
2. Enter FQDN Host Group details.
Name
Enter a name to identify the FQDN Host group.
Description
FQDN Host Group description.
Select Host
"Host" List displays all the hosts including default hosts.
Click the checkbox to select the hosts. All the selected hosts are moved to "Selected host" list.
Single host can be a member of multiple host groups.
Figure 264: Add FQDN Host Group
3. Click Save to add a FQDN Host Group.
| Device Configuration | 386
Country Host
The Country Host page displays the list of all the available Country hosts.
The device allows to create Country based Host. With Country based Host one can apply all Security and UTM
Policies based on the traffic coming from the country and/or going out of the country.
Country Hosts created once can be re-used in multiple referential instances throughout the configuration. For example, you want to deny incoming traffic from country “X”. You can select the country “X” and select the option to block the traffic coming from “X”.
Adding a Country Host
Use the Add Country Host page to create country based host.
The Add Country Host page allows you to manually enter details to add a country based host.
1. Navigate to Objects > Hosts and Services > Country Host and click Add.
2. Enter details.
Name
Enter a name to identify the Country Host.
Country
Select the Country.
Country Host Group
Select Country Host Group. Single host can be member of multiple host groups.
You can add a new Country Host Group from this page itself or from Objects > Assets > Country Host
Group page.
Figure 265: Add Country Host
3. Click Save.
Country Host Group
The Country Host Group page displays the list of all the available Country host groups.
Country Host Group is a grouping of Country Hosts. Multiple countries can be selected to deny or allow incoming traffic by using Country Host Group. Security Policies can be created for an individual Country Host or Country Host
Groups.
The page also provides option to add a new host group, update the parameters of the existing host group, add members to the existing host group, or delete a group.
Adding a Country Host Group
Use the Add Country Host Group page to create a new country host group.
The Add Country Host Group page allows you to manually configure parameters to add a new country host group.
1. Navigate to Objects > Hosts and Services > Country Host Group and click Add.
2. Enter FQDN Host Group details.
Name
Enter a name to identify the Country Host group.
Description
Country Host Group description.
Select Host
"Host" List displays all the hosts including default hosts.
Click the checkbox to select the hosts. All the selected hosts are moved to 'Selected host' list.
Single host can be a member of multiple host groups.
| Device Configuration | 387
Figure 266: Add Country Host Group
3. Click Save to add a Country Host Group.
Services
The Services page displays the list of all the default and custom services.
Services are definitions of certain types of network traffic and combine information about a protocol such as TCP,
ICMP or UDP as well as protocol-related options such as port numbers. You can use services to determine the types of traffic allowed or denied by the firewall.
Certain well-known traffic types have been predefined in services. These predefined services are defaults, and cannot be updated or deleted. If you require service definitions that are different from the predefined services, you can add them as custom services.
The page also provides option to add a new service, update the parameters of the existing service, or delete a service.
Note:
• Service used by Security Policies cannot be deleted.
• Default Services can neither be updated nor deleted.
Adding a New Service
Use the Add Service page to add a new Service.
The Add Service page allows you to manually configure parameters to add a new Service.
1. Navigate to Objects > Hosts and Services > Services and click Add.
2. Enter Service parameters.
Name
Enter a name to identify the Service.
Type
Select a protocol for the service.
Available Options:TCP/UDP - Enter Source and Destination port. You can enter multiple ports for the same service. IP - Select Protocol Number for the Service. You can select multiple ports for the same service.
| Device Configuration | 388
ICMP - Select ICMP Type and Code. You can enter multiple types and codes for the same service. Use Add icon and Remove icon to add and delete the parameters respectively. ICMPv6 - Select ICMPv6 Type and Code. You can enter multiple types and codes for the same service.
Use Add and Remove to add and delete the parameters.
Figure 267: Add Service
3. Click Save to add a Service.
Service Group
The Service Group page displays the list of all the default and custom service groups.
Service Group is a grouping of services. Custom and default services can be grouped in a single group.
Use to configure Security Policies to:
• block group of services for specific zone
• limit some or all users from accessing group of services
• allow only specific user to communicate using group of service
Create groups of services and then add one firewall to allow or block access for all the services in the group. A service group can contain default services as well as custom services in any combination. A single service can be a member of multiple service groups.
The page also provides option to add a new group, update the parameters of the existing group, add members to the existing group, or delete a group.
Note:
• Default Service Groups can neither be updated nor deleted.
• Service Group used by the Security Policies cannot be deleted.
Adding a Service Group
Use the Add Service Group page to add a new customized Service Group.
The Add Service Group page allows you to manually enter details and configure a new service group.
1. Navigate to Objects > Hosts and Services > Service Group and click Add.
2. Enter Service Group details.
Name
Enter a name to identify the Service Group.
Description
Service Group Description.
Select Service
Service List displays all the services including default services.
Click the checkbox to select the service. All the selected services are moved to the Selected Service list.
Single service can be a member of multiple groups.
Use Search to search a service from the list.
You can create a group containing IPv4 and IPv6 services.
| Device Configuration | 389
Figure 268: Add Service Group
3. Click Save to add a Service Group.
Descarcă
Link public actualizat
Linkul public către chat-ul tău a fost actualizat. You may view and manage your chat links after registration here.
Link public document
Publicitate
