Define Firewall rule. Cyberoam v7 User Guide
Reklama
Reklama
System Management
Cyberoam User Guide
Firewall
Manage Gateway
A firewall protects the network from unauthorized access and typically guards the Internal network against malicious access; however, firewalls may also be configured to limit the access of Internal users.
The purpose of a firewall is to keep people on the Internet from accessing data on Internal
Network. Firewall defines certain rules that determine what traffic should be allowed in or out of the
Internal network. One can restrict access to certain IP addresses or domain names, or block certain traffic by blocking the TCP/IP ports used.
Firewall inspects both inbound and outbound Network traffic to determine, based on the configured
Rules, whether to allow the traffic or not.
Cyberoam has the above-described basic features of a firewall. Refer to Define Firewall rule to define rules.
Define Firewall rule
Select
Firewall Æ Create Firewall rule
Screen - Create Firewall rule
115
System Management
Cyberoam User Guide Manage Gateway
Screen Elements Description
Source and Destination Information
Source Domain Source Domain name, IP address or Network for which rule is to be name/IP Address defined. Generally Source address is the Internal Network address
Specify source information
Destination
Domain name/IP
Address
Destination Domain name or IP address for which the rule is to be defined.
Generally Destination address is the External address
Specify destination information
Rule type Rule can be defined for port or application traffic
Specify rule type
Select Application or Port
Applications
(Only for Application based rule)
Click Application list to select
Port details
(Only for Port based rule)
Source Port Specify source port address. Range of ports can be specified using ‘:’ e.g.
20:25
Port Type Specify whether the rule should be applied to the traffic from the source port or not
Select Include or Exclude
Destination Port Specify destination port address. Range of ports can be specified using ‘:’ e.g. 20:25
Port Type Specify whether rule should be applied to the traffic from the destination port or not
Select Include or Exclude
Network Protocol
(Only for Port based rule)
All Protocols
Rule Action
Action
All protocols
Specify what action to take for the traffic
Click Select Action list to select
Accept – Allow access
Drop – Denies access, rejects all the packets without informing the source
Proxy – Allow access
Reject – Denies access, rejects all the packets and denied access message is send to the source
Port forwarding – Allows access through forwarded port. To define port refer to ‘Only for Port forwarding’
SNAT – Allows access but after changing source IP addressi.e. source IP address is substituted by the specified IP address in packets routed from the local network to the Internet.
Masquerade (Only if Cyberoam is installed in bridge mode) – Allows
116
System Management
Cyberoam User Guide Manage Gateway
Screen Elements Description
access but after masquerading ie. source (private) IP address is substituted by the IP address of the interface connected to the Internet in packets routed from the local network to the Internet.
Network Protocol
(Only for Port based rule and when Rule Action is ‘Port Forwarding’)
Address
Forwarded Port Port to which request is to be forwarded
Description
Description
Save button
Specify full description of the rule
Allows maximum of 255 characters
Can be any combination of A-Z, a-z,’_’, 0-9
Saves the rule
Table - Create Firewall rule screen elements
117
System Management
Cyberoam User Guide Manage Gateway
Firewall Rules Examples
Source IP address/Domain name
Source
Port
Action - Accept/Proxy
* *
Destination IP address/Domain name
Destination
Port
Result
* *
* *
192.168.1.242 * *
*
*
192.168.1.242 * 242.128.34.54 *
Access from all the IP addresses to all the IP addresses
All IP addresses are allowed to access yahoo.com
192.168.1.242 is allowed access all the
IP addresses
192.168.1.242 is allowed to access
242.128.34.54
Action – Deny
* * * *
192.168.1.242 * *
*
*
192.168.1.242 * 242.128.34.54 *
Access to all is denied
(want to stop access temporarily due to some technical reasons)
All the IP addresses are denied access to hotmail.com
192.168.1.242 is denied the access to all
192.168.1.242 is denied the access to
242.128.34.54
Action - Port forwarding
Forwarded IP – 192.168.1.58
Port – 80
* * 242.128.34.54 9090 All the connections to port 9090 should be redirected to port 80 on
192.168.1.58
Table - Firewall rules - Result
118
System Management
Cyberoam User Guide Manage Gateway
Change Firewall Rule order
Rules are ordered by their priority. When the rules are applied, they are processed from the top downwards and the first suitable rule found is applied.
Hence, while adding multiple rules, it is necessary to put specific rules before general rules.
Otherwise, a general rule might allow a packet that you specifically have a rule written to deny later in the list. When a packet matches the rule, the packet is immediately dropped or forwarded without being tested by the rest of the rules in the list.
Example of Firewall rule order for DROP action
Rule 1 – Source IP address: 192.168.1.76
Destination: www.yahoo.com
Action: Drop
Rule 2 – Source: *
Destination: www.yahoo.com
Action: Allow
Here if the order is changed i.e. Rule 2 precedes Rule 1 then Host 192.168.1.76 will be able to access www.yahoo.com
even though the DROP rule is specified.
Select
Firewall Æ Manage Firewall Rules
Click the rule whose order is to be changed
Click Moveup to move the selected rule one step up
Click MoveDown to move the selected rule one step down
Click Update to save the order
Screen – Change Firewall Rule order
119
System Management
Cyberoam User Guide
Delete Firewall Rule
Select
Firewall Æ Manage Firewall Rules
Manage Gateway
Screen - Delete Firewall rule
Screen Elements Description
Select
Select All
Delete button
Select rule for deletion
Click Select to select
More than one rule can also be selected
Select all rules
Click Select All to select all rules
Deletes all the selected rules
Click to delete
Table - Delete Firewall rule screen elements
120
System Management
Cyberoam User Guide
DoS Settings
Manage Gateway
Cyberoam provides several security options that cannot be defined by the firewall rules.
Cyberoam provides protection from several kinds of "Denial of Service attacks". These attacks disable computers and circumvent security.
Denial of Service (DoS) attack is the type of attack on a Network that brings network to its knees by flooding it with useless traffic and in which a user or organization is deprived of the services of a resource they would normally expect to have. The nature of the DoS attacks is to deny something from users or other machines/processes by the way of destructing/modifying data, by bringing down the system, or by overloading the system's servers (flooding) to the extent that service to authorized users is delayed or prevented. Many of the DoS attacks exploit the limitations in the
TCP/IP protocols.
Denial of Service attacks normally stem from external sources (such as via the Internet); or from disaffected or disgruntled employees who bear a grudge towards the company.
SYN Flood In this attack, huge amount of connections are send so that the backlog queue overflows. The connection is created when the victim host receives a connection request and allocates for it some memory resources. A SYN flood attack creates so many half-open connections that the system becomes overwhelmed and cannot handle incoming requests any more.
User Datagram Protocol (UDP) Flood This attack links two systems. It hooks up one system's
UDP character-generating service, with another system's UDP echo service. Once the link is made, the two systems are tied up exchanging a flood of meaningless data.
TCP attack This attack sends huge amount of TCP packet than the host/victim computer can handle.
ICMP attack This attack sends huge amount of packet/traffic than the protocol implementation can handle to the host/victim computer.
Drop Source Routed Packets This will block any source routed connections or any packets with internal address from entering your network.
Click Apply Flag to enable.
Disable ICMP redirect packet An ICMP redirect packet is used by routers to inform the hosts what the correct route should be. If an attacker is able to forge ICMP redirect packets, he or she can alter the routing tables on the host and possibly weaken the security of the host by causing traffic to flow via another path.
Set the flag to disable the ICMP redirection
ARP Flooding This attack sends ARP requests to the server at a very high. Because of this server is overloaded with requests and will not be able to respond to the valid requests. Cyberoam protects by dropping such invalid ARP requests.
121
System Management
Cyberoam User Guide Manage Gateway
Source threshold
Source threshold is the total number of connections/packet rate allowed to a particular user at a given time.
When the source threshold value exceeds, all the excess packets from the particular source only are dropped. Source threshold value is applicable on each client/IP address/user and not on the entire network traffic. For example, if source threshold is 2500 packets/minute and the network is of 100 users then the applicable packet rate is 2500 per user and not 2500 for 100 users.
Destination threshold
Destination threshold is the total number of connections/packet rate allowed from a particular user at a given time.
When the destination threshold value exceeds, all the excess packets from the particular destination only are dropped. Destination threshold value is applicable on each client/IP address/user and not on the entire network traffic. For example, if destination threshold is 3800 packets/minute and the network is of 100 clients then the applicable packet rate is 3800 per client and not 3800 for 100 clients.
Lockdown period
When the threshold is crossed, Cyberoam detects it as an attack. Cyberoam provides DoS attack protection by dropping all the excess packets from the particular source/destination. Cyberoam will continue to drop the packets until the attack subsides. Because Cyberoam applies threshold value per IP address, traffic from the particular source/destination will only be dropped while the rest of the network traffic will not be dropped at all i.e. traffic from the remaining IP addresses will not be affected at all.
Lockdown period = time taken to subside the attack + 30 seconds
Cyberoam will re-allow the traffic from the blocked source/destination only after 30 seconds once the attack subsides. For example, if it takes 40 seconds to subside the attack then the traffic from the said source/destination will be allowed only after 70 seconds.
Configuring high values will degrade the performance and too low values will block the regular requests. Hence, it is very important to configure appropriate values for both source and destination IP address.
122
System Management
Cyberoam User Guide
Configure DoS Settings
Select
Firewall → DoS Setting
Manage Gateway
Screen – DoS Settings
Screen Elements Description
Attack type
Source Packets Rate
(packets/minute)
Apply flag
Type of Attack
Click to view the real time updates on flooding. It displays the source IP address - which was used for flooding and IP address which was targeted.
Allowed Packets per minute (Packet rate)
If the packet rate exceeds, it is considered as an attack and the rest of the packets are dropped.
The specified packet rate is applicable to individual IP address i.e. requests per user and not globally to the complete traffic.
Set flag to control allowed number of packets dropped
Destination Packets Allowed Packets per minute (Packet rate)
Rate
(packets/minute) When the packet rate exceeds, all the excess packets are dropped for the next 30 seconds. You can call this the lockdown period which means the traffic from the destination IP address will be blocked for next 30 seconds. Because Cyberoam applies threshold value per IP address, the traffic from rest of the IP addresses is not blocked.
The specified packet rate is applicable to individual IP address i.e. requests per user and not globally to the complete traffic.
Apply flag Set flag to control allowed number of packets
Destination Packets Displays number of packets dropped at destination dropped
Update button Updates Packet rate
Updated details will be applied only after restarting the
Management services from Console
Table – DoS Settings screen elements
123
System Management
Cyberoam User Guide
Bypass DoS Settings
Manage Gateway
Cyberoam allows bypassing the DoS rule in case you are sure that the specified source/destination will never be used for flooding or want to ignore if flooding occurs from the specified source.
Create DoS bypass rule
Select
Firewall → Bypass DoS
Screen – Create DoS bypass rule
Screen Elements Description
Source and Destination Information
Source Domain Source Domain name, IP address or Network on which the DoS rule is not name/IP Address to be applied
Specify source information
Specify * if you want to bypass the complete network
Source Port Specify source port address.
Specify * if you want to bypass all the ports
DoS will not be applied on all the requests from the specified source IP address and port
Destination
Domain name/IP
Address
Destination Domain name or IP address on which the DoS rule is not to be applied
Specify destination information
Specify * if you want to bypass the complete network
Destination Port Specify destination port address.
124
System Management
Cyberoam User Guide Manage Gateway
Screen Elements Description
Specify * if you want to bypass all the ports
DoS will not be applied on all the requests from the specified destination IP address and port
Network Protocol
Create button
Select protocol whose traffic is to be bypassed for specified source to destination.
For example,
If you select TCP protocol then DoS rules will not be applied on the TCP traffic from the specified source to destination.
Creates the bypass rule
Table – Create DoS bypass rule screen elements
Delete DoS bypass rule
Select
Firewall → Bypass DoS
Screen – Delete DoS bypass rule
Screen Elements Description
Select
Select All
Delete button
Select rule for deletion
Click Del to select
More than one rule can also be selected
Select all rules
Click Select All to select all rules
Deletes all the selected rules
Click to delete
Table – Delete DoS bypass rule screen elements
125
System Management
Cyberoam User Guide
Walled Garden
Manage Gateway
Walled garden enables you to define free access to specific websites. This subset of the Internet that un-authenticated users can access is called walled garden e.g. it enables you to direct users to the company’s information. Domain, URL, and IP address define each free-access site.
From the Cyberoam perspective, walled gardens open up filters from the internal network to the external network (Internet) so a user on the internal network can access services on the external network without authenticating, hence providing free access to specific sites on the external network that are set up on the walled garden.
Note
To prevent users from navigating outside the walls, configure proxy settings
Traffic will be routed based on the Firewall rule defined for the user if the user proxy settings are not configured
Creating Allowed List
Select
Firewall → Walled Garden
Screen – Walled Garden
Screen Elements Description
Allowed List
Add button
Displays list of allowed Domains, URLs and keywords
Allows to add Domains, URLs and keywords
Click to add
Refer to Add Keywords for details
Delete button
Available only if
Allows to delete entry from the list keyword is added to the list
Table – Walled Garden screen elements
126
System Management
Cyberoam User Guide
Add Keywords
Manage Gateway
Screen – Add Keywords
Screen Elements Description
Add Keywords
Keywords
Add button
Cancel button
Specify Domain names, URLs or keywords which are to be allowed
Domain name: Specify the domain name such as www.elitecore.com
IP address : Specify IP address/addresses of the site(s) which can accessed without authentication
Keywords : Specify Keywords. Users will be able to access all the sites containing the specified keywords without authentication.
Adds Domain names, URLs and keywords to the allowed list
Cancels current operation
Table – Add Keywords screen elements
Delete Keywords
Screen – Delete Keyword
Screen Elements Description
Del
Select All
Delete button
Select Keyword to be deleted
Click Del to select
More than one keyword can also be selected
Selects the complete list
Click Select All to select whole list
Deletes all the selected keywords
Click to delete
Table – Delete Keyword screen elements
127
System Management
Cyberoam User Guide
Manage Data
Manage Data
Backup data
Backup is the essential part of data protection. No matter how well you treat your system, no matter how much care you take, you cannot guarantee that your data will be safe if it exists in only one place.
Backups are necessary in order to recover data from the loss due to the disk failure, accidental deletion or file corruption. There are many ways of taking backup and just as many types of media to use as well.
Cyberoam provides facility of taking regular and reliable data backup. Backup consists of all the policies, logs and all other user related information.
Cyberoam maintains five logs:
Web surfing log This log stores the information of all the websites visited by all the users
User session log Every time the user logs in, session is created. This log stores the session entries of all the users and specifies the login and logout time.
Audit log This log stores the details of all the actions performed the User administrating
Cyberoam. This log will be generated only if ‘Audit logs’ add-on module is registered.
Virus log This log stores the details of malicious traffic requests received.
Mail log This log stores the information of all the mails sent and received by all the users. This log will be generated only if ‘Mail Management’ add-on module is registered.
Set Backup Schedule
Select
System → Manage Data → Set Backup Schedule
Screen – Set Backup schedule
128
System Management
Cyberoam User Guide Manage Data
Screen Elements Description
Backup of Data only (Does not include Logs)
Backup Frequency Backup schedule. Only data backup will be taken.
Select any one
Daily – backup will be send daily
Weekly – backup will be send weekly
Monthly – backup will be send monthly
Never – backup will never be send
In general, it is best to schedule backup on regular basis.
Depending on how much information you add or change will help you determine the schedule
Incremental Backup of Log files only (in CSV format)
Backup process only copies what has changed since the last backup. This creates a much smaller backup file.
Log Select the logs for backup. Backup of log files will be taken in
CSV format.
Available logs for backup:
1. Web surfing
2. Virus
3. Mail
4. Audit (Only of ‘Audit log’ add-on module is registered)
Backup Frequency Select any one
Daily – backup will be send daily
Weekly – backup will be send weekly
Never – backup will never be send
Set Backup Mode
Backup mode Specifies how backup should be taken and send
Select
FTP backup OR
Mail backup
Only for FTP backup
FTP server
User name
Specify IP address of FTP server
Specify User name with which user has to logon to the FTP server
Only for Mail backup
To Mail Id
Save button
Specify email address to which the backup is to be mailed
Saves the configuration
Table – Set Backup Schedule screen elements
129
System Management
Cyberoam User Guide
Backup Data
Select
System → Manage Data → Backup Data
Manage Data
Screen – Backup Data
Screen Elements Description
Backup System Data
(Does not include logs)
Backup button
Download button
Only if backup is taken previously
Download the backup already taken. Also displays date and time of backup
Click Download to download
To download follow the screen instructions
Backup Log (in CSV format)
Logs
Takes the recent backup and allows to download
Click Backup data to take backup
Backup of selected logs will be taken
Select the logs for backup
1. Web surfing
2. Virus
3. Mail
4. Audit
Backup button
Download button
Only if backup is taken
previously
Takes the recent backup of logs and allows to download
Click Backup data to take the recent backup
Download the backup of logs already taken. Also displays date and time of backup
Click Download to download
To download follow the screen instructions
Table – Backup Data screen elements
130
System Management
Cyberoam User Guide Manage Data
Restore Data
With the help of restore facility, restore data from the backup taken. Restoring data older than the current data will lead to the loss of current data.
Select
System → Manage Data → Restore Data
Screen – Restore Data screen
Screen Elements Description
Upload Backup
File to upload
Browse button
Upload button
Specify name of backup file to be uploaded
Select the backup file
Uploads the backup file
Table - Restore Data screen elements
Note
Restore facility is version dependant i.e. it will work only if the backup and restore versions are same e.g. if backup is taken from Cyberoam version 7.4.0.0 then restore will work only for version 7.4.0.0 and not for any other version.
131
System Management
Cyberoam User Guide
Purge
Manage Data
Purging of data means periodic deletion of the data. Cyberoam provides Auto purge and Manual purge facility for deleting log records.
Configure Auto purge Utility
Select
System → Manage Data → Configure Auto purge utility
Screen – Configure Auto purge Utility screen
Screen Elements Description
Purge Frequency
Purge Web surfing logs every
Save button
Popup Notification
Enable Alert Popup
Specify number of days after which web surfing log should be purged automatically
Saves purging schedule configuration
Enabling Popup Notification displays alert popup before purging the logs
Click to enable
Saves popup alert configuration Save button
Download Purged Logs
Only if Logs have been Auto purged
Download button Allows to download the purged log files
Click to download
Delete button Deletes the purged log files
Table – Configure Auto purge Utility screen elements
Note
System will preserve logs only for the specified number of days and automatically purges the logs generated there after.
132
System Management
Cyberoam User Guide
Manual purge
Use manual purge to delete log records manually
Select
System → Manage Data → Purge Logs
Manage Data
Screen – Purge Logs screen
Screen
Elements
Description
Purge
Select log for purging
Web surfing logs
User session logs
Audit logs (only if Audit Log module is Enable)
Till Date Select the date from Calendar till which the selected log(s) is to be purged
Purge button Purges the selected log till the specified date
Click Purge to purge
Table - Purge Logs screen elements
Note
Auto purge option is always on
133
System Management
Cyberoam User Guide
Restrict Management Console Access
Restrict Management Console Access
You can limit the Administration console access from certain IP addresses only by creating an access control list.
Select
System Æ ACL Æ Access Configuration to open configuration page
Screen – Access Configuration
Screen Elements
Access Restriction
Restriction
Description
Select Yes to enable IP Address Restriction
Select No to disable IP Address Restriction
Enabling restriction will allow only the specified IP addresses to access the management console
Console Access
134
System Management
Cyberoam User Guide Restrict Management Console Access
Screen Elements Description
Allows Access From
IP Address list
Only for Specific IP
Addresses
Specifies whether Administrator and Manager will be able to access Cyberoam Console from all IP Addresses or from specific IP Addresses only
Select All IP Addresses to allow access from all IP addresses
Select Specific IP Addresses to allow access from specific
IP addresses
Specifies from which IP Address Administrator and Manager will be able to access Cyberoam Console
Click Add to add IP address to the list
Click IP Address and Remove to remove IP address from the list
Click Remove All to remove all IP Addresses from list
Web Access
User Type
Allows Access From
IP Address list
Only for Specific IP
Addresses
Save button
Specifies which user has access to Web Administration
Console
Click User type to select
Specifies whether the selected User will be able to access
Cyberoam Console from all IP Addresses or from specific IP
Addresses only
Select All IP Addresses to allow access from all IP addresses
Select Specific IP Addresses to allow access from specific
IP addresses
Specifies from which IP Address selected user will be able to access Web Administration Console
Click Add to add IP address to the list
Click IP Address and Remove to remove IP address from the list
Click Remove All to remove all IP Addresses from list
Saves configuration
Table – Access Configuration screen elements
135
System Management
Cyberoam User Guide
Reset Console Password
Reset Console Password
You can change Text based Console password from Web based or Text based Console itself. To change password from Console, refer to Console guide.
Select
System → Reset Console Password
Screen - Reset Console Password
Screen Elements Description
Reset Console Password
GUI Admin Password Specify current GUI Admin password i.e. the password with which Administrator has logged on to Web Console Administration module
New password Specify new console password
Confirm New password Type again the same password as entered in the
New password field
Submit button Saves new password
Click Submit
Table - Reset Console Password screen elements
136
System Management
Cyberoam User Guide
Client Services
Client Services
Client Messages
Message Management tab allows Administrator to send messages to the various users. Messages help Administrator to notify users about problems as well as Administrative alerts in areas such as access, user sessions, incorrect password, and successful log on and log off etc.
Message is send to the User whenever the event occurs.
Message can be up to 256 characters and send to the number of users at a time.
Select
System → Configure Client Settings → Customize Client Message
Screen – Customized Client Messages screen
Screen Elements
Message Key
Description
Message code
Click Message link to customize the message which will be received by user
Click Save to save the changes
Click Cancel to cancel the current operation
Configure Usage to Alert User before Expiration
Only if ‘Data Transfer Management’ add-on module is registered
Usage in transfer is remaining
Remaining usage can be entered in absolute value or in percentage
137
System Management
Cyberoam User Guide Client Services
Data Transfer (MB) Specify remaining data transfer usage when all the users should receive alert.
Eg. Absolute Remaining data transfer usage: 20 MB
User1: Total Data transfer limit (as defined in Data transfer policy):
150 MB
User2: Total Data transfer limit (as defined in Data transfer policy):
640 MB
User1 will receive alert when he is left with 20 MB of data transfer i.e has done total data transfer of 130 MB
User2 will receive alert when he is left with 20 MB of data transfer i.e has done total data transfer of 620 MB
Percentage Remaining data transfer usage: 20%
User1: Total Data transfer limit (as defined in Data transfer policy):
150 MB
User2: Total Data transfer limit (as defined in Data transfer policy):
640 MB
User1 will receive alert when he is left with 30 MB (20% of 150 MB) of data transfer i.e. has done data transfer of 120 MB
User2 will receive alert when he is left with 128 MB (20% of 640
MB) of data transfer i.e. has done data transfer of 512 MB
Cycle Data Transfer
(MB)
Specify remaining cycle data transfer usage when all the users should receive alert.
Cycle data transfer is the upper limit of total data transfer allowed to the user per cycle. User will be disconnected if the limit is reached. It is applicable the users to whom the cyclic data tanfer policies are applied.
Eg. Absolute Remaining cycle data transfer usage: 20 MB
User1: Cycle Total Data transfer limit (as defined in Data transfer policy): 150 MB
User2: Cycle Total Data transfer limit (as defined in Data transfer policy): 640 MB
User1 will receive alert when he is left with 20 MB of data transfer per cycle i.e has done data transfer of 130 MB
User2 will receive alert when he is left with 20 MB of data transfer per cycle i.e has done data transfer of 620 MB
Percentage Remaining cycle data transfer usage: 20%
User1: Cycle Total Data transfer limit (as defined in Data transfer policy): 150 MB
User2: Cycle Total Data transfer limit (as defined in Data transfer policy): 640 MB
User1 will receive alert when he is left with 30 MB (20% of 150 MB) of data transfer per cycle i.e. has done data transfer of 120 MB
User2 will receive alert when he is left with 128 MB (20% of 640
MB) of data transfer per cycle i.e. has done data transfer of 512 MB
Save details button Saves the data transfer alert configuration
Table - Customized Client Message screen elements
138
System Management
Cyberoam User Guide
List of Predefined messages
Messages Description/Reason
Client Services
AlertMessageWithData
DeactiveUser transfer is equal to the configured value.
Value can be configured from Customize Client Messages page.
Refer to Client Messages for more details
Message is sent to the user when the remaining data transfer is equal to the configured value.
Value can be configured from Customize Client Messages page.
Refer to Client Messages for more details
Administrator has deactivated the User and the User will not be able to log on
DisconnectbyAdmin
InvalidMachine
When the administrator disconnects the user from the live users page
Message is sent if User tries to login from the IP address not assigned to him/her
Message is sent when User logs off successfully LoggedoffsuccessfulMsg
LoggedonsuccessfulMsg Message is sent when User logs on successfully
Loggedinfromsomewhereelse Message is sent if User has already logged in from other machine
MaxLoginLimit Message is sent if User has reached the maximum login limit
Message is sent if User is not allowed multiple login MultipleLoginnotallowed
NotAuthenticate
NotCurrentlyAllowed
Someoneloggedin
SurfingtimeExhausted
SurfingtimeExpired
Message is sent if User name or password are incorrect
Message is sent if User is not permitted to access at this time
Access Time policy applied to the User account defines the allowed access time and not allowed access at any other time.
Message is sent if someone has already logged in on that particular machine
Message is sent when User is disconnected because his/her allotted surfing time is exhausted
The surfing time duration is the time in hours the User is allowed
Internet access that is defined in Surfing time policy. If hours are exhausted, User is not allowed to access
Administrator has temporarily deactivated the User and will not be able to log in because User surfing time policy has expired
LiveIPinuse
Nmpoolexceedlimit
Message is sent if connection is requesting a public IP Address from the server that is already in use
Message is sent if the maximum number of IP Addresses in the public host group at any given time has exceeded the limit
Table - List of predefined messages
139
System Management
Cyberoam User Guide
Client preferences
Client Services
Use Client preference to specify
• which page to open every time user logs on to Cyberoam
• whether HTTP client log on page should pop up if user tries to surf without logging in
• port from which Web Administration Console can be accessed
• number of concurrent log on allowed
Select
System → Configure Client Settings → Customize Client preferences
Screen – Customized Client Preferences screen
Screen Elements Description
Open following site after client logs on to the server
URL
Update button
Specify URL which is to be opened every time user logs on
Leave this field blank, if you do not want to open any specific page every time user logs in
Updates configuration
HTTP Client
Pop up HTTP client Whenever User tries to surf without logging, page with a message ‘Cyberoam Access Denied‘ displayed
If HTTP client pop up option is selected, User will get a
HTTP Client pop up along with the ‘Cyberoam Access
Denied' page.
140
System Management
Cyberoam User Guide Client Services
Screen Elements Description
Once User logs on successfully using the HTTP client, user will be able to surf the requested site.
Updates configuration Update button
Web Admin Console
Web Admin Console
Port
Specify Port number on which Web Admin Console is running
Update button
Number of Logins
Updates configuration
Allowed
OR
Unlimited Login
Update button users
OR
Allows unlimited concurrent logins
Updates configuration
Table – Customized Client Preferences screen elements
Note
The preferences set are applicable to all the users by default i.e. By default, all the preferences set will be applicable when the user is created. Refer to Create User, for customizing number of concurrent logins allowed to the particular user.
141
System Management
Cyberoam User Guide
Customize Access Deny messages
Client Services
Use to customize Access deny message for:
• all web categories
• individual web category
• all file type categories
This customized message will be displayed when user tries to access the site which is not allowed.
1. Select
System → Configure → Customize Denied Message
2. Select category for which you want to customize access deny message
Select ‘All Web categories’ to display the same access deny message for all the web categories. The message specified for ‘All Web Categories’ becomes the default message.
Select a particular category for which you want to display a different message
By default, the message specified for ‘All Web Categories’ is displayed.
Disable Use Default Message, if you want to display a different message for a particular category and modify the message
Select ‘All File type category’ to customize the access deny message for all the file type categories
3. In Denied Message, modify the message contents
4. Click Update to save if any changes are made
142
System Management
Cyberoam User Guide
Upload Corporate logo
Client Services
Use to display your company’s logo in all the messages displayed to the user.
1. Select
System → Configure → Customize Denied Message
2. In Top Bar, specify the image which is to be displayed at the top of the message page.
3. In the Bottom Bar, specify the image which is to be displayed at the bottom of the message page
4. Click Upload
Note
Dimension of Image should be 700 * 80 and jpg file only
143
System Management
Cyberoam User Guide
Customize Login message
Client Services
Use to customize login page messages and client login links provided on login page.
1. Select
System → Configure → Customize Login Message
2. Under Client Login Links, select Login Clients which you want to be displayed on Login page.
In the login page, download links are provided so that user can download the required login client. If you do not want user to download a particular login client, deselect the link
In the Login message box, specify the message to be displayed. You can further customize the message by using clientip address, category and URL
3. Enable Blink Message to display blinking message
4. Before saving the configuration, click Preview and see how message will be displayed to the user
5. Click Save to save the configuration
144
HTTP Proxy Management
Cyberoam User Guide
HTTP Proxy Management
Manage HTTP Proxy
Proxy server is a kind of buffer between your computer and the internet resources you are accessing. Proxy server accumulates and saves all those files that are most often requested by other Internet users in a ‘Cache’. The cache of a proxy server may already contain information you need by the time of your request, making it possible for the proxy to deliver it immediately.
Therefore, proxy servers are able to improve the network performance by reducing the access time.
Cyberoam can also act as a HTTP proxy server. All visited static sites are cached on the Cyberoam server hard drive. The advantage of a cache server is that it will cache the static web pages once requested and serve them locally when requested next time.
Cyberoam will act as a HTTP proxy server only if caching is enabled. Refer Enable Cache server to enable caching and Configure Cache to configure the cache server.
Cyberoam also provides the facility to define an External Cache server. Refer Define External
Cache to define External Cache.
Manage HTTP Proxy
Select
HTTP Proxy → Manage HTTP Proxy
Screen - Manage HTTP Proxy
Screen Elements Description
Server Status
Start button
Only if Current Status is ‘Stopped’
Displays current status of Cache server
Click to start Cache server
Cache Server status
Stop button
Only if Current Status is ‘Running’
Restart button
Click to stop Cache server
Click to restart Cache server
Empty Cache
Available only if ‘Cache Management’ add-on module is registered
Deletes any previous cached entities. Empty cache if corruption is found
Click to empty cache
Enable Caching In Proxy Server
Available only if ‘Cache Management’ add-on module is registered
Enable Caching button Enable Caching if you want
1. Proxy server to cache pages
2. To implement URL filtering
145
HTTP Proxy Management
Cyberoam User Guide
Save configuration
Manage HTTP Proxy
Click to Enable
Save the cache server configuration
Table - Manage HTTP Proxy screen elements
Configure HTTP Proxy
Use to
• specify whether to control bandwidth for cached objects
• specify cache size
• configure cache port
• specify cache server start up mode
• configure cache policy
Select
HTTP Proxy → Configure HTTP Proxy
Screen - Configure HTTP Proxy
Screen Elements Description
Bandwidth control configuration for Cached Objects
Available only if ‘Cache Management’ add-on module is registered
control for Cached objects objects
Click ‘Yes’ to bypass bandwidth control
Click ‘No’ restrict bandwidth for cached objects
Save button Save configuration
Cache size
Recommended Cache size (MB)
Cache size (MB)
Recommended size is the optimum size of cache determined based on the memory and the disk size
Cannot be modified
Specify Cache size (in MB)
It is recommended that cache size defined be equal to or more than the recommended size
146
Atsisiųsti
Vieša nuoroda atnaujinta
Vieša nuoroda į jūsų pokalbį buvo atnaujinta. You may view and manage your chat links after registration here.
Dokumento vieša nuoroda
Reklama
