Unified Threat Management Advanced Firewall Administration Guide

Transcription

1 Unified Threat Management Advanced Firewall Administration Guide For future reference Advanced Firewall serial number: Date installed: Smoothwall contact:

2 Smoothwall Advanced Firewall, Administration Guide, October 2014 Smoothwall publishes this guide in its present form without any guarantees. This guide replaces any other guides delivered with earlier versions of Advanced Firewall. No part of this document may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express written permission of Smoothwall. For more information, contact: Smoothwall Ltd. All rights reserved. Trademark notice Smoothwall and the Smoothwall logo are registered trademarks of Smoothwall Ltd. Linux is a registered trademark of Linus Torvalds. Snort is a registered trademark of Sourcefire INC. DansGuardian is a registered trademark of Daniel Barron. Microsoft, Internet Explorer, Window 95, Windows 98, Windows NT, Windows 2000 and Windows XP are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. Netscape is a registered trademark of Netscape Communications Corporation in the United States and other countries. Apple and Mac are registered trademarks of Apple Computer Inc. Intel is a registered trademark of Intel Corporation. Core is a trademark of Intel Corporation. All other products, services, companies, events and publications mentioned in this document, associated documents and in Smoothwall software may be trademarks, registered trademarks or service marks of their respective owners in the UK, US and/or other countries. Acknowledgements Smoothwall acknowledges the work, effort and talent of the Smoothwall GPL development team: Lawrence Manning and Gordon Allan, William Anderson, Jan Erik Askildt, Daniel Barron, Emma Bickley, Imran Chaudhry, Alex Collins, Dan Cuthbert, Bob Dunlop, Moira Dunne, Nigel Fenton, Mathew Frank, Dan Goscomb, Pete Guyan, Nick Haddock, Alan Hourihane, Martin Houston, Steve Hughes, Eric S. Johansson, Stephen L. Jones, Toni Kuokkanen, Luc Larochelle, Osmar Lioi, Richard Morrell, Piere-Yves Paulus, John Payne, Martin Pot, Stanford T. Prescott, Ralf Quint, Guy Reynolds, Kieran Reynolds, Paul Richards, Chris Ross, Scott Sanders, Emil Schweickerdt, Paul Tansom, Darren Taylor, Hilton Travis, Jez Tucker, Bill Ward, Rebecca Ward, Lucien Wells, Adam Wilkinson, Simon Wood, Nick Woodruffe, Marc Wormgoor. Advanced Firewall contains graphics taken from the Open Icon Library project openiconlibrary.sourceforge.net/ Address Web Telephone Fax Smoothwall Limited 1 John Charles Way Leeds. LS12 6QA United Kingdom info@smoothwall.net USA and Canada: United Kingdom: All other countries: USA and Canada: United Kingdom: All other countries:

3 Contents About This Guide... 1 Audience and Scope... 1 Organization and Use... 1 Conventions... 2 Related Documentation... 2 Chapter 1 Introduction... 3 Overview of Advanced Firewall... 3 Annual Renewal... 4 Chapter 2 Advanced Firewall Overview... 5 Accessing Advanced Firewall... 5 Dashboard... 6 Logs and reports... 6 Reports... 7 Alerts... 7 Realtime... 8 Logs... 9 Settings... 9 Networking Filtering Routing Interfaces Firewall Outgoing Settings Services Authentication User Portal Proxies SNMP DNS Message Censor iii

4 Contents Intrusion System DHCP System Maintenance Central Management Preferences Administration Hardware Diagnostics Certificates VPN Configuration Guidelines Specifying Networks, Hosts and Ports Using Comments Creating, Editing and Removing Rules Connecting via the Console Connecting Using a Client Secure Communication Unknown Entity Warning Inconsistent Site Address Chapter 3 Working with Interfaces Configuring Global Settings for Interfaces Connecting Using an Internet Connectivity Profile Connecting Using a Static Ethernet Connectivity Profile.. 27 Connecting using a DHCP Ethernet Connectivity Profile.. 29 Connecting using a PPP over Ethernet Connectivity Profile Connecting using a PPTP over Ethernet Connectivity Profile Connecting using an ADSL/DSL Modem Connectivity Profile Connecting using an ISDN Modem Connectivity Profile Connecting Using a Dial-up Modem Connectivity Profile. 38 Creating a PPP Profile Modifying Profiles Deleting Profiles Working with Bridges Creating Bridges Editing Bridges Deleting Bridges Working with Bonded Interfaces Creating Bonds Editing Bonds Deleting Bonds Configuring IP Addresses Adding an IP Address Editing an IP Address Deleting an IP Address iv Smoothwall Ltd

5 Contents Virtual LANs Creating a VLAN Editing a VLAN Deleting a VLAN Chapter 4 Managing Your Network Infrastructure Creating Subnets Editing and Removing Subnet Rules Using RIP Sources Creating Source Rules Removing a Rule Editing a Rule About IP Address Definitions Ports Creating a Ports Rule Creating an External Alias Rule Editing and Removing External Alias Rules Port Forwards from External Aliases Creating a Source Mapping Rule Editing and Removing Source Mapping Rules Working with Secondary External Interfaces Configuring a Secondary External Interface Using DHCP Enabling DHCP Creating a DHCP Subnet Editing a DHCP subnet Deleting a DHCP subnet Adding a Dynamic Range Adding a Static Assignment Adding a Static Assignment from the ARP Table Editing and Removing Assignments Viewing DHCP Leases DHCP Relaying Creating Custom DHCP Options Chapter 5 General Network Security Settings Blocking by IP Creating IP Blocking Rules Editing and Removing IP Block Rules Configuring Advanced Networking Features Working with Port Groups Creating a Port Group Adding Ports to Existing Port Groups Editing Port Groups Deleting a Port Group Chapter 6 Configuring Inter-Zone Security About Zone Bridging Rules v

6 Contents Creating a Zone Bridging Rule Editing and Removing Zone Bridge Rules A Zone Bridging Tutorial Creating the Zone Bridging Rule Allowing Access to the Web Server Accessing a Database on the Protected Network Group Bridging Group Bridging and Authentication Creating Group Bridging Rules Editing and Removing Group Bridges Chapter 7 Managing Inbound and Outbound Traffic Introduction to Port Forwards Inbound Security Port Forward Rules Criteria Creating Port Forward Rules Load Balancing Port Forwarded Traffic Editing and Removing Port Forward Rules Advanced Network and Firewall Settings Network Application Helpers Managing Bad External Traffic Configuring Reflective Port Forwards Managing Connectivity Failback Managing Outbound Traffic and Services Working with Port Rules Working with Outbound Access Policies Managing External Services Chapter 8 Virtual Private Networking Advanced Firewall VPN Features What is a VPN? About VPN Gateways Administrator Responsibilities About VPN Authentication PSK Authentication X509 Authentication Configuration Overview Working with Certificate Authorities and Certificates Creating a CA Exporting the CA Certificate Importing Another CA's Certificate Deleting the Local Certificate Authority and its Certificate Deleting an Imported CA Certificate Managing Certificates Creating a Certificate Reviewing a Certificate Exporting Certificates Exporting in the PKCS#12 Format Importing a Certificate Deleting a Certificate vi Smoothwall Ltd

7 Contents Setting the Default Local Certificate Site-to-Site VPNs IPSec Recommended Settings Creating an IPsec Tunnel IPSec Site to Site and X509 Authentication Example Prerequisite Overview Creating the Tunnel on the Primary System Creating the Tunnel on the Secondary System Checking the System is Active Activating the IPSec tunnel IPSec Site to Site and PSK Authentication Creating the Tunnel Specification on Primary System Creating the Tunnel Specification on the Secondary System Checking the System is Active Activating the PSK tunnel About Road Warrior VPNs Configuration Overview IPSec Road Warriors Creating an IPSec Road Warrior Supported IPSec Clients Creating L2TP Road Warrior Connections Creating a Certificate Configuring L2TP and SSL VPN Global Settings Creating an L2TP Tunnel Configuring an iphone-compatible Tunnel Using NAT-Traversal VPNing Using L2TP Clients L2TP Client Prerequisites Connecting Using Windows XP/ Installing an L2TP Client VPNing with SSL Prerequisites Configuring VPN with SSL Managing SSL Road Warriors Managing Group Access to SSL VPNs Managing Custom Client Scripts for SSL VPNs Generating SSL VPN Archives Configuring SSL VPN on Internal Networks Configuring and Connecting Clients VPN Zone Bridging Secure Internal Networking Creating an Internal L2TP VPN Advanced VPN Configuration Multiple Local Certificates Creating Multiple Local Certificates Public Key Authentication Configuring Both Ends of a Tunnel as CAs VPNs between Business Partners Extended Site to Site Routing Managing VPN Systems vii

8 Contents Automatically Starting the VPN System Manually Controlling the VPN System Viewing and Controlling Tunnels VPN Logging VPN Tutorials Example 1: Preshared Key Authentication Example 2: X509 Authentication Example 3: Two Tunnels and Certificate Authentication. 160 Example 4: IPSec Road Warrior Connection Example 5: L2TP Road Warrior Working with SafeNet SoftRemote Configuring IPSec Road Warriors Using the Security Policy Template SoftRemote Creating a Connection without the Policy File Advanced Configuration Chapter 9 Authentication and User Management Configuring Global Authentication Settings About Directory Servers Configuring a Microsoft Active Directory Connection Configuring an LDAP Connection Configuring a RADIUS Connection Configuring an Active Directory Connection Legacy Method Configuring a Local Users Directory Reordering Directory Servers Editing a Directory Server Deleting a Directory Server Diagnosing Directories Managing Local Users Adding Users Editing Local Users Deleting Users Managing Groups of Users About Groups Adding Groups Editing Groups Deleting Groups Mapping Groups Remapping Groups Deleting Group Mappings Managing Temporarily Banned Users Creating a Temporary Ban Removing Temporary Bans Removing Expired Bans Managing User Activity Viewing User Activity Logging Users Out Banning Users About SSL Authentication viii Smoothwall Ltd

9 Contents Customizing the SSL Login Page Reviewing SSL Login Pages Configuring SSL Login Creating SSL Login Exceptions Managing Kerberos Keytabs Adding Keytabs Managing Keytabs Chapter 10 Centrally Managing Smoothwall Systems About Centrally Managing Smoothwall Systems Pre-requirements Setting up a Centrally Managed Smoothwall System Configuring the Parent Node Configuring Child Nodes Adding Child Nodes to the System Editing Child Node Settings Deleting Nodes in the System Managing Nodes in a Smoothwall System Monitoring Node Status Accessing the Node Details Page Working with Updates Rebooting Nodes Disabling Nodes Using BYOD in a Centrally Managed System Appendix A User Authentication Overview Verifying User Identity Credentials About Authentication Mechanisms Other Authentication Mechanisms Choosing an Authentication Mechanism About the Login Time-out Advanced Firewall and DNS A Common DNS Pitfall Working with Large Directories Active Directory Active Directory Username Types Accounts and NTLM Identification About Kerberos Kerberos Pre-requisites and Limitations Troubleshooting Appendix B Troubleshooting VPNs Site-to-site Problems L2TP Road Warrior Problems Enabling L2TP Debugging Windows Networking Issues ix

10 Contents Appendix C Hosting Tutorials Basic Hosting Arrangement Extended Hosting Arrangement More Advanced Hosting Arrangement Glossary Index x Smoothwall Ltd

11 About This Guide Smoothwall s Advanced Firewall is a licenced feature of your Smoothwall System. This manual provides guidance for configuring Advanced Firewall. Audience and Scope This guide is aimed at system administrators maintaining and deploying Advanced Firewall. This guide assumes the following prerequisite knowledge: An overall understanding of the functionality of the Smoothwall System An overall understanding of networking concepts Note: We strongly recommend that everyone working with Smoothwall products attend Smoothwall training. For information on our current training courses, contact your Smoothwall representative. Organization and Use This guide is made up of the following chapters and appendices: Chapter 1, Introduction on page 3 Chapter 2, Advanced Firewall Overview on page 5 Chapter 3, Working with Interfaces on page 25 Chapter 4, Managing Your Network Infrastructure on page 47 Chapter 5, General Network Security Settings on page 67 Chapter 6, Configuring Inter-Zone Security on page 75 Chapter 7, Managing Inbound and Outbound Traffic on page 83 Chapter 8, Virtual Private Networking on page 99 1

12 About This Guide Chapter 9, Authentication and User Management on page 173 Chapter 10, Centrally Managing Smoothwall Systems on page 199 Appendix A:User Authentication on page 211 Appendix B:Troubleshooting VPNs on page 217 Appendix C:Hosting Tutorials on page 221 Glossary on page 227 Index on page 237 Conventions The following typographical conventions are used in this guide: Item Convention Example Key product terms Initial Capitals Advanced Firewall Cross-references and references to other guides Italics See Chapter 1, Introduction on page 3 Filenames and paths Courier The portal.xml file Variables that users replace Courier Italics This guide is written in such a way as to be printed on both sides of the paper. Related Documentation The following guides provide additional information relating to Advanced Firewall: Advanced Firewall Installation Guide, which describes how to install Advanced Firewall Advanced Firewall Operations Guide, which describes how to maintain Advanced Firewall Advanced Firewall Upgrade Guide, which describes how to upgrade Advanced Firewall Advanced Firewall User Portal Guide, which describes how to use the Advanced Firewall user portal contains the Smoothwall support portal, knowledge base and the latest product manuals. 2 Smoothwall Ltd

13 1 Introduction This chapter introduces Advanced Firewall, including: Overview of Advanced Firewall on page 3 Annual Renewal on page 4 Overview of Advanced Firewall Advanced Firewall is the Unified Threat Management system for enterprise networks. Combining the functions of perimeter and internal firewalls, Advanced Firewall employs Microsoft Active Directory/ LDAP user authentication for policy based access control to local network zones and Internet services. Secure wireless, secure remote access and site-to-site IPSec connectivity are provided by the integrated VPN gateway. Advanced Firewall provides: Perimeter firewall multiple Internet connections with load sharing and automatic connection failover User authentication policy-based access control and user authentication with support for Microsoft Active Directory, Novell edirectory and other LDAP authentication servers Load balancer the ideal solution for the efficient and resilient use of multiple Internet connections. Internal firewall segregation of networks into physically separate zones with user-level access control of inter-zone traffic Security: anti-spam, anti-malware, mail relay and control. VPN Gateway site-to-site, secure remote access and secure wireless connections. 3

14 Introduction Annual Renewal To ensure that you have all the functionality documented in this guide, we recommend that you purchase annual renewal. For more information, contact your Smoothwall representative. 4 Smoothwall Ltd

15 2 Advanced Firewall Overview In this chapter: How to access Advanced Firewall An overview of the pages used to configure and manage Advanced Firewall. Accessing Advanced Firewall To access Advanced Firewall: 1. In a web browser, enter the address of your Advanced Firewall, for example: Note: The example address above uses HTTPS to ensure secure communication with your Advanced Firewall. It is possible to use HTTP on port 81 if you are satisfied with less security. Note: The following sections assume that you have registered and configured Advanced Firewall as described in the Advanced Firewall Installation and Setup Guide. 2. Accept Advanced Firewall s certificate.the login screen is displayed. 5

16 Advanced Firewall Overview 3. Enter the following information: Field Username Password Information Enter admin This is the default Advanced Firewall administrator account. Enter the password you specified for the admin account when installing Advanced Firewall. 4. Click Login. The Dashboard opens. The following sections give an overview of Advanced Firewall s default sections and pages. Dashboard The dashboard is the default home page of your Advanced Firewall system. It displays service information and customizable summary reports. Logs and reports The Logs and reports section contains the following sub-sections and pages: 6 Smoothwall Ltd

17 Advanced Firewall Overview Reports Pages Summary Reports Recent and saved Scheduled Custom Displays a number of generated reports. For more information, refer to the Advanced Firewall Operations Guide. Where you generate and organize reports. For more information, refer to the Advanced Firewall Operations Guide. Lists recently-generated and previously saved reports. For more information, refer to the Advanced Firewall Operations Guide. Sets which reports are automatically generated and delivered. For more information, refer to the Advanced Firewall Operations Guide. Enables you to create and view custom reports. For more information, refer to the Advanced Firewall Operations Guide. Alerts Pages Alerts Alert settings Determine which alerts are sent to which groups of users and in what format. For more information, refer to the Advanced Firewall Operations Guide. Settings to enable the alert system and customize alerts with configurable thresholds and trigger criteria. For more information, refer to the Advanced Firewall Operations Guide. 7

18 Advanced Firewall Overview Realtime Pages System Firewall IPSec Portal IM proxy Traffic graphs A real time view of the system log with some filtering options. For more information, refer to the Advanced Firewall Operations Guides. A real time view of the firewall log with some filtering options. For more information, refer to the Advanced Firewall Operations Guide. A real time view of the IPSec log with some filtering options. For more information, see Realtime IPsec Information on page 113. Displays the log viewer running in real time mode. For more information, see Logs on page 122. A real time view of activity on user portals. For more information, refer to the Advanced Firewall Operations Guide. A real time view of recent instant messaging conversations. For more information, see Realtime Instant Messaging on page 114. Displays a real time bar graph of the bandwidth being used. For more information, refer to the Advanced Firewall Operations Guide. 8 Smoothwall Ltd

19 Advanced Firewall Overview Logs Pages System Firewall IPSec IDS IPS IM proxy Web proxy Reverse proxy Log settings Simple logging information for the internal system services. For more information, refer to the Advanced Firewall Operations Guide. Displays all data packets that have been dropped or rejected by the firewall. For more information, refer to the Advanced Firewall Operations Guide. Displays diagnostic information for VPN tunnels. For more information, see IPSec Logs on page 120. Displays sender, recipient, subject and other message information. For more information, see Logs on page 122. Displays network traffic detected by the intrusion detection system (IDS). For more information, see IDS Logs on page 124. Displays network traffic detected by the intrusion detection system (IPS). For more information, see IPS Logs on page 125. Displays information on instant messaging conversations. For more information, see IM Proxy Logs on page 126. Displays detailed analysis of web proxy usage. For more information, see Web Proxy Logs on page 63. Displays information on reverse proxy usage. For more information, see Reverse Proxy Logs on page 127. Settings to configure the logs you want to keep, an external syslog server, automated log deletion and rotation options. For more information, refer to the Advanced Firewall Operations Guide. Settings Pages Datastore settings Groups Output settings Contains settings to manage the storing of log files. For more information, refer to the Advanced Firewall Operations Guide. Where you create groups of users which can be configured to receive automated alerts and reports. For more information, refer to the Advanced Firewall Operations Guide Settings to configure the to SMS Gateway and SMTP settings used for delivery of alerts and reports. For more information, refer to the Advanced Firewall Operations Guide. 9

20 Advanced Firewall Overview Networking The Networking section contains the following sub-sections and pages: Filtering Pages Zone bridging Group bridging IP block Used to define permissible communication between pairs of network zones. For more information, see About Zone Bridging Rules on page 75. Used to define the network zones that are accessible to authenticated groups of users. For more information, see Group Bridging on page 80. Used to create rules that drop or reject traffic originating from or destined for single or multiple IP addresses. For more information, see Creating IP Blocking Rules on page 67. Routing Pages Subnets RIP Sources Ports Used to generate additional routing information so that the system can route traffic to other subnets via a specified gateway. For more information, see Creating Subnets on page 47. Used to enable and configure the Routing Information Protocol (RIP) service on the system. For more information, see Using RIP on page 49. Used to determine which external network interface will be used by internal network hosts for outbound communication when a secondary external connection is active. For more information, see Sources on page 51. Used to create rules to set the external interface based on the destination port. For more information, see Ports on page Smoothwall Ltd

21 Advanced Firewall Overview Interfaces Pages Interfaces Internal aliases External aliases Connectivity PPP Secondaries Configure and display information on your Advanced Firewall s internal interfaces. For more information, see Configuring Global Settings for Interfaces on page 26. Used to create aliases on internal network interfaces, thus enabling a single physical interface to route packets between IP addresses on a virtual subnet without the need for physical switches. For more information, see Working with Secondary External Interfaces on page 56. Used to create IP address aliases on static Ethernet external interfaces. External aliases allow additional static IPs that have been provided by an ISP to be assigned to the same external interface. For more information, see Creating an External Alias Rule on page 54. Used to create external connection profiles and implement them. For more information, see Connecting Using a Static Ethernet Connectivity Profile on page 27. Used to create Point to Point Protocol (PPP) profiles that store PPP settings for external connections using dial-up modem devices. For more information, see Creating a PPP Profile on page 40. Used to configure an additional, secondary external interface. For more information, see Working with Secondary External Interfaces on page 56 Firewall Pages Port forwarding Source mapping Advanced Used to forward incoming connection requests to internal network hosts. For more information, see Introduction to Port Forwards Inbound Security on page 83. Used to map specific internal hosts or subnets to an external alias. For more information, see Creating a Source Mapping Rule on page 55 Used to enable or disable NAT-ing helper modules and manage bad external traffic. For more information, see Network Application Helpers on page

22 Advanced Firewall Overview Outgoing Pages Policies Ports External services Used to assign outbound access controls to IP addresses and networks. For more information, see Working with Outbound Access Policies on page 93. Used to define lists of outbound destination ports and services that should be blocked or allowed. For more information, see Managing Outbound Traffic and Services on page 89. Used to define a list of external services that should always be accessible to internal network hosts. For more information, see Managing External Services on page 96. Settings Pages Port groups Advanced Create and edit groups of ports for use throughout Advanced Firewall. For more information, see Working with Port Groups on page 72. Used to configure advanced network and traffic auditing parameters. For more information, see Configuring Advanced Networking Features on page 69. Services The Services section contains the following sub-sections and pages: 12 Smoothwall Ltd

23 Advanced Firewall Overview Authentication Pages Settings Directories Groups Temporary bans User activity SSL login Kerberos keytabs BYOD Used to set global login time settings. For more information, see Configuring Global Authentication Settings on page 174. Used to connect to directory servers in order to retrieve groups and apply network and web filtering permissions and verify the identity of users trying to access network or Internet resources. For more information, see About Directory Servers on page 175. Used to customize group names. For more information, see Managing Groups of Users on page 186. Enables you to manage temporarily banned user accounts. For more information, see Managing Temporarily Banned Users on page 189. Displays the login times, usernames, group membership and IP address details of recently authenticated users. For more information, see Managing User Activity on page 191. Used to customize the end-user SSL login page and configure SSL login redirection and exceptions. For more information, see About SSL Authentication on page 192. This is where Kerberos keytabs are imported and managed. For more information, see Managing Kerberos Keytabs on page 196. Enables you to authenticate users with their own devices and allow them to connect to the network. For more information, refer to the Advanced Firewall Operations Guide. User Portal Pages Portals Group access User access This page enables you to configure and manage user portals. For more information, refer to the Advanced Firewall Operations Guide. This page enables you to assign groups of users to portals. For more information, refer to the Advanced Firewall Operations Guide. This page enables you to override group settings and assign a user directly to a portal. For more information, refer to the Advanced Firewall Operations Guide. 13

24 Advanced Firewall Overview Proxies Pages Web proxy Instant messenger SIP FTP Reverse proxy Used to configure and enable the web proxy service, allowing controlled access to the Internet for local network hosts. For more information, see Managing the Web Proxy Service. Used to configure and enable instant messaging proxying. For more information, see Instant Messenger Proxying on page 41. Used to configure and enable a proxy to manage Session Initiated Protocol (SIP) traffic. For more information, see SIP Proxying on page 43. Used to configure and enable a proxy to manage FTP traffic. For more information, see FTP Proxying on page 46. The reverse proxy service enables you to control requests from the Internet and forward them to servers in an internal network. For more information, see Reverse Proxy Service on page 50. SNMP Pages SNMP Used to activate Advanced Firewall s Simple Network Management Protocol (SNMP) agent. For more information, refer to the Advanced Firewall Operations Guide. DNS Pages Static DNS DNS proxy Dynamic DNS Used to create a local hostname table for the purpose of mapping the hostnames of local network hosts to their IP addresses. For more information, see Adding Static DNS Hosts on page 54. Used to provide a DNS proxy service for local network hosts. For more information, see Enabling the DNS Proxy Service on page 55 Used to configure access to third-party dynamic DNS service providers. For more information, see Managing Dynamic DNS on page Smoothwall Ltd