Cyberoam 9.5.4 Unified Threat Management User Guide

Configuring DHCP services

Viewing current IP leases

Disabling DHCP services

Updating DHCP services

Enable DHCP service on an Interface

Select

System → Configure Network → Configure DHCP

Screen - Configure DHCP

134

Cyberoam User Guide

Screen Elements Description

DHCP Details

Network Interface

Lease IP From

Select the interface that is to be used for leasing IP addresses i.e. act as a DHCP server. DHCP service cannot be configured on

Interface alias or virtual sub interface.

Specify range of IP address or IP pool from which DHCP server has to lease or assign IP address to the host

Domain name

Subnet Mask

Save button

Specify domain name for the specified subnet

Specify subnet mask for the client/network

Gateway Specify IP address of Gateway

Domain name server Specify IP address of Domain name server

Default Lease Time and Max Lease Time

DHCP client must ask the DHCP server for new settings after the specified maximum lease time. The lease time can range from 61 seconds to 2592000 seconds (30 days). Default lease time is 600 seconds while maximum lease time is 7200 seconds.

Saves details

Table - Configure DHCP screen elements

View DHCP leased IP address list

Cyberoam acting as a DHCP server assigns or leases an IP address from an address pool to a host

DHCP client. The IP address is leased for a determined period of time or until the client relinquishes the address.

View a list of leased IP addresses from

System → Configure Network → Configure DHCP

The following information is available in the leased IP list:

• Leased IP address

• Lease start and end time

• Physical address or MAC address and name of the host

Screen – View DHCP leased IP list

Update DHCP configuration

To update the DHCP services, go to

System → Configure Network → Configure DHCP and click the Interface

135

Cyberoam User Guide

Screen – Update DHCP configuration

Disable DHCP services

To disable the DHCP services from an interface, go to

System → Configure Network →

Configure DHCP and click ‘Del’ checkbox against the Interface and click ‘Delete’ button.

Screen - Disable DHCP service

136

Cyberoam User Guide

View Interface details

Use to

• view the Interface configuration

• add interface alias

Manage Interface

Select

System Æ Configure Network Æ Manage Interface to view port wise network

(physical interface) and zone details. If virtual subinterfaces are configured for VLAN implementation, they are also nested and displayed beneath the physical interface.

Interface - Physical interfaces/ports available on Cyberoam. If virtual subinterface is configured for the physical interface, it also displayed beneath the physical interface. Virtual subinterface configuration can be updated or deleted.

Add Alias button address for more details

- Click to specify alias IP address for the interface. Refer

Configure Alias IP

Add VLAN Subinterface button

VLAN for more details

– Click to add VLAN interface. Refer

Define

Toggle Drill Down icon - Click to few the virtual subinterfaces defined for the said physical interface

Edit icon - Click to edit IP address and netmask of physical or virtual subinterface

Delete icon - Click to delete virtual subinterface. Virtual subinterface cannot be deleted, if virtual subinterface is member of any zone or firewall rule is defined for the virtual subinterface.

Zone and Zone Type - Displays port to zone relationship i.e. zone membership of port. If PPPoE is configured, WAN port will be displayed as the PPPoE Interface.

Screen – Manage Interface

Add Interface Alias

Select

System Æ Configure Network Æ Manage Interface to open page

Screen – Add Alias

137

Cyberoam User Guide

Screen Elements Description

Add Alias

Physical Interface

Alias

Select the physical interface for which Alias is to be added.

Alias cannot be added for the virtual interface.

Click Single or Range to define one or multiple IP address for the Alias

IP Address and netmask Specify IP address and Netmask

Add button Click to save the details

Table – Add Alias screen elements

Edit Interface Alias details

Select

System Æ Configure Network Æ Manage Interface to open page

Screen – Edit Alias

Screen Elements Description

Update Alias

Interface Displays physical interface for which Alias is added

IP Address and netmask Modify IP address and Netmask

Update button Click to save the details

Table – Edit Alias screen elements

Delete Interface Alias details

Select

System Æ Configure Network Æ Manage Interface to open page and click Delete icon against the alias to be deleted

Screen – Delete Alias

138

Cyberoam User Guide

Configuring Dynamic DNS service

Dynamic DNS (Domain Name Service) is a method of keeping a static domain/host name linked to a dynamically assigned IP address allowing your server to be more easily accessible from various locations on the Internet.

Powered by Dynamic Domain Name System (DDNS), you can now access your Cyberoam server by the domain name, not the dynamic IP address. DDNS will tie a domain name (e.g. mycyberoam.com, or elitecore.cyberoam.com) to your dynamic IP address.

Register hostname with DDNS service provider

Select

System Æ Dynamic DNS Configuration Æ Create Account to open configuration page

Screen – Register Hostname with DDNS

Screen Elements Description

Host Name Detail

Hostname Specify hostname you want to use on DDNS server i.e. domain name that you registered with your DDNS service provider

Specify description

Service Provider’s details

Service name Select Service provider with whom you have registered your hostname.

Password

Specify your DDNS account’s login name and password

IP detail

IP address Select WAN Interface if Cyberoam WAN interface is assigned Public IP

139

Cyberoam User Guide address. IP address of the selected interface will be binded with the specified host name.

Select NATed Public IP if Cyberoam WAN interface is assigned private

IP address and is behind NAT box.

Checking Interval

Create button update the IP address of your server if changed.

For example if time interval is set to 10 minutes, after every 10 minutes,

DDNS server will check for any changes in your server IP address

Click Create to save the configuration

Table – Register hostname with DDNS

Testing your Dynamic DNS configuration

You can test your Dynamic DNS by:

• Access your Cyberoam server using the host name you have registered with DDNS service provider - If you are able to access Cyberoam then your configuration is correct and DDNS is working properly.

• Ping your host - If you get the IP address of your external interface then your configuration is correct and DDNS is working properly.

Manage Account

Check the IP address updation status from the Manage Account page. It also displays the reason incase updation was not successful.

Select

System Æ Dynamic DNS Configuration Æ Manage Account to open configuration page and click the hostname to be updated.

140

Cyberoam User Guide

PPPoE

PPPoE Client is a network protocol that uses Point to Point Protocol over Ethernet to connect with a remote site using various Remote Access Service products. This protocol is typically founding broadband network of service provider. The ISP may then allow you to obtain an IP address automatically or give you a specific IP address.

PPPoE Access Concentrator is a router that acts as a server in a Point-to-Point Protocol over Ethernet

(PPPoE) session and is used to:

• For Ethernet LANs, to assign IP addresses to workstations, e.g. Multi-apartment buildings, Offices, to provide user authentication and accounting

• Schools and universities, computer classes

• Connections to Wireless ISPs

• Connections to xDSL providers

Access Concentrators (AC) also known as PPPoE Termination units, answer the PPPoE request coming from a client site PPPoE application for PPP negotiation and authentication.

When using Cyberoam as a PPPoE client, computers on LAN are transparent to WAN side PPPoE link.

This alleviates Administrator from having to manage the PPPoE clients on the individual computers.

To configure PPPoE Interface

Before configuring the Interface for PPPoE:

1. Run Wizard from Web Admin Console

2. In the Network Configuration, for the WAN port:

Enable option ‘Obtain an IP from PPPoE’

Under PPPoE Details, specify PPPoE username and password

3. Click Finish to exit from Wizard

4. To confirm log on to Web Admin Console, go to System

Æ Configure Network Æ View Interface

Details. PPPoE Interface will be defined under the WAN zone.

Note:

• A new dynamic IP address will be leased to the PPPoE Interface, each time a new PPP session is establish with Access Concentrator

• IP address in Firewall rules will automatically change when the new IP address is leased

• If multiple gateways are defined then IP address in the failover condition will automatically change when the new IP address is leased

• As IP address to PPPoE interface is assigned dynamically: b) You will not be able to change the IP address of the PPPoE interface from Telnet Console using

Network Configuration

Select

System Æ Configure Network Æ View Interface Details and click PPPoE Interface

141

Cyberoam User Guide

Screen – PPPoE configuration

Screen Elements Description

PPPoE Configuration

Interface Displays the Port which configured as PPPoE Interface from Wizard

User and Password Specify username and password. Username and password should be same as specified in the Network Configuration using Wizard

Access Concentrator

Name

Specify Access Concentrator name (PPPoE server).

Cyberoam will initiate sessions with the specified Access Concentrator only. In most of the cases, you can leave this field blank. Use it only if you know that there are multiple Access Concentrators.

Service name

LCP Interval

LCP Failure

Update button

Specify Service Name.

Cyberoam will initiate only those sessions with Access Concentrator, which can provide the specified service. In most of the cases, you can leave this field blank. Use it only if you need a specific service.

Specify LCP interval in seconds. Default is 20 seconds. Every 20 seconds LCP echo request is send to check whether the link is alive or not.

LCP echo request and reply can be disabled by setting LCP Interval and LCP Failure as zero

Specify Failure. Default is 3 attempts. Cyberoam will wait for the LCP echo request response for the LCP interval defined after every attempt.

Cyberoam declares PPPoE link as closed if it does not receive response after defined attempts.

Click Update to save the configuration

Table – PPPoE configuration screen elements

Establish PPPoE session

which you want to establish connection

2. Click Reconnect. It establishes 128-bit tunnel with Access Concentrator. Cyberoam will automatically detect the presence of PPPoE server on the WAN interface.

Remove PPPoE Interface configuration

1. Run Wizard from Web Admin Console

142

Cyberoam User Guide

2. In the Network Configuration, for the WAN port: Enable option ‘Use Static IP’

3. Click Finish to exit from Wizard. To confirm log on to Web Admin Console, go to System

Æ Configure

Network

Æ View Interface Details and check under WAN zone

Manage Gateway

Gateway routes traffic between the networks and if gateway fails, communication with outside Network is not possible. In this case, organization and its customers face significant downtime and financial loss.

By default, Cyberoam supports only one gateway. However, since organizations opt for multiple gateways to cope with gateway failure problems, Cyberoam also provides an option for supporting multiple gateways. However, simply adding one more gateway is not an end to the problem. Optimal utilization of all the gateways is also necessary.

Cyberoam not only supports multiple gateways but also provides a way to utilize total bandwidth of all the gateways optimally.

At the time of installation, you configured the IP address for a default gateway. You can change this configuration any time and configure for additional gateways.

Refer to Multi link Configuration Guide for source based static routing. Policy based routing can be done from firewall rule.

To view the Gateway details, select

System Æ Gateway Æ Manage Gateway(s)

Screen – Gateway Configuration

Screen Elements Description

Gateway Details

Gateway Name Displays Gateway name address and port

Save button

Cancel button

IP address of a device Cyberoam uses to reach devices on different

Network, typically a router

Saves the modified details

Click to save

Cancels the current operation and returns to Manage Gateway page

143

Click to cancel

Table - Gateway Configuration screen elements

Cyberoam User Guide

144

Cyberoam User Guide

DoS Settings

Cyberoam provides several security options that cannot be defined by the firewall rules. This includes protection from several kinds of “Denial of Service attacks”. These attacks disable computers and circumvent security.

Denial of Service (DoS) attack is a method hackers use to prevent or deny legitimate users access to a service.

DoS attacks are typically executed by sending many request packets to a targeted server (usually Web,

FTP, or Mail server), which floods the server's resources, making the system unusable. Their goal is not to steal the information but disable or deprive a device or network so that users no longer have access to the network services/resources.

All servers can handle traffic volume up to a maximum, beyond which they become disabled. Hence, attackers send a very high volume of redundant traffic to a system so it cannot examine and allow permitted network traffic. Best way to protect against the DoS attack is to identify and block such redundant traffic.

Packet rate per Source

Total number of connections or packets allowed to a particular user.

Burst rate per Source

Maximum number of packets allowed to a particular user at a given time.

Packet rate per Destination

Total number of connections or packets allowed from a particular user.

Packet rate per Destination

Maximum of packets allowed from a particular user at a given time.

How it works

When the brust rate is crossed, Cyberoam considers it as an attack. Cyberoam provides DoS attack protection by dropping all the excess packets from the particular source/destination. Cyberoam will continue to drop the packets till the attack subsides. Because Cyberoam applies threshold value per IP address, traffic from the particular source/destination will only be dropped while the rest of the network traffic will not be dropped at all i.e. traffic from the remaining IP addresses will not be affected at all.

Time taken to re-allow traffic from the blocked source/destination = time taken to subside the attack + 30 seconds

For example

Packet rate per Source – 100 packets per second

Burst rate per Source – 200 packets per second

When user starts sending requests, initially user will be able to send 200 packets per second but once the 200 packets are received, in the next phase user will be able to send only 100 packets per second.

So in the next phase, if user sends 150 packets per second, Cyberoam will consider it as an attack and drop 50 (150 -100) packets. Cyberoam will accept traffic from the user only after 30 seconds of dropping the packets.

145

Cyberoam User Guide

Threshold values

Cyberoam uses packet rate and brust rate values as a threshold value to detect DoS attack. These values depend on various factors like:

• Network bandwidth

• Nature of traffic

• Capacity of servers in the network

These values are applicable to the individual source or destination i.e. requests per user/IP address and not globally to the entire network traffic. For example, if source rate is 2500 packets/minute and the network consists of 100 users then each user is allowed packet rate of 2500 packets per minute.

Configuring high values will degrade the performance and too low values will block the regular requests.

Hence it is very important to configure appropriate values for both source and destination IP address.

Configure DoS Settings

Select

Firewall → DoS Setting

Screen – DoS Settings

Define the attack definition from

Firewall → DoS Settings

(Attack definition can be defined both for source and destination)

4. Define SYN flood.

Configure Packet Rate (packets/minute) and Burst Rate (packets/second) for source and destination.

Click Apply Flag to apply the SYN flood definition and control the allowed number of packets.

Click ‘SYN Flood’ to view the real time updates on flooding. It displays the source IP address - which was used for flooding and IP address which was targeted.

SYN Flood is the attack in which large numbers of connections are send so that the backlog queue overflows. The connection is created when the victim host receives a connection request and allocates for it some memory resources. A SYN flood attack creates so many half-open connections that the system becomes overwhelmed and cannot handle incoming requests any more.

146

Cyberoam User Guide

Configure Packet Rate (packets/minute) and Burst Rate (packets/second) for source and destination.

Click Apply Flag to apply the UDP flood definition and control the allowed number of packets.

Click ‘UDP Flood’ to view the real time updates on flooding. It displays the source IP address - which was used for flooding and IP address which was targeted.

User Datagram Protocol (UDP) Flood links two systems. It hooks up one system’s UDP charactergenerating service, with another system’s UDP echo service. Once the link is made, the two systems are tied up exchanging a flood of meaningless data

6. Define TCP flood

Configure Packet Rate (packets/minute) and Burst Rate (packets/second) for source and destination.

Click Apply Flag to apply the TCP flood definition and control the allowed number of packets.

TCP attack sends huge amount of TCP packet so that the host/victim computer cannot handle.

Configure Packet Rate (packets/minute) and Burst Rate (packets/second) for source and destination.

Click Apply Flag to apply the ICMP flood definition and control the allowed number of packets.

Click ‘ICMP Flood’ to view the real time updates on flooding. It displays the source IP address - which was used for flooding and IP address which was targeted.

ICMP attack sends huge amount of packet/traffic so that the protocol implementation of the host/victim computer cannot handle.

8. Drop Source Routed Packets

Click Apply Flag to enable. This will block any source routed connections or any packets with internal address from entering your network.

9. Disable ICMP redirect packet

An ICMP redirect packet is used by routers to inform the hosts what the correct route should be. If an attacker is able to forge ICMP redirect packets, he or she can alter the routing tables on the host and possibly weaken the security of the host by causing traffic to flow via another path.

Set the flag to disable the ICMP redirection.

10. Disable ARP flooding

ARP attack sends ARP requests at a very high rate to the server. Because of this, server is overloaded with requests and will not be able to respond to the valid requests. Cyberoam protects by dropping such invalid ARP requests.

11. Click Update to save the configuration

147

Cyberoam User Guide

12. Bypass DoS Settings

Cyberoam allows bypassing the DoS rule in case you are sure that the specified source/destination will never be used for flooding or want to ignore if flooding occurs from the specified source.

Create DoS bypass rule

Select

Firewall → Bypass DoS

Screen – Create DoS bypass rule

Screen Elements Description

Source and Destination Information

Source Domain Source Domain name, IP address or Network on which the DoS rule is not name/IP Address to be applied

Specify source information

Specify * if you want to bypass the complete network

Source Port Specify source port address.

Specify * if you want to bypass all the ports

DoS will not be applied on all the requests from the specified source IP address and port

Destination

Domain name/IP

Address

Destination Domain name or IP address on which the DoS rule is not to be applied

Specify destination information

Specify * if you want to bypass the complete network

Destination Port Specify destination port address.

148

Cyberoam User Guide

Specify * if you want to bypass all the ports

DoS will not be applied on all the requests from the specified destination IP address and port

Network Protocol

Create button

Select protocol whose traffic is to be bypassed for specified source to destination.

For example,

If you select TCP protocol then DoS rules will not be applied on the TCP traffic from the specified source to destination.

Creates the bypass rule

Table – Create DoS bypass rule screen elements

Delete DoS bypass rule

Select

Firewall → Bypass DoS

Screen – Delete DoS bypass rule

Screen Elements Description

Select

Select All

Delete button

Select rule for deletion

Click Del to select

More than one rule can also be selected

Select all rules

Click Select All to select all rules

Deletes all the selected rules

Click to delete

Table – Delete DoS bypass rule screen elements

149

Cyberoam User Guide

Reset Console Password

You can change Telnet Console password from Web based Console or Telnet Console itself. To change password from Telnet Console, refer to Cyberoam Console guide.

Select

System → Reset Console Password

Screen - Reset Console Password

Screen Elements Description

Reset Console Password

GUI Admin Password Specify current Web Admin Console password i.e. the password with which Administrator has logged on to Web Admin Console

New password Specify new console password

Confirm New password Type again the same password as entered in the

New password field

Submit button Saves new password

Click Submit

Table - Reset Console Password screen elements

150

Cyberoam User Guide

System Module Configuration

Enable/disable services to enhance the network performance and reduce the potential security risk. Do not enable any local services that are not in use. Any enabled services could present a potential security risk. A hacker might find a way to misuse the enabled services to access your network.

By default, all the services are enabled.

Cyberoam allows enabling/disabling of following services and VPN and Traffic Discovery modules:

TFTP - Trivial File Transfer Protocol (TFTP) is a simple form of the File Transfer Protocol (FTP). TFTP uses the User Datagram Protocol (UDP) and provides no security features.

PPTP - PPTP (Point-to-Point Tunneling Protocol) is a network protocol that enables secure transfer of data from a remote client to a private server, creating a VPN tunnel using a TCP/IP based network

IRC - IRC (Internet Relay Chat) is a multi-user, multi-channel chatting system based on a client-server model. Single Server links with many other servers to make up an IRC network, which transport messages from one user (client) to another. In this manner, people from all over the world can talk to each other live and simultaneously. DoS attacks are very common as it is an open network and with no control on file sharing, performance is affected.

H323 - The H.323 standard provides a foundation for audio, video, and data communications across IPbased networks, including the Internet. H.323 is an umbrella recommendation from the International

Telecommunications Union (ITU) that sets standards for multimedia communications over Local Area

Networks (LANs) that do not provide a guaranteed Quality of Service (QoS). It enables users to participate in the same conference even though they are using different videoconferencing applications.

P2P Traffic Modules - Identifies peer-to-peer (P2P) data in IP traffic. It works together with connection tracking and connection marking which helps in identifying the bigger part of all P2P packets and limit the bandwidth rate.

Select

Firewall → System Modules and enable or disable the required service and modules.

Screen – System Modules Configuration

151

Cyberoam User Guide

Manage Data

Backup data

Backup is the essential part of data protection. No matter how well you treat your system, no matter how much care you take, you cannot guarantee that your data will be safe if it exists in only one place.

Backups are necessary in order to recover data from the loss due to the disk failure, accidental deletion or file corruption. There are many ways of taking backup and just as many types of media to use as well.

Cyberoam provides facility of taking regular and reliable data backup. Backup consists of all the policies, logs and all other user related information.

Cyberoam maintains five logs:

Web surfing log This log stores the information of all the websites visited by all the users

User session log Every time the user logs in, session is created. This log stores the session entries of all the users and specifies the login and logout time.

Audit log This log stores the details of all the actions performed the User administrating Cyberoam.

Refer to Appendix A – Audit Log for more details.

Virus log This log stores the details of malicious traffic requests received.

Set Backup Schedule

Select

System → Manage Data → Set Backup Schedule

Screen – Set Backup schedule

Screen Elements Description

Backup of Data only (Does not include Logs)

Backup Frequency Backup schedule. Only data backup will be taken.

Select any one

Daily – backup will be send daily

152

Cyberoam User Guide

Incremental Backup of Log files only (in CSV format)

Backup process only copies what has changed since the last backup. This creates a much smaller backup file.

Log Select the logs for backup. Backup of log files will be taken in CSV format.

Available logs for backup: Web surfing, Audit

Backup Frequency

Weekly – backup will be send weekly

Monthly – backup will be send monthly

Never – backup will never be send

In general, it is best to schedule backup on regular basis.

Depending on how much information you add or change will help you determine the schedule

Select any one

Daily – backup will be send daily

Weekly – backup will be send weekly

Never – backup will never be send

Set Backup Mode

Backup mode Specifies how backup should be taken and send

Select FTP backup OR Mail backup

Only for FTP backup

FTP server

User name

Specify IP address of FTP server

Specify User name with which user has to logon to the FTP server

Only for Mail backup

To Mail Id

Save button

Specify email address to which the backup is to be mailed

Saves the configuration

Table – Set Backup Schedule screen elements

Backup Data

Select

System → Manage Data → Backup Data

Screen – Backup Data

Screen Elements

Backup System Data

(Does not include logs)

Backup button

Description

Takes the recent backup and allows to download

153

Cyberoam User Guide

Download button

Only if backup is taken previously

Click Backup data to take backup

Download the backup already taken. Also displays date and time of backup

Click Download to download

To download follow the screen instructions

Backup Log (in CSV format)

Logs Backup of selected logs will be taken

Select the logs for backup: Web surfing, Audit

Backup button Takes the recent backup of logs and allows to download

Click Backup data to take the recent backup

Download button

Only if backup is taken previously

Download the backup of logs already taken. Also displays date and time of backup

Click Download to download

To download follow the screen instructions

Table – Backup Data screen elements

Restore Data

With the help of restore facility, restore data from the backup taken. Restoring data older than the current data will lead to the loss of current data.

Select

System → Manage Data → Restore Data

Screen – Restore Data screen

Screen Elements Description

Upload Backup

File to upload

Browse button

Upload button

Specify name of backup file to be uploaded

Select the backup file

Uploads the backup file

Table - Restore Data screen elements

Note

Restore facility is version dependant i.e. it will work only if the backup and restore versions are same

154

Cyberoam User Guide

Purge

Purging of data means periodic deletion of the data. Cyberoam provides Auto purge and Manual purge facility for deleting log records. Additionally, Auto purge utility also provides an option to enable or disable log archiving.

Cyberoam allows to retain following logs:

• Web surfing

• Mail virus

• Mail spam

• Traffic discovery

• IDP

• FTP

• Appliance Audit log

Configure Auto purge Utility

Go to

System → Manage Data → Configure Auto purge utility and click against the log to enable archiving and specify the time period to retain log. By default, Cyberoam will not archive IDP logs.

One has to manually enable the archiving of IDP logs.

Log (if enabled)

Web Surfing

Mail Virus

Mail Spam

Traffic Discovery

Log Retention period (days)

Default Configurable up to

60 365

Appliance Audit 30 60

If disabled, Cyberoam will keep log of current date only and delete records every night.

Earlier versions of Cyberoam supported retention of Web Surfing and Appliance Audit logs only.

Cyberoam will retain the configured retention period of Web Surfing logs and Appliance Audit Logs after upgrading to the latest version.

155

Cyberoam User Guide

Screen – Configure Auto purge Utility screen

Manual purge

Use manual purge to delete log records manually

Select

System → Manage Data → Purge Logs

Screen – Purge Logs screen

Screen Elements Description

Purge

Select log for purging

Web surfing logs

User session logs

Audit logs

Appliance Audit logs

Till Date Select the date from Calendar till which the selected log(s) is to be purged

Purge button Purges the selected log till the specified date

156

Note

Auto purge option is always on

Click Purge to purge

Table - Purge Logs screen elements

Cyberoam User Guide

157

Cyberoam User Guide

Client Services

Client Messages

Message Management tab allows Administrator to send messages to the various users. Messages help

Administrator to notify users about problems as well as Administrative alerts in areas such as access, user sessions, incorrect password, and successful log on and log off etc.

Message is send to the User whenever the event occurs.

Message can be up to 256 characters and send to the number of users at a time.

Select

System → Configure Client Settings → Customize Client Message

Screen – Customized Client Messages screen

Screen Elements

Message Key

Description

Message code

Click Message link to customize the message which will be received by user

Click Save to save the changes

Click Cancel to cancel the current operation

Configure Usage to Alert User before Expiration

Usage in

Data Transfer (MB) remaining

Remaining usage can be entered in absolute value or in percentage

Specify remaining data transfer usage when all the users should receive

158

Cyberoam User Guide alert.

E.g. Absolute Remaining data transfer usage: 20 MB

User1: Total Data transfer limit (as defined in Data transfer policy): 150

User2: Total Data transfer limit (as defined in Data transfer policy): 640

User1 will receive alert when he is left with 20 MB of data transfer i.e. has done total data transfer of 130 MB

User2 will receive alert when he is left with 20 MB of data transfer i.e. has done total data transfer of 620 MB

Percentage Remaining data transfer usage: 20%

User1: Total Data transfer limit (as defined in Data transfer policy): 150

User2: Total Data transfer limit (as defined in Data transfer policy): 640

User1 will receive alert when he is left with 30 MB (20% of 150 MB) of data transfer i.e. has done data transfer of 120 MB

User2 will receive alert when he is left with 128 MB (20% of 640 MB) of data transfer i.e. has done data transfer of 512 MB

Cycle Data Transfer

(MB)

Specify remaining cycle data transfer usage when all the users should receive alert.

Cycle data transfer is the upper limit of total data transfer allowed to the user per cycle. User will be disconnected if the limit is reached. It is applicable the users to whom the cyclic data transfer policies are applied.

E.g. Absolute Remaining cycle data transfer usage: 20 MB

User1: Cycle Total Data transfer limit (as defined in Data transfer policy):

150 MB

User2: Cycle Total Data transfer limit (as defined in Data transfer policy):

640 MB

User1 will receive alert when he is left with 20 MB of data transfer per cycle i.e. has done data transfer of 130 MB

User2 will receive alert when he is left with 20 MB of data transfer per cycle i.e. has done data transfer of 620 MB

Percentage Remaining cycle data transfer usage: 20%

User1: Cycle Total Data transfer limit (as defined in Data transfer policy):

150 MB

User2: Cycle Total Data transfer limit (as defined in Data transfer policy):

640 MB

User1 will receive alert when he is left with 30 MB (20% of 150 MB) of data transfer per cycle i.e. has done data transfer of 120 MB

User2 will receive alert when he is left with 128 MB (20% of 640 MB) of data transfer per cycle i.e. has done data transfer of 512 MB

Save details button Saves the data transfer alert configuration

Table - Customized Client Message screen elements

159

Cyberoam User Guide

List of Predefined messages

Messages Description/Reason

AlertMessageWithData

DeactiveUser

DisconnectbyAdmin

InvalidMachine

Someoneloggedin

Administrator has deactivated the User and the User will not be able to log on

When the administrator disconnects the user from the live users page

Message is sent if User tries to login from the IP address not assigned to him/her

Message is sent when User logs off successfully LoggedoffsuccessfulMsg

LoggedonsuccessfulMsg Message is sent when User logs on successfully

Loggedinfromsomewhereelse Message is sent if User has already logged in from other machine

MaxLoginLimit Message is sent if User has reached the maximum login limit

MultipleLoginnotallowed

NotAuthenticate

NotCurrentlyAllowed

Message is sent if User is not allowed multiple login

Message is sent if User name or password are incorrect

Message is sent if User is not permitted to access at this time

Access Time policy applied to the User account defines the allowed access time and not allowed access at any other time.

Message is sent if someone has already logged in on that particular machine

SurfingtimeExhausted transfer is equal to the configured value.

Value can be configured from Customize Client Messages page.

Refer to Client Messages for more details

Message is sent to the user when the remaining data transfer is equal to the configured value.

Value can be configured from Customize Client Messages page.

Refer to Client Messages for more details

SurfingtimeExpired

LiveIPinuse

Nmpoolexceedlimit

Message is sent when User is disconnected because his/her allotted surfing time is exhausted

The surfing time duration is the time in hours the User is allowed

Internet access that is defined in Surfing time policy. If hours are exhausted, User is not allowed to access

Administrator has temporarily deactivated the User and will not be able to log in because User surfing time policy has expired

Message is sent if connection is requesting a public IP Address from the server that is already in use

Message is sent if the maximum number of IP Addresses in the public Logon Pool at any given time has exceeded the limit

Table - List of predefined messages

160

Cyberoam User Guide

Client preferences

Use Client preference to specify

• which page to open every time user logs on to Cyberoam

• whether HTTP client log on page should pop up if user tries to surf without logging in

• port from which Web Administration Console can be accessed

• number of concurrent log on allowed

Select

System → Configure Client Settings → Customize Client preferences

Screen – Customized Client Preferences screen

Screen Elements Description

Open following site after client logs on to the server

URL Specify URL which is to be opened every time user logs on

Leave this field blank, if you do not want to open any specific page every time user logs in

Update button

HTTP Client

Updates configuration

Pop up HTTP client Whenever User tries to surf without logging, page with a message ‘Cyberoam Access Denied‘ displayed

If HTTP client pop up option is selected, User will get a

HTTP Client pop up along with the ‘Cyberoam Access

Denied' page.

161

Cyberoam User Guide

Once User logs on successfully using the HTTP client, user will be able to surf the requested site.

Updates configuration Update button

Web Admin Console

Web Admin Console

Port

Specify Port number on which Web Admin Console is running

Update button Updates configuration

User Authentication setting

Allowed

Unlimited Login users

Allows unlimited concurrent logins

User Inactivity Timeout Enter the timeout duration in minutes. After this period of inactivity (no data transfer), user will be logged out automatically.

Click “Unlimited”

Update button Updates configuration

Table – Customized Client Preferences screen elements

Note

The preferences set are applicable to all the users by default. All the set preferences will be applicable when the user is created. Refer to Create User, for customizing number of concurrent logins allowed to a particular user.

162

Cyberoam User Guide

Customize Access Deny messages

Use to customize Access deny message for:

• all web categories

• individual web category

• all file type categories

This customized message will be displayed when user tries to access the site, which is not allowed.

Screen – Customize Denied message screen elements

2. Select category for which you want to customize access deny message

Select ‘All Web categories’ to display the same access deny message for all the web categories.

The message specified for ‘All Web Categories’ becomes the default message.

Select a particular category for which you want to display a different message

By default, the message specified for ‘All Web Categories’ is displayed.

Disable Use Default Message, if you want to display a different message for a particular category and modify the message

Select ‘All File type category’ to customize the access deny message for all the file type categories

3. In Denied Message, modify the message contents

4. Click Update to save if any changes are made

163

Upload Corporate logo

Use to display your company’s logo in all the messages displayed to the user.

Cyberoam User Guide

1. Select

System → Configure → Customize Denied Message

2. In Top Bar, specify the image to be displayed at the top of the message page.

3. In the Bottom Bar, specify the image to be displayed at the bottom of the message page

4. Click Upload

Note

Dimension of Image should be 700 * 80 and jpg file only

164

Customize Login message

Use to customize login page messages and client login links provided on login page.

Cyberoam User Guide

1. Select

System → Configure → Customize Login Message

2. Under Client Login Links, select Login Clients that you want to be displayed on Login page.

In the login page, download links are provided so that user can download the required login client. If you do not want user to download a particular login client, deselect the link

In the Login message box, specify the message to be displayed. You can further customize the message by using clientip address, category and URL

3. Enable Blink Message to display blinking message

4. Before saving the configuration, click Preview and see how message will be displayed to the user

5. Click Save to save the configuration

165

Cyberoam User Guide

Disable Warning messages

Alert messages displayed on the Dashboard Alert Messages section can be enabled or disabled as per the need. By default, all the messages are enabled.

Messages can be enabled/disabled from

System

→ Configure → Warning Messaging

- indicates that alert is disabled

- indicates that alert is enabled

166

Cyberoam User Guide

HTTP Client Login page template

Cyberoam provides flexibility to customize the HTTP Client Login page. This page can include your organization name and logo.

Cyberoam has included a fully integrated Template Editor to design the page. It supports numerous placement and arrangement options for each field and a provision to add a personalized message or inserting logo or any other image.

Cyberoam also supports customized page in languages other then English.

Cyberoam provides a default template that can be modified to customize the HTTP Client login page.

167

Cyberoam User Guide

HTTP Proxy Management

Cyberoam can also act as a HTTP proxy server and enable access to the HTTP proxy services from the local ACL section.

You can configure Cyberoam's LAN IP address as a proxy server IP address in your browser settings.

Note

HTTP proxy will enforce the Internet Access Policy and Anti Virus policy as configured in the User and the

Firewall policy.

IDP policy will be applicable on the traffic between proxy and the WAN, but not between the user and the proxy.

Bandwidth policy will not be applicable on the direct proxy traffic.

Manage HTTP Proxy

Select

System → HTTP Proxy → Manage HTTP Proxy

Screen - Manage HTTP Proxy

Screen Elements Description

Server Status

Start button

Only if Current Status is ‘Stopped’

Stop button

Only if Current Status is ‘Running’

Restart button

Displays current status of Proxy server

Click to start Proxy server

Click to stop Proxy server

Click to restart Proxy server

Table - Manage HTTP Proxy screen elements

168

Configure HTTP Proxy

Use to

• configure http proxy port

• configure trusted ports

Select

System → HTTP Proxy → Configure HTTP Proxy

Cyberoam User Guide

Screen - Configure HTTP Proxy

Screen Elements Description

HTTP Proxy Port Setting

HTTP Proxy port Specify proxy port to be used

Save button

Parent Proxy Setting

Click to save the port setting

Enable Parent Proxy If enabled all the HTTP requests will be sent to HTTP Proxy

Server via Cyberoam. One needs to configure Parent Proxy when the HTTP traffic is blocked by the upstream Gateway.

Click to enable

169

Cyberoam User Guide

IP address

HTTP Proxy Port

Specify IP address of Parent proxy

Specify parent proxy port

Save button Click to save the setting

HTTP Proxy Trusted Ports Setting

Cyberoam allows the access to those sites that are hosted on standard port only if deployed as HTTP proxy.

To allow access to the sites hosted on the non-standard ports, you have to define non-standard ports as trusted ports.

You can define individual port or range of ports.

Click Add to define non-standard ports

Pharming Protection Configuration

Protection

Save button their regular web surfing activities. Pharming attack succeeds by redirecting the users from legitimate web sites instead of similar fraudulent web sites that has been created to look like the legitimate site.

Enable to protect against pharming attacks and direct users to the legitimate web sites instead of fraudulent web sites.

Click to enable/disable

Click to save the port setting

Table - Configure HTTP Proxy screen elements

170

Cyberoam User Guide

Set Default Internet Access Policy

Go to

System → HTTP Proxy → Default Policy to specify default internet access policy when

Cyberoam is being used as HTTP Proxy

171

Cyberoam User Guide

Manage Servers

Use Services tab to Start/Stop and Enable/Disable Autostart various configured servers. According to the requirement, one can Start, Stop, Enable or Disable the services.

Types of the servers available:

• DHCP

• Domain Name Server

• Cyberoam server

• Proxy servers – HTTP, SMTP, POP3, IMAP, FTP

Select

System → Manage Servers

Screen - Manage Services

Screen Elements Description

Service name

Status

Commands

Name of the server

Status of the respective server

Running

– if server is on

Stopped – if server is off

Starts or stops the respective servers

Enables or disables Autostart

Refer to Action table for details

Table - Manage Control Service screen elements

Action table

Button Usage

Start Starts the Server whose status is ‘Stopped’

Stop Stops the server whose status is ‘Started’

Enable Autostart Automatically starts the configured server with the startup of Cyberoam

Disable Autostart Disables the Autostart process

Restart Restarts Cyberoam

All the servers with ‘Enable Autostart’ will restart

Table - Manage Control Service – Action

172

Cyberoam User Guide

Monitoring Bandwidth Usage

Bandwidth is the amount of data passing through a media over a period. In other words, it is the amount of data accessed by the Users. Each time the data is accessed – uploaded or downloaded, the amount is added to the total bandwidth. Because of the limited resource, it needs periodic monitoring.

Bandwidth usage graphical report allows Administrator to monitor the amount of data uploaded or downloaded by the Users. Administrator can use this information to help determine:

• Whether to increase or decrease the bandwidth limit?

• Whether all the gateways are utilized optimally?

• Which gateway is underutilized?

• What type of traffic is consuming the majority of the Bandwidth?

• Which inbound/ outbound traffic has consumed the most Bandwidth in the last week/month?

Select

System → View Bandwidth usage

Screen – View Bandwidth Usage

Screen Elements Description

Bandwidth report

Graph type Generates graph

Select any one

Gateway wise – Displays list of Gateways defined, click the Gateway whose data transfer report is to be generated

Logon Pool wise – Displays list of Logon Pools defined, click the Logon

Pool whose data transfer report is to be generated

Total – Generates total (all gateways and Logon Pools) data transfer report. Also generates Live user report

Gatewaywise breakup - Generates total (all gateways) data transfer report.

Graph period Generates graph based on time interval selected

Click Graph period to select

Table - Bandwidth usage screen elements

173

Cyberoam User Guide

It generates eight types of graphical reports:

1. Live users - Graph shows time and live users connected to Internet. In addition, shows minimum, maximum and average no. of users connected during the selected graph period. This will help in knowing the peak hour of the day.

X axis – Hours

Y axis – No. of users

Peak hour – Maximum no. of live users

Screen - Bandwidth usage - Live Users graph

2. Total data transfer – Graph shows total data transfer (upload + download) during the day. In addition, shows minimum, maximum and average data transfer.

X axis – Hours

Y-axis – Total data transfer (upload + download) in KB/Second

Maximum data transfer

Minimum data

Screen - Bandwidth usage - Total Data transfer graph

174

Cyberoam User Guide

3. Composite data transfer – Combined graph of Upload & Download data transfer. Colors differentiate upload & download data traffic. In addition, shows the minimum, maximum and average data transfer for upload & download individually

X axis – Hours

Y-axis – Upload + Download in Bits/Second

Orange Color - Upload traffic

Blue Color – Download traffic

Screen - Bandwidth usage - Composite Data transfer graph

4. Download data transfer – Graph shows only download traffic during the day. In addition, shows the minimum, maximum and average download data transfer.

X axis – Hours

Y-axis – Download data transfer in Bits/Second

Screen - Bandwidth usage - Download Data transfer graph

175

Cyberoam User Guide

5. Upload data transfer - Graph shows only upload traffic during the day. In addition, shows minimum, maximum and average upload data transfer.

X axis – Hours

Y-axis – Upload data transfer in Bits/Second

Screen - Bandwidth usage - Upload Data transfer graph

6. Integrated total data transfer for all Gateways – Combined graph of total (Upload + Download) data transfer for all the gateways. Colors differentiate gateways. In addition, shows the minimum, maximum and average data transfer of individual gateway

X axis – Hours

Y-axis – Total (Upload + Download) data transfer in Bits/Second

Orange Color – Gateway1

Blue Color – Gateway2

176

Cyberoam User Guide

7. Integrated Download data transfer of all Gateways – Graph shows only the download traffic of all the gateways during the day. In addition, shows the minimum, maximum and average download data transfer.

X axis – Hours

Y-axis – Download data transfer in Bits/Second

Orange Color – Gateway1

Blue Color – Gateway2

8. Integrated Upload data transfer for all the Gateways - Graph shows only the upload traffic of all the gateways during the day. In addition, shows minimum, maximum and average upload data transfer.

X axis – Hours

Y-axis – Upload data transfer in Bits/Second

Orange Color – Gateway1

Blue Color – Gateway2

177

Cyberoam User Guide

Migrate Users

Cyberoam provides a facility to migrate the existing users from PDC or LDAP server. Alternately, you can also import user definition from an external file (CSV format file).

If you do not want to migrate users, configure for Automatic User creation. This reduces Administrator’s burden of creating the same users again in Cyberoam.

Migration from PDC server

All the migrated users will be created under Group type – ‘Normal’ and default policies will be applied.

Administrator can change the assigned group or status at the time of migration or later.

After migration, Username will be set as password in Cyberoam.

Select

User Æ Migrate Users to open migration page

Step 1: Click Download User Migration Utility link

Screen - Download User Migration Utility

Step 2: Opens the File Download window and prompts to run or save the utility. Select the appropriate option and click OK button

Screen - Save User Migration Utility

Step 3: Opens a new browser window and prompts for the login. Provide the administrator username and

178

Cyberoam User Guide password. E.g. Username: “cyberoam” and password: “cyber”

Step 4: On successful authentication, following screen will be shown. Upload the specified file.

Screen – Upload downloaded User Migration Utility

Step 5: Change the group or status of the user at this stage, if required. To migrate all the users, click

Select All or select the individual users and click Migrate Users.

Note

After migration, for Cyberoam login password will be same as the username

Once the users are migrated, configure for single sign on login utility. The configuration is required to be done on the Cyberoam server.

Migration from External file

Instead of creating user again in Cyberoam, if you already have User details in a CSV file then you can upload CSV file.

CSV file should be in the following format:

1. Header (first) row should contain field names. Format of header row:

Compulsory first field: username

Optional fields in any order: password, name, groupname

2. Subsequent rows should contain values corresponding to the each field in header row

3. Number of fields in each row should be same as in the header row

4. Error will be displayed if data is not provided for any field specified in the header

5. Blank rows will be ignored

6. If password field is not included in the header row then it will set same as username

7. If name field is not included in the header row then it will set same as username

8. If groupname is not included in the header row, administrator will be able to configure group at the time of migration

Step 1 Upload CSV file

Select

System Æ Migrate User to open migration page

179

Cyberoam User Guide

Screen – Upload CVS file

Step 2 Change Group or Active status of user at this stage, if required. To migrate all the users, click

Select All or select the individual users and click Migrate Users.

Screen - Register migrated users from External file

If migration is successful, Manage Active User page will be displayed with all the migrated users as

Active users.

180

Cyberoam User Guide

Customization

Schedule

Schedule defines a time schedule for applying firewall rule or Internet Access policy i.e. used to control when firewall rules or Internet Access policies are active or inactive.

Types of Schedules:

• Recurring – use to create policies that are effective only at the specified times of the day or on specified days of the week.

• One-time - use to create firewall rules/policies that are effective once for the period of time specified in the schedule.

Define Schedule

Select

Firewall Æ Schedule Æ Define Schedule to open define schedule page

Screen - Define One Time Schedule

Screen Elements Description

Schedule details

Name

Schedule Type

Specify schedule name. Choose a name that best describes schedule

Specify type of schedule

Recurring – applied at specified times of the day or on specified days of the week

One time – applied only once for the period of time specified in the schedule

Start time & Stop Defines start and stop time for the schedule time

(only if

Schedule Type is

Start & stop time cannot be same

‘One Time’)

Description

Create button

Specify full description of schedule

Creates schedule

Refer to Add Schedule Entry details to add time details

Table - Define Schedule screen elements

181

Cyberoam User Guide

Add Schedule Entry details

Select

Firewall Æ Schedule Æ Manage Schedule to view the list of schedule and click the

Schedule name in which the schedule entry details are to be added.

Screen – Add Schedule Entry details

Screen Elements

Schedule Entry

Description

Start time & Stop time Defines the access hours/duration

Start & stop time cannot be same button

Cancel button weekday to the schedule

Cancels the current operation

Table – Add Schedule Entry details screen elements

182

Cyberoam User Guide

Manage Schedule

Use to modify:

• Schedule Name

• Description

• Add Schedule Entry details

• Delete Schedule Entry details

Select

Firewall Æ Schedule Æ Manage Schedule and click Schedule name to be updated

Screen - Manage Schedule

Screen Elements Description

Schedule details

Schedule name

Schedule description

Schedule Entry

Add button

Delete button

Save button

Cancel button

Displays schedule name, modify if required

Displays schedule description, modify if required

Allows to add the schedule entry details

Refer to ‘Add Schedule Entry details’ for more details

Allows to delete the schedule entry details

Refer to ‘Delete Schedule Entry details’ for more details

Saves schedule

Cancels the current operation and returns to Manage

Schedule page

Table - Manage Schedule screen elements

183

Cyberoam User Guide

Delete Schedule Entry details

Screen – Delete Schedule Entry details

Screen Elements Description

Del

Select All

Delete button

Select Schedule Entry detail to be deleted

Click Del to select Schedule Entry details

More than one Schedule Entry details can also be selected

Selects all the Schedule Entry details

Click Select All to select all the Schedule Entry details

Deletes the selected Schedule Entry detail(s)

Table - Delete Schedule Entry details screen elements

Delete Schedule

Select

Firewall Æ Schedule Æ Manage Schedule to view the list of Schedules

Screen - Delete Schedule

Screen Elements

Del

Select All

Delete button

Description

Select schedule to be deleted

Click Del to select schedule

More than one schedule can also be selected

Selects all the schedules

Click Select All to select all the schedules

Deletes the selected schedule(s)

Table - Delete Schedule screen elements

184

Cyberoam User Guide

Services

Services represent types of Internet data transmitted via particular protocols or applications.

Protect your network by configuring firewall rules to

• block services for specific zone

• limit some or all users from accessing certain services

• allow only specific user to communicate using specific service

Cyberoam provides several standard services and allows creating:

• Customized service definitions

• Firewall rule for customized service definitions

Define Custom Service

Select

Firewall Æ Services Æ Create to open the create page

Screen - Define Custom Service

Screen Elements Description

Create Service

Service Name

Select Protocol

Description

Create button

Cancel button

Specify service name

Select the type of protocol

For IP - Select Protocol No.

For TCP - Specify Source and Destination port

For UDP - Specify Source and Destination port

For ICMP – Select ICMP Type and Code

Specify service description

Creates a new service

Cancels the current operation and returns Manage Service

Table – Define Custom Service screen elements

185

Cyberoam User Guide

Manage Custom Service

Use to modify:

• Description

• Add Protocol details

• Delete Protocol details

Select

Firewall Æ Services Æ Manage to view the list of custom services. Click service to be modified

Screen - Update Custom Service

Screen Elements Description

Custom Service

Service Name

Description

Protocol Details

Add button

Delete button

Save button

Cancel button

Displays service name

Displays description, modify if required

Allows to add protocol details

Click to add

Select protocol

For IP - Select Protocol No.

For TCP - Specify Source and Destination port

For UDP - Specify Source and Destination port

For ICMP – Select ICMP Type and Code

Click Add

Allows to delete protocol details

Click to delete against the protocol details to be deleted

Click Delete

Updates the modified details

Cancels the current operation

Table - Update Custom Service screen elements

186

Delete Custom Service

Select

Firewall Æ services Æ Manage to view the list of services.

Cyberoam User Guide

Screen - Delete Custom Service

187

Screen Elements Description

Del

Select All

Delete button

Select the Service for deletion

More than one services can be selected

Click to select

Allows to select all the services for deletion

Click to select

Deletes all the selected service(s)

Click to delete

Table - Delete Custom Service screen elements

Note

Default Services cannot be deleted

Cyberoam User Guide

188

Cyberoam User Guide

Create Service Group

Service Group is the grouping of services. Custom and default services can be grouped in a single group.

Use to configure firewall rules to

• block group of services for specific zone

• limit some or all users from accessing group of services

• allow only specific user to communicate using group of service

Select

Firewall Æ Service Group Æ Create to open the create page

Screen – Create Service Group screen

Screen Elements Description

Create Service Group

Service Group Name Specify service group name

Select Service

Description

Create button

Select the services to be grouped.

‘Available Services’ column displays the services that can be grouped

Using arrow buttons to move services between the lists

‘Member Services’ column displays the services that will be grouped

Specify group description

Cancel button

Creates a new service group

Cancels the current operation and returns Manage Service

Group page

Table – Create Service Group screen elements

189

Cyberoam User Guide

Update Service Group

Select

Firewall Æ Service Group Æ Manage to view the list of groups created. Click the group to be modified

Screen – Edit Service Group

Screen Elements Description

Edit Service Group

Service Group Name

Select Service

Description

Save button

Displays service group name

Displays grouped services

‘Available Services’ column displays the services that can be grouped

Using arrow buttons to move services between the lists

‘Member Services’ column displays the services that will be grouped

Displays group description, modify if required

Saves the modified details

Cancels the current operation and returns Manage

Service Group page

Table – Edit Service Group screen elements

190

Cyberoam User Guide

Delete Service Group

Select

Firewall Æ Service Group Æ Manage to view the list of groups created.

Screen – Delete Service Group

Screen Elements

Del

Select All

Delete button

Description

Select the group for deletion

More than one groups can be selected

Click to select

Allows to select all the groups for deletion

Click to select

Deletes all the selected group(s)

Click to delete

Table – Delete Service Group

191

Cyberoam User Guide

Web Category

Web category is the grouping of Domains and Keywords used for Internet site filtering. Domains and any

URL containing the keywords defined in the Web category will be blocked.

Each category is grouped according to the type of sites. Categories are grouped into four types and specify whether accessing sites specified those categories are considered as productive or not:

• Neutral

• Productive

• Non-working

• Un-healthy

For your convenience, Cyberoam provides a database of default Web categories. You can use these or even create new web categories to suit your needs. To use the default web categories, the subscription module Web and Application Filter should be registered.

Depending on the organization requirement, allow or deny access to the categories with the help of policies by groups, individual user, time of day, and many other criteria.

Custom web category is given priority over default category while allowing/restricting the access.

Search URL

Use Search URL to search whether the URL is categorized or not. It searches the specified URL and displays Category name under which the URL is categorized and category description.

When a custom category is created with a domain/URL which is already categorized in default category then the custom category overrides the default category and the search result displays custom category name and not the default category name.

Select

Categories Æ Web Category Æ Search URL

Screen – Search URL

193

Cyberoam User Guide

Manage Default Web Category

Default Web categories are available for use only if ‘Web and Application Filter’ subscription module is registered. Database of web categories is constantly updated by Cyberoam.

If the module is not registered, page is displayed with the message ‘Web and Application Filter module is not registered’. See Register Add on Modules for registering Web and Application Filter module. Module can also be registered as ‘Demo’ version if you have yet not purchased but will expire after 15 days of registration.

Once the module is registered, the default categories can be used in Internet Access for filtering.

Select

Categories Æ Web Category Æ Manage Default to view list of default Web Categories

Screen - Manage Default Web Category

Note

Default Web categories cannot be modified or deleted.

Custom web category is given the priority over the default category while allowing/restricting access.

194

Cyberoam User Guide

Create Custom Web category

Select

Categories Æ Web Category Æ Create Custom to open create page

Screen - Create Custom Web Category

Screen Elements Description

Create Custom Web Category

Name

Description

Specify Web category name

Specify full description

Category type Categories are grouped into four types and specifies whether accessing sites specified in those categories is considered as Neutral, Productive, Non-working or Un-healthy

Select category type

Creates a new custom Web Category. Web Category configuration is incomplete until domain names or keywords are attached

Domain Management

195

Cyberoam User Guide

Add button Use to define domains for the web category. Depending on the user’s Internet access policy, accessing specified domain(s) will be allowed or denied.

Click to add

Refer to Add Domain(s) for more details

Keywords Management

Add button

Update button

Cancel button

Use to define keywords for the web category. Depending on the user’s Internet access policy, accessing sites with the specified keyword(s) will be allowed or denied.

Click to add

Refer to Add Keyword(s) for details

Saves the web category

Cancels the current operation and returns to View Web Category page

Table - Create Web Category screen elements

Note

Custom category name cannot be same as default category name.

Add Domain

Screen - Add Domain

Screen Elements Description

Domains Management

Domains Specify domains for the category. Depending upon the Internet access policy and schedule strategy any site falling under the specified domain will be allowed or blocked access.

Add Domain button Assigns domains to the web category

Cancel button Cancels the current operation

Table - Add Domain screen elements

Note

Domains can be added at the time of creation of web category or whenever required.

196

Cyberoam User Guide

Add Keyword

Screen - Add keyword

Screen Elements Description

Keywords Management

Keywords Specify domains for the category. Depending on the Internet access policy and schedule strategy any site falling under the specified domain will be allowed or blocked access

Add button Assigns keywords to the Web Category

Cancel button Cancels the current operation

Table - Add keyword screen elements

Note

Keywords can be added at the time of creation of web category or whenever required.

Manage Custom Web Category

Use to modify:

• Description

• Add and delete Domains

• Add and delete Keywords

Select

Categories Æ Web Category Æ Manage Custom to view the list of Web categories and click Web Category to be modified

197

Cyberoam User Guide

Screen - Manage Custom Web category

Screen Elements Description

Update Custom Web Category

Name Displays name of the web category, modify if required

Category type

Domain Management

Add button Allows to add domain name(s) to the web category

Click to add

Refer to Add Domains for details

Delete button

Categories are grouped into four types and specifies whether accessing sites specified in those categories is considered as Neutral, Productive,

Non-working or Un-healthy

Select category type

Allows to remove domain name(s) from the web category

Click to remove

Refer to Delete Domains for details

Keywords Management

Add button Allows to add keyword(s) to the web category

Click to add

Refer to Add Keywords for details

Delete button Allows to remove keywords from the web category

Click to remove

198

Update button

Cancel button

Cyberoam User Guide

Refer to Delete Keywords for details

Modifies and saves the updated details

Click to Update

Cancels the current operation and returns to the Manage Custom Web

Category page

Table - Update Custom Web category screen elements

Delete Domain

Screen – Delete Domain

Delete Keyword

Screen Elements Description

Select

Select All button

Delete button

Click all the domains required to be removed

Allows to select all the domains for deletion

Click Select All to select all domains

Remove(s) domains from the web category

Click to remove

Table – Delete Domain screen elements

Screen - Delete keyword

199

Cyberoam User Guide

Screen Elements Description

Select

Select All button

Delete button

Click all the keywords required to be removed

Allows to select all the keywords for deletion

Click Select All to select all keywords

Remove(s) keywords from the web category

Click to remove

Table - Delete keywords screen elements

Delete Web Category

Prerequisite

• Not attached to any Policy

Select

Categories Æ Web Category Æ Manage Custom to view the list of Web Categories.

Screen - Delete Custom Web Category

Screen Elements Description

Del

Select All

Delete button

Select web category to be deleted

More than one web category can be selected

Click to select

Allows to select all the web categories for deletion

Click to select

Deletes all the selected web categories

Click to delete

Table - Delete Custom Web Category screen elements

200

Cyberoam User Guide

File Type Category

File type is a grouping of file extensions. Cyberoam allows filtering Internet content based on file extension. For example, you can restrict access to particular types of files from sites within an otherwisepermitted category.

For your convenience, Cyberoam provides several default File Types categories. You can use these or even create new categories to suit your needs.

Depending on the organization requirement, allow or deny access to the categories with the help of policies by groups, individual user, time of day, and many other criteria.

Manage Default File Type Category

Cyberoam provides five default File Type categories that cannot be modified or deleted.

Select

Categories Æ File Type Category Æ Manage Default to view the list of default File

Type Categories. Click the Category to view extensions included in the Category.

Screen – Manage Custom File Type Category

201

Cyberoam User Guide

Create Custom File Type Category

Select

Categories Æ File Type Category Æ Create Custom to open the create page

Screen - Create Custom File Type Category

Screen Elements Description

Custom File Type details

Name Assign name to File Type Category

File Extensions

Description

Specify file extensions to be included in the File Type

Manage Custom File Type Category

Select

Categories Æ File Type Category Æ Manage Custom to view the list of File Type

Categories and click File Type Category to be modified.

Screen - Manage Custom File Type Category

202

Cyberoam User Guide

Screen Elements Description

Update Custom File Type Category

Name Displays name of the File Type Category, modify if necessary

File Extensions Displays file extension(s) added to the Category, modify if required

Description

Update button

Cancel button

Displays description of Category

Modifies and saves the updated details

Click to Update

Cancels the current operation and returns to the Manage Custom

File Type Category page

Screen - Manage Custom File Type Category

Delete Custom File Type Category

Prerequisite

• Not attached to any Policy

Select

Categories Æ File Type Category Æ Manage Custom to view the list of File Type

Categories created

Screen - Delete Custom File Type Category

Screen Elements Description

Del

Select All button

Delete button

Click all the File Types required to be deleted

Allows to select all the File Types for deletion

Click Select All to select all File Types

Delete(s) the File Type Category

Click to delete

Table - Delete Custom File Type screen elements

203

Cyberoam User Guide

Application Protocol Category

Application Protocol Category is the grouping of Application Protocols used for filtering Internet content.

You can also filter Internet requests based on protocols or applications other than HTTP, HTTPS or FTP, for example those used for instant messaging, file sharing, file transfer, mail, and various other network operations.

For your convenience, Cyberoam provides a database of default Application Protocol categories. To use the default Application Protocol categories, the subscription module ‘Web and Application Filter’ should be registered.

You can also create:

• Customized Application protocol category, if required

• Firewall rule based on customized Application protocol category

Manage Default Application Protocol Category

Default Application protocol categories are available for use only if ‘Web and Application Filter’ subscription module is registered. Database of protocol category is constantly updated by Cyberoam. If the module is not registered, page is displayed with the message ‘Web and Application Filter’ module is not registered.

Once the module is registered, the default protocol categories can be used in Internet Access for filtering.

Default Application protocol category cannot be modified or deleted.

Select

Categories Æ Application Protocol CategoryÆ Manage Default to view the list of default Application protocols Categories

Screen - Manage Default Application Protocol Category

204

Cyberoam User Guide

Create Custom Application Protocol Category

Select

Categories Æ Application Protocol Category Æ Create Custom to open the create page

Screen - Create Custom Application Protocol Category

Screen Elements Description

Custom Application Protocol Category

Name Specify name to Application Protocol Category. Custom category and default category cannot have same names.

Description Specify full description

Create button Creates a new custom Application Protocol Category

Application Protocol details

Add button Use to assign application protocols to Category for blocking. Select application protocol you want to include in a Category. Cyberoam gives access to the Category based on the Schedule.

Allows to add application protocol(s) to Category

Click to add

Refer to Add Custom Application Protocol details for more details

Update button Saves Application Protocol Category

Cancels the current operation and returns to View Custom

Application Protocol Category page

Table – Create Custom Application Category screen elements

205

Cyberoam User Guide

Add Custom Application Protocol Details

Screen – Add Custom Application Protocol Category details

Screen Elements Description

Custom Application Protocol details

Application Select Application Protocols that are to be grouped in the

Category.

Custom and Default both can be grouped in a single

Application Protocol Category

Address

Add button

Cancel button

Groups the application protocols in the Category

Cancels the current operation

Table – Add Custom Application Protocol Category details

Manage Custom Application Protocol Category

Use to modify:

• Description

• Add Application Protocol details

• Delete Application Protocol details

Select

Categories Æ Application Protocol Category Æ Manage Custom to view the list of custom Application Protocol Categories. Click Application Protocol Category to be modified.

Screen – Manage Custom Application Protocol Category

206

Cyberoam User Guide

Screen Elements Description

Update Custom Application Protocol Category

Name Displays name of Application Protocol Category, modify if necessary

Application Protocol Details

Add button Allows to add Application Protocol(s) to Category

Click to add

Refer to Add Custom Application Protocols for details

Delete button

Update button

Allows to remove Application Protocol(s) from Category

Click to remove

Refer to Delete Custom Application Protocol for details

Modifies and saves the updated details

Click to Update

Cancel button Cancels the current operation and returns to the Manage Custom

Application Protocol Category page

Table – Manage Custom Application Protocol Category screen elements

Delete Custom Application Protocol Category details

Screen – Delete Application Protocol Category details

Screen Elements Description

Del

Select All button

Delete button

Click Application Protocol(s) required to be deleted

Allows to select all Application Protocol(s) for deletion

Click Select All to select all Application Protocol(s)

Delete(s) Application Protocol(s)

Click to delete

Table – Delete Application Protocol Category screen elements

207

Cyberoam User Guide

Delete Custom Application Protocol Category

Prerequisite

• Not attached to any Policy

Select

Categories Æ Application Protocol Category Æ Manage Custom to view the list of

Application Protocol Categories created

Screen - Delete Custom Application Protocol Category

Screen Elements Description

Del

Select All

Delete button

Select Category to be deleted

More than one Category can be selected

Click to select

Allows to select all the Categories for deletion

Click to select

Deletes all the selected Categories

Click to delete

Table - Delete Custom Application Protocol Category screen elements

208

Cyberoam User Guide

Access Control

Use Local ACLs to limit the Administrative access to the following Cyberoam services from

LAN/WAN/DMZ:

• Admin Services

• Authentication Services

• Proxy Services

• Network Services

Default Access Control configuration

When Cyberoam is connected and powered up for the first time, it will have a default Access configuration as specified below:

Admin Services

HTTPS (TCP port 443) and SSH (TCP port 22) services will be open for administrative functions for

LAN zone

Authentication Services

Cyberoam (UDP port 6060) and HTTP Authentication (TCP port 8090) will be open for User

Authentication Services for LAN zone. User Authentication Services are not required for any of the

Administrative functions but required to apply user based internet surfing, bandwidth and data transfer restrictions.

Customize Access Control configuration

Use access control to limit the access to Cyberoam for administrative purposes from the specific authenticated/trusted networks only. You can also limit access to administrative services within the specific authenticated/trusted network.

Select

Firewall Æ Local ACL

Screen – Access Configuration

209

Cyberoam User Guide

Screen Elements Description

Admin Services

Enable/disable access to Cyberoam using following service from the specified zone and network:

• HTTP

• HTTPS

• Telnet

Authentication Services

Enable/disable following service from the specified zone and network:

• Cyberoam

• HTTP

Proxy Services

Enable/disable HTTP service from the specified zone and network

Network Services

Enable/disable following service from the specified zone and network:

• DNS

• ICMP

Update button Saves configuration

Add button Allows to add the trusted networks from which the above specified services will be allowed/disallowed

Click Add to add network details

Specify Network IP address and Zone

Click Add

Table – Access Configuration screen elements

210

Cyberoam User Guide

Logging

Cyberoam provides extensive logging capabilities for traffic, system and network protection functions.

Detailed log information and reports provide historical as well as current analysis of network activity to help identify security issues and reduce network abuse.

Cyberoam can either store logs locally or send logs to external syslog servers for storage and archival purposes.

Cyberoam can log many different network activities and traffic including:

• Firewall log

• Anti-virus infection and blocking

• Web filtering, URL and HTTP content blocking

• Signature and anomaly attack and prevention

• Spam filtering

Cyberoam supports multiple syslog servers for remote logging. When configuring logging to a Syslog server, one needs to configure the facility, severity and log file format. One can also specify logging location if multiple syslog servers are defined.

Maximum five syslog servers can be defined from Logging page of Web Admin Console.

Cyberoam can either store logs locally or send to the syslog servers. Traffic Discovery logs can be stored locally only.

211

Cyberoam User Guide

Syslog Configuration

Syslog is an industry standard protocol/method for collecting and forwarding messages from devices to a server running a syslog daemon usually via UDP Port 514. The syslog is a remote computer running a syslog server. Logging to a central syslog server helps in aggregation of logs and alerts.

Cyberoam appliance can also send a detailed log to an external Syslog server in addition to the standard event log. The Cyberoam Syslog support requires an external server running a Syslog daemon on any of the UDP Port.

The Cyberoam captures all log activity and includes every connection source and destination IP address,

IP service, and number of bytes transferred.

A SYSLOG service simply accepts messages, and stores them in files or prints. This form of logging is the best as it provides a Central logging facility and a protected long-term storage for logs. This is useful both in routine troubleshooting and in incident handling.

To add the syslog server details, go to

System Æ Logging Æ Manage Syslog and click Create

Screen – Syslog Configuration

Screen Elements Description

Add Syslog server details

Name Specify unique name for syslog server

IP address

Port

Specify IP address of the syslog server. Messages from the

Cyberoam will be sent to the server.

Default: 192.168.1.254

Specify the port number for communication with the syslog server. Cyberoam will send messages using the configured port

Default: 514

Facility Select syslog facility for log messages to be send to the syslog server.

212

Cyberoam User Guide

Severity Level

Format

Create button

Facility indicates to the syslog server the source of a log message. It is defined by the syslog protocol. You can configure facility to distinguish log messages from different Cyberoams. In other words, it can be helpful in identifying the device that recorded the log file.

Cyberoam supports following syslog facilities for log messages received from remote servers and network devices:

DAEMON - Daemon logs (Information of Services running in

Cyberoam as daemon)

KERNEL – Kernel log

LOCAL0 – LOCAL7 – Log level information

USER - Logging on the basis of users who are connected to

Server

Specify severity levels of logged messages.

Severity level is the severity of the message that has been generated.

Cyberoam logs all messages at and above the logging severity level you select. For example, select ‘ERROR’ to log all messages tagged as ‘ERROR,’ as well as any messages tagged with ‘CRITICAL,’ ‘ALERT’ and ‘EMERGENCY’ and select

‘DEBUG’ to log all messages.

Cyberoam supports following syslog levels:

EMERGENCY - System is not usable

ALERT - Action must be taken immediately

CRITICAL - Critical condition

ERROR - Error condition

WARNING - Warning condition

NOTICE - Normal but significant condition

INFORMATION - Informational

DEBUG Debug - level messages

Cyberoam produces logs in the specified format. Cyberoam currently produces logs in its own standard format

Click to save the configuration

Once you add the server, go to

System → Logging → Log configuration page and enable all those logs, which are to be send to the syslog, sever.

213

Cyberoam User Guide

Log configuration

Once you add the server, configure logs to be send to the syslog sever

System → Logging → Log

configuration page. If multiple servers are configured various logs can be send on different servers.

To record logs you must enable the respective log and specify logging location. Administrator can choose between on-appliance (local) logging, Syslog logging or disabling logging temporarily.

Cyberoam logs many different network activities and traffic including:

Firewall Log

Firewall Log records invalid traffic, local ACL traffic, DoS attack, ICMP redirected packets, source routed and fragmented traffic. Firewall logs can be disabled or send to the remote syslog server only but cannot be stored locally.

Invalid Traffic Log

Log records the dropped traffic that does not follow the protocol standards, invalid fragmented traffic and traffic whose packets Cyberoam is not able to relate to any connection.

Local ACL Log

Log records the entire (allowed and dropped) incoming traffic and traffic for the firewall

DoS attack Log

The DoS Attack Log records attacks detected and prevented by the Cyberoam i.e. dropped TCP,

UDP and ICMP packets.

To generate log, go to Firewall

→ Denial of Service → DoS Settings and click ‘Apply Flag’ against

SYN Flood, UDP flood, TCP flood, and ICMP flood individually

Dropped ICMP Redirected Packet Log

Log records all the dropped ICMP redirect packets.

To generate log, go to Firewall

→ Denial of Service → DoS Settings and click ‘Apply Flag’ against

‘Disable ICMP redirect Packets'

Dropped Source Routed Packet Log

Log records all the dropped source routed packets.

To generate log, go to Firewall

→ Denial of Service → DoS Settings and click ‘Apply Flag’ against

‘Drop Source Routed Packets’

Dropped Fragmented traffic

Log records the dropped fragmented traffic

IDP reports

Records detected and dropped attacks based on unknown or suspicious patterns (anomaly) and signatures.

Antivirus Logs

Virus detected in HTTP, SMTP, FTP, POP3 and IMAP4 traffic. Enabling logging for SMTP will also

214

Cyberoam User Guide enable logging for POP3 and IMAP4 on local server. HTTP and FTP logs can be disabled or send to the remote log server only.

Antispam Logs

SMTP, POP3, IMAP4 spam and probable spam mails.

Content Filtering reports

HTTP filtering log.

Traffic Discovery reports

Traffic discovery log can be stored locally only.

Log Type

Firewall Firewall Rules

Invalid Traffic

Local ACLs

Dos Attack

Local

(On-appliance)

ICMP Redirected packets No

IDP

Syslog

Yes

Source Routed packets

Fragmented traffic

Yes

Anomaly Yes Yes

Signature Yes Yes

Anti Virus

Anti Spam

SMTP log will also enable/disable POP3 log

SMTP log will also enable/disable IMAP4 log

SMTP log will also enable/disable POP3 log

SMTP log will also enable/disable IMAP4 log

Content

Filtering

Traffic

Discovery

215

Cyberoam User Guide

Note

Cyberoam removes entire Syslog configuration on upgrading to V 9.5.3 build 20. Hence, you will have to reconfigure Syslog.

216

Cyberoam User Guide

Product Licensing & Updates

Product Version information

Click Cyberoam icon (on the rightmost corner of the screen) to get the version and appliance key information.

Screen – About Cyberoam

217

Cyberoam User Guide

Upgrade Cyberoam

Cyberoam provides two types of upgrades:

• Automatic – Correction to any critical software errors, performance improvement or changes in system behavior leads to automatic upgrade of Cyberoam without manual intervention or notification.

• Manual – Manual upgrades requires human intervention.

Automatic Upgrade

By default, AutoUpgrade mode is ON. It is possible to disable the automatic upgrades. Follow the procedure to disable the AutoUpgrade mode:

1. Log on to Telnet Console

2. Go to option 4 Cyberoam Console

3. At the prompt, type the command, cyberoam autoupgrade off

Manual Upgrade

Step 1. Check for Upgrades

Press F10 to go to Dashboard from any of the screens.

Under the Installation Information section, click Check for Upgrades

218

Cyberoam User Guide

Page displays the list of available upgrades and the upgrade details like release date and size. Order specifies the sequence in which Cyberoam should be upgraded.

Step 2. Download Upgrade

Click Download against the version to be downloaded and follow the on screen instructions to save the upgrade file.

Step 3. Upload downloaded version to Cyberoam

Select

Help Æ Upload Upgrade

Type the file name with full path or select using ‘Browse’ and click Upload

219

Cyberoam User Guide

Screen - Upload Upgrade version

Step 4. Upgrade

Once the upgrade file is uploaded successfully, log on to Console to upgrade the version.

Log on to Cyberoam Telnet Console.

Type ‘6’ to upgrade from the Main menu and follow the on-screen instructions.

Successful message will displayed if upgraded successfully.

Repeat above steps if more than one upgrade is available. If more than one upgrade is available, please upgrade in the same sequence as displayed on the Available Upgrades page.

220

Cyberoam User Guide

Download

Clients

Cyberoam Client supports Users using following platforms:

Windows Enables Users using Windows Operating System to log-on to Cyberoam Server

HTTP Enables Users using any other Operating System than Windows & Linux to log-on to Cyberoam

Server

Linux Enables Users using Linux Operating System to log-on to Cyberoam server

Single Sign on Client Enables Windows-migrated Users to log on to Cyberoam using Windows

Username and password.

Single Sign on Client Auto Setup Download the setup.

Guides Opens the Cyberoam Documentation site (http://docs.cyberoam.com) and download or view the complete documentation set available for all the versions.

Depending on the requirement, download the Cyberoam Client from

Help Æ Downloads

Screen – Download Clients

221

Cyberoam User Guide

Appendix A – Audit Log

Audit logs are an important part of any secure system that provides an invaluable view into the current and past state of almost any type of complex system, and they need to be carefully designed in order to give a faithful representation of system activity.

Cyberoam Audit log can identify what action was taken by whom and when. The existence of such logs can be used to enforce correct user behavior, by holding users accountable for their actions as recorded in the audit log.

An audit log is the simplest, yet also one of the most effective forms of tracking temporal information. The idea is that any time something significant happens you write some record indicating what happened and when it happened.

Audit logs can be accessed in two ways:

1. Log on to Cyberoam Web Admin Console and click Reports to open the reports page in a new window

2. Log on to Reports, click on the Reports link to open the reports login page in a new window

Screen – Reports Login

222

Cyberoam User Guide

Viewing Log details

Tailor the report by setting filters on data by arbitrary date range. Use the Calendar to select the date range of the report.

Screen – Audit Log report

Screen – Sample Audit Log Report

223

Cyberoam User Guide

Audit Log Components

Entity – Cyberoam Component through which the event was generated/Audit Resource Type

Entity Name – Unique Identifier of Entity

Action – Operation requested by entity/Audit Action

Action By – User who initiated the action/Accessor name

Action Status – Action result/Audit Outcome

Entity

Report GUI

Entity Name Action

Action By

Action

Status

Message

<username> Successful -

Address

Explanation

Report GUI Login <username> Failed Wrong username or address> password

<IP

Report GUI by User

<username> was successful

Report GUI by User

<username> was not successful because of wrong username and password

Management

GUI address>

Management

GUI

Management

GUI

<username> Failed

User not found <IP address>

User has no <IP previllege of address>

Administration

Management GUI by

User <username> was successful

Management GUI by

User <username> was not successful because system did not find the User

Management GUI by

User <username> was not successful as user does not have administrative privileges

Configuration

Wizard address> request to start

Configuration Wizard was successful

Configuration

Wizard address>

System

SSh

SSh telnet

Started <username> Successful Cyberoam-

System

Started

<IP address> authentication <username> Successful User admin, <IP coming from address>

192.168.1.241, authenticated. authentication <username> Failed Login Attempt

192.168.1.241 by user root

<IP authentication <username> Failed Password authentication failed. Login to account hello not allowed or account nonexistent

<IP address> authentication <username> Successful Login <IP request to close

Configuration Wizard was successful

Cyberoam was successfully started by the User <username>

<username> trying to log on from <ip address> using SSH client was successfully authenticated

Authentication of

<username> trying to log on from <ip address> using SSH client was not successful

Log on to account

<username> using

SSH client was not successful

224

Cyberoam User Guide

Host

HostGroup telnet console console console

Firewall

Firewall Rule <firewall rule id> e.g. 7

Firewall Rule <firewall rule id> e.g. 6

Firewall Rule <firewall rule id> e.g. 21

Successful address> through Telnet by User

<username> was successful authentication authentication <username> Successful Login authentication <username> Successful Login authentication

Started

<username> Failed

System

Failed

Successful

Authentication

Failure

Successful

Authentication

Failure

<IP address> ttyS0 Login attempt to

Console using

Console Interface via remote login utility by

User <username> was successful tty1

Authentication of

<username> trying to log on remotely through Telnet was not successful

Console via direct

Console connection by

User <username> was successful

Console by User

<username> was not successful

Firewall subsystem started successfully without any error address> rule id> was created successfully by user

<username> address> address> rule id> was updated successfully by user

<username> rule id> was updated successfully by user

Firewall Rule <firewall rule id> e.g. 10

Host N/A Delete <username> Failed - address>

<IP address> rule id> was deleted successfully by user

Request to delete Host by user <username> was not successful

<host name> e.g.

192.168.1.68,

#Port D

<host name> e.g.

192.168.1.66,

#Port D

<host group name> e.g. mkt group address> address> address> was deleted successfully by user

<username> was added successfully by user

<username> group name>

was deleted successfully by user

HostGroup

<host group name> e.g. sys group

<host group name> e.g.

Trainee address> group name>

was updated successfully by user

<username> address> group name>

was updated successfully by user

Service <service name> e.g. vypress chat address> name>

was deleted successfully by user

225

Service <service name> e.g. vypress chat

Service <service name > e.g. vypress chat

ServiceGroup <service group name

> e.g.

Intranet chat

ServiceGroup <service group name

> e.g.

Intranet chat

ServiceGroup <service group name

> e.g.

Intranet chat

NAT Policy <policy name>

DNAT Policy <policy name>

Schedule <schedule name>

Schedule

Schedule

Detail

Local ACLs Local ACLs Update

DoS Bypass DoS Bypass Delete

<username> Successful -

Cyberoam User Guide address> name> was updated successfully by user

<username> address> name>

was inserted successfully by user

<username> address> <service group name

was inserted successfully by user

<username> address> <service group name

was updated successfully by user

<username> address> <service group name

was deleted successfully by address> name> was inserted successfully by user

<username> address> name> was updated successfully by user

<username> address> name> was deleted successfully by user

<username> address> name> was inserted successfully by user

<username> address> name> was updated successfully by user

<username> address> name> was deleted successfully by user

<username> address> name> was inserted successfully by user

<username> address> name> was updated successfully by user

<username> address> name> was deleted successfully by user

<username> address>

Schedule <schedule name> was inserted successfully by user

Local ACL was updated successfully by user <username>

DoS Bypass rule deleted successfully

226

Cyberoam User Guide

DoS Bypass DoS Bypass Insert

DoS Settings DoS Settings Update

<username> Successful -

DoS Bypass rule inserted successfully by user <username>

DoS settings updated successfully by user <username>

Online

Registration

Upload

Version

Date

Version

Update <username> Successful System time changed from

2006-06-19

23:15:50 IST to 2006-07-19

23:15:03 IST

Apart from the tabular format, Cyberoam allows to view the log details in: address>

<IP address> successfully registered

Appliance/Subscription module(s) through

Online Registration

User <username> successfully uploaded the version

Request to update the

Date from Console by

User <username> was successful

• Printable format Click

to open a new window and display the report in the printer friendly format. Report can be printed from File -> Print.

• Export as CSV (Comma Separated Value) Click

to export and save the report in CSV format. Report can be very easily exported to MS Excel and all the Excel functionalities can be used to analyze the data.

227

Cyberoam User Guide

Appendix B – Network Traffic Log Fields

Cyberoam provides extensive logging capabilities for traffic, system and network protection functions.

Detailed log information and reports provide historical as well as current analysis of network activity to help identify security issues and reduce network misuse and abuse.

Cyberoam provides following logs:

• DoS Attack Log

• Invalid traffic Log

• Firewall Rule Log

• Local ACL Log

• Dropped ICMP Redirected Packet Log

• Dropped Source Routed Packet Log

• IDP Log - Anomaly and Signature Log

• Antivirus Log – HTTP, SMTP, FTP, POP3 and IMAP4 traffic

• Antispam Log – SMTP, POP3, IMAP4 spam and probable spam

• Fragmented traffic Log

• Invalid fragmented traffic Log

• Content filtering Log

By default, only the firewall rule logging will be ON i.e. only traffic allowed/denied by the firewall will be logged. Refer to Cyberoam Console Guide on how to enable/disable logging.

Log ID structure

Log ID – Unique 12 characters code (c1c2c3c4c5c6c7c8c9c10c11c12) e.g. 0101011, 0102011

Where: c1c2 - Log Type ID c3c4 - Log Component ID c5c6 - Log Sub Type ID c7 - Priority c8c9c10c11c12 - Message ID

Log Type

Log Component

Log Type ID Log Type

01 Firewall

02 IDP

Log Component ID Log Component

228

Cyberoam User Guide

Log Subtype

07 Anomaly

08 Signatures

09 HTTP

10 FTP

11 SMTP

12 POP3

13 IMAP4

15 Invalid Fragmented Traffic

Priority

Log Subtype ID Sub Type

01 Allowed

02 Denied

03 Detect

04 Drop

05 Clean

06 Virus

07 Spam

Priority Description

0 Emergency

1 Alert

2 Critical

3 Error

4 Warning

5 Notice

6 Information

7 Debug

Message ID

Each event is has unique message ID and is included as a part of log id.

Log Component Event

Firewall rule Traffic allowed according to the firewall rule

Invalid traffic

Traffic denied/dropped according to the firewall rule

Invalid traffic denied

Message ID

00001

00002

01001

229

Cyberoam User Guide

Local ACLs Traffic allowed according to the configured

Local ACL

02001

Traffic denied according to the configured Local

ACL

02002

DoS attack denied according to the DoS settings

03001

ICMP Redirection ICMP redirection traffic denied 04001

Source Routed Source routed traffic denied

Fragmented traffic Fragmented traffic denied

Invalid Fragmented traffic denied Invalid Fragmented traffic

IDP

05001

01301

01601

Detected attacks based on unknown or 06001 suspicious patterns (anomaly)

Dropped attacks based on unknown or 06002 suspicious patterns (anomaly)

Detected attacks based on attack signature 07001

Antivirus

Dropped attacks based on attack signature

HTTP – Virus infected URL blocked

Virus infected FTP data transfer blocked

07002

08001

09001

Antispam

FTP data transfer completed successfully

Virus infected mail detected in SMTP traffic

Virus infected mail detected in POP3 traffic

Virus infected mail detected in IMAP4 traffic

09002

10001

11001

12001

Mail detected as SPAM in SMTP traffic and rejected

13001

Mail detected as SPAM in SMTP traffic and dropped

Mail detected as SPAM in SMTP traffic but accepted

13004

13005

Mail detected as SPAM in SMTP traffic but mail is forwarded after changing the original

13006 recipient address

13007 Mail detected as SPAM in SMTP traffic but forwarded after tagging the original subject i.e. adding prefix to the subject

Mail detected as a PROBABLE SPAM in SMTP traffic and rejected

13002

Mail detected as PROBABLE SPAM in SMTP traffic and dropped

Mail detected as PROBABLE SPAM in SMTP traffic but accepted

13008

13009

Mail detected as PROBABLE SPAM in SMTP traffic but is forwarded after changing the original recipient address

13010

13011 Mail detected as PROBABLE SPAM in SMTP traffic but forwarded after tagging the original subject i.e. adding prefix to the subject

Clean mail in SMTP traffic 13004

Mail detected as SPAM in POP3 traffic but accepted

14001

Mail detected as PROBABLE SPAM in POP3 traffic but accepted

14002

Clean mail in POP3 traffic 14003

Mail detected as SPAM in POP3 traffic but mail 14004

230

Cyberoam User Guide is forwarded after changing the original recipient address

Mail detected as PROBABLE SPAM in POP3 traffic but forwarded after tagging the original subject i.e. adding prefix to the subject

14005

Mail detected as SPAM in IMAP4 traffic but accepted

Mail detected as PROBABLE SPAM in IMAP4 traffic but accepted

15001

15002

Clean mail in IMAP4 traffic

Mail detected as SPAM in IMAP4 traffic but forwarded after tagging the original subject i.e. adding prefix to the subject

15003

15004

Web site/file/application access allowed 16001 according to the Internet Access policy

Web site/file/application access blocked 16002 according to the Internet Access policy

Firewall Log

Cyberoam logs all the packets - dropped or allowed, by the firewall rule.

Event Log sample

Traffic allowed by

Firewall rule date=2007-11-16 time=21:20:55 timezone=”IST” device_name=”CR500i” device_id=C010600411 deployment_mode=”route”

=010101600001

log_type=”Firewall” log_component=”Firewall Rule”

C010600411 deployment_mode=”route” log_id

=”Allowed” priority=Information duration=0 fw_rule_id=85 user_name=““ user_gp=““ iap=16 application=““ application_id=““ in_interface=”Port A” out_interface=”Port B” src_ip=192.168.15.40 dst_ip=64.233.167.99 protocol=”TCP” src_port=1293 dst_port=80 icmp_type=““ icmp_code=““ sent_pkts=45 recv_pkts=12 sent_bytes=162 recv_bytes=45 tran_src_ip=203.88.135.197 tran_src_port=““ tran_dst_ip=““ tran_dst_port=““ srczonetype=”LAN” dstzonetype=”WAN” dir_disp=”org” connevent=”start” connid=”3456” vconnid=””

Traffic denied/dropped by

Firewall rule date=2007-11-17 time=11:09:35 timezone=”IST” device_name=”CR500i” device_id=

=010102600002 log_type=”Firewall”

log_component=”Firewall Rule” log_subtype

=”Denied” priority=Information duration=““ fw_rule_id=14 user_name=““ user_gp=““ iap=““ application=““ application_id=““ in_interface=”Port A” out_interface=”Port B” src_ip=172.16.16.40 dst_ip=216.109.112.135 protocol=”ICMP” src_port=““ dst_port=““ icmp_type=8 icmp_code=0 sent_pkts=0 recv_pkts=0 sent_bytes=0 recv_bytes=0 tran_src_ip=““ tran_src_port=““ tran_dst_ip=““ tran_dst_port=““ srczonetype=”LAN” dstzonetype=”WAN” dir_disp=”org” connevent=”” connid=”” vconnid=””

Firewall log fields and description

SR.

No.

DATA FIELDS

date

TYPE

date

DESCRIPTION

Date (yyyy-mm-dd) when the event occurred

For the allowed traffic - the date on which connection was started on Cyberoam

231

2 time

4 timezone device_name

5 device_id

6 deployment_mode

Cyberoam User Guide time

For the dropped traffic - the date when the packet was dropped by Cyberoam

Time (hh:mm:ss) when the event occurred

For the allowed traffic - the time when the connection was started on Cyberoam

For the dropped traffic - the time when the packet was dropped by Cyberoam

Time zone set on Cyberoam appliance e.g. IST string Model Number of the Cyberoam Appliance

13 log_type log_component

10 log_subtype

11 priority duration firewall_rule_id

14 user_name

15 user_group

16 iap

17 application

18 application_id

19 in_interface

20 out_interface

22 log_id source_ip destination ip

23 protocol

24 source_port

25 destination_port

26 icmp_type

27 icmp_code

Possible values: Route, Bridge string Unique 12 characters code (c1c2c3c4c5c6c7c8c9c10c11) e.g. 0101011, 0102011 c1c2 - Log Type e.g. 01 for firewall log c3c4 - Log Component i.e. firewall/local ACL/ DoS Attack etc. c5c6 - Log Sub Type i.e. allow/violation c7 - Priority e.g. 0 for Emergency

C8c9c10c11 - Message ID e.g. 00001 for traffic allowed by firewall string Type of event occurred in Cyberoam e.g. firewall event string Component responsible for logging e.g. Firewall rule string Decision taken on traffic string Severity level of traffic integer Durability of traffic (seconds) integer Firewall rule id i.e. firewall rule id which is applied on the traffic string Group Id of user integer Internet Access policy Id applied on the traffic string Application name string Application identifier string Interface for incoming traffic e.g. Port A

Blank for outgoing traffic

Blank for incoming traffic string Original Source IP address of traffic string Original Destination IP address of traffic integer Protocol number of traffic integer Original Destination Port of TCP and UDP traffic integer ICMP type of ICMP traffic integer ICMP code of ICMP traffic

232

Cyberoam User Guide

28 sent_packets

29 received_packets

30 sent_bytes

31 received_bytes integer Total number of packets sent integer integer integer

Total number of packets received

Total number of bytes sent

Total number of bytes received

32 translated_source_ integer applicable only in route mode.

Possible values:

"" – When Cyberoam is deployed in Bridge mode or source

IP address translation is not done

IP Address – IP Address with which the original source IP address is translated only in route mode.

Possible values:

"" – When Cyberoam is deployed in Bridge mode or source port translation is not done

Port – Port with which the original port is translated applicable only in route mode.

Possible values:

"" – When Cyberoam is deployed in Bridge mode or destination IP address translation is not done

IP Address – IP Address with which the original destination

IP address is translated applicable only in route mode.

Possible values:

"N/A" – When Cyberoam is deployed in Bridge mode or destination port translation is not done

Port – Port with which the original port is translated

36 sourcezonetype

37 destinationzonetype

38 direction_disposition string Packet

Possible values:

“org”, “reply”, “”

39 connection_event Event on which this log is generated

40 connection id

41 virtual connection id integer Unique identifier of connection integer Connection ID of the master connection

Invalid traffic Log

Cyberoam will filter following traffic as Invalid traffic:

• Short IP Packet

• IP Packets with bad IP checksum

• IP Packets with invalid header and/or data length

• Truncated/malformed IP packet

• Packets of Ftp-bounce Attack - FTP bounce attack is an exploit of the FTP protocol whereby an attacker is able to use the PORT command to request access to ports indirectly through the use of the victim machine as a middle man for the request. This technique can be used to port scan hosts

233

Cyberoam User Guide discreetly, and to access specific ports that the attacker cannot access through a direct connection.

• Short ICMP packet

• ICMP packets with bad ICMP checksum

• ICMP packets with wrong ICMP type/code

• Short UDP packet

• Truncated/malformed UDP packet

• UDP Packets with bad UDP checksum

• Short TCP packet

• Truncated/malformed TCP packet

• TCP Packets with bad TCP checksum

• TCP Packets with invalid flag combination

• Cyberoam TCP connection subsystem not able to relate TCP Packets to any connection

•

• If Strict Internet Access Policy is applied then Cyberoam will filter following traffic also as Invalid traffic:

• UDP Packets with Destination Port 0

• TCP Packets with Source Port and/or Destination Port 0

• Land Attack - Attacker forges a SYN packet with the same source and destination IP address that causes the victim to try to open a connection with itself, causing the system to go into an infinite loop. Machine becomes slow or hangs until connection times out. An attacker sends a forged packet with the same source and destination IP address. The victim system will be confused and crashed or rebooted. Some implementations of TCP/IP are vulnerable to packets that are crafted in a particular way (a SYN packet in which the source address and port are the same as the destination--i.e., spoofed).

• Winnuke Attack - This attack sends OOB (Out-of-Band) data to an IP address of a Windows machine connected to a network and/or Internet. When a Windows machine receives the out-ofband data, it is unable to handle it and exhibits odd behavior, ranging from a lost Internet connection to a system crash. This affects Windows 95, NT and 3.11 machines. WinNuke is a ping of death (invalid icmp) kind of attack, exploiting the vulnerability in the NetBIOS handler in

Windows 95. A string of out-of-band data is sent to TCP port 135-139 of the victim machine, causing it to lock up and display a Blue Screen of Death.

• TCP Syn Packets contains Data

• IP Packet with Protocol Number 0

IP Packet with TTL Value 0

Event

Invalid traffic denied

Log sample

date=2007-12-19 time=15:33:52 timezone="IST" device_name="CR500i" device_id=C010600411-YFK5RL deployment_mode="Route"

=010202601001 log_type="Firewall" log_component="Invalid Traffic" log_subtype

="Denied" priority=Information duration=0 fw_rule_id=”” user_name="" user_gp="" iap=0 application="" application_id=”” in_interface="Port A" out_interface="" src_ip=192.168.1.100 dst_ip=192.168.13.25 protocol="ICMP" icmp_type=3 icmp_code=3 sent_pkts=0 recv_pkts=0 sent_bytes=0 recv_bytes=0 tran_src_ip=0.0.0.0 tran_src_port=0 tran_dst_ip=0.0.0.0 tran_dst_port=0 srczonetype=”LAN” dstzonetype=”Local” dir_disp=”” connevent=”” connid=”” vconnid=””

Log fields and description

SR.

No.

DATA FIELDS

date

TYPE

date

DESCRIPTION

Date (yyyy-mm-dd) when the event occurred

For the allowed traffic - the date on which connection was started on Cyberoam

234

2 time

4 timezone device_name

5 device_id

6 deployment_mode

Cyberoam User Guide time

For the dropped traffic - the date when the packet was dropped by Cyberoam

Time (hh:mm:ss) when the event occurred

For the allowed traffic - the time when the connection was started on Cyberoam

For the dropped traffic - the time when the packet was dropped by Cyberoam

Time zone set on Cyberoam appliance e.g. IST string Model Number of the Cyberoam Appliance

13 log_type log_component

10 log_subtype

11 priority duration firewall_rule_id

14 user_name

15 user_group

16 iap

17 application

18 application_id

19 in_interface

20 out_interface

22 log_id source_ip destination ip

23 protocol

24 source_port

25 destination_port

26 icmp_type

27 icmp_code

Blank for outgoing traffic

235

Cyberoam User Guide

28 sent_packets

29 received_packets

30 sent_bytes

31 received_bytes integer Total number of packets sent integer integer integer

Total number of packets received

Total number of bytes sent

Total number of bytes received

32 translated_source_ integer applicable only in route mode.

Possible values:

"" – When Cyberoam is deployed in Bridge mode or source

IP address translation is not done

IP Address – IP Address with which the original source IP address is translated only in route mode.

Possible values:

"" – When Cyberoam is deployed in Bridge mode or source port translation is not done

Port – Port with which the original port is translated applicable only in route mode.

Possible values:

"" – When Cyberoam is deployed in Bridge mode or destination IP address translation is not done

IP Address – IP Address with which the original destination

IP address is translated applicable only in route mode.

Possible values:

"N/A" – When Cyberoam is deployed in Bridge mode or destination port translation is not done

Port – Port with which the original port is translated

36 sourcezonetype

37 destinationzonetype

38 direction_disposition string Packet

Possible values:

“org”, “reply”, “”

39 connection_event Event on which this log is generated

40 connection id

41 virtual connection id integer Unique identifier of connection integer Connection ID of the master connection

Local ACL

Event Log sample

according to the device_id=C010600411-YFK5RL deployment_mode="Route"

log_type="Firewall" log_component="Local ACLs" log_subtype

=010301602001

configured Local

="Allowed"

ACL priority=Information duration=0 fw_rule_id=”” user_name="" user_gp="" iap=0 application="" application_id=”” in_interface="Port A" out_interface="" src_ip=192.168.15.240 dst_ip=192.168.13.25 protocol="ICMP" icmp_type=8 icmp_code=0 sent_pkts=1 recv_pkts=0 sent_bytes=84 recv_bytes=0 tran_src_ip=0.0.0.0 tran_src_port=0 tran_dst_ip=0.0.0.0 tran_dst_port=0

236

Cyberoam User Guide srczonetype=”LAN” dstzonetype=”Local” dir_disp=”org” connevent=”start” connid=”1425” vconnid=”” according to the device_id=C010600411-YFK5RL deployment_mode="Route"

log_type="Firewall" log_component="Local ACLs" log_subtype

=010302602002

configured Local

ACL priority=Information duration=0 fw_rule_id=”” user_name="" user_gp="" iap=0 application="" application_id=”” in_interface="Port A" out_interface="" src_ip=192.168.1.84 dst_ip=192.168.15.255 protocol="UDP" src_port=138 dst_port=138 sent_pkts=0 recv_pkts=0 sent_bytes=0 recv_bytes=0 tran_src_ip=0.0.0.0 tran_src_port=0 tran_dst_ip=0.0.0.0 tran_dst_port=0 srczonetype=”LAN” dstzonetype=”Local” dir_disp=”org” connevent=”” connid=”” vconnid=””

Log fields and description

SR.

No.

DATA FIELDS

date

TYPE DESCRIPTION

4 time timezone device_name

5 device_id

6 deployment_mode date time

Date (yyyy-mm-dd) when the event occurred

For the allowed traffic - the date on which connection was started on Cyberoam

For the dropped traffic - the date when the packet was dropped by Cyberoam

Time (hh:mm:ss) when the event occurred

For the allowed traffic - the time when the connection was started on Cyberoam

For the dropped traffic - the time when the packet was dropped by Cyberoam

Time zone set on Cyberoam appliance e.g. IST string Model Number of the Cyberoam Appliance

9 log_id log_type log_component

10 log_subtype

11 priority

12 duration

237

Cyberoam User Guide

13 firewall_rule_id integer Firewall rule id i.e. firewall rule id which is applied on the traffic

14 user_name

19 user_group iap application application_id in_interface string Group Id of user integer Internet Access policy Id applied on the traffic string Application name string Application identifier string Interface for incoming traffic e.g. Port A

Blank for outgoing traffic

20 out_interface

21 source_ip

22 destination ip

23 protocol

24 source_port

27 destination_port icmp_type icmp_code

Blank for incoming traffic string Original Source IP address of traffic string integer

Original Destination IP address of traffic

Protocol number of traffic integer Original Destination Port of TCP and UDP traffic integer ICMP type of ICMP traffic integer ICMP code of ICMP traffic

28 sent_packets

29 received_packets

30 sent_bytes

31 received_bytes integer integer integer integer

Total number of packets sent

Total number of packets received

Total number of bytes sent

Total number of bytes received

32 translated_source_ Translated applicable only in route mode.

Possible values:

"" – When Cyberoam is deployed in Bridge mode or source

IP address translation is not done

IP Address – IP Address with which the original source IP address is translated only in route mode.

Possible values:

"" – When Cyberoam is deployed in Bridge mode or source port translation is not done

Port – Port with which the original port is translated applicable only in route mode.

Possible values:

"" – When Cyberoam is deployed in Bridge mode or destination IP address translation is not done

IP Address – IP Address with which the original destination

IP address is translated applicable only in route mode.

Possible values:

"N/A" – When Cyberoam is deployed in Bridge mode or destination port translation is not done

Port – Port with which the original port is translated

36 sourcezonetype

37 destinationzonetype

238

38 direction_disposition string Packet

Possible values:

“org”, “reply”, “”

39 connection_event

40 connection id

41 virtual connection id integer integer

Event on which this log is generated

Unique identifier of connection

Connection ID of the master connection

Cyberoam User Guide

DoS Attack log

Event Log sample

denied according to the

DoS settings device_id=C010600411-YFK5RL deployment_mode="Route"

log_type="Firewall" log_component="DoS Attack" log_subtype

=010402403001

="Denied" priority=Warning duration=0 fw_rule_id=”” user_name="" user_gp="" iap=”” application="" application_id=”” in_interface="Port A" out_interface="" src_ip=192.168.3.60 dst_ip=192.168.13.25 protocol="ICMP" icmp_type=3 icmp_code=3 sent_pkts=0 recv_pkts=0 sent_bytes=0 recv_bytes=0 tran_src_ip=0.0.0.0 tran_src_port=0 tran_dst_ip=0.0.0.0 tran_dst_port=0 srczonetype=”LAN” dstzonetype=”Local” dir_disp=”org” connevent=”” connid=”” vconnid=””

Log fields and description

SR.

No.

DATA FIELDS

date

TYPE DESCRIPTION

4 time timezone device_name

5 device_id

6 deployment_mode date time

Date (yyyy-mm-dd) when the event occurred

For the allowed traffic - the date on which connection was started on Cyberoam

For the dropped traffic - the date when the packet was dropped by Cyberoam

Time (hh:mm:ss) when the event occurred

For the allowed traffic - the time when the connection was started on Cyberoam

For the dropped traffic - the time when the packet was dropped by Cyberoam

Time zone set on Cyberoam appliance e.g. IST string Model Number of the Cyberoam Appliance

7 log_id

Possible values: Route, Bridge string Unique 12 characters code (c1c2c3c4c5c6c7c8c9c10c11) e.g. 0101011, 0102011 c1c2 - Log Type e.g. 01 for firewall log

239

Cyberoam User Guide

13 log_type log_component

10 log_subtype

11 priority duration firewall_rule_id c3c4 - Log Component i.e. firewall/local ACL/ DoS Attack etc. c5c6 - Log Sub Type i.e. allow/violation c7 - Priority e.g. 0 for Emergency

14 user_name

Blank for outgoing traffic

20 out_interface

21 source_ip

22 destination ip

23 protocol

24 source_port

29 destination_port icmp_type icmp_code sent_packets received_packets

Blank for incoming traffic string Original Source IP address of traffic string integer

Original Destination IP address of traffic

Protocol number of traffic integer Original Destination Port of TCP and UDP traffic integer ICMP type of ICMP traffic integer ICMP code of ICMP traffic integer Total number of packets sent integer Total number of packets received

30 sent_bytes

31 received_bytes integer integer

Total number of bytes sent

Total number of bytes received

32 translated_source_ Translated applicable only in route mode.

Possible values:

"" – When Cyberoam is deployed in Bridge mode or source

IP address translation is not done

IP Address – IP Address with which the original source IP address is translated only in route mode.

Possible values:

"" – When Cyberoam is deployed in Bridge mode or source port translation is not done

Port – Port with which the original port is translated

240

Cyberoam User Guide applicable only in route mode.

Possible values:

"" – When Cyberoam is deployed in Bridge mode or destination IP address translation is not done

IP Address – IP Address with which the original destination

IP address is translated applicable only in route mode.

Possible values:

"N/A" – When Cyberoam is deployed in Bridge mode or destination port translation is not done

Port – Port with which the original port is translated

36 sourcezonetype

37 destinationzonetype

38 direction_disposition string Packet

Possible values:

“org”, “reply”, “”

39 connection_event Event on which this log is generated

40 connection id

41 virtual connection id integer Unique identifier of connection integer Connection ID of the master connection

ICMP Redirection log

Event

ICMP redirection traffic denied

Log sample

date=2007-12-12 time=14:48:59 timezone="IST" device_name="CR500i" device_id=C010600411-YFK5RL deployment_mode="Route"

=010502604001

log_type="Firewall" log_component="ICMP Redirection"

priority=Information duration=0 fw_rule_id=”” user_name="" user_gp="" iap=”” application="" application_id=”” in_interface="" out_interface="" src_ip=192.168.13.25 dst_ip=192.168.15.40 protocol="UDP" src_port=33379 dst_port=514 sent_pkts=0 recv_pkts=0 sent_bytes=0 recv_bytes=0 tran_src_ip=0.0.0.0 tran_src_port=0 tran_dst_ip=0.0.0.0 tran_dst_port=0 srczonetype=”” dstzonetype=”” dir_disp=”” connevent=”” connid=”” vconnid=””

Log fields and description

SR.

No.

DATA FIELDS

date

TYPE

date

DESCRIPTION

2 time time

Date (yyyy-mm-dd) when the event occurred

For the allowed traffic - the date on which connection was started on Cyberoam

For the dropped traffic - the date when the packet was dropped by Cyberoam

Time (hh:mm:ss) when the event occurred

For the allowed traffic - the time when the connection was started on Cyberoam

241

Cyberoam User Guide

4 timezone device_name

5 device_id

6 deployment_mode

For the dropped traffic - the time when the packet was dropped by Cyberoam

Time zone set on Cyberoam appliance e.g. IST string Model Number of the Cyberoam Appliance

13 log_id log_type log_component

10 log_subtype

11 priority duration firewall_rule_id

14 user_name

Blank for outgoing traffic

20 out_interface

21 source_ip

22 destination ip

23 protocol

24 source_port

29 destination_port icmp_type icmp_code sent_packets received_packets

Blank for incoming traffic string Original Source IP address of traffic string integer

Original Destination IP address of traffic

30 sent_bytes

31 received_bytes integer integer

Total number of bytes sent

Total number of bytes received

32 translated_source_ Translated applicable only in route mode.

242

Cyberoam User Guide

Possible values:

"" – When Cyberoam is deployed in Bridge mode or source

IP address translation is not done

IP Address – IP Address with which the original source IP address is translated only in route mode.

Possible values:

"" – When Cyberoam is deployed in Bridge mode or source port translation is not done

Port – Port with which the original port is translated applicable only in route mode.

Possible values:

"" – When Cyberoam is deployed in Bridge mode or destination IP address translation is not done

IP Address – IP Address with which the original destination

IP address is translated applicable only in route mode.

Possible values:

"N/A" – When Cyberoam is deployed in Bridge mode or destination port translation is not done

Port – Port with which the original port is translated

36 sourcezonetype

37 destinationzonetype

38 direction_disposition string Packet

Possible values:

“org”, “reply”, “”

39 connection_event Event on which this log is generated

40 connection id

41 virtual connection id integer Unique identifier of connection integer Connection ID of the master connection

Source Routed log

Event

Source routed traffic denied

Log sample

date=2007-12-12 time=14:10:53 timezone="IST" device_name="CR500i" device_id=C010600411-YFK5RL deployment_mode="Route"

=010602605001 log_type="Firewall" log_component="Source Routed" log_subtype

priority=Information duration=0 fw_rule_id=”” user_name="" user_gp="" iap=”” application="" application_id=”” in_interface="" out_interface="" src_ip=192.168.1.76 dst_ip=192.168.13.25 protocol="ICMP" icmp_type=8 icmp_code=0 sent_pkts=0 recv_pkts=0 sent_bytes=0 recv_bytes=0 tran_src_ip=0.0.0.0 tran_src_port=0 tran_dst_ip=0.0.0.0 tran_dst_port=0 srczonetype=”” dstzonetype=”” dir_disp=”” connevent=”” connid=”” vconnid=””

243

Cyberoam User Guide

SR.

No.

Log fields and description

DATA FIELDS

date time

4 timezone device_name

5 device_id

6 deployment_mode

TYPE DESCRIPTION

date time

Date (yyyy-mm-dd) when the event occurred

For the allowed traffic - the date on which connection was started on Cyberoam

For the dropped traffic - the date when the packet was dropped by Cyberoam

Time (hh:mm:ss) when the event occurred

For the allowed traffic - the time when the connection was started on Cyberoam

For the dropped traffic - the time when the packet was dropped by Cyberoam

Time zone set on Cyberoam appliance e.g. IST string Model Number of the Cyberoam Appliance

19 log_id log_type log_component

10 log_subtype

11 priority

12 duration

13 firewall_rule_id

14 user_name

15 user_group

16 iap

17 application application_id in_interface

20 out_interface

Blank for outgoing traffic

244

Cyberoam User Guide

21 source_ip

22 destination ip

23 protocol

24 source_port

25 destination_port

26 icmp_type string string integer

Blank for incoming traffic

Original Source IP address of traffic

Original Destination IP address of traffic

Protocol number of traffic integer Original Destination Port of TCP and UDP traffic integer ICMP type of ICMP traffic

27 icmp_code

28 sent_packets

29 received_packets

30 sent_bytes integer integer integer integer

ICMP code of ICMP traffic

Total number of packets sent

Total number of packets received

Total number of bytes sent

31 received_bytes integer Total number of bytes received

32 translated_source_ integer applicable only in route mode.

Possible values:

"" – When Cyberoam is deployed in Bridge mode or source

IP address translation is not done

IP Address – IP Address with which the original source IP address is translated only in route mode.

Possible values:

"" – When Cyberoam is deployed in Bridge mode or source port translation is not done

Port – Port with which the original port is translated applicable only in route mode.

Possible values:

"" – When Cyberoam is deployed in Bridge mode or destination IP address translation is not done

IP Address – IP Address with which the original destination

IP address is translated applicable only in route mode.

Possible values:

"N/A" – When Cyberoam is deployed in Bridge mode or destination port translation is not done

Port – Port with which the original port is translated

36 sourcezonetype

37 destinationzonetype

38 direction_disposition string Packet

Possible values:

“org”, “reply”, “”

39 connection_event Event on which this log is generated

40 connection id

41 virtual connection id integer Unique identifier of connection integer Connection ID of the master connection

245

Cyberoam User Guide

Fragmented Traffic log

Event

Fragmented traffic denied

Log sample

date=2007-12-12 time=14:10:53 timezone="IST" device_name="CR500i" device_id=C010600411-YFK5RL deployment_mode="Route"

=011402601301 log_type="Firewall" log_component="Fragmented Traffic" log_subtype

priority=Information duration=0 fw_rule_id=”” user_name="" user_gp="" iap=”” application="" application_id=”” in_interface="Port A" out_interface="" src_ip=192.168.1.76 dst_ip=192.168.13.25 protocol="ICMP" icmp_type=8 icmp_code=0 sent_pkts=0 recv_pkts=0 sent_bytes=0 recv_bytes=0 tran_src_ip=0.0.0.0 tran_src_port=0 tran_dst_ip=0.0.0.0 tran_dst_port=0 srczonetype=”LAN” dstzonetype=”Local” dir_disp=”” connevent=”” connid=”” vconnid=””

Log fields and description

SR.

No.

DATA FIELDS

date

TYPE DESCRIPTION

4 time timezone device_name

5 device_id

6 deployment_mode date time

Date (yyyy-mm-dd) when the event occurred

For the allowed traffic - the date on which connection was started on Cyberoam

For the dropped traffic - the date when the packet was dropped by Cyberoam

Time (hh:mm:ss) when the event occurred

For the allowed traffic - the time when the connection was started on Cyberoam

For the dropped traffic - the time when the packet was dropped by Cyberoam

Time zone set on Cyberoam appliance e.g. IST string Model Number of the Cyberoam Appliance

9 log_id log_type log_component

10 log_subtype

246

Cyberoam User Guide

13 priority duration firewall_rule_id string Severity level of traffic integer Durability of traffic (seconds) integer Firewall rule id i.e. firewall rule id which is applied on the traffic

14 user_name

15 user_group

16 iap

17 application

18 application_id

19 in_interface string Group Id of user integer Internet Access policy Id applied on the traffic string Application name string Application identifier string Interface for incoming traffic e.g. Port A

Blank for outgoing traffic

20 out_interface

21 source_ip

22 destination ip

23 protocol

24 source_port

25 destination_port

26 icmp_type

27 icmp_code

28 sent_packets

29 received_packets

30 sent_bytes string string integer integer integer ICMP type of ICMP traffic integer ICMP code of ICMP traffic integer integer integer

Blank for incoming traffic

Original Source IP address of traffic

Original Destination IP address of traffic

Protocol number of traffic

Original Destination Port of TCP and UDP traffic

Total number of packets sent

Total number of packets received

Total number of bytes sent

31 received_bytes integer Total number of bytes received

32 translated_source_ Translated applicable only in route mode.

Possible values:

"" – When Cyberoam is deployed in Bridge mode or source

IP address translation is not done

IP Address – IP Address with which the original source IP address is translated only in route mode.

Possible values:

"" – When Cyberoam is deployed in Bridge mode or source port translation is not done

Port – Port with which the original port is translated applicable only in route mode.

Possible values:

"" – When Cyberoam is deployed in Bridge mode or destination IP address translation is not done

IP Address – IP Address with which the original destination

IP address is translated applicable only in route mode.

Possible values:

"N/A" – When Cyberoam is deployed in Bridge mode or destination port translation is not done

Port – Port with which the original port is translated

247

36 sourcezonetype

37 destinationzonetype

38 direction_disposition string Packet

Possible values:

“org”, “reply”, “”

39 connection_event Event on which this log is generated

40 connection id

41 virtual connection id integer Unique identifier of connection integer Connection ID of the master connection

Cyberoam User Guide

Invalid Fragmented Traffic log

Event

Invalid

Fragmented traffic denied

Log sample

date=2007-12-12 time=14:10:53 timezone="IST" device_name="CR500i" device_id=C010600411-YFK5RL deployment_mode="Route"

log_type="Firewall" log_component="Invalid Fragmented Traffic" log_subtype

=011502601601

priority=Information duration=0 fw_rule_id=”” user_name="" user_gp="" iap=”” application="" application_id=”” in_interface="Port A" out_interface="" src_ip=192.168.1.76 dst_ip=192.168.13.25 protocol="ICMP" icmp_type=3 icmp_code=3 sent_pkts=0 recv_pkts=0 sent_bytes=0 recv_bytes=0 tran_src_ip=0.0.0.0 tran_src_port=0 tran_dst_ip=0.0.0.0 tran_dst_port=0 srczonetype=”LAN” dstzonetype=”Local” dir_disp=”” connevent=”” connid=”” vconnid=””

Log fields and description

SR.

No.

Cyberoam will filter following traffic as Invalid Fragmented traffic:

Fragment Queue out of memory while reassembling IP fragments

Fragment Queue Timeout while reassembling IP fragments

Fragment too far ahead while reassembling IP fragments

Oversized IP Packet while reassembling IP fragments

Fragmentation failure while creating fragments

DATA FIELDS

date

TYPE DESCRIPTION

4 time timezone device_name

5 device_id

6 deployment_mode date time

Date (yyyy-mm-dd) when the event occurred

For the allowed traffic - the date on which connection was started on Cyberoam

For the dropped traffic - the date when the packet was dropped by Cyberoam

Time (hh:mm:ss) when the event occurred

For the allowed traffic - the time when the connection was started on Cyberoam

For the dropped traffic - the time when the packet was dropped by Cyberoam

Time zone set on Cyberoam appliance e.g. IST string Model Number of the Cyberoam Appliance

248

Cyberoam User Guide

9 log_id log_type log_component

10 log_subtype

11 priority

12 duration

13 firewall_rule_id

14 user_name

Blank for outgoing traffic

20 out_interface

21 source_ip

22 destination ip

23 protocol

24 source_port

28 destination_port icmp_type icmp_code sent_packets string string integer

Blank for incoming traffic

Original Source IP address of traffic

Original Destination IP address of traffic

Protocol number of traffic integer Original Destination Port of TCP and UDP traffic integer ICMP type of ICMP traffic integer ICMP code of ICMP traffic integer Total number of packets sent

29 received_packets

30 sent_bytes integer Total number of packets received integer Total number of bytes sent

31 received_bytes integer Total number of bytes received

32 translated_source_ Translated applicable only in route mode.

Possible values:

"" – When Cyberoam is deployed in Bridge mode or source

IP address translation is not done

IP Address – IP Address with which the original source IP address is translated only in route mode.

249

Cyberoam User Guide

Possible values:

"" – When Cyberoam is deployed in Bridge mode or source port translation is not done

Port – Port with which the original port is translated applicable only in route mode.

Possible values:

"" – When Cyberoam is deployed in Bridge mode or destination IP address translation is not done

IP Address – IP Address with which the original destination

IP address is translated applicable only in route mode.

Possible values:

"N/A" – When Cyberoam is deployed in Bridge mode or destination port translation is not done

Port – Port with which the original port is translated

36 sourcezonetype

37 destinationzonetype

38 direction_disposition string Packet

Possible values:

“org”, “reply”, “”

39 connection_event

40 connection id

41 virtual connection id

Event on which this log is generated integer Unique identifier of connection integer Connection ID of the master connection

IDP logs

Event Log sample

based on unknown device_id=C010600411 deployment_mode=”Route”

=020703306001

or suspicious

=”Detect” status="Allowed" patterns (anomaly) priority=Warning idp_policy_id=1 idp_policy_name=”generalpolicy” fw_rule_id=85 user_name=““ signature_id=221 signature_msg="DDOS TFN Probe" classification="Misc activity" rule_priority=3 src_ip=192.168.15.40 dst_ip=203.88.135.198 protocol=”ICMP” src_port=““ dst_port=““ icmp_type=8 icmp_code=0 based on unknown patterns (anomaly) device_id=C010600411 deployment_mode=”Route”

=020704306002

or suspicious

=”Drop” status="Denied" priority=Warning idp_policy_id=1 idp_policy_name=”generalpolicy” fw_rule_id=88 user_name=““ signature_id=221 signature_msg="DDOS TFN Probe" classification="Misc activity" rule_priority=3 src_ip=192.168.15.40 dst_ip=66.94.234.13 protocol=”ICMP” src_port=““ dst_port=““ icmp_type=8 icmp_code=0 based on attack device_id=C010600411 deployment_mode=”Route”

log_type=”IDP” log_component="Signatures" log_subtype

=020803307001

signature

=”Detect” status="Allowed"

priority=Warning idp_policy_id=1 idp_policy_name=”generalpolicy” fw_rule_id=85 user_name=““ signature_id=384 signature_msg="ICMP PING" classification="Misc activity" rule_priority=3 src_ip=192.168.15.40 dst_ip=203.88.135.198 protocol=”ICMP” src_port=““ dst_port=““ icmp_type=8 icmp_code=0

250

Cyberoam User Guide based on attack device_id=C010600411 deployment_mode=”Route”

=020804307002

signature log_type=”IDP” log_component="Signatures"

=”Drop” status="Denied" priority=Warning idp_policy_id=1 idp_policy_name=”generalpolicy” fw_rule_id=88 user_name=““ signature_id=384 signature_msg="ICMP PING" classification="Misc activity" rule_priority=3 src_ip=192.168.15.40 dst_ip=66.94.234.13 protocol=”ICMP” src_port=““ dst_port=““ icmp_type=8 icmp_code=0

Log fields and description

SR.

No.

DATA FIELDS

date

TYPE DESCRIPTION

4 time timezone device_name

5 device_id

6 deployment_mode

Date Date (yyyy-mm-dd) when the event occurred

For the allowed traffic - the date on which connection was started on Cyberoam

For the dropped traffic - the date when the packet was dropped by Cyberoam

Time Time (hh:mm:ss) when the event occurred

For the allowed traffic - the time when the connection was started on Cyberoam

For the dropped traffic - the time when the packet was dropped by Cyberoam

Time zone set on Cyberoam appliance e.g. IST

String Model Number of the Cyberoam Appliance

15 log_id log_type log_component log_subtype status priority idp_policy_id idp_policy_name firewall_rule_id

Possible values: Route, Bridge

String Unique 12 characters code (c1c2c3c4c5c6c7c8c9c10c11) e.g. 0101011, 0102011 c1c2 - Log Type e.g. 01 for firewall log c3c4 - Log Component i.e. firewall/local ACL/ DoS Attack etc. c5c6 - Log Sub Type i.e. allow/violation c7 - Priority e.g. 0 for Emergency

C8c9c10c11 - Message ID e.g. 00001 for traffic allowed by firewall

String Type of event occurred in Cyberoam e.g. firewall event

String Component responsible for logging e.g. Firewall rule

String Decision taken on traffic

String Ultimate status of traffic – allowed or denied

String Severity level of traffic integer IDP policy id i.e. IDP policy id which is applied on the traffic integer IDP policy name i.e. IDP policy name which is applied on the traffic integer Firewall rule id i.e. firewall rule id which is applied on the

251

Cyberoam User Guide traffic

16 user_name

17 signature_id

18 singature_message

19 classification

20 rule_priority

21 source_ip

22 destination ip

23 protocol

24 source_port

25 destination_port

26 icmp_type

27 icmp_code

String Signature message

String Priority of IDP policy

String Original Source IP address of traffic

String Original Destination IP address of traffic integer Protocol number of traffic integer Original Destination Port of TCP and UDP traffic integer ICMP type of ICMP traffic integer ICMP code of ICMP traffic

Anti Virus logs

Event Log sample

HTTP – Virus date=2007-11-17 time=07:50:26 timezone=”IST” device_name=”CR500i” infected URL

=030906208001 log_type=”Anti

blocked Virus” log_component=”HTTP”

=”Virus” status=”Denied” priority=Critical

fw_rule_id=”” user_name=”” AV_policy_name=”Common Virus Policy” virus=”eicar”

URL=”www.eicar.com” domainname=”eicar.com” src_ip=192.168.15.40 dst_ip=66.249.89.18 protocol=”TCP” src_port=2458 dst_port=80 sent_bytes=162 recv_bytes=45

Virus infected date=2007-11-17 time=10:55:06 timezone=”IST” device_name=”CR500i”

FTP data

=031006209001 log_type=”Anti

transfer blocked

Virus” log_component=”FTP” log_subtype

=”Virus” status=”Denied” priority=Critical fw_rule_id=”” user_name=““ virus=”codevirus” FTP_URL=”ftp.myftp.com”

FTP_Direction=”download” filename=”resume.doc” file_size=”550k” file_path=”mike/Shortcut to virus.lnk” ftpcommand=”RETR” src_ip=192.168.15.40 dst_ip=203.88.136.154 protocol=”TCP” src_port=2458 dst_port=21 dstdomain=”myftp.cpm” sent_bytes=162 recv_bytes=45 transfer completed successfully device_id=C010600411 deployement_mode=”Route”

=031005609002 log_type=”Anti Virus” log_component=”FTP”

Virus” log_component=”SMTP” log_subtype

=”Clean” status=”Allowed” priority=Information fw_rule_id=”” user_name=”” virus=““ FTP_URL=”ftp.myftp.com”

FTP_Direction=”download” filename=”demonstration.doc” file_size=”470k” file_path=”mike/myfile.doc” ftpcommand=”RETR” src_ip=192.168.15.40 dst_ip=203.88.136.154 protocol=”TCP” src_port=2458 dst_port=21 dstdomain=”myftp.com” sent_bytes=162 recv_bytes=45

Virus infected date=2007-11-17 time=08:50:06 timezone=”IST” device_name=”CR500i” mail detected in

SMTP traffic device_id=C010600411 deployment_mode=”Route”

=031106210001 log_type=”Anti

=”Virus” status=”Denied” priority=Critical

fw_rule_id=”” user_name=”” AV_Policy_name=”AV common Policy” from_email_address=”[email protected]” to_email_address=”[email protected]” subject=”Important” mailid=”001a01c82a19$a9dde620$061c568c@xxx” mailsize=”420k” virus=”eicar” filename=”eicar” virus_status=”Infected” virus_action=”Quarantined” quarantine=”/var/quarantine/0x10001f9f.47412e69” src_domainname=”core.com” dst_domainname=”cnen.com” src_ip=192.168.15.40 dst_ip=66.249.89.18 protocol=”TCP” src_port=2458 dst_port=80 sent_bytes=162 recv_bytes=45

Virus infected date=2007-11-17 time=08:55:06 timezone=”IST” device_name=”CR500i” mail detected in

POP3 traffic device_id=C010600411 deployment_mode=”Route”

Virus” log_component=”POP3” log_subtype

=031206211001 log_type=”Anti

=”Virus” status=”Denied” priority=Critical

fw_rule_id=”” user_name=”” AV_Policy_name=”AV common Policy”

252

Cyberoam User Guide from_email_address=”[email protected]” to_email_address=”[email protected]” subject=”Important” mailid=”001a01c82a19$a9dde620$061c568c@xxx” mailsize=”420k” virus=”redvirus” filename=”resume.doc” virus_status=”Infected” virus_action=”Quarantined” quarantine=”/var/quarantine/0x10001f9f.47412e69” src_domainname=”core.com” dst_domainname=”cnen.com” src_ip=192.168.15.40 dst_ip=66.249.89.18 protocol=”TCP” src_port=2458 dst_port=80 sent_bytes=162 recv_bytes=45

Virus infected date=2007-11-17 time=08:55:06 timezone=”IST” device_name=”CR500i” mail detected in

IMAP4 traffic device_id=C010600411 deployment_mode=”Route”

Virus” log_component=”IMAP4”

=031306212001 log_type=”Anti

=”Virus” status=”Denied” priority=Critical fw_rule_id=”” user_name=““ AV_Policy_name=”AV common Policy” from_email_address=”[email protected]” to_email_address=”[email protected]” subject=”Important” mailid=”001a01c82a19$a9dde620$061c568c@xxx” mailsize=”420k” virus=”redvirus” filename=”resume.doc” virus_status=”Infected” virus_action=”Quarantined” quarantine=”/var/quarantine/0x10001f9f.47412e69” src_domainname=”core.com” dst_domainname=”cnen.com” src_ip=192.168.15.40 dst_ip=66.249.89.18 protocol=”TCP” src_port=2458 dst_port=80 sent_bytes=162 recv_bytes=45

Log fields and description

SR.

No.

DATA FIELDS

date

TYPE DESCRIPTION

4 time timezone device_name

5 device_id

6 deployment_mode date time

Date (yyyy-mm-dd) when the event occurred

For the allowed traffic - the date on which connection was started on Cyberoam

For the dropped traffic - the date when the packet was dropped by Cyberoam

Time (hh:mm:ss) when the event occurred

For the allowed traffic - the time when the connection was started on Cyberoam

For the dropped traffic - the time when the packet was dropped by Cyberoam

Time zone set on Cyberoam appliance e.g. IST string Model Number of the Cyberoam Appliance

7 log_id

C8c9c10c11 - Message ID e.g. 00001 for traffic allowed by

253

Cyberoam User Guide

8 log_type

9 log_component

10 log_subtype

11 status

12 priority

13 firewall_rule_id firewall string Type of event occurred in Cyberoam e.g. firewall event string Component responsible for logging e.g. Firewall rule string Decision taken on traffic string Ultimate status of traffic – allowed or denied string Severity level of traffic integer Firewall rule id i.e. firewall rule id which is applied on the traffic

14 user_name

15 av_policy_name

16 from_email_address

17 to_email_address

18 subject

19 mailid

20 mailsize

21 virus

22 filename

23 virus_status

24 virus_action

25 quarantine

26 src_domainname

27 dst_domainname

28 source_ip

29 destination ip

30 protocol

31 source_port

32 destination_port

33 send_bytes

34 received_bytes

Anti Spam log

integer AV policy name i.e. AV policy name which is applied on the traffic string Sender email address string Receipeint email address string Signature message string Priority of IDP policy string Name of the file that contained virus string Suspicious or infected or protected string Dropped or Quarantined string Path and filename of the file quarantined string Sender domain name string Receiver domain name string Original Source IP address of traffic string Original Destination IP address of traffic integer Protocol number of traffic integer Original Destination Port of TCP and UDP traffic integer Total number of bytes send integer Total number of bytes received

Event Sample log

Mail detected as SPAM in SMTP traffic and rejected date=2007-11-17 time=08:15:46 timezone=”IST” device_name=”CR500i”

device_id=C010600411 deployment_mode=”Route” log_id

=041107413001 log_type=”Anti Spam” log_component=”SMTP”

=”Spam” status=”Denied” priority=Warning fw_rule_id=”” user_name=““

Spam_Policy_Name=”Department Spam Policy” from_email_address=”[email protected]” to_email_address=”[email protected]” email_subject=”Promotional

Scheme” mailsize=”550k” mailid=”001a01c82a19$a9tte620$061c568c@xxx” spamaction=”Reject”

device_id=C010600411 deployment_mode=”Route” log_id

=”Cyberoam Anti Spam identifies mail as Spam” quarantine=““ src_domainname=”core.com” dst_domainname=”elitecore.com” src_ip=192.168.15.40 dst_ip=203.88.136.154 protocol=”TCP” src_port=2458 dst_port=21 sent_bytes=162 recv_bytes=45

Mail detected as SPAM in SMTP traffic and date=2007-11-17 time=08:15:46 timezone=”IST” device_name=”CR500i”

=041107413004 dropped log_type=”Anti Spam” log_component=”SMTP”

=”Spam” status=”Denied” priority=Warning fw_rule_id=”” user_name=““

254

Cyberoam User Guide

Spam_Policy_Name=”Department Spam Policy” from_email_address=”[email protected]” to_email_address=”[email protected]” email_subject=”Promotional

Scheme” mailsize=”550k” mailid=”001a01c82a19$a9tte620$061c568c@xxx” spamaction=”Drop”

=”Cyberoam Anti Spam identifies mail as Spam”

quarantine=““ src_domainname=”core.com” dst_domainname=”elitecore.com” src_ip=192.168.15.40 dst_ip=203.88.136.154 protocol=”TCP” src_port=2458 dst_port=21 sent_bytes=162 recv_bytes=45

Mail detected as SPAM in SMTP traffic but

device_id=C010600411 deployment_mode=”Route” log_id

=041107413005 accepted date=2007-11-17 time=08:15:46 timezone=”IST” device_name=”CR500i” log_type=”Anti Spam” log_component=”SMTP”

=”Spam” status=”Allowed” priority=Warning fw_rule_id=”” user_name=““

Spam_Policy_Name=”Department Spam Policy” from_email_address=”[email protected]” to_email_address=”[email protected]” email_subject=”Promotional

Scheme” mailsize=”550k” mailid=”001a01c82a19$a9tte620$061c568c@xxx” spamaction=”Accept”

device_id=C010600411 deployment_mode=”Route” log_id

Mail detected as SPAM in SMTP traffic but mail date=2007-11-17 time=08:15:46 timezone=”IST” device_name=”CR500i”

=041107413006 is forwarded after

=”Spam” changing the original status=”Allowed” priority=Warning fw_rule_id=”” user_name=““ recipient address

Spam_Policy_Name=”Department Spam Policy” from_email_address=”[email protected]” to_email_address=”[email protected]” changed_to_email_address=”[email protected]” email_subject=”Promotional Scheme” mailsize=”550k” mailid=”001a01c82a19$a9tte620$061c568c@xxx” spamaction=”Change

Recipient”

=”Cyberoam Anti Spam identifies mail as Spam”

quarantine=““ src_domainname=”core.com” dst_domainname=”elitecore.com” src_ip=192.168.15.40 dst_ip=203.88.136.154 protocol=”TCP” src_port=2458 dst_port=21 sent_bytes=162 recv_bytes=45

Mail detected as SPAM date=2007-11-17 time=08:15:46 timezone=”IST” device_name=”CR500i” in SMTP traffic but

device_id=C010600411 deployment_mode=”Route” log_id

=041107413007 forwarded after tagging the original subject i.e. log_type=”Anti Spam” log_component=”SMTP”

=”Spam” status=”Allowed” priority=Warning fw_rule_id=”” user_name=““ adding prefix to the subject

Spam_Policy_Name=”Department Spam Policy” from_email_address=”[email protected]” to_email_address=”[email protected]” email_subject=”Promotional

Scheme” subject_prefix=”spam:” mailsize=”550k” mailid=”001a01c82a19$a9tte620$061c568c@xxx” spamaction=”Prefix

Subject”

device_id=C010600411 deployment_mode=”Route” log_id

Mail detected as a date=2007-11-17 time=10:55:06 timezone=”IST” device_name=”CR500i”

PROBABLE SPAM in

=041108413002

SMTP traffic and

=”Probable rejected Spam” status=”Denied” priority=Warning fw_rule_id=”” user_name=””

Spam_Policy_Name=”Custom Spam Policy” from_email_address=”[email protected]” to_email_address=”[email protected]” email_subject=”Photos” mailsize=”550k” mailid=”001a01c82a19$a9tte620$061c568c@xxx” spamaction=”Reject”

device_id=C010600411 deployment_mode=”Route” log_id

=”Cyberoam Anti Spam identifies mail as

Probable Spam” src_domainname=”core.com”

255

Cyberoam User Guide dst_domainname=”elitecore.com” src_ip=192.168.15.40 dst_ip=203.88.136.154 protocol=”TCP” src_port=2458 dst_port=21 sent_bytes=162 recv_bytes=45

PROBABLE SPAM in

=0411084130082

SMTP traffic and

device_id=C010600411 deployment_mode=”Route” log_id

=”Probable dropped Spam” status=”Denied” priority=Warning fw_rule_id=”” user_name=””

spamaction=”Drop” reason

=”Cyberoam Anti Spam identifies mail as Probable

Spam” src_domainname=”core.com” dst_domainname=”elitecore.com” src_ip=192.168.15.40 dst_ip=203.88.136.154 protocol=”TCP” src_port=2458 dst_port=21 sent_bytes=162 recv_bytes=45

PROBABLE SPAM in

=041108413009

SMTP traffic but

=”Probable accepted Spam” status=”Allowed” priority=Warning fw_rule_id=”” user_name=””

device_id=C010600411 deployment_mode=”Route” log_id

=”Cyberoam Anti Spam identifies mail as

Probable Spam” src_domainname=”core.com” dst_domainname=”elitecore.com” src_ip=192.168.15.40 dst_ip=203.88.136.154 protocol=”TCP” src_port=2458 dst_port=21 sent_bytes=162 recv_bytes=45

PROBABLE SPAM in

=041108413010

SMTP traffic but is log_type=”Anti Spam” log_component=”SMTP”

=”Probable changing the original Spam_Policy_Name=”Custom Spam Policy” recipient address from_email_address=”[email protected]” to_email_address=”[email protected]” changed_to_email_address=”[email protected]” email_subject=”Photos” mailsize=”550k” mailid=”001a01c82a19$a9tte620$061c568c@xxx” spamaction=”Change Recipient”

=”Cyberoam Anti Spam identifies

mail as Probable Spam” src_domainname=”core.com” dst_domainname=”elitecore.com” src_ip=192.168.15.40 dst_ip=203.88.136.154 protocol=”TCP” src_port=2458 dst_port=21 sent_bytes=162 recv_bytes=45

PROBABLE SPAM in

SMTP traffic but

device_id=C010600411 deployment_mode=”Route” log_id

=”Probable forwarded after tagging the original subject i.e.

Spam” status=”Allowed” priority=Warning fw_rule_id=”” user_name=””

Spam_Policy_Name=”Custom Spam Policy” adding prefix to the from_email_address=”[email protected]” subject

=041108413011 to_email_address=”[email protected]” email_subject=”Photos” mailsize=”550k” subject_prefix=”probable spam:” mailid=”001a01c82a19$a9tte620$061c568c@xxx” spamaction=”Prefix

Subject”

device_id=C010600411 deployement_mode=”Route” log_id

=”Cyberoam Anti Spam identifies mail as Probable Spam” src_domainname=”core.com” dst_domainname=”elitecore.com” src_ip=192.168.15.40 dst_ip=203.88.136.154 protocol=”TCP” src_port=2458 dst_port=21 sent_bytes=162 recv_bytes=45

Clean mail in SMTP traffic date=2007-11-17 time=10:55:06 timezone=”IST” device_name=”CR500i”

=041105613003

log_type=”Anti Spam” log_component=”SMTP” log_subtype

=”Clean” status=”Allowed” priority=Information fw_rule_id=”” user_name=””

Spam_Policy_Name=”Custom Spam Policy” from_email_address=”[email protected]”

256

Cyberoam User Guide to_email_address=”[email protected]” email_subject=”Photos” mailsize=”550k” mailid=”001a01c82a19$a9tde620$061c568c@xxx” spamaction= ““

= ““ src_domainname=”core.com”

dst_domainname=”elitecore.com” src_ip=192.168.15.40 dst_ip=203.88.136.154 protocol=”TCP” src_port=2458 dst_port=21 sent_bytes=162 recv_bytes=45

Mail detected as SPAM date=2007-11-17 time=08:15:46 timezone=”IST” device_name=”CR500i” in POP3 traffic but

device_id=C010600411 deployment_mode=”Route” log_id

=041207414001 accepted log_type=”Anti Spam” log_component=”POP3”

=”Spam” status=”Allowed” priority=Warning fw_rule_id=”” user_name=““

Spam_Policy_Name=”Department Spam Policy” from_email_address=”[email protected]” to_email_address=”[email protected]” email_subject=”Promotional

Scheme” mailsize=”550k” mailid=”001a01c82a19$a9tte620$061c568c@xxx” spamaction=”Accept”

device_id=C010600411 deployment_mode=”Route” log_id

= “Cyberoam Anti Spam identifies mail as

Spam” quarantine=““ src_domainname=”core.com” dst_domainname=”elitecore.com” src_ip=192.168.15.40 dst_ip=203.88.136.154 protocol=”TCP” src_port=2458 dst_port=21 sent_bytes=162 recv_bytes=45

PROBABLE SPAM in

=041207414004

POP3 traffic but

=”Spam” accepted status=”Allowed” priority=Warning fw_rule_id=”” user_name=““

Spam_Policy_Name=”Department Spam Policy” from_email_address=”[email protected]” to_email_address=”[email protected]” email_subject=”Promotional

Scheme” subject_prefix=”Spam:” mailsize=”550k” mailid=”001a01c82a19$a9tte620$061c568c@xxx” spamaction=”Prefix

Subject”

= “Cyberoam Anti Spam identifies mail as Spam”

quarantine=““ src_domainname=”core.com” dst_domainname=”elitecore.com” src_ip=192.168.15.40 dst_ip=203.88.136.154 protocol=”TCP” src_port=2458 dst_port=21 sent_bytes=162 recv_bytes=45

Clean mail in POP3 traffic date=2007-11-17 time=10:55:06 timezone=”IST” device_name=”CR500i”

device_id=C010600411 deployment_mode=”Route” log_id

=041208414002 log_type=”Anti Spam” log_component=”POP3”

=”Probable

Spam” status=”Allowed” priority=Warning fw_rule_id=”” user_name=””

device_id=C010600411 deployment_mode=”Route” log_id

=”Cyberoam Anti Spam identifies mail as

Probable Spam” src_domainname=”core.com” dst_domainname=”elitecore.com” src_ip=192.168.15.40 dst_ip=203.88.136.154 protocol=”TCP” src_port=2458 dst_port=21 sent_bytes=162 recv_bytes=45

Mail detected as SPAM in POP3 traffic but mail date=2007-11-17 time=10:55:06 timezone=”IST” device_name=”CR500i”

=041208414005 is forwarded after

=”Probable changing the original recipient address

Spam” status=”Allowed” priority=Warning fw_rule_id=”” user_name=””

Spam_Policy_Name=”Custom Spam Policy” from_email_address=”[email protected]” to_email_address=”[email protected]” email_subject=”Photos” subject_prefix=”Probable Spam:” mailsize=”550k” mailid=”001a01c82a19$a9tte620$061c568c@xxx” spamaction=”Prefix

Subject”

device_id=C010600411 deployment_mode=”Route” log_id

PROBABLE SPAM in

=041209614003

257

Cyberoam User Guide

POP3 traffic but

=”Clean” forwarded after tagging the original subject i.e. adding prefix to the subject status=”Allowed” priority=Information fw_rule_id=”” user_name=””

Spam_Policy_Name=”Custom Spam Policy” from_email_address=”[email protected]” to_email_address=”[email protected]” email_subject=”Photos” mailsize=”550k” mailid=001a01c82a19$a9tde620$061c568c@xxx spamaction= ““

= ““ src_domainname=”core.com”

dst_domainname=”elitecore.com” src_ip=192.168.15.40 dst_ip=203.88.136.154 protocol=”TCP” src_port=2458 dst_port=21 sent_bytes=162 recv_bytes=45

Mail detected as SPAM date=2007-11-17 time=08:15:46 timezone=”IST” device_name=”CR500i” in IMAP4 traffic but

device_id=C010600411 deployement_mode=”Route” log_id

=041307415001 accepted log_type=”Anti Spam” log_component=”IMAP4”

=”Spam” status=”Allowed” priority=Warning fw_rule_id=”” user_name=““

Spam_Policy_Name=”Department Spam Policy” from_email_address=”[email protected]” to_email_address=”[email protected]” email_subject=”Promotional

Scheme” mailsize=”550k” mailid=”001a01c82a19$a9tte620$061c568c@xxx” spamaction=”Accept”

device_id=C010600411 deployment_mode=”Route” log_id

= “Cyberoam Anti Spam identifies mail as

PROBABLE SPAM in accepted

=041307415001

IMAP4 traffic but

=”Spam” status=”Allowed” priority=Warning fw_rule_id=”” user_name=““

Spam_Policy_Name=”Department Spam Policy” from_email_address=”[email protected]” to_email_address=”[email protected]” email_subject=”Promotional

Scheme” mailsize=”550k” mailid=”001a01c82a19$a9tte620$061c568c@xxx” spamaction=”Accept”

= “Cyberoam Anti Spam identifies mail as

Clean mail in IMAP4 traffic date=2007-11-17 time=10:55:06 timezone=”IST” device_name=”CR500i” device_id=C010600411

=041308515002 log_type=”Anti Spam”

log_component=”IMAP4”

spamaction=”prefix subject” reason

=”Probable Spam” status=”accept” priority=”Warning” fw_rule_id=85 user_name=”rach”

=”Cyberoam Anti Spam identifies mail as

Probable Spam” src_domainname=”core.com” dst_domainname=”elitecore.com” src_ip=192.168.15.40 dst_ip=203.88.136.154 protocol=”TCP” src_port=2458 dst_port=21 sent_bytes=162 recv_bytes=45

Mail detected as SPAM in IMAP4 traffic but device_id=C010600411

=041309715003 log_type=”Anti Spam”

forwarded after tagging date=2007-11-17 time=10:55:06 timezone=”IST” device_name=”CR500i” log_component=”IMAP4”

=”Clean” status=”Accept”

the original subject i.e. adding prefix to the subject priority=”Information” fw_rule_id=85 user_name=”rach”

=““ src_domainname=”core.com”

dst_domainname=”elitecore.com” src_ip=192.168.15.40 dst_ip=203.88.136.154 protocol=”TCP” src_port=2458 dst_port=21 sent_bytes=162 recv_bytes=45

258

Cyberoam User Guide

SR.

No.

Log fields and description

DATA FIELDS

date

2 time

3 timezone

4 device_name

5 device_id

6 deployment_mode

TYPE DESCRIPTION

date time

Date (yyyy-mm-dd) when the event occurred

For the allowed traffic - the date on which connection was started on Cyberoam

For the dropped traffic - the date when the packet was dropped by Cyberoam

Time (hh:mm:ss) when the event occurred

For the allowed traffic - the time when the connection was started on Cyberoam

For the dropped traffic - the time when the packet was dropped by Cyberoam

Time zone set on Cyberoam appliance e.g. IST string Model Number of the Cyberoam Appliance

19 log_id log_type log_component

10 log_subtype

11 Status

12 Priority

13 firewall_rule_id

14 user_name spam_policy_name from_email_address

17 to_email_address

18 smail_subject

Mailsize

20 Mailid

C8c9c10c11 - Message ID e.g. 00001 for traffic allowed by firewall string Type of event occurred in Cyberoam e.g. firewall event string Component responsible for logging e.g. Firewall rule string Decision taken on traffic string Ultimate status of traffic – allowed or denied string Severity level of traffic integer Firewall rule id i.e. firewall rule id which is applied on the traffic integer Spam policy name i.e. spam policy name which is applied on the traffic string Sender email address string Receipeint email address string Email subject string Email size

259

Cyberoam User Guide

24 spam_action

25 Reason string Action performed on the message

Possible values:

Reject

Drop

Change Receipient

Prefix subject string Reason why spam was detected as Spam

Possible values for Reason:

• Cyberoam Anti Spam identifies mail as Spam/Probable

Spam

• From email address/From Domain/From IP Address is marked as spam in spam policy

• From email address/From IP Address belonged to email group/IP address group marked as spam

• Message size is greater/less than <msg_size> MB as specified in the spam policy

• Message header={Message Header| Subject | From | To

| Other=(other header)} contains/equals <value specified in spam policy>

• Sender IP address is blacklisted by RBL=<RBL Group> specified in the spam policy string Path and filename where the message is quarantined string Sender domain name integer Receiver domain name string Original Source IP address of traffic string Original Destination IP address of traffic integer Protocol number of traffic

26 Quarantine

27 src_domainname

28 dst_domainname

29 source_ip

30 destination ip

31 protocol

32 source_port

33 destination_port

34 send_bytes

35 received_bytes

Content filter logs

Event

integer Original Destination Port of TCP and UDP traffic integer Total number of bytes send integer Total number of bytes received

Log sample

access allowed according to the Internet Access device_id=C010600411

=050901716001 log_type=”Content Filtering” log_component=”HTTP”

=”Allowed” status=”Accept”

policy priority=”Information” fw_rule_id=75 user_name=““ user_gp=““ iap=16 iap_policy_name=”General Corporate Policy” category=”Search Engine” url=”www.google.com” file=““ application=““ contentype=”text/html” httpresponsecode=”200OK” src_ip=192.168.15.40 dst_ip=72.14.235.104 protocol=”TCP” src_port=2458 dst_port=80 sent_bytes=162 recv_bytes=45 access blocked according device_id=C010600411

=050902716002 log_type=”Content Filtering”

260

Cyberoam User Guide to the Internet Access log_component=”HTTP” policy