User Guide Version 9 Document version /03/2007

Transcription

1 User Guide Version 9 Document version /03/2007

2 2 Cyberoam User Guide IMPORTANT NOTICE Elitecore has supplied this Information believing it to be accurate and reliable at the time of printing, but is presented without warranty of any kind, expressed or implied. Users must take full responsibility for their application of any products. Elitecore assumes no responsibility for any errors that may appear in this document. Elitecore reserves the right, without notice to make changes in product design or specifications. Information is subject to change without notice. USER S LICENSE The Appliance described in this document is furnished under the terms of Elitecore s End User license agreement. Please read these terms and conditions carefully before using the Appliance. By using this Appliance, you agree to be bound by the terms and conditions of this license. If you do not agree with the terms of this license, promptly return the unused Appliance and manual (with proof of payment) to the place of purchase for a full refund. LIMITED WARRANTY Software: Elitecore warrants for a period of ninety (90) days from the date of shipment from Elitecore: (1) the media on which the Software is furnished will be free of defects in materials and workmanship under normal use; and (2) the Software substantially conforms to its published specifications except for the foregoing, the software is provided AS IS. This limited warranty extends only to the customer as the original licenses. Customers exclusive remedy and the entire liability of Elitecore and its suppliers under this warranty will be, at Elitecore or its service center s option, repair, replacement, or refund of the software if reported (or, upon, request, returned) to the party supplying the software to the customer. In no event does Elitecore warrant that the Software is error free, or that the customer will be able to operate the software without problems or interruptions. Elitecore hereby declares that the anti virus and anti spam modules are powered by Kaspersky Labs and the performance thereof is under warranty provided by Kaspersky Labs. It is specified that Kaspersky Lab does not warrant that the Software identifies all known viruses, nor that the Software will not occasionally erroneously report a virus in a title not infected by that virus. Hardware: Elitecore warrants that the Hardware portion of the Elitecore Products excluding power supplies, fans and electrical components will be free from material defects in workmanship and materials for a period of One (1) year. Elitecore's sole obligation shall be to repair or replace the defective Hardware at no charge to the original owner. The replacement Hardware need not be new or of an identical make, model or part; Elitecore may, in its discretion, replace the defective Hardware (or any part thereof) with any reconditioned product that Elitecore reasonably determines is substantially equivalent (or superior) in all material respects to the defective Hardware. DISCLAIMER OF WARRANTY Except as specified in this warranty, all expressed or implied conditions, representations, and warranties including, without limitation, any implied warranty or merchantability, fitness for a particular purpose, non-infringement or arising from a course of dealing, usage, or trade practice, and hereby excluded to the extent allowed by applicable law. In no event will Elitecore or its supplier be liable for any lost revenue, profit, or data, or for special, indirect, consequential, incidental, or punitive damages however caused and regardless of the theory of liability arising out of the use of or inability to use the product even if Elitecore or its suppliers have been advised of the possibility of such damages. In the event shall Elitecore s or its supplier s liability to the customer, whether in contract, tort (including negligence) or otherwise, exceed the price paid by the customer. The foregoing limitations shall apply even if the above stated warranty fails of its essential purpose. In no event shall Elitecore or its supplier be liable for any indirect, special, consequential, or incidental damages, including, without limitation, lost profits or loss or damage to data arising out of the use or inability to use this manual, even if Elitecore or its suppliers have been advised of the possibility of such damages. RESTRICTED RIGHTS Copyright 2000 Elitecore Technologies Ltd. All rights reserved. Cyberoam, Cyberoam logo are trademark of Elitecore Technologies Ltd. Information supplies by Elitecore Technologies Ltd. Is believed to be accurate and reliable at the time of printing, but Elitecore Technologies assumes no responsibility for any errors that may appear in this documents. Elitecore Technologies reserves the right, without notice, to make changes in product design or specifications. Information is subject to change without notice CORPORATE HEADQUARTERS Elitecore Technologies Ltd. 904 Silicon Tower, Off. C.G. Road, Ahmedabad , INDIA Phone: Fax: Web site:

3 3 Cyberoam User Guide Contents Guide Sets 6 Technical Support 7 Typographic Conventions 8 Preface 9 Guide Organization 10 Cyberoam Basics 11 Benefits of Cyberoam 11 Accessing Cyberoam 11 Accessing the Web Admin Console 13 Getting Started 16 Dashboard 18 Management 20 Setting up Zones 20 Create Zone 21 Setting up Users 22 Define Authentication 22 Define User 24 Setting up Groups 33 Firewall 38 Create Firewall rule 40 Manage Firewall 45 Host Management 55 Setting up Logon Pools 60 Traffic Discovery 62 Live Connections report 62 Today s Connection History 69 Policy Management 75 Surfing Quota policy 76 Access Time policy 80 Internet Access policy 84 Bandwidth policy 92 Data Transfer policy 107 SNAT Policy 111 DNAT Policy 115 Zone Management 118 Manage Zone 118 Delete Zone 119 Group Management 120 Manage Group 120 Delete Group 125 User Management 126 Search User 126 Live User 127 Manage User 128 Logon Pool Management 140 Search Node 140 Update Logon Pool 141

4 4 Cyberoam User Guide Delete Logon Pool 144 System Management 145 Configure Network 145 Configure DNS 145 Configure DHCP 147 View Interface details 148 Configuring Dynamic DNS service 149 PPPoE 151 Manage Gateway 154 DoS Settings 155 Bypass DoS Settings 159 Reset Console Password 161 System Module Configuration 162 SNMP 163 Cyberoam SNMP Implementation 164 Cyberoam MIB 165 Cyberoam Traps 168 Manage SNMP 169 Configure SNMP Agent 170 Create SNMP Community 171 Manage SNMP Community 171 Delete SNMP Community 172 Create SNMP V3 User 174 Manage SNMP V3 User 174 Delete SNMP V3 User 175 Manage Data 176 Client Services 182 Customize Access Deny messages 187 Upload Corporate logo 188 Customize Login message 189 HTTP Proxy Management 190 Manage HTTP Proxy 190 Configure HTTP Proxy 191 Set Default Internet Access Policy 192 Manage Servers 193 Monitoring Bandwidth Usage 194 Migrate Users 199 Migration from PDC server 199 Migration from External file 200 Customization 202 Schedule 202 Define Schedule 202 Manage Schedule 205 Delete Schedule 207 Services 208 Define Custom Service 208 Manage Custom Service 209 Delete Custom Service 210 Create Service Group 211 Update Service Group 212 Delete Service Group 213 Categories 214 Web Category 215 File Type Category 224

5 5 Cyberoam User Guide Application Protocol Category 228 Access Control 234 Syslog Configuration 236 Product Licensing & Updates 239 Product Version information 239 Upgrade Cyberoam 240 Licensing 243 Download 248 Clients 248 Documentation 249 Appendix A Audit Log 250 Appendix B Network Traffic Log Fields 256 Appendix C Web Categories 260 Appendix D Services 265 Appendix E Application Protocols 267 Menu wise Screen and Table Index 269

6 Guide Sets Guide User Guide Console Guide Windows Client Guide Linux Client Guide HTTP Client Guide Analytical Tool Guide LDAP Integration Guide ADS Integration Guide PDC Integration Guide RADIUS Integration Guide High Availability Configuration Guide Data transfer Management Guide Multi Link Manager User Guide Cyberoam Anti Virus Implementation Guide Cyberoam Anti Spam Implementation Guide VPN Management Describes Console Management Installation & configuration of Cyberoam Windows Client Installation & configuration of Cyberoam Linux Client Installation & configuration of Cyberoam HTTP Client Using the Analytical tool for diagnosing and troubleshooting common problems Configuration for integrating LDAP with Cyberoam for external authentication Configuration for integrating ADS with Cyberoam for external authentication Configuration for integrating PDC with Cyberoam for authentication Configuration for integrating RADIUS with Cyberoam for external authentication Configuration of High Availability (HA) Configuration and Management of user based data transfer policy Configuration of Multiple Gateways, load balancing and failover Configuring and implementing anti virus solution Configuring and implementing anti spam solution Implementing and managing VPN 6

7 7 Cyberoam User Guide Technical Support You may direct all questions, comments, or requests concerning the software you purchased, your registration status, or similar issues to Customer care/service department at the following address: Corporate Office elitecore Technologies Ltd. 904, Silicon Tower Off C.G. Road Ahmedabad Gujarat, India. Phone: Fax: Web site: Cyberoam contact: Technical support (Corporate Office): Web site: Visit for the regional and latest contact information.

8 Typographic Conventions Material in this manual is presented in text, screen displays, or command-line notation. Item Convention Example Server Client User Username Part titles Bold and shaded font typefaces Machine where Cyberoam Software - Server component is installed Machine where Cyberoam Software - Client component is installed The end user Username uniquely identifies the user of the system Report Topic titles Shaded font typefaces Introduction Subtitles Bold & Black typefaces Notation conventions Navigation link Bold typeface Group Management Groups Create it means, to open the required page click on Group management then on Groups and finally click Create tab Name of a particular parameter / field / command button text Cross references Lowercase italic type Hyperlink in different color Enter policy name, replace policy name with the specific name of a policy Or Click Name to select where Name denotes command button text which is to be clicked refer to Customizing User database Clicking on the link will open the particular topic Notes & points to remember Prerequisites Bold typeface between the black borders Bold typefaces between the black borders Note Prerequisite Prerequisite details 8

9 9 Cyberoam User Guide Preface Welcome to Cyberoam s - User guide. Cyberoam is an Identity-based UTM Appliance. Cyberoam s solution is purpose-built to meet the security needs of corporates, government organizations, and educational institutions. Cyberoam s perfect blend of best-of-breed solutions includes User based Firewall, Content filtering, Anti Virus, Anti Spam, Intrusion Detection and Prevention (IDP), and VPN. Cyberoam provides increased LAN security by providing separate port for connecting to the publicly accessible servers like Web server, Mail server, FTP server etc. hosted in DMZ which are visible the external world and still have firewall protection. This Guide helps you manage and customize Cyberoam to meet your organization s various requirements including creating groups and users and assigning policies to control internet access. Default Web Admin Console username is cyberoam and password is cyber It is recommended that you change the default password immediately after installation to avoid unauthorized access.

10 10 Cyberoam User Guide Guide Organization This Guide provides information regarding the administration, maintenance, and customization of Cyberoam. How do I search for relevant content? For help on how to perform certain task use Contents For help on a specific menu or screen function use Menu wise Screen and Table Index This Guide is organized into three parts: Part I Getting started It describes how to start using Cyberoam after successful installation. Part II Management It describes how to define groups and users to meet the specific requirements of your Organization. It also describes how to manage and customize Cyberoam. 1. Define Authentication process and firewall rule. 2. Manage Groups and Users. Describes how to add, edit and delete Users and User Groups 3. Manage & Customize Policies. Describes how to define and manage Surfing Quota policy, Access Time policy, Internet Access policy, Bandwidth policy and Data transfer policy 4. Manage Logon Pools. Describes how to add, edit and delete Logon Pools 5. Manage Cyberoam server Part III Customization Customize Services, Schedules and Categories. Describes how to create and manage Categories, Schedules and Services and Cyberoam upgrade process.

11 11 Cyberoam User Guide Cyberoam Basics Cyberoam is an Identity-based UTM Appliance. Cyberoam s solution is purpose-built to meet the security needs of corporates, government organizations, and educational institutions. Cyberoam s perfect blend of best-of-breed solutions includes Identity based Firewall, Content filtering, Anti Virus, Anti Spam, Intrusion Detection and Prevention (IDP), and VPN. Cyberoam provides increased LAN security by providing separate port for connecting to the publicly accessible servers like Web server, Mail server, FTP server etc. hosted in DMZ which are visible the external world and still have firewall protection. It also provides assistance in improving Bandwidth management, increasing Employee productivity and reducing legal liability associated with undesirable Internet content access. Benefits of Cyberoam 1. Boost Employee productivity by a. Blocking access to the sites like Gaming, Shopping, news, Pornography 2. Conserve bandwidth by a. Controlling access to non-productive site access during working hours b. Controlling rate of uploading & downloading of data 3. Load balancing over multiple links a. Improved User response time b. Failover solution c. Continuous availability of Internet d. Reduced bandwidth bottlenecks 5. Enforce acceptable Internet usage policies 6. Comprehensive, easy-to-use reporting tool enabling the IT managers to compile reports on Internet and other resources usage and consumption patterns Accessing Cyberoam Two ways to access Cyberoam: 1. Web Admin Console Managing Firewall rules Used for policy configuration Managing users, groups and policies Managing Bandwidth Viewing bandwidth graphs as well as reports 2. Telnet Console Used for Network and System configuration (setting up IP Addresses, setting up gateway) Managing Cyberoam application a) Using Console Interface via remote login utility TELNET b) Direct Console connection - attaching a keyboard and monitor directly to Cyberoam server Accessing Console via remote login utility - TELNET Access Cyberoam Console with the help of TELNET utility. To use TELNET, IP Address of the Cyberoam server is required. To start the TELNET utility: Click Start, and then click Run

12 12 Cyberoam User Guide In Open, type TELNET xxx.xxx.x.xxx Click OK, opens a console login window and prompts to enter Password Default password for Cyberoam TELNET console is admin. Screen - Console access Screen - Console login screen Accessing Console using SSH client Access Cyberoam Console using any of the SSH client. Cyberoam server IP Address is required. Start SSH client and create new Connection with the following parameters: Hostname - <Cyberoam server IP Address> Username admin Password admin

13 13 Cyberoam User Guide Accessing the Web Admin Console Cyberoam Web Admin Console (GUI) access requires Microsoft Internet Explorer 5.5+ or Mozilla Firefox 1.5+ and Display settings as True color (32 bits) Log on & log off from the Cyberoam Web Admin Console The Log on procedure verifies validity of user and creates a session until the user logs off. Log on procedure To get the log in window, open the browser and type IP Address in browser s URL box. A dialog box appears prompting you to enter username and password to log on. Use the default user name cyberoam and password cyber if you are logging in for the first time after installation. Asterisks are the placeholders in the password field. Log on Methods HTTP log in To open unencrypted login page, in the browser s Address box, type address of Cyberoam> Screen - HTTP login screen HTTPS log in Cyberoam provides secured communication method which encrypts the User log on information and which prevents unauthorized users from viewing the user information. For this, Cyberoam uses https protocol. The secure Hypertext Transfer Protocol (HTTPS) is a communication protocol designed to transfer encrypted information between computers over the World Wide Web. HTTPS is http using a Secure Socket Layer (SSL). A secure socket layer is an encryption protocol invoked on a Web server that uses HTTPS.

14 HTTPS protocol opens a secure hypertext transfer session with the specified site address. Cyberoam User Guide To open login over secure HTTP, type address of Cyberoam> Screen - HTTPS login Screen Elements Login User name Password Specify user login name. If you are logging on for the first time after installation, please use default username cyberoam Specify user account Password 14

15 Log on to Login button If you are logging on for the first time after installation, please use default password cyber To administer Cyberoam, select Web Admin Console Logs on to Web Admin Console Click Login Table - Login screen elements Web console Authorization and Access control By default, Cyberoam has four types of user groups: Administrator group Log in as Administrator group User to maintain, control and administer Cyberoam. Administrator group User can create, update and delete system configuration and user information. Administrator can create multiple administrator level users. Manager group Manager group User can only view the reports. User group User group User is the user who accesses the resources through Cyberoam. Clientless group Clientless User group User who can bypass Cyberoam Client login to access resources. Cyberoam itself takes care of login of this level user. For Administrators and Managers, IP address based access restriction/control can be implemented. Refer to Access Configuration to implement. Log out procedure To avoid un-authorized users from accessing Cyberoam, log off after you have finished working. This will end the session and exit from Cyberoam. 15

16 16 Cyberoam User Guide Getting Started Once you have configured network, you can start using Cyberoam. PART 1 1. Start monitoring Once you have installed Cyberoam successfully, you can monitor user activity in your Network. Depending on the Internet Access policy configured at the time of installation, certain categories will be blocked/allowed for LAN to WAN traffic with or without authentication. 2. View Cyberoam Reports Monitor your Network activities using Cyberoam Reports. To view Reports, log on to Reports from Web Admin Console using following URL: IP Address> To log on, use default username cyberoam and password cyber. View your organization s surfing pattern from Web Surfing Organization wise report View your organization s general surfing trends from Trends Web Trends report View your organization s Category wise surfing trends from Trends Category Trends report 3. Discover Network Application Traffic Detect your network traffic i.e. applications and protocols accessed by your users. To view traffic pattern of your network, log on to Cyberoam Web Management Console using following URL: IP Address> To log on, use default username cyberoam and password cyber. View amount of network traffic generated by various applications from Traffic Discovery Live Connections Application wise 4. Configure for User name based monitoring As Cyberoam monitors and logs user activity based on IP address, all the reports generated are also IP address based. To monitor and log user activities based on User names, you have to configure Cyberoam for integrating user information and authentication process. Integration will identify access request based on User names and generate reports based on Usernames. If your Network uses Active Directory Services and users are already created in ADS, configure Cyberoam to communicate your ADS. Refer to Cyberoam ADS Integration guide for more details. If your Network uses Windows Domain Controller, configure for Cyberoam to communicate with Windows Domain Controller. Refer to Cyberoam PDC Integration guide for more details.

17 17 Cyberoam User Guide 5. Customize Depending on the Internet Access configuration done at the time of installation, default firewall rules will be created. You can create additional firewall rules and other policies to meet your organization s requirement. Cyberoam allows you to: 1. Control user based per zone traffic by creating firewall rule. Refer to Firewall for more details. 2. Control individual user surfing time by defining Surfing quota policy. Refer to Policy Management- Surfing Quota policy for more details. 3. Schedule Internet access for individual users by defining Access time policy. Refer to Policy Management-Access time policy for more details. 4. Control web access by defining Internet Access policy. Refer to Policy Management-Internet Access policy for more details. 5. Allocate and restrict the bandwidth usage by defining Bandwidth policy. Refer to Policy Management-Bandwidth policy for more details. 6. Limit total as well as individual upload and/or download data transfer by defining data transfer policy. Refer Data transfer policy for more details.

18 18 Cyberoam User Guide Dashboard As soon as you logon to the Web Admin Console, Dashboard is displayed. Dashboard provides one solution to many analytical needs. Using the "dashboard" concept of information presentation, Cyberoam makes it easy to view access data from multiple perspectives, allowing management to identify patterns and potential areas of risk and productivity loss. It will empower organizations to plan, understand, integrate and leverage strategy all from a single page report. The goal of dashboard is to provide fast access to monitor and analyze employee Internet usage. As a result, managers gain an unprecedented ability to report on and manage a wide spectrum of the data and applications that employees use during their working hours. Dashboard is the answer to Why can't Cyberoam automatically show me things that will help me with what I'm doing, instead of making me search around for them? Dashboard is divided into following section: 1. HTTP Traffic Analysis 2. User Surfing pattern 3. Usage Summary 4. Recent Mail Viruses detected 5. Recent HTTP Viruses detected 6. Installation Information 7. System Resources 8. System Status 9. Installation Information 10. DoS attack status 11. Recent IDP Alerts 12. License Information 13. Gateway status

19 19

20 20 Cyberoam User Guide Management Setting up Zones PART 2 A Zone is a logical grouping of ports. Zones provide flexible layer of security for the firewall. With the zone-based security, the administrator can group similar ports and apply the same policies to them, instead of having to write the same policy for each interface. Default Zones Types LAN Depending on the appliance in use and on your network design, you can group one to six ports in this zone. Even though each interface will have a different network subnet attached to it, when grouped together they can be managed as a single entity. Group all the LAN networks under this zone. By default the traffic to and from this zone is blocked and hence the highest secured zone. However, traffic between ports belonging to the same zone will be allowed. DMZ (DeMilitarized Zone) - This zone is normally used for publicly accessible servers. Depending on the appliance in use and on your network design, you can group one to five ports in this zone. WAN This zone is used for Internet services. It can also be referred as Internet zone. Depending on the appliance in use and on your network design, you can group one to six ports in this zone. Local - This zone is the grouping of all the available ports of Cyberoam. Cyberoam provides single zone of each type. These are called System Zones. Administrator can add LAN and DMZ zone types. By default, entire traffic will be blocked except LAN to Local zone service likes Administration, Authentication and Network.

21 Create Zone Select System Zone Create to open the create page Screen - Create Zone Screen Elements Create Zone Zone Name Zone Type Specify name of the Zone Select zone type LAN Depending on the appliance in use and on your network design, you can group one to six ports in this zone. By default the traffic to and from this zone is blocked and hence the highest secured zone. DMZ (DeMilitarized Zone) - This zone is normally used for publicly accessible servers. Depending on the appliance in use and on your network design, you can group one to five ports in this zone. WAN This zone type is used for the Internet services. Only one WAN zone is allowed, hence you will not be able to create additional WAN zones. Multiple LAN is not possible if Cyberoam is placed deployed as Bridge Select Port It is not possible to add Zone if Cyberoam is placed deployed as Bridge Allows to bind port to the zone Available Ports list displays the list of ports that can be binded to the selected zone. Create button Use Right arrow button to move the selected ports to Member Port list. Specify zone description Saves the configuration and creates zone Table Create Zone 21

22 22 Cyberoam User Guide Setting up Users Define Authentication Cyberoam provides policy-based filtering that allows defining individual filtering plans for various users of your organization. You can assign individual policies to users (identified by IP address), or a single policy to number of users (Group). Cyberoam detects users as they log on to Windows domains in your network via client machines. Cyberoam can be configured to allow or disallow users based on username and password. In order to use User Authentication, you must select at least one database against which Cyberoam should authenticate users. Cyberoam supports user authentication against: an Active Directory an Windows Domain controller an LDAP server an RADIUS server an internal database defined in Cyberoam To filter Internet requests based on policies assigned, Cyberoam must be able to identify a user making a request. When the user attempts to access, Cyberoam requests a user name and password and authenticates the user's credentials before giving access. User level authentication can be performed using the local user database on the Cyberoam, an External ADS server, RADIUS server, LDAP or Windows Domain Controller. Integrate with ADS, LDAP or Domain Controller if external authentication is required. If your network uses an Active Directory service, configure Cyberoam to communicate with ADS. Refer to Cyberoam - ADS Integration Guide for details. If your network uses a Windows Domain controller, configure Cyberoam to communicate with Domain controller. Refer to Cyberoam - PDC Integration for details. If your Network uses LDAP, configure Cyberoam to communicate with LDAP server. Refer to Cyberoam LDAP Integration for details. If your Network uses RADIUS server, configure Cyberoam to communicate with RADIUS server. Refer to RADIUS Integration Guide for details. Cyberoam can prompt for user identification if your network does not use Windows environment. Refer to Cyberoam Authentication for details. Cyberoam Authentication When Cyberoam is installed in Non PDC environment, it is necessary to create users and groups in Cyberoam. Before users log on to Cyberoam, Administrator has to create all the users in Cyberoam, assign them to a Group and configure for Cyberoam authentication. Refer to Define Group and Define User for details on creating groups and users.

23 When user attempts to log on, Cyberoam server performs authentication i.e. User is authenticated directly by the Cyberoam server. Select User Authentication Settings to open configuration page Screen Cyberoam Authentication Screen Elements Configure Authentication & Integration parameters Integrate with Select Cyberoam as the authentication server Default Group Allows to select default group for users Update button Click Default Group list to select Updates and saves the configuration Table Cyberoam Authentication screen elements 23

24 Define User User Users are identified by an IP address or a user name and assigned to a group. All the users in a group inherit all the group policies. Refer to Policy Management to define new policies. User types Cyberoam supports three types of Users: 1. Normal 2. Clientless 3. Single Sign on Normal User has to logon to Cyberoam. Requires Cyberoam client (client.exe) on the User machine or user can use HTTP Client component and all the policy-based restriction can be applied. Clientless Does not require Cyberoam client component (client.exe) on the User machines. Symbolically represented as User name (C) Single Sign On If User is configured for Single Sign On, whenever User logs on to Windows, he/she is automatically logged to the Cyberoam. Symbolically represented as User name (S) Use the given decision matrix below to decide which type of the user should be created. Decision matrix for creation of User Feature Normal User Clientless User Single Sign on User User Login required Yes No No Type of Group Normal Clientless Yes No No Yes Yes No Apply Login restriction Yes Yes Yes Apply Surfing Quota policy Yes No No Apply Access Time policy Yes No No Apply Bandwidth policy Yes Yes Yes Apply Internet Access policy Yes Yes Yes Apply Data Transfer policy Yes No Yes Table - Create User - Decision matrix 24