Manuale d’uso / di manutenzione del prodotto Broadband Security Gateway P-312 del fabbricante ZyXEL Communications
Vai alla pagina of 254
Pr estige 312 Broadba nd Securi ty Gateway User’s Guide Version 3.20 November 2000.
P312 Broadban d Security G ateway ii Copyright Prestige 312 Broadband Securi ty Gatew ay Copyright Copyright © 2000 by Zy XEL C ommunicat ions C orporati on.
P312 Broadban d Security G ateway FCC Statem ent iii Federal Co mmunicatio ns Commission ( FCC) Inte rference Statement This dev ice comp lie s with Part 15 o f FCC rul es. Op eration is sub ject to the f ollow ing tw o conditio ns: This dev ice may not cau se harmf ul interferen ce.
P312 Broadban d Security G ateway iv Canadia n Users Informat ion for Can adian U sers The Industry Canad a label iden tif ies certifi ed equi pme nt. This cer t ifi cat ion mea ns that the equ ipm ent meet s certain te lecom municatio ns network pro tectiv e, operat ion, and sa fety req uirement s.
P312 Broadban d Security G ateway Warranty v Declaration of Con for mit y We, the Manufacturer/Im porter, ZyXEL Communica tions Corp . No. 6, Innovation Rd.
P312 Broadban d Security G ateway vi CE Doc.
P312 Broadban d Security G ateway Warranty vi i ZyXE L Limited W arr anty ZyX EL warrants to t he origi nal end user (pur cha ser) that this pro duct is fre e from a ny defe cts in materia ls or workmans hip for a period of up to two y ears fr om the d ate of p urchase .
P312 Broadban d Security G ateway viii Cust omer Su ppor t Customer Support When y ou contact your custom er support repres ent ative pl ease have the following information ready: ♦ Prestig e Model and s erial num ber. ♦ Information in Menu 24.2 .
P312 Broadban d Security G ateway T able Of C ontents ix T able of Contents T able of Conte nts .............................................................................................................. ............. ix List of Fig ures ..........
P312 Broadba nd Security Gateway x T able Of C ontents 2.10.1 LAN Port Filter Setup .................................................................................................... ...2-12 Chapter 3 Internet Access ................................
P312 Broadban d Security G ateway T able Of C ontents xi 6.1.4 NAT Mapping Types ......................................................................................................... .6 - 2 6.1.5 SUA (Singl e User Account) Versus NAT .............
P312 Broadba nd Security Gateway xii T able Of Conte nts 9.1 System Status ............................................................................................................... ............... 9-2 9.2 System Inf ormation and Console Port Speed .
P312 Broadban d Security G ateway T able Of C ontents xiii 12.2 Telnet Under NAT........................................................................................................... ......... 12-1 12.3 Telnet Capabilities .......................
P312 Broadba nd Security Gateway xiv T able Of Conte nts 15.3 E-Mail ..................................................................................................................... ..................15-3 15.3.1 What are Al erts? ................
P312 Broadban d Security G ateway T able Of C ontents xv 20.1 Restrict Web Featu res...................................................................................................... ......... 20-1 20.1.1 ActiveX ..................................
P312 Broadba nd Security Gateway xvi List Of Figur es List of Figures Figure 1-1 Secure In ternet Access via Cable ..................................................................................... ....... 1-3 Figure 1-2 Secure In ternet Access via DSL.
P312 Broadban d Security G ateway List Of F igures xvii Figure 4-5 Remote Node Netw ork Layer Options .................................................................................. 4 -8 Figure 4-6 Rem ote Node Filter (Ethernet Encapsulation)......
P312 Broadba nd Security Gateway xvi ii List Of F igures Figure 6- 22 Example 4- Menu 15.1.1. 1 - A ddress Mapping Ru le ............................................................ 6-20 Figure 6-23 Exam ple 4 - Menu 15.1.1 - Addres s Mapping Rules ..
P312 Broadban d Security G ateway List Of F igures xix Figure 9-9 Call-T rigg ering Packet Ex ample ....................................................................................... ... 9- 10 Figure 9-10 Menu 24.4 - System Maintenan ce - Diagnostic .
P312 Broadba nd Security Gateway xx List Of F igures Figure 14-2 Menu 21 - Filter and Firewall Setup ................................................................................. .... 14-1 Figure 14-3 Menu 21.2 – Firew all Setup ................
P312 Broadban d Security G ateway List Of F igures xxi Figure 19-9 Exam ple 2 - L ocal Net work Rule Summ ary .................................................................. 19-10 Figure 19-10 Ex ample 2 - Internet to Local Netw ork Rule Summary ..
.
P312 Broadban d Security G ateway List of T ables xx iii List Of T ables T able 2-1 LED functions ........................................................................................................ ................ 2-1 T able 2-2 Main Menu Co mm ands .
P312 Broadba nd Security Gateway xxiv List of T ab les T able 7- 2 Abbrev iations Used If Filter T ype Is IP .............................................................................. ....7-7 T able 7- 3 Abbrev iations Used If Filter T y pe Is GEN .
P312 Broadban d Security G ateway List of T ables xxv T able 16-5 T im eou t Menu ......................................................................................................... ........... 16-14 T able 17-1 Cus tom Ports ...................
.
P312 Broadban d Security G ateway Preface xxvii Preface A bout Y our Router Congrat ulation s on y our purch ase of the Presti ge 312 Broad band Secu rity Gateway . Don’t f orget to reg ister your Prestig e (fast, e asy onlin e regist ration at www .
P312 Broadba nd Security Gateway xxvi ii Prefac e Regardless of your particular applicatio n, it is important that you follo w the steps outlined in Chapt ers 1-2 to connect y our Prestige to your LAN. You can then refer to the appropriate chapters of the m anual, depending on you r applications.
Getting S tarted I Part I: Getti ng Starte d Chapters 1-3 are s tructured as a step- by-step guide to h elp you connec t, install a nd set up your Prestig e to op erate on your networ k and acc ess the Inter net.
.
P312 Broadba nd Security Gateway Getting to Know Y our Prest ige 1-1 Chapter 1 Getting to Know Your Prestige This c hapter intr oduces the main f eatures and appl ications of the Pr estige .
P312 Broadban d Security G ateway 1-2 Gettin g to Know Y our Prestige Dynamic DNS Support With Dyn amic DNS su pport, y ou can have a s tatic hostname alias for a dynami c IP address, al low ing th e host to be m ore easily accessi ble from various locations on the Intern et.
P312 Broadba nd Security Gateway Getting to Know Y our Prest ige 1-3 not choose a time service protocol that your ti meserver will send when the Prestige powers up you can enter the tim e manually but each ti me the sy stem is booted, th e tim e & date w ill be reset t o 1/1/197 0 0: 0:0 .
P312 Broadban d Security G ateway 1-4 Gettin g to Know Y our Prestige Figure 1- 2 Secure Int ernet Access v ia DSL You can als o use your xDSL m odem in the bridg e mode f or always- on Internet access and high speed data transfer.
P312 Broadba nd Security Gateway Hardwar e Ins ta lla ti on & Initia l Setup 2-1 Chapter 2 Hardware Installation & Initial Setup This c hapter shows you how to connec t the har dware an d perform the in itial s etup. 2.1 Front Panel LEDs and Back Panel Ports 2.
P312 Broadban d Security G ateway 2-2 Hardware Insta llati on & Initia l Se tup LEDs Function Indicator Status Activ e Description Flashing The 100M LAN is sendi ng/re ceiv ing pac kets. Off The W AN Link is not ready, or ha s faile d. On The W AN L ink is ok .
P312 Broadba nd Security Gateway Hardwar e Ins ta lla ti on & Initia l Setup 2-3 connector on the back of the cable modem. C onnect an xDSL Modem to th e xDSL Wall Jack. Please also see Appendix C f or im portant safety instructi ons on making conn ections to th e Prestig e.
P312 Broadban d Security G ateway 2-4 Hardware Insta llati on & Initia l Se tup ♦ 9600 Baud. ♦ No parity, 8 Data bits, 1 Stop b it, Flow Control set to None. 3. A cable/xDSL modem and an ISP accoun t. After t he Pres tige is properl y set up, y ou can make future ch anges to th e config uration th rough t elnet connections.
P312 Broadba nd Security Gateway Hardwar e Ins ta lla ti on & Initia l Setup 2-5 Figure 2- 4 Passw ord Scr een 2.6 Navigating the SM T Interface The SMT (System Management Terminal) is the interf ace that you use to conf igure your Prestige.
P312 Broadban d Security G ateway 2-6 Hardware Insta llati on & Initia l Se tup 2.6.1 Main Menu After you enter the password, the SMT displa y s the Prestige 312 Main Menu , as shown bel ow.
P312 Broadba nd Security Gateway Hardwar e Ins ta lla ti on & Initia l Setup 2-7 99 Exit To ex it from SM T and return t o a bla nk scre en. 2.7 Changing the Sy stem Password The firs t th ing your sh ould do bef ore any thing el se is to ch ange th e default system passw ord by followi ng the steps below.
P312 Broadban d Security G ateway 2-8 Hardware Insta llati on & Initia l Se tup 2.8 General Setup Me nu 1 - General Setup contains administrative and system- related information. The fields for General Setup are as shown next. Syste m Name is for identifi cation purposes.
P312 Broadba nd Security Gateway Hardwar e Ins ta lla ti on & Initia l Setup 2-9 Table 2-4 Gener al Setup Menu Field Field Description Example System Na me Choose a des criptiv e name f or ident ificati on purpo ses. It is recomme nded y ou enter y our co mputer’ s “Computer na me” in th is field.
P312 Broadban d Security G ateway 2-10 Hardwar e Ins ta lla ti on & Initia l Se tup Table 2-5 Configure Dynamic DNS Menu Fields Field Description Example Service Provider Enter the na me of your Dy namic DNS cl ient. www.d dns.org Active Press [SPACE BAR] to togg le betw een Yes or No .
P312 Broadba nd Security Gateway Hardwar e Ins ta lla ti on & Initia l Setup 2-1 1 Figure 2-9 Menu 2 – WAN Setup The MAC addres s field allows users to configu re the WAN port's MAC Address by either u sing the factory default or clon ing the MAC address from a works tation on your LA N.
P312 Broadban d Security G ateway 2-12 Hardwar e Ins ta lla ti on & Initia l Se tup Figure 2-10 Menu 3 - LA N Setup 2.10.1 LA N Port Filt er Setup This menu allows you to specif y the filter sets that you wish to apply to the LAN traffic.
P312 Broadba nd Security Gateway Internet Acc ess 3-1 Chapter 3 Internet Access This chapt er shows you how to confi gure the LAN as we ll as th e WAN of your Presti ge for Int ernet access.
P312 Broadban d Security G ateway 3-2 Internet Ac cess The subnet mask speci fies the net w ork number portio n of an IP addr ess. Yo ur P restige will compute the subn et mask automatically based on th e IP address th at you entered. You don’t need to ch ange the subn et mask computed by th e Prestige unless you are inst ructed to do otherwis e.
P312 Broadba nd Security Gateway Internet Acc ess 3-3 3.1.5 DHCP Configuration DHCP (Dy n amic Host C onfig uration Protocol, R FC 2131 an d RF C 2132) all ow s th e indiv idual cli ents ( wor ksta t ion s ) to o bta i n the T CP/ I P co nfigur atio n at st art -up fro m a se rver .
P312 Broadban d Security G ateway 3-4 Internet Ac cess The address 224.0.0.1 i s us ed for qu ery messag es and is as signed to t he perm anent grou p of al l IP hos ts (incl uding g ateways ). All hosts must join th e 224.0.0.1 g roup in order t o part icipate i n IGMP.
P312 Broadba nd Security Gateway Internet Acc ess 3-5 Figure 3-3 Menu 3 - LA N Setup (10/ 100 Mbps Etherne t) To edit the T CP /IP and DHCP configuration, enter 2 to open Menu 3.2 - TCP /IP a nd DHCP Ethernet Setup as s hown next. Figure 3-4 Menu 3.2 – TCP/IP and DHCP Ethernet Setup Menu 3 – LAN Setup 1.
P312 Broadban d Security G ateway 3-6 Internet Ac cess Follo w the instr uction s in the follo wing table on how to configure the DHCP fie ld s. T able 3-1 LAN DHCP Setup Menu Fields Field Description Example DHCP= This field enables/disables the DHCP server.
P312 Broadba nd Security Gateway Internet Acc ess 3-7 Field Description Example Edit IP Alia s The Prestige s upports three log ical LAN inter faces v ia its single physical Et herne t interfa ce with t he Presti ge itse lf as th e gatew ay for each LAN netw ork.
P312 Broadban d Security G ateway 3-8 Internet Ac cess RIP Direction Press the space bar to se lect th e RIP d irection from None, Bo th/In Onl y /Out Onl y.
P312 Broadba nd Security Gateway Internet Acc ess 3-9 The follo w ing table describes t his screen. Tab le 3-4 Internet Acces s Setup M enu F ields Field Description ISP’s Name Enter the na me of y our Intern et Service Prov ider, e .g., my ISP. This informati on is f or identi ficatio n purpo ses only .
P312 Broadban d Security G ateway 3-10 Internet Ac cess 3.3.3 Configuring the PPTP Client T o co nfigur e a P PT P clie nt, you must c onfi gure the M y Login an d Passw ord fields for a PPP conn ection and the PPTP parameters for a PPTP conn ection.
P312 Broadba nd Security Gateway Internet Acc ess 3-1 1 For the serv ice provider, PPPoE off ers an access and authentication method that w orks with existing access control sy stems (e.
P312 Broadban d Security G ateway 3-12 Internet Ac cess Tab le 3-6 New Fields in M enu 4 (PPPoE) screen Field Description Examples Encapsulation Press the [SPACE BAR] and then press [ENTER] to choose PPPoE . The enca psulati on meth od influen ces your c hoice s for IP Address .
Advance d App licatio ns II Part II: Advanced Applicat ions Advance d App licatio ns (Chap ters 4-6) describ e the a dvanced applic ations of your Prest ige, suc h as Rem ote Node Se tup IP Sta tic rou tes and N A T .
P312 Broadban d Security G ateway Remote N ode Set up 4-1 Chapter 4 Remote Node Setup This c hapter shows you how to confi gure a rem ote node . A rem ote node is req uired for placing calls to a remote gateway. A remote node represents both the remote gate way a nd the ne twor k be hind it a cro ss a W AN c onne ctio n.
P312 Broadban d Security G ateway 4-2 Remote N ode Set up Table 4-1 Fields in Menu 11.1 Field Description Examples Rem Node Name Enter a des criptive n ame for t he re mote no de. Thi s field c an be up to e ight ch aracters . LAoffice Act iv e Press the [SPACE BAR] to t oggle be tween Yes and No and activat e (deact ivate) th e remote node.
P312 Broadban d Security G ateway Remote N ode Set up 4-3 4.1.2 PPPoE Encap sulation The Pr est ig e support s PP PoE (P oin t- to-Poin t Prot ocol ove r Eth erne t). You can only us e PPPoE encapsulation w hen you’re using the Prestige with an xDSL m odem as the WAN device.
P312 Broadban d Security G ateway 4-4 Remote N ode Set up Tab le 4-2 Fields in M enu 11.1 (PPPoE Encapsu lation Specific) Field Description Examples Authen T his fie ld sets the aut hentica tion protoco l used for outgoing cal ls.
P312 Broadban d Security G ateway Remote N ode Set up 4-5 Figure 4- 3 Remote Nod e Profil e for P PTP En capsulat ion The nex t table sh ows h ow to conf igure fi elds in Menu 11.
P312 Broadban d Security G ateway 4-6 Remote N ode Set up 4.2 Edit i ng TCP/IP Options (with Ethernet Encapsulati on) Move the cursor to the Edit IP fie ld i n Me nu 11.1 , then press th e [SPA CE B AR] to toggle and set the value to Yes . Press [Enter] to open Menu 11.
P312 Broadban d Security G ateway Remote N ode Set up 4-7 Field Description Example between 1 a nd 15. In pra ctice, 2 or 3 is us ually a good n umb er. Private This field is valid only for PPT P/ PP PoE enc aps u lat io n. Thi s parameter determin es if t he Pre stige w ill incl ude the r oute to this remote no de in it s RIP br oad casts.
P312 Broadban d Security G ateway 4-8 Remote N ode Set up Figure 4-5 Remote Node Network Layer Options T he next tab le gi ves yo u ins truct io ns a bout con figuri ng r emote node net work la yer o ptio ns.
P312 Broadban d Security G ateway Remote N ode Set up 4-9 between 1 a nd 15. In pra ctice, 2 or 3 is us ually a good n umb er. Private T his paramet er determ ines if the Prest ige w ill in clude th e route to thi s remote no de in it s RIP br oad casts.
P312 Broadban d Security G ateway 4-10 Remote N ode Set up Figure 4-6 Remote Node Filter (Ethernet Encapsulation) Figure 4-7 Remote Node Filter (PPPoE or PPTP Encapsulation) Menu 11.
P312 Broadban d Security G ateway IP Stat ic Route Setup 5-1 Chapter 5 IP Static Route Setup This c hapter shows you how to confi gure stat ic routes with yo ur Prestige. Static routes tell the Presti ge routing in formation that it cannot learn automatically through other m eans.
P312 Broadban d Security G ateway 5-2 IP Stat ic Rout e Setup 5.1 IP Stat ic Route Setup You c onfig ure I P sta t ic ro utes in M enu 12. 1 , by selecting one of the IP static rou tes as show n below.
P312 Broadban d Security G ateway IP Stat ic Route Setup 5-3 Tab le 5-1 IP Stat ic Route M enu F ields Field Description Route # This is the ind ex number of the sta tic rout e that y ou cho se in M enu 12. Route Na me Enter a des criptiv e name for this rout e.
.
P312 Broadban d Security G ateway NA T 6-1 Chapter 6 Network Address Translation (NAT) This c hapter d iscusses how to conf igure NAT on the Prestige. 6.1 Intr oduction NAT (Netw ork Addres s Translat ion - NAT, RFC 1631) i s th e trans lation of the IP address of a h ost in a packet, e.
P312 Broadban d Security G ateway 6-2 NA T them access ible to the outs ide world. If y ou do not def ine any se rvers (for Many -to-One and Many -to- Many Overload mapping – see below), NAT o ff ers the additional benefit of firewall protectio n.
P312 Broadban d Security G ateway NA T 6-3 2. Many to One: In Many-to-One mode, the Prestige maps multiple lo cal IP addresses to one global IP address. T his is equivalent to SUA (i.e., PAT, por t addr ess translation), Zy XEL’s Sin gle U ser A ccount feature th at prev ious ZyXEL routers su pported (th e SUA Only option in today’ s rout ers).
P312 Broadban d Security G ateway 6-4 NA T remote node bas is. They are reu sable, but on ly one s et is allowed for each rem ote node. The Prestige support s 2 set s since there i s only one rem ote node. The secon d set ( SUA Onl y option i n Menu 15.
P312 Broadban d Security G ateway NA T 6-5 Figure 6- 3 Applyin g N A T for Int ernet Access This f igure sh ows how you apply NAT to th e remote node i n Menu 11.1. Step 1. Enter 11 f rom the Main Menu . Step 2. Move the cursor to the Edit IP field, press the [SPACEBAR] to togg le the default No to Yes , then p r ess [ ENT ER] t o bring up Menu 11.
P312 Broadban d Security G ateway 6-6 NA T Tabl e 6-3 A ppl ying N A T in M enus 4 & 11.3 Field Options Description Full Feature When you selec t this o ption the SMT will use Address M apping S et 1 (M enu 15.1 – see sec ti on 6.2.3 for further dis cu ss ion).
P312 Broadban d Security G ateway NA T 6-7 Figure 6- 6 M enu 15.1 Addres s M apping Sets Let’s look first at Option 255. Opti on 255 i s equ ival ent to SUA in previous ZyXEL routers ( see section 6.1.4) . The fiel ds in this menu cann ot be chang ed.
P312 Broadban d Security G ateway 6-8 NA T Tab le 6-4 SU A Addres s Map ping Rules Field Description Options/Exa mple Set Name This is the nam e of the set yo u sele cted in M enu 15.1 or ent er the na me of a new set you w ant to create. SUA Idx This is the ind ex or rule number .
P312 Broadban d Security G ateway NA T 6-9 Figure 6-8 First Set in Men u 15.1.1 The Ty pe, Loc al a nd Glob al Start/ End I Ps are co nfigur ed i n Men u 15.
P312 Broadban d Security G ateway 6-10 NA T moved d own by one rule. Delete mea ns t o delete the selecte d rule an d then a ll t he rule s after the sele cted one will b e advan ced one rul e. Save Set means to save the w hole set (note when y ou cho ose this a ction, the Select Rul e item w ill be d isa bled).
P312 Broadban d Security G ateway NA T 6-1 1 Field Description Option/Exam ple ex amples. and Server Local IP Only loca l IP f ields a re N/A for server; Global IP fie lds M US T be set fo r Server . Start T his is the start ing lo cal IP ad dress (I LA).
P312 Broadban d Security G ateway 6-12 NA T Figure 6- 10 Mult iple Servers Beh ind N A T 6.3.2 Configuring a Server behind NA T Follow the steps below to configure a se rver behind NAT: Step 1. Enter 15 in the main menu to go to Menu 1 5 – NAT Setup.
P312 Broadban d Security G ateway NA T 6-13 Figure 6- 11 M enu 15.2 – N A T Serv er Set up Tab le 6-7 Servic es & Port numbe rs Services Port Number FTP (File T ransfer Proto col) 21 Telnet 23 S.
P312 Broadban d Security G ateway 6-14 NA T Figure 6-1 2 N A T Example 1 Figure 6- 13 Internet Access & N A T Exampl e From Menu 4 sh own above, si mply choos e the SUA Only o p tion from the Network Addr ess Trans lation fiel d. This is the Many-t o-One mappi ng dis cuss ed in sect ion 6.
P312 Broadban d Security G ateway NA T 6-15 6.4.2 Example 2 – Intern et A ccess with an Inside Serv er Figure 6-1 4 N A T Example 2 In this cas e, we do exactly as above (us e the conven ient pre-conf igured SU A Only set) and also go to Menu 15.2 t o specify the Insi de Server beh ind th e NAT as show n in the next f igure.
P312 Broadban d Security G ateway 6-16 NA T server an d the other IGA is used by all. We w ant to map the FTP servers to the f irst two of our IGAs and the other LAN traff ic to the rem aining IGA. We also want to m ap out third IGA to an inside w eb server an d mail server.
P312 Broadban d Security G ateway NA T 6-17 Step 5. Select Type = as One-to-One (direct m apping for packets g oing both ways ) , and enter the local Start IP as 192.168 .1.10 (t he IP address of FTP S erver 1), th e global Star t IP as 10.132.5 0.1 (our fi rst IGA).
P312 Broadban d Security G ateway 6-18 NA T When w e have conf igured all fou r rules, Menu 15.1.1 sh ould look as f ollows . Figure 6-19 Example 3 Final Menu 15.1.1 Now we configu re our IGA 3 to map to ou r w eb server an d mail se rver on th e LAN.
P312 Broadban d Security G ateway NA T 6-19 6.4.4 Example 4 –NA T Unfriendly A pplication Programs Some appl ication s do n ot support NA T Mapping us ing TCP or UD P port address t rans lation .
P312 Broadban d Security G ateway 6-20 NA T Figure 6-2 2 Example 4- Menu 15.1.1.1 - Address M appin g Rule After you’ve configured this menu, you should see the following screen. Figure 6-2 3 Example 4 - Menu 15.1.1 - Address M appin g Rules Menu 15.
Advance d Mana gem ent III Part III: Advanced Manag e ment Chapters 7 - 12 pr ovide inf orm ation on Pres tige fil tering, S ystem Inform ation and Dia gnosis, Transferring Fil es and T elnet.
.
P312 Broadban d Security G ateway Filters 7-1 Chapter 7 Filter Configuration This c hapter shows you how to crea te and app ly filter( s). 7.1 About Filtering Your Prestige uses filters to decid e whether to allow passage of a data packet and/or to m ake a call.
P312 Broadban d Security G ateway 7-2 Filters 7.1.1 The Filter Structure of the Pr estige A filter set consists of one or more filter rules. Usuall y , you would group related rules, e.g., all the rules for NetBIOS, into a single set and give it a descrip tive name.
P312 Broadban d Security G ateway Filters 7-3 Start Fetch First Filter Set Fetch First Filter Rule Active? Execute Filter Rule Fetch Next Filter Rule Next filter Rule Available? Fetch Next Filter Set .
P312 Broadban d Security G ateway 7-4 Filters 7.2 Configur ing a Filter Set To configu re a filter s et, follow the procedure below . For more inf ormation on Menus 21.2 and 21. 3, please see Part 4. Step 1. Select option 21. F ilt er Set Configurat ion fro m the M ain M enu t o op en M enu 21 .
P312 Broadban d Security G ateway Filters 7-5 Figure 7-6 NetBIOS_W AN Filter Rules Summ ary Figure 7-7 NetBIOS _LAN Filter Rules Summary Figure 7-8 TEL_FT P_WEB_W A N Filter Rules Summ ary Menu 21.1.1 - Filter Rules Summary # A Type Filter Rules M m n - - ---- -------------------------------------------- --------- - - - 1 Y IP Pr=6, SA=0.
P312 Broadban d Security G ateway 7-6 Filters 7.2.1 Filter Rules Summary Menu This screen shows the summ ary of the existing rules in the filter set. The f ollowing tables cont ain a brief descripti on of the abbrev iati ons used in the previous menus .
P312 Broadban d Security G ateway Filters 7-7 The protocol d ependent filter rules abbreviation are listed as follows: ! If the filter ty pe is IP, the following abbreviation s lis ted in t he follo wing table will be used.
P312 Broadban d Security G ateway 7-8 Filters Figure 7-9 Men u 21.1.1.1 - TCP/I P Filter Ru le The following table describes ho w to configure your TCP/IP filter rule. Table 7-4 T CP/IP Filter Rule M enu Fields Field Description Option Active This fie ld activ ates/d eactiv ates th e filter r ule.
P312 Broadban d Security G ateway Filters 7-9 Field Description Option don’t-care if it i s 0. Destinatio n: Por t # Comp Select the co mparis on to ap ply to t he d estinat ion port in the pack et agai nst the v alue g iven i n Destina tion : Port #.
P312 Broadban d Security G ateway 7-10 Filters Field Description Option Once you h ave co mp leted fi lling i n Menu 21.1. 1.1 - TCP/IP Filt er Rule , press [E nter] at th e mes sage [Press Enter to Confir m] to save your co nfigurati on, or pre ss [Es c] to ca ncel.
P312 Broadban d Security G ateway Filters 7-1 1 Packet into IP Filter Matched Matched Yes Action Matched Action Not Matched More? No Filter Active? Check IP Protocol Drop Drop Packet Accept Packet Dro.
P312 Broadban d Security G ateway 7-12 Filters 7.2.4 Generic Filter Rul e This section sho ws you ho w to configure a generic filter rule. The purpose of generic rules is to allo w you to filter non-IP packets. For IP, it is generally easier to use the IP rules directly.
P312 Broadban d Security G ateway Filters 7-13 The follo wing table describes the fields in the Generic Filter R ule Me nu. Table 7-5 Generic Filter Rule Menu Fields Field Description Option Filter # This is the filt er s et, filter rule co-o rdinate s, i.
P312 Broadban d Security G ateway 7-14 Filters Drop Once you h ave co mp leted fi lling i n Menu 21.4. 1.1 - Gen eric Filter Rule , pre ss [Enter ] at the messa ge [Press Enter to Confir m] to save your co nfigurati on, or pre ss [Es c] to ca ncel. T his dat a w ill now be display ed on Menu 21.
P312 Broadban d Security G ateway Filters 7-15 Figure 7-1 3 Exampl e Filter – M enu 21.1. 1.1 When y ou pres s [Enter] to co nfirm, you will see the following screen.
P312 Broadban d Security G ateway 7-16 Filters Figure 7-1 4 Example F ilter Rule s Summary – M enu 21.1 .3 After you’ve created the filter set, you must appl y it. Step 1. Enter 11 f rom the main menu t o go to Men u 11. Step 2. Go to the Edit Filter Sets field, press the [SPA CE BAR ] to toggle Yes to No and press [ENTER] .
P312 Broadban d Security G ateway Filters 7-17 packets and after NAT for incoming packets. On the other hand, the generic, or device filters are applied to the raw packets that appear on the w ire. They are applied at the poin t when the Prestige is receiving an d sending the pack ets; i.
P312 Broadban d Security G ateway 7-18 Filters Figure 7-16 Filtering LAN Traffic 7.6.2 Remote Node Filters Go to Menu 11.5 (sho wn below – note that call filter sets are only present for PP PoE encapsulation) and enter the number(s) of th e filter set(s) as appro priate.
P312 Broadban d Security G ateway SNMP 8- 1 Chapter 8 SNMP Configuration This c hapter d iscusses SNMP (Simp le Netw ork Manage ment Pro toco l) for network managem ent and monitor ing. 8.1 About SNMP Your Prest ige su pports S NMP agen t funct ionality, wh ich all ows a manage r station t o manage an d monitor the Prestige through the network.
P312 Broadban d Security G ateway 8-2 SN MP The follo wing table describes t he SNMP co nfiguration parameters. Table 8-1 SNMP Configuration Menu Fields Field Description Default Get Community Enter th e ge t comm unity , which i s the pa ssw ord for the incomi ng Get- and GetN ex t- request s from the m anagem ent stat ion.
P312 Broadban d Security G ateway System I nform ation & D iagnosis 9-1 Chapter 9 System Information & Diagnosis This c hapter talk s you thro ugh S M T Menus 24.1 t o 24 .4. This chapter covers the dia gnost ic to ols that help you to maintai n your Prestige.
P312 Broadban d Security G ateway 9-2 System I nformati on & D iagnosis 9.1 S y stem Status T he first se l ectio n, S yste m Stat us, gi ves yo u info r mati on on t h e ver sio n o f your syste m fi r mwa r e and t he status an d statistics of the ports, as s hown in the figu re below.
P312 Broadban d Security G ateway System I nform ation & D iagnosis 9-3 The following table des cribes the fields presen t in Menu 2 4.1 - Syste m Maintena nce - Status . T able 9-1 System M aint enance - Stat us Men u Fields Field Description Port The W AN or LAN port.
P312 Broadban d Security G ateway 9-4 System I nformati on & D iagnosis 9.2 S ystem Information and Console Port Speed This sect ion des cribes y our sys tem and al lows you to choose dif fe rent console port speeds. To g et to t he Sy stem Informat ion an d Consol e Port Speed: Step 1.
P312 Broadban d Security G ateway System I nform ation & D iagnosis 9-5 Tab le 9-2 Fields in System M aintenance Field Descriptio n Name This is the Prest ige' s syste m na me + d omain n ame a ssigned in M enu 1. E.G., Syste m Name= x xx ; Domain Name= babo o.
P312 Broadban d Security G ateway 9-6 System I nformati on & D iagnosis 9.3.1 Viewing Error Log The first place y ou should look f or clues w hen something goes wrong is th e error/trace log. Follow the procedure bel ow to v iew the local error/trace log: Step 1.
P312 Broadban d Security G ateway System I nform ation & D iagnosis 9-7 Figure 9-8 Men u 24.3.2 - System M aint enance – UNI X Syslog You need to con figure the UNIX syslog parameters described in th e following table to activate syslog then choose w hat y o u want to log.
P312 Broadban d Security G ateway 9-8 System I nformati on & D iagnosis 1. CDR CDR Message Format Sdcm dSyslogSend( SYSLOG_CDR, SYSLOG_INFO, String ); Stri ng = board xx line xx channel xx , c all.
P312 Broadban d Security G ateway System I nform ation & D iagnosis 9-9 Mar 03 10:39:43 202.132.155.97 ZyXEL: GEN[fffffffffffnordff0080] }S05>R01mF Mar 03 10:41:29 202.132.155.97 ZyXEL: GEN[00a0c5f502fnord010080] }S05>R01mF Mar 03 10:41:34 202.
P312 Broadban d Security G ateway 9-10 System I nformati on & D iagnosis 9.3.3 Call-T riggering Packet Call-Triggering Packet dis plays information about the pack et that triggered a dial-out call in an easy readable form at. Equivalent inf ormation is available in Menu 2 4.
P312 Broadban d Security G ateway System I nform ation & D iagnosis 9-1 1 Figure 9-10 M enu 24.4 - Sys tem M aintena nce - Diagnos tic Follo w the proced ure b elow to get to M enu 24 .4 - System M aintenan ce – Diagnos tic. Step 1. From the Main Menu, select optio n 24 to open Menu 24 - Syst em Mainte na nce .
P312 Broadban d Security G ateway 9-12 System I nformati on & D iagnosis Figure 9-11 W A N & L A N DHCP The follo w ing table describes t he diagnostic tests a vailable in Menu 24.
P312 Broadban d Security G ateway T ransferring F iles 10-1 Chapter 10 T ransferring Files This c hapter te lls you how to bac k up and restore y our co nfiguratio n file as well as uploa d new firmware and a new c onfigurat ion fi le.
P312 Broadban d Security G ateway 10-2 T ransferr ing Files Table 10-1 Filename Conv entions File Ty pe Internal Name External Name Description AT Command Configurati on File Rom-0 *.
P312 Broadban d Security G ateway T ransferring F iles 10-3 10.3 Restore Configuration Me nu 2 4.6 -- System Ma int e na nce - Restore Configuration allo ws you to restore the configuratio n via the cons ole port.
P312 Broadban d Security G ateway 10-4 T ransferr ing Files Step 4. After successful firmware upload, enter atgo to restart the Prestige. Figure 1 0-4 Men u 24.
P312 Broadban d Security G ateway T ransferring F iles 10-5 Figure 10-5 M enu 24.7.2 - System Maintenance - Upload Router Configura tion File 10.5 TFTP File T ransfer In addition to th e direct consol.
P312 Broadban d Security G ateway 10-6 T ransferr ing Files Note: If yo u uplo ad the firm war e to t he Pre stige, i t will r eb oot a utoma ticall y whe n t he file tra nsfe r is c omple ted (t he SYS LED will f lash) . Note that the telnet connection must b e active a nd the SMT in CI mode before and during the TFTP transfer.
P312 Broadban d Security G ateway T ransferring F iles 10-7 10.6 FTP File T ransfer In addition to uploading the firmware and configuration via the console port and T FTP client, y ou can also upload the Prestige firmw are and configuration files using FTP .
P312 Broadban d Security G ateway 10-8 T ransferr ing Files Figure 1 0-7 Telnet into Men u 24.7.2 - System M aintenance To transfer the f irmware and the configu ration file, follow these examples: 10.6.1 Using the FTP command from the DOS Prompt Step 1.
P312 Broadban d Security G ateway T ransferring F iles 10-9 Figure 1 0-8 FT P Session Example Th e system r eboot s aft er a succes sfu l upload . The follow ing table desc ribes some of the fields that y ou may see in third party FTP clien ts.
.
P312 Broadban d Security G ateway System Mai nten anc e & Infor m ation 1 1-1 Chapter 11 System Maintenance & Information This c hapter leads you throu gh S M T me nus 24.8 t o 24.11 . 11.1 Comman d Interp rete r Mod e The Command In terpreter (CI) is a part of the m ain rout er firmw are.
P312 Broadban d Security G ateway 1 1- 2 System Mai nten anc e & Infor m ation 11.2 Call Control Suppor t The Prestige prov ides two call cont rol functions: bu dget management and call hi story. Please note that this menu is only applicable when Encapsulat ion is set to PPPoE or PPTP i n Menu 4 or Menu 11.
P312 Broadban d Security G ateway System Mai nten anc e & Infor m ation 1 1-3 The total budget is the time limit o n the accu mu lated ti m e for outgoing calls to a re mote node. When this limit is reached, th e call will be dropped an d furth er outgoing calls to that remote node w ill be blocked.
P312 Broadban d Security G ateway 1 1- 4 System Mai nten anc e & Infor m ation Tab le 11-2 Call Hi story Fi elds Field Description Phone Number The PPPoE serv ice na mes are show n here. Dir This sh ow s whether the cal l was in co ming or o utgoing.
P312 Broadban d Security G ateway System Mai nten anc e & Infor m ation 1 1-5 Figure 11-6 System Maintenance – Time and Date Setting Table 11-3 T ime and Da te Setting Fiel ds Field Description Use Time S erver w hen Bootup= Enter the ti me serv ice pro tocol t hat your timeserv er w ill send w hen th e Prestige p owers up.
P312 Broadban d Security G ateway 1 1- 6 System Mai nten anc e & Infor m ation zone and Greenw ich mea n T ime (GM T). Be aw are if/when day light savings ti me alters t his ti me differe nce for y our time z one. Once you h ave fil led in t he new time and date, pre ss [E nter] to save th e settin g and pr ess [Esc] to return to Menu 2 4 .
P312 Broadban d Security G ateway System Mai nten anc e & Infor m ation 1 1-7 Table 11-4 M enu 24.1 1 - Remote Management Control Field Description Option FTP serv ice active Press the [SPACE BAR] to t oggle Yes to No and press [Enter] to disable all FT P activity (both LAN and W AN).
P312 Broadban d Security G ateway 1 1- 8 System Mai nten anc e & Infor m ation Figure 11-9 Boot M odule Commands ======= Debug Command Listing ======= AT just answer OK ATHE print help ATBAx change baudrate. 1:38.4k, 2:19.2k, 3:9.6k 4:57.6k 5:115.
P312 Broadban d Security G ateway Te l n e t 12-1 Chapter 12 Telnet Configuration and Capabilities This c hapter cov ers the T elnet C onfigura tion and C apabi lities of th e Pres tige. 12.1 About T elnet Configur ati on Before the Prestige is prop e rly setup for T CP/IP, the only option for configurin g it i s through the conso le port.
P312 Broadban d Security G ateway 12-2 Te l n e t 12.3.2 Sy stem T imeout There is a sy stem t imeout of 5 minu tes (300 seconds ) for eit her th e console port or teln et. Your Pres tig e will automatically log you out if you do nothi n g in this timeout perio d, except when it is continuously updating the stat us i n M enu 24.
Firewall and Cont ent Filters IV Part IV: Firewall and Co ntent Filter s Chapters 13 – 20 describ e types of fire walls, h ow to conf igure your Pr estige f irewall using th e Prestig e Web Configur ator , as well as t ypes of Den ial of Ser vices ( DoS) at tack s and Content Filter ing.
P312 Broadba nd Security Gateway W hat Is a Firewall ? 13-1 Chapter 13 What is a Firewall This chapt er giv es some back gro u nd infor mat ion on firew al ls. Ori g in al ly , th e term firewall refe rred to a constru ction technique des igned to preven t the spread of f ire from one room to an other.
P312 Broadba nd Security Gateway 13-2 W hat Is a Firewa ll? needed to filter application traffic and direct it to a number of specific systems. The router need only allow application traffic desti ned for the applicatio n gateway and reject the rest. 13.
P312 Broadba nd Security Gateway W hat Is a Firewall ? 13-3 Figure 13-1 Pr estige Firewall A pplication 13.3 Denial of Service Denials of Service (DoS) attack s are aimed at dev ices and netw orks with a con nection to the Intern et.
P312 Broadba nd Security Gateway 13-4 W hat Is a Firewa ll? Table 13-1 Common IP Ports 21 FTP 53 DNS 23 Telnet 80 HTTP 25 SMT P 110 POP3 13.3.2 T y pes of Do S attacks There are four ty pes of DoS attacks: 1. Those that exploit bugs i n a T CP/IP implementation.
P312 Broadba nd Security Gateway W hat Is a Firewall ? 13-5 Under normal circums tances, the application th at initiates a session sends a SYN (synchronize) packet to the receiving s erver. The receiver sen ds back an ACK (ackn owledgment) packet and its own SYN, and then the initiator responds with an ACK (ac kno wled g m ent).
P312 Broadba nd Security Gateway 13-6 W hat Is a Firewa ll? Figure 13-4 Smurf A ttack 4. Often, many DoS attacks also employ a techniqu e known as "IP Spoofing " as part of their attack . IP Spoofi ng may be u sed to break in to systems , to hi de the hack er's identi ty, or to magn ify the effect of the DoS attack.
P312 Broadba nd Security Gateway W hat Is a Firewall ? 13-7 Figure 13-5 Stateful Inspection Figure 13-5 shows the Presti ge’s default fire wall rules i n action as well as de monstrates ho w stateful inspection works. User A ca n initiate a T elnet session fro m within the LAN and respo nse s to this request are allowed.
P312 Broadba nd Security Gateway 13-8 W hat Is a Firewa ll? 7. The packet is ins pected by a firewall rule, and the conn ection's state table entry is updated as necessary.
P312 Broadba nd Security Gateway W hat Is a Firewall ? 13-9 When any subsequent pack et hits the box (f rom the In ternet or from th e LAN), its conn ection information is extracted and ch ecked against the cach e.
P312 Broadba nd Security Gateway 13-10 W hat Is a Firewa ll? 3. Limit who can Telnet into your router. 4. Don' t enable any local s ervice (su ch as SNMP or NTP) th at you don' t use. Any enabl ed serv ice coul d present a potential security risk.
P312 Broadba nd Security Gateway W hat Is a Firewall ? 13-1 1 12. Always shred confidential information, particularly about your computer, before throwing it away. Some hackers dig through the trash of co m panies or individ uals for information that mig ht help them in a social intrusio n.
.
P312 Broadban d Security G ateway Introduc ing the Pr estige F irewall 14-1 Chapter 14 Introducing the Prestige Firewall This chapt er shows you how to get st arted with the Prest ige Firew all. Ple ase see Cha pter 1 3 for some b ackground inform ation on f irewalls .
P312 Broadba nd Security Gateway 14-2 Introduc ing the Pr estige F irewall Figure 14-3 M enu 21.2 – Fir ewall Setup Please n ote that yo u ca n onl y conf igur e the fire wall rules u sing t he Pre stige Web Configur at or or CL I co mman ds. 14.1.1 V iew Fire wall Log Enter 3 from menu 21 to view the firewall log.
P312 Broadban d Security G ateway Introduc ing the Pr estige F irewall 14-3 ICM P Echo A bru te-force attack, such as a "Smurf" attack, targets a feature in the IP specification known as directed or subn et broadcastin g, t o quickl y flood th e targ et network with us eless data.
P312 Broadba nd Security Gateway 14-4 Introduc ing the Pr estige F irewall T racerou te Traceroute is a u til ity used to determ ine the pat h a packet tak es betw een two endpoin ts.
P312 Broadban d Security G ateway Introduc ing the Pr estige F irewall 14-5 Table 14-4 View Firewall Log Field Description # This is the ind ex number of the firew all log. 128 entr ies are av ailable numbere d from 0 to 127. Once t hey are all used, the log w ill w rap arou nd and t he old l og s will be lost.
P312 Broadba nd Security Gateway 14-6 Introduc ing the Pr estige F irewall Figure 14-5 Big Pictu re - Filtering, Firewall and NA T 14.3 Packet F iltering Vs Fire w all Belo w are some comparis ons between the Prestige’s filtering and firewall functions.
P312 Broadban d Security G ateway Introduc ing the Pr estige F irewall 14-7 When T o Use Filtering 1. To block/allow LA N packets by their MAC addres s.
.
P312 Broadban d Security G ateway Introduc ing the Pr estige Web Configur ator 15-1 Chapter 15 Introducing the Prestige Web Configurator This c hapter shows you how to confi gure your firewall w ith the W eb Conf igurator. 15.1 W eb Configurator Logi n and W elcome Screens Laun ch your web brow ser an d ent er 192.
P312 Broadba nd Security Gateway 15-2 Introduc ing the Prest ige Web Config urator Figure 15-2 Prestige Web Configurator Welcome Scre e n 15.2 Enabling the Firewall Click Firewall, then Co n figuration, then the Rule Config tab to enable the fire wall as seen in the following screen.
P312 Broadban d Security G ateway Introduc ing the Pr estige Web Configur ator 15-3 Figure 15-3 Enabling the Firewall 15.3 E-Mail This screen allows y ou to specify your mail server, where e- m ail alerts sho uld be sent as well as when and how often they should be sen t.
P312 Broadba nd Security Gateway 15-4 Introduc ing the Prest ige Web Config urator To field and schedule tim es for sending alerts in the Alert Tim er fields in the E-Mail s creen (following screen).
P312 Broadban d Security G ateway Introduc ing the Pr estige Web Configur ator 15-5 Tab le 15-1 E-Mail Field Description Options Address Inform ation Mail Serv er Enter the IP addre ss of y our mai l server in dot decimal format. Y our Inter net Serv ice Prov ider (ISP) sh ould be able to pr ovide t his inf orma tion.
P312 Broadba nd Security Gateway 15-6 Introduc ing the Prest ige Web Config urator 15.3.3 SMTP Error Me ssag es If there are diff iculties in sending e-m ail the follo wing error messages appear. Please see th e Support Notes on the accom panying CD for information on oth er ty pes of error m essages .
P312 Broadban d Security G ateway Introduc ing the Pr estige Web Configur ator 15-7 Figure 15-5 E-M ail Log 15.4 A ttack A lert In this screen you may choose to g enerate an alert whenever an attack is detected. For DoS attack s, the Prestig e us es threshol ds to dete rmine when to drop ses sions that do not becom e fully est ablishe d.
P312 Broadba nd Security Gateway 15-8 Introduc ing the Prest ige Web Config urator You can use the default threshold values, or you can change them to value s more suitable to your security requirements.
P312 Broadban d Security G ateway Introduc ing the Pr estige Web Configur ator 15-9 The Prestige deletes the old est exi sting half-open session for the host for every new connectio n request to the host. This ens ures that the nu mber of h alf-open sessi ons to a given host will n ever exceed the thresh old.
P312 Broadba nd Security Gateway 15-10 Introduc ing the Pr estige Web Configur ator Tab le 15-3 A ttac k Alert Field Description Default Values Generate aler t when attack dete cted A detected atta ck aut oma tically genera tes a log entry. C heck thi s box to generate an alert (as w ell a s a log) w henever an attack is dete cted.
P312 Broadban d Security G ateway Introduc ing the Pr estige Web Configur ator 15-1 1 Field Description Default Values rises ab ove thi s numb er, the Pre stige deletes half-ope n se ssion s as require d to accommoda te new connection reque sts. Do not set Maximum Inco mplet e High to lower than t he curren t Max-Inc omplete Low number.
.
P312 Broadban d Security G ateway Creating C ustom Rul es 16-1 Chapter 16 Creating Custom Rules 16.1 Rules Overvie w Firewall rules are subdiv ided into “ Local Network” and “ Internet”.
P312 Broadba nd Security Gateway 16-2 Creati ng Custom Rules 5. What computers on the LAN are to be aff ected (if any)? 6. What computers on the Internet will be affected? The m ore specific, the better.
P312 Broadban d Security G ateway Creating C ustom Rul es 16-3 16.3 Connection Direction This section talks abo ut con figuring firewall rules for connection s goi ng from L AN to W AN and WAN to LA N in y o u r f i rew a ll.
P312 Broadba nd Security Gateway 16-4 Creati ng Custom Rules Figure 16-2 W AN to LAN Traffic 16.4 Services Supported The list box in the Rule Config (uration) screen ( see Figur e 16-4 ) display s all services that the Prestige support s. Cust om servi ces may also be configured u sing th e Custo m Ports function discussed later.
P312 Broadban d Security G ateway Creating C ustom Rul es 16-5 Table 16-1 Services Supported SERV ICE DESCRIPTI ON BGP(TCP:179) Border Gateway Protoc ol BOOTP_CLIE NT (UDP: 68) DHCP Client BOOTP_SERVE R(UDP:67) DHCP S erver CU-SEE ME(TC P/UDP:7648, 24032) A popular videoconferencing s olution from W hite Pines S oftware.
P312 Broadba nd Security Gateway 16-6 Creati ng Custom Rules 16.5 Rule Summary The fi elds in the Rule Su m mar y screens ar e th e same for Loc al Networ k and Int ern et , so the dis cussion below refers to both. Click on Firew all , then Local Net w ork to bring up the following scree n.
P312 Broadban d Security G ateway Creating C ustom Rul es 16-7 Tab le 16-2 Firewall Rules Summar y – First S creen Field Description Option General Name This is the name of the firewall rule set. Default Perm it Log Check this b ox to log all matched rules i n the ACL default set.
P312 Broadba nd Security Gateway 16-8 Creati ng Custom Rules Field Description Option section 16.5.1 f or more d etails. Delete Press this bu tton to d elet e an ex isting firewall r ule. Note that s ubseque nt firew all rules move u p by on e when y ou take thi s actio n.
P312 Broadban d Security G ateway Creating C ustom Rul es 16-9 Figure 16-4 Crea ting/Editing A Firewall Rule Table 16-3 Cre ating/Editing A Firewall Rule Field Description Option Source Addre ss Press Sr cA dd to add a n ew address, SrcEdit to edit an ex isting o ne or SrcD elete to delete one.
P312 Broadba nd Security Gateway 16-10 Creating C ustom Rul es Field Description Option from the A vailable Ser vices box on the left, then pres s >> to sele ct it.
P312 Broadban d Security G ateway Creating C ustom Rul es 16-1 1 Figure 16-5 Adding/Editing Source & Destination A ddresses Table 16-4 A d ding/Editing Source & Destination Addresses Field Description Option Address T ype Do you w ant your rule to a pply to packe ts w ith a part icular (single) IP , a range of IP addr es ses (e.
P312 Broadba nd Security Gateway 16-12 Creating C ustom Rul es W he n y ou hav e fini shed, c lick A pply to save y our custo mized setting s and ex it this screen, Cancel to ex it this screen w ithout savin g, or He lp for online HTM L help on fie lds in this scre en.
P312 Broadban d Security G ateway Creating C ustom Rul es 16-13 Figure 16-6 T imeout Sc reen.
P312 Broadba nd Security Gateway 16-14 Creating C ustom Rul es Table 16-5 Timeout Menu Field Description Default Value TCP T imeout V a lues Connectio n Timeo ut This is the len gth o f time t he Presti ge w aits for a T CP session to r ea ch the e stablished st ate before droppin g the sessio n.
P312 Broadban d Security G ateway Custom Ports 17-1 Chapter 17 Custom Ports 17.1 Introducti on You will need to configure customized po r ts for services not included in t he services pr o vided in the scrolling list box in t he screen sho wn in Figur e 16-4 .
P312 Broadba nd Security Gateway 17-2 Custom Ports Tab le 17-1 Custom Ports Field Description Cus tom ize d Ser vices No This is the num ber of y our cust omiz ed por t. Name This is the nam e of yo ur custom ized port. Protocol T his show s the IP p rotocol ( TCP , UDP or Both ) that defines y our cu stomiz ed port.
P312 Broadban d Security G ateway Custom Ports 17-3 Figure 17-2 Creating/Editing A Custom Port The next table describes the fields in this screen..
P312 Broadba nd Security Gateway 17-4 Custom Ports Tab le 17-2 Creating/Ed iting A Custom Po rt Field Description Option Service Na me Enter a uni que nam e for you r custo m port. Service T ype Choose the IP por t ( TCP , UDP or Both ) tha t defines y our cu stomiz ed port fr om the drop down list box .
P312 Broadban d Security G ateway Logs 18-1 Chapter 18 Logs 18.1 Log Scr een When y ou configu re a new rule you als o have the opti on to log events that match , don’t match (or both ) thi s rule ( see Fi gure 16-4 ). Click on the Logs to br ing up the ne x t scre en.
P312 Broadba nd Security Gateway 18-2 Logs Table 18-1 Log Screen Field Description No. This is the ind ex number of the firew all log. 128 entries are av ailable numbered from 0 to 127. Onc e they ar e al l used, the log w ill wrap aroun d and the o ld logs will be lost .
P312 Broadban d Security G ateway Logs 18-3 Field Description W he n you have fi ni shed v iewing thi s scre en, cli ck ano ther link to ex it..
.
P312 Broadban d Security G ateway Example F irewall Rules 19-1 Chapter 19 Example Firewall Rules 19.1 Examples Please note that whenever y ou open a hole in the firewall to f orward a service from the Internet to the local net work, a nd NAT is also enab led, you ma y ha ve to al so conf igur e a serve r be hi nd N AT usi n g SMT menu 15.
P312 Broadba nd Security Gateway 19-2 Examp les Fir ewall R ules Figure 19-1 Activate The Firewall Step 2. Now we configu re our E-mail screen as follo ws. Click the E-Ma il tab t o br i ng up the next screen. Check here to activate the firew all. You may also activate the firew all in SMT m enu 21.
P312 Broadban d Security G ateway Example F irewall Rules 19-3 Figure 1 9-2 Exampl e 1 – E- Mail Scre en Step 3. Now we conf igure our firewall rule as shown in the f ollowing screen. The defau lt firewall blocks all In ternet traffic entering ou r local network, but w e want to create a hole for w eb service from the Internet.
P312 Broadba nd Security Gateway 19-4 Examp les Fir ewall R ules Figure 19-3 Example 1 – Configuring A Rule This is an Internet to Local Network rule. Click DestAd d to configure the dest ination address as the IP of our server on the LAN. See the ne xt scre en.
P312 Broadban d Security G ateway Example F irewall Rules 19-5 Figure 1 9-4 Example 1: Destinat ion A ddres s for T raffic Origin ating F rom Th e Internet 10.100.1. 2 is t he IP of our server on th e LAN (support ing FTP, HTT P, Telnet and mail services) to w hich we w ish to forward traff ic orig inating from the Internet.
P312 Broadba nd Security Gateway 19-6 Examp les Fir ewall R ules Figure 1 9-5 Example 1 - Rule Su mmary Scr een 19.1.2 Example 2 – Sm all Off ice W ith Mail, FTP and Web Serv ers Our small offi ce has: i. A mail server wi th an IP of 192.168. 10.2 .
P312 Broadban d Security G ateway Example F irewall Rules 19-7 Step 1. First we want to send alerts whe n there is an attack. Go to the Attack Alert screen (click Configura tion , then the Attack Alert tab) sh own n ext. Figure 1 9-6 Send Alerts Wh en Atta cked Step 2.
P312 Broadba nd Security Gateway 19-8 Examp les Fir ewall R ules Figure 19-7 Configuring A PO P Custom Por t Step 4. Now, we will create rules to block all outgoing traffic (from the local network to the Internet) except for traff ic originating from the HTTP proxy server and ou r mail server.
P312 Broadban d Security G ateway Example F irewall Rules 19-9 Figure 1 9-8 Example 2 - L ocal N etwo rk Rule 1 Config uration Step 6. Similarly configure another local netw ork to Internet rule allowing traffic from our web (HTTP) proxy se rver. Step 7.
P312 Broadba nd Security Gateway 19-10 Examp les Firewa ll Rul es Figure 1 9-9 Example 2 - Local N etw ork Rule Summ ary Step 8. Now we want an FTP server (IP of 192.
P312 Broadban d Security G ateway Example F irewall Rules 19-1 1 Figure 1 9-10 Example 2 - Internet t o Local Net work Rule Summary 19.1. 3 Example 3: DHCP Negotiation and S y slog Connection from the Internet The following are some Internet firew all rules examples to: 1.
P312 Broadba nd Security Gateway 19-12 Examp les Firewa ll Rul es Figure 19-11 Custom Port for Syslog Step 2. Follo w the procedures o utli ned in t he pr evious exa m ples to co n figure all your rules. When finished, your rule summary screen should look like the following.
P312 Broadban d Security G ateway Example F irewall Rules 19-13 Figure 19-12 Syslog Rule Configuration This is our Sy slog cust om port. Click Apply whe n fi ni shed .
P312 Broadba nd Security Gateway 19-14 Examp les Firewa ll Rul es Figure 1 9-13 Example 3 Ru le Summar y Rul e 1: Al low DHCP negot iation between t he ISP an d th e P312. Rule 2: Allow a syslog connection from the WAN. Click Apply to sa ve yo ur settings back to the Pr estige.
P312 Broadban d Security G ateway Content Fi ltering 20-1 Chapter 20 Content Filtering The Prestige can block web features such as ActiveX controls, Java applets, cook ies as well as disable web proxies. The Prestige can also block specif ic URLs by using the k eyword featu re.
P312 Broadba nd Security Gateway 20-2 Content F iltering 20.1.3 Cookies Cooki es are used by Web serv ers to track usag e. Cookies provide s ervice bas ed on ID. U nfortun ately, cookies can be progra mmed not only to identify the visitor to the site, but also to track that visitor's activitie s.
P312 Broadban d Security G ateway Content Fi ltering 20-3 Figure 20-1 Conte nt Filtering Sc reen Table 20-1 Content Filtering Fields Field Description Restrict We b Features Check the box (es) to restri ct that f eatu re. When you dow nload a page containi ng a res tricted feature, t hat part of the w eb page w ill app ear blan k or grayed out.
T roubleshoot ing, A ppendic es, Glossar y and In dex V Part V: Troubleshooting, App end ices, Glossary and Index Chapter 21 provid es inf ormation a bout sol ving com mon pr oblem s, followed b y som e Appen dices, a Glossar y of T erm s and an Index.
.
P312 Broadban d Security G ateway T roubleshoot ing 21-1 Chapter 21 Troubleshooting This c hapter cov ers the potential problems you may run int o and the p ossibl e remed ies. After each pro blem des cription, s ome ins tructions are pr ovided to help you to diagnos e and to s olve t he problem.
P312 Broadban d Security G ateway 21-2 T roublesh ooting 21.2 Problems with the LA N Interface Table 21-2 T roubleshooting the LAN Interface Problem Corr ective A ction Check the 10M /100M LEDs on the fron t panel. O ne of these LED s should b e on. If t hey are both off, ch eck the cable s betw een your Prestige a nd hub or the sta tion.
P312 Broadban d Security G ateway T roubleshoot ing 21-3 21.4 Problems w ith Internet A ccess Table 21-4 T roubleshooting Inte rnet A ccess Problem Correctiv e A ction Connect y our Cable/x DSL modem with th e Prestig e using appropriat e cable .
.
P312 Broadban d Security G ateway PPPo E E Appendix A PPPoE PPPoE in Action An A DSL modem bridges a PPP s ess ion over Et hern et (PPP ov er Eth ern et, R FC 2516) from your PC to an ATM PVC (Permanent Virtual Circuit) w hich connects to a xDSL Access Concentrator where th e PPP ses sion t erm inat es (see the next f igure).
P312 Broadban d Security G ateway PPPo E F How PPPoE Work s The P PPoE d river ma kes th e Et hern et appear as a se ria l l ink t o th e PC an d th e PC run s PPP ov er it , w h ile th e m odem bridges the Ethe rnet fra mes to the Access Concentrator (AC ).
P312 Broadban d Security G ateway PPTP G Appendix B PPTP What is PPT P? PPTP (Poi nt- to- Poin t Tunn eling Protocol) is a Micros oft prop riet ary protocol (R FC 2637 f or PPTP is inf orm ation al on ly ) to tunn el PPP f ram es.
P312 Broadban d Security G ateway PPTP H PNS and the PAC must have IP connectivity; however, the PAC must in additio n have dial-up capability. The ph on e ca ll is betw een the use r an d th e P A C an d t he PAC tunn els th e PPP f ra m es to t he PNS .
P312 Broadban d Security G ateway Hardware Sp ec if ic ati ons I Appendix C Hardware Specifications Power Specifi cation I/P AC 120V / 60Hz ; O/P DC 12V 120 0 mA MT BF 10000 0 hrs Operation T emper at.
P312 Broadban d Security G ateway J Safety Ins tructions Appendix D Important Safety Instructions The follo wing safet y instructio ns appl y to the Presti ge: 1. Be sure to read and follow all warning notices and instr uction s. 2. The maximum recommended ambient temperature for th e Prestige is 40º(104º).
P312 Broadban d Security G ateway CLI Comm ands K Appendix E Firewall CLI Commands T he follo wing tab le d escri bes t he syn tax use d to conf i gure your fi re wa l l usi ng Co mmand Line I nte r face (CLI) comm ands. Select option 24.8 Comm a nd Interpreter Mode from the Main Menu to go into CLI m ode.
P312 Broadban d Security G ateway L CLI Comm ands Function CLI Sy ntax Description config edit firewall e-mail email-to <e-mail address> Edits the m ail address which you want to send t he alert.
P312 Broadban d Security G ateway CLI Comm ands M Function CLI Sy ntax Description config edit firewall set <set #> default-permit <forward | block> E di ts whether a pack et is dropped or.
P312 Broadban d Security G ateway N CLI Comm ands Function CLI Sy ntax Description config edit firewall set <set #> rule <rule #> srcaddr-subnet <ip address> <subnet mask> Sele.
P312 Broadban d Security G ateway CLI Comm ands O Function CLI Sy ntax Description D D e e l l e e t t e e config delete firewall e-mail Removes al l the sett i ngs for e-mai l alert config delete fir.
P312 Broadban d Security G ateway P Power Adapt er Spec if ic ati ons Appendix F Power Adapter Specs AC Power Adapter Specificati ons North America AC Pow er Adapter mode l M W 48-1201200 Input power: AC120Volts/ 60Hz Output pow er: DC12Volt s/1.
P312 Broadban d Security G ateway Power Adapt er Specif ications Q Japan AC Pow er Adapter mode l JOD-48-1 124 Input pow er: AC100Vo lts/ 50/ 60Hz/ 27VA Output pow er: DC12Volt s/1.
P312 Broadban d Security G ateway R Glossa ry Glossary of T erms 10BaseT T he 10-M bps baseban d Ethernet speci ficatio n that u ses tw o pair s of tw isted-pa ir cabling (C ategory 3 or 5): on e pair for tran smitti ng data and the o ther for re ceivi ng data.
P312 Broadban d Security G ateway Glossa ry S Cookie A string of charac ters sav ed by a web brow ser on the user' s hard d isk. M any w eb pages s end coo kies t o track spe cific user inf ormatio n. Coo kies can be u sed to r etai n informati on as t he user b row ses a w eb site .
P312 Broadban d Security G ateway T Glossa ry Digital Sig natur e Digital code t hat auth enticat es w homever signed the do cument or so ftware. Softw are, messages, E ma il, and other ele ctronic docum ents c an be s igned e lectroni cally so that they can not be a ltered by anyon e else.
P312 Broadban d Security G ateway Glossa ry U Events These are netw ork activit ies. Som e activ ities are dire ct attac ks on y our sy stem, w hile others m ight be d ependi ng on the cir cumst ances. Therefore , any a ctivity , regard less of severity i s calle d an ev ent.
P312 Broadban d Security G ateway V Glossa ry Integrity Proof that th e data i s the s ame as origina lly in tended. Un autho rized software or people have not altered t he or iginal informa tion . internet (Low er case i) Any t ime y ou conne ct 2 or more netw orks together, y ou have an internet.
P312 Broadban d Security G ateway Glossa ry W as a stream of bits. Name Re solutio n T he allocati on of an IP ad dress t o a host name. S ee DN S NAT Netw ork Address T ranslati on is t he tr anslati on of an Internet Pr oto col addr ess us ed within one netw ork to a d ifferent IP addr ess k nown w ithin anot her netw ork - s ee also SUA.
P312 Broadban d Security G ateway X Glossa ry Plain Tex t The opposite of Ci pher Tex t, Plain Text is read able by anyone . Prestige W eb Configurator T his is a web-bas ed Presti ge router ( not all) con figurator that inclu des an I nternet Access W izard, A dvance d and Fir ew all (not all Pre stige m odels) configur atio ns.
P312 Broadban d Security G ateway Glossa ry Y system, m eaning t hat an end-to-e nd priv ate cir cuit i s estab lished betw een call er and callee. Public Key Encryption Sy stem of en cryptin g el ectronic file s using a key pair .
P312 Broadban d Security G ateway Z Glossa ry SPAM Unw anted e-mail, usual ly in the form of advert isemen ts. Spoofing T o forge some thing, such a s an IP ad dress.
P312 Broadban d Security G ateway Glossa ry AA on a host syst em. Ob jects inc lude dir ect ories an d an as sortmen t of file ty pes, in clu ding tex t files, graph ics, v ideo, a nd audi o. A URL i s the a ddre ss of an object that i s nor mally typed in the Addre ss fiel d of a W eb br ow ser.
.
P312 Broadban d Security G ateway Index CC Index A Action for M atched Pa ckets .......................... 16-10 Activate The F irew all ...................................... 19-2 ActiveX ........................................................... 20-1 Add Keyw ord .
P312 Broadban d Security G ateway DD Index Encapsulati on PPP over Ethernet .................................................... E Ethernet Enc apsulat ion3-8, 4-1, 4-5 , 4-6, 4-1 0, 6- 11, 6-12 Example E-M ail Log ....................................
P312 Broadban d Security G ateway Index EE L LAN Setup ........................ 2-6, 2-11, 2- 12, 3-4, 3-5 LAN to W AN Rul es ......................................... 16-3 LAND ............................................ 13-4, 13-5, 14-2 Local Netw ork Rule Sum mary .
P312 Broadban d Security G ateway FF Index S Safety Instruc tions ................................................ J Safety Instruc tions ................................................ J saving the stat e ............................................
P312 Broadban d Security G ateway Index GG W A N Setup ............................ 2-6, 2-10, 2- 11, 21-2 W AN t o LAN Rules ......................................... 16-3 W eb Configur ator ........................................... 13-9 W eb Prox y .
Un punto importante, dopo l’acquisto del dispositivo (o anche prima di acquisto) è quello di leggere il manuale. Dobbiamo farlo per diversi motivi semplici:
Se non hai ancora comprato il ZyXEL Communications Broadband Security Gateway P-312 è un buon momento per familiarizzare con i dati di base del prodotto. Prime consultare le pagine iniziali del manuale d’uso, che si trova al di sopra. Dovresti trovare lì i dati tecnici più importanti del ZyXEL Communications Broadband Security Gateway P-312 - in questo modo è possibile verificare se l’apparecchio soddisfa le tue esigenze. Esplorando le pagine segenti del manuali d’uso ZyXEL Communications Broadband Security Gateway P-312 imparerai tutte le caratteristiche del prodotto e le informazioni sul suo funzionamento. Le informazioni sul ZyXEL Communications Broadband Security Gateway P-312 ti aiuteranno sicuramente a prendere una decisione relativa all’acquisto.
In una situazione in cui hai già il ZyXEL Communications Broadband Security Gateway P-312, ma non hai ancora letto il manuale d’uso, dovresti farlo per le ragioni sopra descritte. Saprai quindi se hai correttamente usato le funzioni disponibili, e se hai commesso errori che possono ridurre la durata di vita del ZyXEL Communications Broadband Security Gateway P-312.
Tuttavia, uno dei ruoli più importanti per l’utente svolti dal manuale d’uso è quello di aiutare a risolvere i problemi con il ZyXEL Communications Broadband Security Gateway P-312. Quasi sempre, ci troverai Troubleshooting, cioè i guasti più frequenti e malfunzionamenti del dispositivo ZyXEL Communications Broadband Security Gateway P-312 insieme con le istruzioni su come risolverli. Anche se non si riesci a risolvere il problema, il manuale d’uso ti mostrerà il percorso di ulteriori procedimenti – il contatto con il centro servizio clienti o il servizio più vicino.
