GlobalSCAPE DMZ Gateway v3.1

Transcription

1 GlbalSCAPE DMZ Gateway v3.1 User Guide Mdule fr EFT Server 6.3

2 GlbalSCAPE, Inc. (GSB) Address: 4500 Lckhill-Selma Rad, Suite 150 San Antni, TX (USA) Sales: (210) Sales (Tll Free): (800) Technical Supprt: (210) Web Supprt: GlbalSCAPE, Inc. All Rights Reserved Last Updated: April 1, 2011

3 Table f Cntents Intrductin t GlbalSCAPE DMZ Gateway... 5 Hw Des it Wrk?... 5 Technical Details... 6 DMZ Gateway Initializatin and Cnnectin Diagrams... 7 What's New in DMZ Gateway Installing DMZ Gateway System Requirements fr DMZ Gateway v Installing DMZ Gateway n a Windws System Installing DMZ Gateway n a nn-windws System Installing DMZ Gateway n RedHat r SuSE Linux 32-Bit r 64-Bit Installing DMZ Gateway n Ubuntu Linux 32-Bit r 64-Bit Slaris x86 32-Bit r 64-Bit Example f Installatin Prcess Activating DMZ Gateway Manually Registering and Deregistering the DMZ Gateway Server Daemn RedHat Enterprise Linux SuSE Linux Ubuntu Linux Slaris Upgrading r Repairing DMZ Gateway Uninstalling DMZ Gateway Uninstalling DMZ Gateway n a Windws System Uninstalling DMZ Gateway n a nn-windws System RedHat Enterprise Linux, SuSE Linux, r Slaris x86 32-Bit r 64-Bit Ubuntu Linux 32-Bit r 64-Bit Example f Uninstallatin Prcess n Slaris Administering DMZ Gateway DMZ Gateway Cmpnents DMZ Gateway Server DMZ Gateway Server Service DMZ Gateway Administratin Interface DMZ Gateway System Files The DMZ Gateway Interface Starting the DMZ Gateway Server Service Specifying the Listening IP Addresses What Des This Mean fr the Peer Server Listeners? What Des This Mean fr the Client Listeners? Creating a Prfile Renaming a Prfile Deleting a Prfile Editing a Prfile Cntrlling Access by IP Address iii

4 DMZ Gateway User Guide Managing the DMZ Gateway Server Service Viewing Statistics Peer Ntificatin Channels Client Listeners Statistics DMZ Gateway Lgging DMZ Gateway Cmmunicatins Activity Lgging DMZ Gateway Server Diagnstics Lgging DMZ Gateway Server Service Diagnstics Lgging DMZ Gateway Statistics Lgging DMZ Gateway Server Event Viewer (Windws Operating Systems Only) DMZ Gateway Server Syslg (Slaris/Linux-based Operating Systems Only) DMZ Gateway Administratin Interface Lgging DMZ Gateway Administratin Diagnstics Lgging DMZ Gateway AdminLauncher Diagnstics Lgging Cmmunicating with EFT Server r Mail Express Server Enabling DMZ Gateway in EFT Server Cnfiguring the DMZ Gateway Cnnectin in Mail Express Ruting AS2 Traffic thrugh DMZ Gateway Using DMZ Gateway as an Outbund Prxy Testing the Cnfiguratin Trubleshting DMZ Gateway Cmmunicatin Interface Reference IP Access Exceptin Entry Dialg Bx New Prfile Wizard--Prfile name New Prfile Wizard--Peer Server Access New Prfile Wizard--Cnfiguratin Frequently Used Cmmands (nn-windws) License, Cpyrights, and Release Ntes Cpyright Infrmatin DMZ Gateway Release Ntes DMZ Gateway EULA iv

5 Intrductin t GlbalSCAPE DMZ Gateway GlbalSCAPE DMZ Gateway is designed t reside in the demilitarized zne and prvide secure cmmunicatin with a server behind intranet firewalls withut requiring any inbund firewall hles between the internal netwrk and the DMZ, and with n sensitive data stred in the DMZ, even temprarily. DMZ Gateway supprts cnnectins frm the server thrugh the use f Prfiles (depending n the license purchased). Hw Des it Wrk? Using EFT Server as an example f the server as illustrated belw, when a Site is started, EFT Server establishes an utbund cnnectin t the DMZ Gateway (1). This prprietary, nn-encrypted cnnectin is called the Peer Ntificatin Channel (PNC). EFT Server and DMZ Gateway use the PNC t setup subsequent cmmunicatins between EFT Server and incming client cnnectins. When a client (web brwser, FTP client, etc.) cnnects t the DMZ Gateway (2) n the pre-apprved prts (21, 22, , etc.), DMZ Gateway creates a new listener (3), called an ephemeral prt, and gives this prt and ther relevant infrmatin t EFT Server ver the PNC (4). EFT Server then generates a new utbund cnnectin (5) t the ephemeral prt created by the DMZ Gateway. Next, the DMZ Gateway "glues" the incming client cnnectin tgether with EFT Server s new cnnectin (6), and frm that pint frward, the client s cmmunicatins are streamed thrugh the DMZ Gateway t EFT Server ver this cnnectin (7). 5

6 DMZ Gateway User Guide Technical Details The DMZ Gateway rutes all client data t the server ver the server-initiated scket withut any translatin r mdificatin t the packet s paylad. Thus, if the client is using HTTPS, then HTTPS traffic ges ver that streaming cnnectin. Unlike a netwrk hardware bridge/ruter device, the DMZ Gateway des nt "pass thrugh" mdified packets. The DMZ Gateway reads in a buffer full f data frm the client TCP/IP stream (~4KB) and then sends that data ver the server's TCP/IP scket. They are cmpletely different TCP/IP packets with different surce and destinatin lcatins; hwever, the paylad is NOT changed at all. The DMZ Gateway des nt frward client requests. The Peer Ntificatin Channel (PNC) is used fr brkering new incming client cnnectins using the prcess utlined abve. Once the incming client cnnectin and the server cnnectin are "glued" tgether, the client s requests are streamed thrugh the DMZ Gateway t the server. Bth external (DMZ Gateway clud facing) and internal (server-netwrk facing) listening prts are specified frm within the server fr each supprted (and enabled) prtcl. These prts can be the same r different (even fr the same prtcl). Once cnfigured t wrk with the DMZ Gateway, the server (when running) will always attempt t initiate, maintain, and if necessary recnnect t the DMZ Gateway server. N further administrative actin is required in the server t establish r maintain cmmunicatins after the initial setup. Frm the DMZ Gateway server perspective, if the PNC channel is brken, it will refuse new (and existing) client cnnectins until the server re-establishes a cnnectin. The server peridically queries the DMZ Gateway. If a reply is nt received within 10 secnds, the server cnsiders the cnnectin lst, severs the current cnnectin, and then attempts t recnnect. The DMZ Gateway als maintains its wn awareness (ping/png) f whether the server is cnnected. Every 30 secnds, DMZ Gateway determines whether it has received a png message frm the server since the last ping. If it has, it will ping again; if nt, it drps the cnnectin. This allws it t free up prts if the server is nt available (n lnger respnds t ping) and fr errr reprting. (Refer t the Knwledge Base article "Hw d EFT Server and DMZ Gateway Server cmmunicate with each ther?" fr infrmatin abut changing these defaults in EFT Server 6.2 and later and DMZ Gateway 3.0 and later.) DMZ Gateway perfrms client impersnatin, which means nne f the sckets created via the DMZ Gateway have the DMZ Gateway IP address and prt; instead, all sckets created thrugh the DMZ Gateway have the IP address and prt f the client cnnectin. This results in the server s lgs shwing the actual cnnecting client IP addresses and prts, rather than thse f the DMZ Gateway. Because the client cnnectin is streamed thrugh the DMZ Gateway t the server, user authenticatin is handled by the server, as if the client were lgging in directly t the server frm the internal netwrk. With EFT Server, the DMZ Gateway can restrict incming server PNC cnnectins based upn IP address. The DMZ Gateway can als restrict incming client cnnectins via the IP address ban feature. Any IP addresses banned (manually r autmatically) in EFT Server will als be banned by the DMZ Gateway. The server and DMZ Gateway PNC cnnectin des nt emply username and passwrd credentials. There is nthing sensitive cntained in the PNC ntificatins that requires encryptin. 6

7 DMZ Gateway Initializatin and Cnnectin Diagrams The diagrams belw illustrate the initializatin and cnnectin sequences fr DMZ Gateway and EFT Server cmmunicatin. 7

8 DMZ Gateway User Guide 8

9 What's New in DMZ Gateway 9

10 DMZ Gateway User Guide 10

11 What's New in DMZ Gateway 11

12 DMZ Gateway User Guide What's New in DMZ Gateway DMZ Gateway was cmpletely rebuilt fr versin 3. DMZ Gateway can nw be installed nt nly n Windws, but als n RedHat, SuSE Linux, and Slaris, n 32-Bit r 64-Bit perating systems. (Fr a list f supprted perating systems, refer t System Requirements fr DMZ Gateway.) Other changes include: Can cnnect t up t 15 EFT Server Sites simultaneusly Can cnnect t Mail Express Server IP address access plicy changes are nw autmatically prpagated t DMZ Gateway when the plicy is mdified in EFT Server whether in the EFT Server interface r by the aut-ban lgic DMZ Gateway's interface was cmpletely redesigned t accmmdate multiple prfiles and extended cmmunicatin infrmatin Mved DMZ Gateway licensing t the server t simplify DMZ Gateway installatin and activatin Lgging was imprved and expanded Hardened t better withstand attacks frm several Denial f Service (DS) attack tls 12

13 Installing DMZ Gateway The tpics in this sectin prvide instructins fr installing DMZ Gateway. System Requirements fr DMZ Gateway Installing DMZ Gateway n Windws Systems Installing DMZ Gateway n nn-windws Systems Activating DMZ Gateway Manually Registering and Deregistering the DMZ Gateway Server Daemn Upgrading r Repairing DMZ Gateway Uninstalling DMZ Gateway System Requirements fr DMZ Gateway v3 The GlbalSCAPE Quality Assurance team tests ur prducts with a variety f perating systems, sftware, and hardware. It is pssible fr DMZ Gateway t functin with ther perating systems, sftware, and hardware, but is nly tested and apprved fr use with the fllwing: Accepts incming cnnectins frm EFT Server Enterprise v6.2 and later, and EFT Server 6.2 and later. (Versins prir t v6.2 require DMZ Gateway v2) Accepts incming cnnectins frm Mail Express Server v3 and later Supprted perating systems: Windws Server bit and 64-bit Windws Server 2008 R1&R2 32-bit and 64-bit Red Hat Enterprise Linux release bit and 64-bit SuSE Linux Enterprise Server release bit and 64-bit Ubuntu 8.04LTS Server Editin 32-bit and 64-bit Slaris 10 10/09 32-bit and 64-bit x86-cmpatible prcessr (Itanium 64-bit prcessrs are nt supprted) 1GB memry 1024x768 reslutin r higher display (headless cmputer supprted n nn-windws systems) Remte administratin must be available. On Slaris and Linux-based systems, the administratin interface will perate lcally; therefre, yu must: Exprt the display t a remte X-Server t access the user interface. Make available n the DMZ Gateway cmputer the subset f X11 libraries necessary fr exprting the display. Prperly cnfigure a remte X11 server. The DMZ Gateway Server may be manually cnfigured withut the use f the administratin interface. 13

14 DMZ Gateway User Guide Installing DMZ Gateway n a Windws System DMZ Gateway and the cnnecting server must be installed n separate cmputers. Fr details f installing DMZ Gateway in a cluster cnfiguratin, refer t If a previus prduct versin is installed, the installer prmpts yu t uninstall the previus versin befre installing the new versin. T install DMZ Gateway 1. Clse all unnecessary applicatins s that the installer can update system files withut rebting the cmputer. 2. Start the installer. The Welcme page appears. 3. Click Next. The License Agreement appears. 4. Read the license, then click I Agree. 14

15 Installing DMZ Gateway 5. If an existing installatin is detected, refer t Upgrading r Repairing DMZ Gateway. Otherwise, the Chse Installatin Lcatin page appears. 6. The Destinatin Flder bx displays the default lcatin. Keep the default displayed in the bx r click Brwse t specify a different lcatin. Als displayed is the amunt f hard drive space required t install the prgram. 7. Click Next. The Chse Cnfiguratin Lcatin page appears. 8. In the Cnfiguratin Flder bx, specify the path at which t stre cnfiguratin files fr DMZ Gateway. The installatin lcatin is specified by default, but yu can specify a separate lcatin fr backup and disaster recvery r fr shared resurces, such as with a cluster envirnment. 9. Click Next. The shrtcuts page appears. 15

16 DMZ Gateway User Guide A shrtcut t pen the DMZ Gateway interface will be installed n the Start menu in a flder called GlbalSCAPE. Yu can keep this default lcatin r specify a different lcatin in which t install the shrtcut. 10. Click Install. The prduct is installed and the installatin lg appears. 11. Click Next. The cmpleted page appears. 16

17 Installing DMZ Gateway The Start the Administratin Interface, Create a desktp shrtcut, and Start the DMZ Gateway Server service check bxes are selected by default. Select the Shw versin histry check bx if yu want t read the release ntes. (Yu can als access the release ntes in the installatin flder.) 11. Click Finish. If yu left the Start the Administratin Interface check bx selected, the DMZ Gateway Administratin Interface appears. A default Prfile is defined using the IP address f the cmputer n which yu installed DMZ Gateway and the default prt f Refer t Editing a Prfile t change the IP address/prt assignments. Refer t Creating a Prfile t create new/additinal Prfiles. Refer t Cntrlling Access by IP Address t specify which IP addresses r IP masks are allwed r denied cnnectins. Installing DMZ Gateway n a nn-windws System The installatin prcess n each nn-windws perating system is basically the same with a few minr differences. The basic prcess f installatin can be described as fllws: 1. Cpy the apprpriate installer archive file (.tgz) t the target machine. 2. Extract the cntents f the installer archive. The archive cntains 2 files: an installatin script and an archive f the actual prgram files. 3. Run the installatin script as rt and fllw the prmpts. The prcess fr supprted nn-windws perating systems is described belw. (Fr installatin n Windws systems, refer t Installing DMZ Gateway.) The installatin script includes registering and starting the DMZ Gateway server daemn (cnfiguring it t aut-start n system start and aut-stp n system stp). Alternately, yu can start the server manually using the cmmand <InstallDir>/bin/dmzgatewayd start. Refer t Manually Registering and Deregistering the DMZ Gateway Server Daemn if yu decide nt t register the daemn during the installatin prcess. 17

18 DMZ Gateway User Guide Installing DMZ Gateway n RedHat r SuSE Linux 32-Bit r 64-Bit T install DMZ Gateway 1. Transfer the DMZ Gateway Linux x86 installer archive t a cnvenient directry n the target machine. 2. On the target machine, pen a terminal windw. The installatin package must be run with rt privileges. If nt already lgged n as the rt user, change t rt using the su cmmand in the terminal windw: su 3. Change t the directry cntaining the installer archive and perfrm the fllwing: On 32-bit systems: gunzip dmz-gateway-linux-x86-32.tgz tar xvf dmz-gateway-linux-x86-32.tar./install.sh On 64-bit systems: gunzip dmz-gateway-linux-x86-64.tgz tar xvf dmz-gateway-linux-x86-64.tar./install.sh 4. Fllw the prmpts t cmplete the installatin. Yu will be prmpted t accept the license agreement, and t specify the installatin and cnfiguratin directries (e.g., /pt/dmzgateway), etc. After everything is installed, yu will prmpted t register and start the DMZ Gateway daemn service. If yu start the service, yu can execute the DMZ Gateway Administratin interface script (e.g., type: /pt/dmzgateway/bin/dmzgatewayadmin). Refer t the example belw fr details f the installatin prcess. Installing DMZ Gateway n Ubuntu Linux 32-Bit r 64-Bit T install DMZ Gateway 1. Transfer the DMZ Gateway installer archive int a cnvenient directry n the target machine. 2. On the target machine, pen a terminal windw. 3. Change t the directry cntaining the installer archive and perfrm the fllwing: gunzip dmz-gateway-linux-x86-32.tgz (r dmz-gateway-linux-x86-64.tgz) tar xvf dmz-gateway-linux-x86-32.tar (r dmz-gateway-linux-x86-64.tar) sud./install.sh 4. Fllw the prmpts t cmplete the installatin. Yu will be prmpted t accept the license agreement, and t specify the installatin and cnfiguratin directries (by default, /pt/dmzgateway), etc. After everything is installed, yu will prmpted t register and start the DMZ Gateway daemn service. 18

19 Installing DMZ Gateway If yu start the service, yu can execute the DMZ Gateway Administratin interface script (e.g., type: /pt/dmzgateway/bin/dmzgatewayadmin). Refer t the example belw fr details f the installatin prcess. Slaris x86 32-Bit r 64-Bit T install DMZ Gateway 1. Transfer the DMZ Gateway installer archive t a cnvenient directry n the target machine. 2. On the target machine, pen a terminal windw. The installatin package must be run with rt privileges. If nt already lgged n as the rt user, change t rt using the su cmmand in the terminal windw: su 3. Change t the directry cntaining the installer archive and perfrm the fllwing: gunzip dmz-gateway-slaris-x86-32.tgz tar xvf dmz-gateway-slaris-x86-32.tar./install.sh 4. Fllw the prmpts t cmplete the installatin. Yu will be prmpted t accept the license agreement, and t specify the installatin and cnfiguratin directries (e.g., /pt/dmzgateway), etc. After everything is installed, yu will prmpted t register and start the DMZ Gateway daemn service. If yu start the service, yu can execute the DMZ Gateway Administratin interface script (e.g., type: /pt/dmzgateway/bin/dmzgatewayadmin). Refer t the example belw fr details f the installatin prcess. Example f Installatin Prcess Belw is an example f executing the Install.sh script n a Slaris x86 32-bit cmputer. == License Agreement == OMITTED End-user License Agreement D yu agree t the abve license terms? [yes r n]: yes [ENTER] == Chse Install Lcatin == Please specify the path int which the DMZ Gateway prgram files will be installed r press "Enter" t accept the default. Specify installatin directry [/pt/dmzgateway]: [ENTER] == Chse Cnfiguratin Lcatin == Please specify the path in which t stre the DMZ Gateway Server cnfiguratin settings r press "Enter" t accept the default. Specify cnfiguratin directry [/pt/dmzgateway]: /exprt/hme/appdata [ENTER] == Chse Installatin Owner == Please specify the user accunt name t use as the wner f the installed files. Specify wner [rt]: [ENTER] == Chse Installatin Grup == Please specify the user grup name t use as the grup f the installed files. 19

20 DMZ Gateway User Guide Specify grup [rt]: [ENTER] == Cnfirm Settings == Installatin directry: /pt/dmzgateway Cnfiguratin directry: /exprt/hme/appdata Installatin wner: rt Installatin grup: rt Are these settings crrect? [yes r n]: yes [ENTER] Creating directry "/pt/dmzgateway" Creating directry "/exprt/hme/appdata" Unpacking archive... Extracting files... OMITTED - Extracted Prgram File List Unpacking JRE... Extracting JRE... OMITTED - Extracted Java Runtime Envirnment File List Remving temprary files... Updating permissins... Updating wnership... Updating cnfiguratin file... == Register Service == The installatin script can attempt t register the DMZ Gateway Server daemn service (dmzgatewayd) fr autmatic startup and shutdwn. Register the DMZ Gateway Server daemn service? [yes r n]: yes Creating symblic link "/etc/init.d/dmzgatewayd"... Registering system daemn... ln -sf /etc/init.d/dmzgatewayd /etc/rc0.d/k99dmzgatewayd ln -sf /etc/init.d/dmzgatewayd /etc/rc1.d/k99dmzgatewayd ln -sf /etc/init.d/dmzgatewayd /etc/rc2.d/s99dmzgatewayd ln -sf /etc/init.d/dmzgatewayd /etc/rc3.d/s99dmzgatewayd == Start Service == The installatin script can attempt t start the DMZ Gateway Server daemn service (dmzgatewayd). Start the DMZ Gateway Server daemn service? [yes r n]: yes [ENTER] Executing: /etc/init.d/dmzgatewayd start -n Starting DMZ Gateway Server... == Installatin Cmplete == The GlbalSCAPE, Inc. DMZ Gateway is nw installed. The DMZ Gateway Server daemn service may be cntrlled using the "dmzgatewayd" script: /pt/dmzgateway/bin/dmzgatewayd The DMZ Gateway Administratin Interface may be started using the script: /pt/dmzgateway/bin/dmzgatewayadmin 20

21 Installing DMZ Gateway Activating DMZ Gateway DMZ Gateway licensing is activated in the cnnecting server, nt DMZ Gateway, which accepts cnnectins frm any licensed server. Fr example, a Single-Site license enables ne EFT Server Site r a Mail Express Server t cnnect t any available DMZ Gateway. A Multi-Site license enables ne r mre Sites frm EFT Server Enterprise t cnnect t any available DMZ Gateway. DMZ Gateway allws up t 15 Prfile definitins t manage cnnectins, but the license installed n the cnnecting server determines hw many cnnectins the server is allwed t make t DMZ Gateway. After the 30-day trial has expired, yu must activate DMZ Gateway by activating the serial number in the cnnecting server's administratin interface. Refer t the EFT Server r Mail Express dcumentatin fr details f activating DMZ Gateway. Manually Registering and Deregistering the DMZ Gateway Server Daemn During the installatin prcess, yu are prmpted t register the DMZ Gateway server daemn (cnfiguring it t aut-start n system start and aut-stp n system stp). If yu chse nt t register the daemn during the installatin prcess, use the prcedure belw t add r remve the DMZ Gateway Server daemn script, dmzgatewayd, frm autmatic system startup and shutdwn. There are multiple methds f cnfiguring a daemn script fr autmatic startup/shutdwn n Linux/Slaris. Ultimately, whatever methd is used typically results in the creatin f symblic links in the /etc/rc* directries. These scripts are called at different startup and shutdwn run levels f the perating system t start and stp the daemn. RedHat Enterprise Linux After creatin f the /etc/init.d/dmzgatewayd symblic link, the chkcnfig cmmand can be used t register and deregister the script fr system startup/shutdwn. T register the script The fllwing cmmand may be used as rt: chkcnfig --add dmzgatewayd (there are 2 dashes befre add) T deregister the script The fllwing cmmand may be used as rt: chkcnfig --del dmzgatewayd (there are 2 dashes befre del) SuSE Linux After creatin f the /etc/init.d/dmzgatewayd symblic link, the insserv cmmand can be used t register and deregister the script fr system startup/shutdwn. T register the script The fllwing cmmand may be used as rt: insserv dmzgatewayd T deregister the script The fllwing cmmand may be used as rt: insserv -r dmzgatewayd 21

22 DMZ Gateway User Guide Ubuntu Linux After creatin f the /etc/init.d/dmzgatewayd symblic link, the update-rc.d cmmand can be used t register and deregister the script fr system startup/shutdwn. T register the script The fllwing cmmand may be used as rt: update-rc.d dmzgatewayd defaults T deregister the script The /etc/init.d/dmzgatewayd symbl link must first be remved using the fllwing cmmand as rt: rm /etc/init.d/dmzgatewayd T deregister the daemn The fllwing cmmand may be used as rt: update-rc.d dmzgatewayd remve Slaris On Slaris, after creatin f the /etc/init.d/dmzgatewayd symblic link yu typically manually create the apprpriate symblic links in the /etc/rc* directries. T register the script The fllwing cmmands may be used as rt: ln -sf /etc/init.d/dmzgatewayd /etc/rc0.d/k99dmzgatewayd ln -sf /etc/init.d/dmzgatewayd /etc/rc1.d/k99dmzgatewayd ln -sf /etc/init.d/dmzgatewayd /etc/rc2.d/s99dmzgatewayd ln -sf /etc/init.d/dmzgatewayd /etc/rc3.d/s99dmzgatewayd T deregister the script Remve the symblic links as rt: rm /etc/rc0.d/k99dmzgatewayd rm /etc/rc1.d/k99dmzgatewayd rm /etc/rc2.d/s99dmzgatewayd rm /etc/rc3.d/s99dmzgatewayd Upgrading r Repairing DMZ Gateway Upgrades frm versin 2.x t versin 3 f the DMZ Gateway are supprted n Windws systems nly. T upgrade r repair DMZ Gateway n nn-windws systems Perfrm the standard installatin prcess fr the target perating system and use the same settings fr installatin path and cnfiguratin path. If the DMZ Gateway Server daemn service is running, yu are prmpted t stp it; if yu d nt stp it, the installer will abrt. T upgrade frm DMZ Gateway 2.x n Windws systems 1. Clse the Administratin interface. 2. As a precautin, back up the existing installatin directries and any ther files yu may have installed elsewhere. 22

23 Installing DMZ Gateway 3. Launch the installer. The installer will detect an existing installatin. After accepting the End-User License Agreement the fllwing dialg bx appears: Click ne f the fllwing, then click Next: Keep existing cnfiguratin and uninstall the lder versin Use a default cnfiguratin and uninstall the lder versin Fllw the prmpts t finish the upgrade. Refer t Installing DMZ Gateway, if necessary. During the upgrade prcess, the DMZ Gateway service Lg On As accunt is set t use the Lcal System accunt. T upgrade frm DMZ Gateway 3.x n Windws systems 1. Clse the Administratin interface. 2. Launch the installer. The installer will detect an existing installatin. 3. After accepting the End-User License Agreement the fllwing dialg bx appears: 23

24 DMZ Gateway User Guide 4. Click Upgrade DMZ Gateway, then click Upgrade. 5. Fllw the prmpts t finish the upgrade. Refer t Installing DMZ Gateway, if necessary. T reinstall DMZ Gateway 3.x n Windws systems 1. Clse the Administratin interface. 2. Launch the installer. The installer will detect an existing installatin. After accepting the End-User License Agreement the fllwing dialg bx appears: 3. Click Reinstall DMZ Gateway, then click Reinstall. 4. Fllw the prmpts t finish the reinstall. Refer t Installing DMZ Gateway, if necessary. Uninstalling DMZ Gateway The DMZ Gateway will prmpt yu if a previus versin f DMZ Gateway is installed and needs t uninstalled. Uninstalling DMZ Gateway n a Windws System Uninstall DMZ Gateway using Windws' Add/Remve Prgrams tl r via the shrtcut n the Start menu. Uninstalling DMZ Gateway n a nn-windws System The installatin prcess n each nn-windws perating system is basically the same with a few minr differences. The basic prcess f installatin can be described as fllws: Run the uninstallatin script as rt and fllw the prmpts. (The script is created during installatin and is <InstallDir>/bin/Uninstall.sh) 24

25 Installing DMZ Gateway RedHat Enterprise Linux, SuSE Linux, r Slaris x86 32-Bit r 64-Bit Yu can uninstall DMZ Gateway using the Uninstall.sh script lcated in the <InstallDir>/bin directry. T uninstall DMZ Gateway 1. On the target machine, pen a terminal windw. The uninstall script must be run with rt privileges. If nt already lgged n as the rt user, change t rt using the su cmmand in the terminal windw: su 2. Run the Uninstall.sh script: /<InstallDir>/bin/Uninstall.sh Fr example: /pt/dmzgateway/bin/uninstall.sh 3. Fllw the prmpts t cmplete uninstalling. Ubuntu Linux 32-Bit r 64-Bit Yu can uninstall DMZ Gateway using the Uninstall.sh script lcated in the <InstallDir>/bin directry. T uninstall DMZ Gateway n Ubuntu Linux 1. On the target machine, pen a terminal windw. 2. Run the Uninstall.sh script: sud /<InstallDir>/bin/Uninstall.sh Fr example: sud /pt/dmzgateway/bin/uninstall.sh 3. Fllw the prmpts t cmplete uninstalling. Example f Uninstallatin Prcess n Slaris The fllwing printut is a sample executin f the Uninstall.sh installatin script run n Slaris x bit. == Cnfirm Uninstallatin == The uninstallatin script will nw uninstall the DMZ Gateway frm the fllwing installatin directry: /pt/dmzgateway Prceed with uninstallatin? [yes r n]: yes [ENTER] == Stp Service == The installatin script has detected that the DMZ Gateway Server daemn service (dmzgatewayd) is currently running. The service must be stpped befre prceeding. The script can nw attempt t stp the service. Stp the DMZ Gateway Server daemn service? [yes r n]: yes [ENTER] 25

26 DMZ Gateway User Guide Executing: /etc/init.d/dmzgatewayd stp Stpping DMZ Gateway Server... Stpped DMZ Gateway Server. == Deregister Service == The installatin script can attempt t deregister the DMZ Gateway Server daemn service (dmzgatewayd) frm autmatic startup and shutdwn. Deregister the DMZ Gateway Server daemn service? [yes r n]: yes [ENTER] Remving /etc/init.d/dmzgatewayd symblic link... Deregistering system daemn: rm /etc/rc0.d/k99dmzgatewayd rm /etc/rc1.d/k99dmzgatewayd rm /etc/rc2.d/s99dmzgatewayd rm /etc/rc3.d/s99dmzgatewayd Remving installatin files... == Uninstallatin Cmplete == 26

27 Administering DMZ Gateway The tpics in this sectin prvide instructins fr administering DMZ Gateway. DMZ Gateway Cmpnents DMZ Gateway System Files The DMZ Gateway Administratin Interface Starting and Stpping the DMZ Gateway Server Service Specifying the Listening IP Addresses Creating a Prfile Renaming a Prfile Deleting a Prfile Editing a Prfile Cntrlling Access by IP Address Managing the DMZ Gateway Server Service Viewing Statistics DMZ Gateway Lgging DMZ Gateway Cmpnents DMZ Gateway cnsists f the fllwing cmpnents: The main server cmpnent, the DMZ Gateway Server A launch and mnitring cmpnent, the DMZ Gateway Server Service A cnfiguratin and mnitring cmpnent, the DMZ Gateway administratin interface DMZ Gateway Server The DMZ Gateway Server is the main Java-based functinality. An embedded Java Runtime Envirnment (JRE) is used t execute this functinality. (The JRE is installed with DMZ Gateway--yu d nt need t install r maintain the JRE.) The DMZ Gateway Server cmpnent is never executed directly, but rather cntrlled and mnitred using the DMZ Gateway Server Service cmpnent. DMZ Gateway Server Service The DMZ Gateway Server Service cmpnent is respnsible fr prperly initializing the JRE and launching the DMZ Gateway Server cmpnent. It then stays resident and prvides watchdg mnitring functinality ver the DMZ Gateway Server cmpnent. It als prvides lgging and diagnstic capabilities t facilitate trubleshting any pssible issues that may ccur during server startup. (Refer t DMZ Gateway Lgging fr detailed infrmatin.) DMZ Gateway Administratin Interface The DMZ Gateway Administratin Interface is a Java-based thick client that prvides graphical administratin capabilities fr the DMZ Gateway Server. The interface cmmunicates with the DMZ Gateway Server via a lcal-nly TCP/IP administratin prt. The administratin capabilities include: Creating and Cnfiguring Prfiles Viewing Statistics 27

28 DMZ Gateway User Guide Cntrlling the Server Service/Daemn DMZ Gateway System Files The fllwing file names can be bserved when running DMZ Gateway: On Windws Systems: In the Windws Services dialg bx: DMZ Gateway Server is the DMZ Gateway service. In the Task Manager: On Nn-Windws Systems: DMZGatewayServerService.exe launches and mnitrs the DMZ Gateway Server. DMZGatewayServer.exe is the DMZ Gateway Server. DMZGatewayAdmin.exe is the administratin interface. dmzgatewayd is the DMZ Gateway daemn. DMZGatewayServer is the DMZ Gateway Server. DMZGatewayAdmin is the DMZ Gateway administratin interface. Yu can view all running DMZ Gateway executables by typing: ps ef grep DMZGateway The DMZ Gateway Interface The DMZ Gateway interface is used fr mapping and viewing DMZ Gateway cnnectins. Prfiles are used t define cnnectins t DMZ Gateway. T pen the interface On Windws systems, duble-click the DMZ Gateway shrtcut n the desktp r Start menu. On nn-windws systems, after the server service has started, execute the DMZ Gateway administratin interface script (e.g., /pt/dmzgateway/bin/dmzgatewayadmin). The left pane displays each f the defined Prfiles in an expandable/cllapsible tree view. DMZ Gateway has a default Prfile fr which yu define the listening IP address and prt f the cnnecting server, and the IP address ban list. When DMZ Gateway cnnects, nly the default Prfile is displayed. The interface displays the cnfiguratin fr the last Prfile mdified r viewed the last time the interface was pened r the first (default) Prfile if n "last viewed" prfile value is available. 28

29 Administering DMZ Gateway In the default view, with All Prfiles selected, the right pane displays the status f the DMZ Gateway service and the status f the Prfile selected in the tree. When a Prfile is selected, the right pane displays cnfiguratin infrmatin in additin t status. Refer t Creating a Prfile fr infrmatin abut Prfile cnfiguratin. Refer t Cntrlling Access by IP Address fr infrmatin abut granting r denying access t a specific IP addresses r an IP mask. Refer t Managing the DMZ Gateway Server Service fr details f stpping and starting the DMZ Gateway server service. Refer t Viewing Statistics fr details f each f the tabs in the Status pane. Starting the DMZ Gateway Server Service Typically, the DMZ Gateway server service is cnfigured t start autmatically when the cmputer is started. When the DMZ Gateway administratin interface is launched, it determines whether the DMZ Gateway server service is running. If the DMZ Gateway server service is nt running, a prmpt appears asking if yu like t start the DMZ Gateway service. On Windws systems: When yu install DMZ Gateway, the service is cnfigured t start autmatically. Yu can start and stp the service in the Windws Services dialg bx and in the DMZ Gateway Administratin Interface. On nn-windws systems: The installatin script includes registering and starting the DMZ Gateway server daemn (cnfiguring it t aut-start n system start and aut-stp n system stp). Alternately, yu can start and stp the server manually using the cmmands <InstallDir>/bin/dmzgatewayd start and <InstallDir>/bin/dmzgatewayd stp. 29

30 DMZ Gateway User Guide In the DMZ Gateway administratin interface, yu can start and stp the service frm the Server menu r using the tlbar cntrls. Specifying the Listening IP Addresses Fr each DMZ Gateway Prfile, yu specify 2 IP addresses: 1. One address is used by client prgrams t cnnect. This is typically an external-facing address. When a Site cnfigured at a peer server cnnects t the DMZ Gateway ver the PNC, the DMZ Gateway reads the list f client prts cnfigured in the Site. These prts are then cmbined with the client IP Address and it is n these client IP address/site prt cmbinatins that the DMZ Gateway will listen fr client cnnectins. 2. The ther address specifies the IP address n which t listen fr cnnectins frm peer servers. The cmmunicatins established using this address is knwn as the Peer Ntificatin Channel r PNC. Typically this IP Address will be an internal-facing address. This address is cmbined with the cnfigured prt value and it is n this IP Address/prt cmbinatin that the DMZ Gateway will listen fr cnnectins frm peer servers. Each address is cnfigured by selecting the IP address t use frm a drp-dwn list in the Prfile Cnfiguratin. The list f IP address includes all IPv4 addresses present n the cmputer. Additinally, the list includes an All Available setting. IMPORTANT: All Available means that DMZ Gateway will listen n the IP address/prt cmbinatin ONLY IF that IP address/prt cmbinatin is nt already being used by anther Prfile. Prfiles cnfigured with an explicit IP address have precedence ver Prfiles cnfigured with All Available. What Des This Mean fr the Peer Server Listeners? Suppse yu have 3 IP addresses n the cmputer: IP 1, IP 2, and IP 3, and yu have 2 Prfiles: Prfile 1 and Prfile 2. Bth Prfiles are cnfigured t use the same Peer Server Listener Prt Prfile 1 is set t use All Available. Prfile 2 is set t use IP 2. Prfile 1 will listen n IP 1:54321 and IP 3:54321, and Prfile 2 will listen n IP 2: Nw, suppse yu delete Prfile 2, making IP 2:54321 available. The DMZ Gateway will detect this and update the cmmunicatins listeners s that Prfile 1 will nw listen n IP 1:54321, IP 2:54321, and IP 3: What Des This Mean fr the Client Listeners? Suppse yu have 3 IP addresses n the cmputer: IP 1, IP 2, and IP 3, and yu have 2 Prfiles: Prfile 1 and Prfile 2. Prfile 1 is set t use All Available and Prfile 2 is set t use IP 2. Nw suppse yu have 2 Sites cnfigured n EFT Server. Bth Sites are cnfigured t cnnect t the DMZ Gateway and use FTP prt 21. Site 1 is set t cnnect t Prfile 1, and Site 2 is set t cnnect t Prfile 2. Once bth Sites are cnnected, the DMZ Gateway will establish client listeners fr Site 1 n IP 1:21 and IP 3:21 (because Site 1 used Prfile 1, which uses all available IP/prt cmbinatins nt currently in use). Fr Site 2 the DMZ Gateway will establish a client listener n IP 2:21. 30

31 Administering DMZ Gateway Nw, if Site 2 shuld discnnect fr sme reasn (perhaps it was deleted), IP 2:21 is nw cnsidered available. The DMZ Gateway will detect this and update the cmmunicatins listeners s that Prfile 1 will listen fr client cnnectins n IP 1:21, IP 2:21, and IP 3:21. Refer t Creating a Prfile r Editing a Prfile fr mre infrmatin. Creating a Prfile Creating a new Prfile includes specifying the listening IP address fr incming clients, specifying the listening IP addresses and prt fr the cnnecting server, and specifying the IP addresses that are allwed r denied access. T create a new Prfile 1. D ne f the fllwing: In the Prfiles tree, right-click then click New Prfile. On the tlbar, click New Prfile. On the main menu, click Prfile > New. The New Prfile Wizard appears. 2. In the Prfile Name bx, prvide a unique name fr this Prfile. The name will appear in the interface, lgs, errr messages, and reprts. 3. Click Next. The Cnfiguratin page f the wizard appears. 31

32 DMZ Gateway User Guide 4. In the Listening IP fr incming Clients bx, click the dwn arrw t select an IP address r All Available. (Only the IP addresses defined n this cmputer appear in this bx.) 5. In the Listening IP fr Server bx, click the dwn arrw t select an IP address r All Available. (Only the IP addresses defined n this cmputer appear in this bx.) (All Available means that DMZ Gateway will listen n the IP address/prt cmbinatin ONLY IF that IP address/prt cmbinatin is nt already being used by anther Prfile. Prfiles cnfigured with an explicit IP address have precedence ver Prfiles cnfigured with All Available.) 6. In the Prt bx, prvide the prt number ver which cnnectins are allwed. The cnnectin will be refused if the prt is being used by anther DMZ Gateway/Site r if the IP address is n the IP address ban list. 7. Click Next. The Peer Server Access page appears. 8. All IP addresses are granted access by default. T grant r deny access t specific IP addresses (ptinal): 9. Click Granted access r Denied access. If mst IP addresses are allwed access, click Granted access, then add the exceptins. If mst IP addresses are denied access, click Denied access, then add the exceptins. 32

33 Administering DMZ Gateway Fr example, if yu want t allw nly and blck every ther IP address, click Denied access, click Add, then type in the IP Mask bx. This will deny access t all IP addresses except Click Add. The New IP Access Exceptin Entry dialg bx appears. 10. Specify the IP address r range f IP addresses t which yu are denying r granting access. Yu can use wildcards t select ranges f IP addresses. 11. Click OK t clse the dialg bx. 12. Click Finish. The IP Mask appears in the exceptin list. When yu make changes t DMZ Gateway Server, yu must stp and restart any Site cnnected t DMZ Gateway. Renaming a Prfile The Prfile name appears in statistics, lgs, messages, and reprts. Yu can change the name in the DMZ Gateway interface. T change the name f a Prfile 1. Click the Prfile in the tree, then d ne f the fllwing: Click the Prfile name again. Right-click the Prfile name, then click Rename Prfile. On the tlbar, click Rename Prfile. On the main menu, click Prfile > Rename. The name in the tree becmes editable. 2. Type a new name fr the tree, then press ENTER. Deleting a Prfile Yu can cnfigure multiple Prfiles. Yu can delete Prfiles that yu n lnger use, but yu cannt delete a Prfile if it is the nly Prfile. T delete a Prfile Click the Prfile in the tree, then d ne f the fllwing: Right-click the Prfile name, then click Delete Prfile. On the tlbar, click Delete Prfile. On the main menu, click Prfile > Delete Prfile. The Prfile is deleted frm the tree. 33

34 DMZ Gateway User Guide Editing a Prfile When yu create a new Prfile, yu define the listening IP address fr remte cnnecting clients, the listening IP address and prt fr the server inside yur netwrk, and any IP addresses exceptins. After the Prfile is created, yu can edit the Prfile's cnfiguratin as necessary. Yu can als rename r delete the Prfile. When yu make a change t a Prfile, befre yu click Apply, an asterisk appears in the tree next t the Prfile that yu are editing. T edit a Prfile 1. In the Navigatin pane, click the Prfile that yu want t edit. 2. In the Cnfiguratin pane, click the General tab. 3. D ne r mre f the fllwing: In the Listening IP fr incming Clients bx, click the dwn arrw t select a different IP address r All Available. (Only the IP addresses defined n this cmputer appear in this bx.) In the Listening IP fr Server bx, click the dwn arrw t select a different IP address r All Available. (Only the IP addresses defined n this cmputer appear in this bx.) In the Prt bx, prvide the prt number ver which cnnectins are allwed. (All Available means that DMZ Gateway will listen n the IP address/prt cmbinatin ONLY IF that IP address/prt cmbinatin is nt being used by anther Prfile. Prfiles cnfigured with an explicit IP address take precedence ver Prfiles cnfigured with All Available.) Yu must define a unique IP address/prt cmbinatin fr each Prfile. 4. In the Cnfiguratin pane, click the Access tab. 34

35 Administering DMZ Gateway 5. Specify the IP addresses r IP mask f servers that are allwed r denied access. 6. In the tlbar, click Apply Changes. If the IP address and prt pair are nt unique, an errr message appears; therwise, the DMZ Gateway will allw the server t cnnect. If yu have made multiple edits, yu can revert t the last-saved state by clicking Revert Changes (und) befre clicking Apply Changes. Hwever, nce yu click Apply Changes, yu cannt g back. Cntrlling Access by IP Address By default, all IP addresses are granted access t DMZ Gateway. Yu can grant access t nly ne specific IP address r a range f IP addresses, r deny access t ne specific address r a range f addresses. Yu can define up t 100 IP address masks. Fr example, if yu want t allw nly and blck every ther IP address, click Denied access, click Add, then type in the IP mask bx. This will deny access t all IP addresses except T grant/deny access by IP Address 1. In the Prfile tree, click the default Prfile r create a new prfile. 2. In the Cnfiguratin pane, click the Access tab. The exceptin list appears. 3. The Access tab displays the IP addresses that are granted r denied access. By default, all IP addresses are granted access, and n exceptins are displayed in the list. 35

36 DMZ Gateway User Guide 4. T cnfigure exceptins, click Granted access r Denied access. If mst IP addresses are allwed access, click Granted access, then add the exceptins (IP addresses that are nt allwed access). If mst IP addresses are denied access, click Denied access, then add the exceptins (IP addresses that are allwed access). 5. Click Add. The New IP Access Exceptin Entry dialg bx appears. 6. Specify the IP address r range f IP addresses t which yu are denying r granting access. Yu can use wildcards t select ranges f IP addresses. 7. Click OK The IP address/mask appears in the exceptins list. 8. Click Apply Changes t save the changes n DMZ Gateway. Managing the DMZ Gateway Server Service The status f the DMZ Gateway server service appears in the status bar at the bttm f the interface. (e.g., "DMZ Gateway is running.") Yu can start, pause, restart, r stp the DMZ Gateway service n the DMZ Gateway main menu r tlbar. T start the DMZ Gateway On the DMZ Gateway main menu, click Server > Start r click Start n the tlbar. T restart the DMZ Gateway On the DMZ Gateway main menu, click Server > Restart r click Restart n the tlbar. T stp the DMZ Gateway On the DMZ Gateway main menu, click Server > Stp r click Stp n the tlbar. Viewing Statistics In the DMZ Gateway administratin interface, yu can view a variety f statistics. Whether yu click All Prfiles r a specific Prfile, the Status area displays infrmatin abut Peer Ntificatin Channels and Client Listeners, as well as the size and speed f server and client data being transferred. Yur selectins persist acrss Prfiles; that is, if yu click the Client Listeners tab in Prfile 3, then click Prfile 2, the Client Listeners tab is selected in Prfile 2 als. The status "bubbles up" t the All Prfiles nde. Fr example, if there is a prblem in Prfile 1 causing the icn t turn yellw, the All Prfiles icn is als yellw. In the Prfile tree: A red icn indicates that an errr exists (e.g. prt cnflict frm external applicatin, IP address n lnger exists, etc). A yellw icn indicates that the DMZ Gateway service is running, but prt cnflicts exist between cnnected sites, when at least 2 Sites are cnnected. 36

37 Administering DMZ Gateway A green icn indicates that the DMZ Gateway Service is running and at least ne Site is cnnected. A gray icn indicates that there are n errrs and n Servers are cnnected. Peer Ntificatin Channels The Peer Ntificatin Channels tab f the Status panel displays the IP address, prt, active sites, active cnnectins, status, and status message fr a selected Prfile r All Prfiles. If All Prfiles is selected, a Prfile clumn displays the name f the applicable Prfile. (Fr mre abut Peer Ntificatin, refer t Intrductin t GlbalSCAPE DMZ Gateway.) The fllwing icns prvide an indicatin f status: Listening Inactive Warning Errr The fllwing clumns displayed n the tab can be srted by clicking the clumn header: IP address - IP address n which Peer Ntificatin Channels cmmunicate Prt - Prt n which Peer Ntificatin Channels cmmunicates Active Sites - Number f Sites cnnected t DMZ Gateway Active Cnnectins - Number f active cnnectins t DMZ Gateway Status - Active, Inactive, Warning Message - Mre infrmatin regarding status (e.g., Listening fr cnnectins, Prt already in use) Client Listeners The Client Listeners tab f the Status panel displays the PNC address, server IP address, server name, Site name, listener IP address/prt, status, and status message. If All Prfiles is selected, a Prfile clumn displays the name f the applicable Prfile. 37

38 DMZ Gateway User Guide The fllwing icns prvide an indicatin f status: Listening Inactive Warning Errr The fllwing clumns displayed n the tab can be srted by clicking the clumn header: Statistics PNC Address - IP address n which cnnecting clients cnnect t DMZ Gateway Server IP Address - IP address n which the server listens Server Name - user-assigned name f Server Server Type - Type f server, e.g., EFT Server, EFT Server Enterprise, Mail Express Server Site - User-assigned name f Site Listener IP Address - IP address f Listener (i.e., EFT Server Site r Mail Express) Listener Prt - Prt f Listener (i.e., EFT Server Site r Mail Express) Status - Active, Inactive, Errr, Warning Message - Mre infrmatin regarding status (e.g., Listening fr incming cnnectins, Unable t bind t prt, Listener creatin failure, Clsed, Inactive, Listener IP/Prt address already assigned) The Statistics tab f the Status panel displays the size and speed f server and client data being transferred. When All Prfiles is selected, the aggregated data sizes are displayed, and a Prfile clumn displays the name f the applicable Prfile. The Statistics tab is cnfigured by default t refresh autmatically every 15 secnds. Yu can change the refresh frequency r cnfigure the interface t nt refresh autmatically. Yu can als refresh the display manually. T change the refresh frequency, in the Refresh Interval bx, prvide a new interval, in secnds, then click Apply Refresh Interval. T prevent the interface frm refreshing autmatically, clear the Enable autmatic refresh check bx. T manually refresh the interface, click Refresh Nw. The fllwing clumns displayed n the tab can be srted by clicking the clumn header: Client Bytes Read/sec - Number f bytes received frm Clients 38

39 Administering DMZ Gateway Client Bytes Written/sec - Number f bytes sent t Clients Server Bytes Read/sec - Number f bytes received frm Servers Server Bytes Written/sec - Number f bytes sent t Servers Accepted Client Cnnectins - Number f successful client cnnectins. Rejected Client Cnnectins - Number f client cnnectins attempted that were rejected. DMZ Gateway Lgging All lgging functinality in DMZ Gateway cmes precnfigured with the ptimal settings. The infrmatin belw is prvided t help yu understand what is in the lgs. When necessary, mdifying the cnfiguratin fr the lgging functinality shuld nly be perfrmed with the aid f GlbalSCAPE Custmer Supprt. The fllwing lgs are created and ppulated during the peratin f DMZ Gateway: DMZ Gateway Cmmunicatins Activity Lg (DMZActivity.lg) DMZ Gateway Server Diagnstics Lg (DMZGatewayServer.lg) DMZ Gateway Server Service Diagnstics Lg (DMZGatewayServerService.lg) DMZ Gateway Statistics Lg (DMZStatistics.lg) DMZ Gateway Server Event Viewer (Windws Operating Systems Only) DMZ Gateway Server Syslg (Slaris/Linux-based Operating Systems Only) DMZ Gateway Cmmunicatins Activity Lgging The DMZ Gateway cmmunicatins activity lgging recrds messages relating t cmmunicatins t a W3C Extended Lg File-frmatted file. By default, this lg file is created as <installatin directry>\lgs\dmzactivity.lg. The frmat f the lg file cnsists f a header at the beginning f the file and subsequent lines fr each cmmunicatins message generated by the DMZ Gateway Server. (Nt all fields will be ppulated fr every message. Mre infrmatin n the W3C Extended Lg File frmat is available n the W3C Web site at (The examples belw are fr illustratin nly and d nt necessarily reflect yur versin r installatin f DMZ Gateway.) The header is f the frmat: #Sftware: DMZ Gateway Server Versin: build 4 #Versin: 3.0 #Date: :31:48 #Fields: time status rs-ip rs-cmment s-ip s-cmment c-ip c-cmment where: Sftware Identifies the applicatin that generated the lg file. In this case, the DMZ Gateway Server. This line will als cntain the applicatin versin and build number f the DMZ Gateway Server. Versin The versin f the extended lg file frmat used. Date The date and time the lg file was initially created. Fields The field names fr the fields included in each lg message. The fields are defined as: time The date and time the lg message was generated 39