Stonesoft 5.4

Administrator s Guide

Secur i ty Engines

Management Center

2Legal Information

End-User License AgreementThe use of the products described in these materials is subject to the then current end-user license agreement, which can be found at the Stonesoft website:www.stonesoft.com/en/support/eula.html

Third Party LicensesThe Stonesoft software includes several open source or third-party software packages. The appropriate software licensing information for those products at the Stonesoft website:www.stonesoft.com/en/support/third_party_licenses.htmlU.S. Government AcquisitionsIf Licensee is acquiring the Software, including accompanying documentation on behalf of the U.S. Government, the following provisions apply. If the Software is supplied to the Department of Defense (DoD), the Software is subject to Restricted Rights, as that term is defined in the DOD Supplement to the Federal Acquisition Regulations (DFAR) in paragraph 252.227-7013(c) (1). If the Software is supplied to any unit or agency of the United States Government other than DOD, the Governments rights in the Software will be as defined in paragraph 52.227-19(c) (2) of the Federal Acquisition Regulations (FAR). Use, duplication, reproduction or disclosure by the Government is subject to such restrictions or successor provisions.

Product Export RestrictionsThe products described in this document are subject to export control under the laws of Finland and the European Council Regulation (EC) N:o 1334/2000 of 22 June 2000 setting up a Community regime for the control of exports of dual-use items and technology (as amended). Thus, the export of this Stonesoft software in any manner is restricted and requires a license by the relevant authorities.

General Terms and Conditions of Support and Maintenance ServicesThe support and maintenance services for the products described in these materials are provided pursuant to the general terms for support and maintenance services and the related service description, which can be found at the Stonesoft website:www.stonesoft.com/en/support/view_support_offering/terms/

Replacement ServiceThe instructions for replacement service can be found at the Stonesoft website:www.stonesoft.com/en/support/view_support_offering/return_material_authorization/

Hardware WarrantyThe appliances described in these materials have a limited hardware warranty. The terms of the hardware warranty can be found at the Stonesoft website:www.stonesoft.com/en/support/view_support_offering/warranty_service/

Trademarks and PatentsThe products described in these materials are protected by one or more of the following European and US patents: European Patent Nos. 1065844, 1189410, 1231538, 1231754, 1259028, 1271283, 1289183, 1289202, 1304830, 1304849, 1313290, 1326393, 1361724, 1379037, and 1379046 and US Patent Nos. 6,650,621; 6,856,621; 6,912,200; 6,996,573; 7,099,284; 7,127,739; 7,130,266; 7,130,305; 7,146,421; 7,162,737; 7,234,166; 7,260,843; 7,280,540; 7,325,248; 7,360,242; 7,386,525; 7,406,534; 7,461,401; 7,573,823; 7,721,084; and 7,739,727 and may be protected by other EU, US, or other patents, or pending applications. Stonesoft, the Stonesoft logo and StoneGate, are all trademarks or registered trademarks of Stonesoft Corporation. All other trademarks or registered trademarks are property of their respective owners.

DisclaimerAlthough every precaution has been taken to prepare these materials, THESE MATERIALS ARE PROVIDED "AS-IS" and Stonesoft makes no warranty to the correctness of information and assumes no responsibility for errors, omissions, or resulting damages from the use of the information contained herein. All IP addresses in these materials were chosen at random and are used for illustrative purposes only.

Copyright 2012 Stonesoft Corporation. All rights reserved. All specifications are subject to change.

Revision: SGAG_20120911

TABLE OF CONTENTS

GETTING STARTED

CHAPTER 1Using Stonesoft Documentation . . . . . . . . . . . . 23

Using This Documentation. . . . . . . . . . . . . . . . 24Typo

AdditiProd

UsSupSystSup

ContaLiceTechYourSecOthe

CHAPTENew in

ImporAnaCha

AvaCha

PoEven

SeInspLayeSec

OtherLocaTraffRouElemImpSMS

ChangAppLoggRouSno

Changes in IPS 5.4 . . . . . . . . . . . . . . . . . . . . 34Application Detection Improvements . . . . . . . 34Logging of Evasion-Related Events . . . . . . . . 34Snort Rules Library Import . . . . . . . . . . . . . . 34

Documentation Changes. . . . . . . . . . . . . . . . . 343Table of Contents

graphical Conventions . . . . . . . . . . . . . . 24

onal Documentation . . . . . . . . . . . . . . . . 25uct Documentation. . . . . . . . . . . . . . . . . 25ing Online Help Locally . . . . . . . . . . . . . . 26

port Documentation . . . . . . . . . . . . . . . . 26em Requirements. . . . . . . . . . . . . . . . . . 27ported Features . . . . . . . . . . . . . . . . . . . 27ct Information . . . . . . . . . . . . . . . . . . . . 27nsing Issues . . . . . . . . . . . . . . . . . . . . . 27nical Support . . . . . . . . . . . . . . . . . . . . . 27 Comments . . . . . . . . . . . . . . . . . . . . . . 27urity Related Questions and Comments . . 27r Queries. . . . . . . . . . . . . . . . . . . . . . . . 27

R 2 This Release . . . . . . . . . . . . . . . . . . . . . 29

tant Changes . . . . . . . . . . . . . . . . . . . . . 30lyzers no Longer Used . . . . . . . . . . . . . . . 30nges to Management Server High ilability . . . . . . . . . . . . . . . . . . . . . . . . . 30

nges to Ready-Made Policies and Template licies . . . . . . . . . . . . . . . . . . . . . . . . . . . 30t Correlation and Analysis on Log rvers and Security Engines . . . . . . . . . . . 30ection Policies . . . . . . . . . . . . . . . . . . . . 31r 2 Firewalls. . . . . . . . . . . . . . . . . . . . . . 31

urity Engines. . . . . . . . . . . . . . . . . . . . . . 31

Changes in SMC 5.4 . . . . . . . . . . . . . . . 32l Filters . . . . . . . . . . . . . . . . . . . . . . . . . 32ic Capture . . . . . . . . . . . . . . . . . . . . . . . 32ting Monitoring . . . . . . . . . . . . . . . . . . . . 32ent Snapshots . . . . . . . . . . . . . . . . . . . 32

rovements to Reporting . . . . . . . . . . . . . . 32 Notifications for 64-Bit SMC . . . . . . . . . 32

es in Firewall/VPN 5.4 . . . . . . . . . . . . . . 33lication Detection Improvements . . . . . . . 33ing of Evasion-Related Events . . . . . . . . . 33

te-Based VPN . . . . . . . . . . . . . . . . . . . . . 33rt Rules Library Import . . . . . . . . . . . . . . 33

Information on Analyzers and Sensor-Analyzers Removed. . . . . . . . . . . . . . . . . . . . . . . . . . 34

CHAPTER 3Using the Management Client . . . . . . . . . . . . . 35

Overview to the Management Client . . . . . . . . 36Rearranging the General Layout. . . . . . . . . . . . 40Bookmarking Views . . . . . . . . . . . . . . . . . . . . 41

Managing Bookmarks. . . . . . . . . . . . . . . . . . 41Creating New Bookmarks . . . . . . . . . . . . . . . 42Creating New Bookmark Folders . . . . . . . . . . 43Adding Bookmarks to the Toolbar . . . . . . . . . 43

Changing the Startup View . . . . . . . . . . . . . . . 44Using the Search Features . . . . . . . . . . . . . . . 44

Using Basic Element Search . . . . . . . . . . . . . 44Searching for Element References. . . . . . . . . 46Using the DNS Search . . . . . . . . . . . . . . . . . 46

Creating Host Elements Based on DNS Queries . . . . . . . . . . . . . . . . . . . . . . . . . . . 46

Searching for Duplicate IP Addresses . . . . . . 47Searching for Unused Elements . . . . . . . . . . 47Searching for Users . . . . . . . . . . . . . . . . . . . 48Searching the Trash . . . . . . . . . . . . . . . . . . . 49

Using Type-Ahead Search . . . . . . . . . . . . . . . . 50Saving Elements, Log Data, Reports, and Statistics. . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

PDF Output Settings. . . . . . . . . . . . . . . . . . . 51Adding Style Templates for PDF Output . . . . . 52Managing PDF Style Templates . . . . . . . . . . . 53

Sending Messages to Other Administrators . . . 53Enabling/Disabling Administrator Messaging . 53Sending Messages to Other Administrators . . 54

Adding Custom Commands to Element Menus . 54Creating a Tools Profile. . . . . . . . . . . . . . . . . 54Attaching a Tools Profile to an Element . . . . . 55

CHAPTER 4Setting up the System . . . . . . . . . . . . . . . . . . . 57

Getting Started with the Management Center . . 58Getting Started with the Firewall . . . . . . . . . . . 59

4Getting Started with the IPS . . . . . . . . . . . . . . 60Getting Started with the Layer 2 Firewall. . . . . . 60

CHAPTER 5Configuring System Communications . . . . . . . . 63

Getting Started with System Communications. . 64Defining Locations . . . . . . . . . . . . . . . . . . . . . 66Defining Contact IP Addresses. . . . . . . . . . . . . 66

Defining Engine Location. . . . . . . . . . . . . . . . 67DefiEngiDefiDedDefiClusDefiDefiSec

SelecConfig

CHAPTEManag

UsingCon

CreaSeleActivFilte

ExporExpoImpo

CreIm

ResRes

LockinDeletMovin

ResDele

MONI

CHAPTEMonito

GettinMonit

Defa

System Summary. . . . . . . . . . . . . . . . . . . . . 94Viewing System Status for a Selected

Element . . . . . . . . . . . . . . . . . . . . . . . . . . 94Viewing Appliance Configuration Status . . . . . 96Info Panel . . . . . . . . . . . . . . . . . . . . . . . . . . 96Commands for Monitoring Components . . . . . 97Monitoring Tools in the Main Menu . . . . . . . . 97

Reading Component Statuses. . . . . . . . . . . . 98Table of Contents

ning Contact Addresses for a Single ne or a Cluster Virtual IP Address . . . . . . 68ning Contact Addresses for Node icated IP Addresses . . . . . . . . . . . . . . . . 69ning Contact Addresses for an IPS ter or a Layer 2 Firewall Cluster . . . . . . . . 70ning Server Contact Addresses . . . . . . . . 70ning a Contact Address for External urity Gateway End-Point . . . . . . . . . . . . . . 72ting the Management Client Location . . . . 73uring Multi-Link System Communications. 73

R 6ing Elements . . . . . . . . . . . . . . . . . . . . . 75

Categories . . . . . . . . . . . . . . . . . . . . . . 76figuration Overview . . . . . . . . . . . . . . . . . 76

ting New Categories . . . . . . . . . . . . . . . . 76cting Categories for Elements . . . . . . . . . 77ating Categories . . . . . . . . . . . . . . . . . . 77ring With Several Categories . . . . . . . . . . 78ting, Importing, and Restoring Elements. . 79rting Elements. . . . . . . . . . . . . . . . . . . . 80rting Elements . . . . . . . . . . . . . . . . . . . 81ating a CSV File or a TSV File . . . . . . . . . 81

porting Elements from a File . . . . . . . . . . 82toring Elements from Policy Snapshots . . . 83toring Elements from Element Snapshots . 84g and Unlocking Elements . . . . . . . . . . . 86

ing Elements . . . . . . . . . . . . . . . . . . . . . 86g Elements to the Trash . . . . . . . . . . . . . 87toring Elements from the Trash . . . . . . . . 88ting Elements from the Trash . . . . . . . . . 88

TORING

R 7ring the System. . . . . . . . . . . . . . . . . . . 91

g Started with System Monitoring . . . . . . 92oring the System Status . . . . . . . . . . . . . 92ult Arrangement of System Status View. . 93

Engine Hardware Malfunction Icons . . . . . . . . 98Replication Malfunction Icon . . . . . . . . . . . . . 98Element Status Colors . . . . . . . . . . . . . . . . . 99Node Status Colors . . . . . . . . . . . . . . . . . . . 99NetLink Status Colors . . . . . . . . . . . . . . . . . 100VPN Status Colors . . . . . . . . . . . . . . . . . . . . 100Connectivity Status Colors . . . . . . . . . . . . . . 101

Creating Overviews. . . . . . . . . . . . . . . . . . . . . 102Creating a New Overview . . . . . . . . . . . . . . . 103Adding a New System Summary Section to an Overview. . . . . . . . . . . . . . . . . . . . . . . . . 103Adding a New Statistics Section to an Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . 104Creating a New Statistics Section . . . . . . . . . 105Selecting Statistical Items . . . . . . . . . . . . . . 106Setting Thresholds for Monitored Items . . . . . 107

Monitoring Connections, Blacklists, VPN SAs, Users, and Routing . . . . . . . . . . . . . . . . . . . . 108

Checking Connections, Blacklists, VPN SAs, Users, and Routing . . . . . . . . . . . . . . . . . . . 109Saving Snapshots of Connections, Blacklists, VPN SAs, Users, and Routing . . . . . . . . . . . . 111Exporting Snapshots of Connections, Blacklists, VPN SAs, Users, and Routing . . . . . . . . . . . . 112Viewing Snapshots of Connections, Blacklists, VPN SAs, Users, and Routing . . . . . . . . . . . . 112Comparing Snapshots of Connections, Blacklists, VPN SAs, Users, and Routing . . . . 113

Viewing and Comparing Element Snapshots . . . 115Monitoring Connections on a Map . . . . . . . . . . 117

Defining a New Geolocation . . . . . . . . . . . . . 118Setting a Geolocation for an Element. . . . . . . 120Viewing Geolocations and IP Addresses in Google Maps . . . . . . . . . . . . . . . . . . . . . . . . 120

Viewing Geolocation Element Locations in Overviews and Reports. . . . . . . . . . . . . . . . 120Viewing IP Address Locations in the Logs view . . . . . . . . . . . . . . . . . . . . . . . . . 121Viewing IP Address Locations from the Whois Information Dialog . . . . . . . . . . . . . . 121

Monitoring Configurations and Policies . . . . . . 121Monitoring Administrator Actions. . . . . . . . . . . 122

Monitoring Task Execution . . . . . . . . . . . . . . . . 122Taking a Traffic Capture . . . . . . . . . . . . . . . . . . 123Checking Maintenance Contract Information . . . 125

Enabling Automatic Maintenance Contract Checking . . . . . . . . . . . . . . . . . . . . . . . . . . . 125Viewing Maintenance Contract Information . . . 126Fetching Maintenance Contract Information . . 126

Checking When Internal Certificates or Internal CAs E

CHAPTEMonito

GettinMonit

Con

ConveCreaDefiDefiAdd

DeVaDeTim

ValidMonit

ImpCrea

ActivaConfigChangMonitActivaMonit

CHAPTEBrowsi

GettinOveOpe

DefaToolDetaStatLog

BrowsView

Filtering Logs in the Logs View . . . . . . . . . . . 154Specifying Filters for a Query. . . . . . . . . . . . 154Viewing Logs From Specific Components . . . 156Viewing Logs From Specific Servers and Archive Folders . . . . . . . . . . . . . . . . . . . . . 156

Analyzing Logs, Alerts, and Audit Entries . . . . 157Saving Snapshots of Log, Alert, and Audit Entries . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157Viewing Snapshots of Log, Alert, and Audit 5Table of Contents

xpire . . . . . . . . . . . . . . . . . . . . . . . . . . . 127

R 8ring Third-Party Devices . . . . . . . . . . . . 129

g Started with Third-Party Device oring . . . . . . . . . . . . . . . . . . . . . . . . . . . 130figuration Overview . . . . . . . . . . . . . . . . . 130

rting Logs From External Devices . . . . . . 131ting a Logging Profile Element. . . . . . . . . 132ning Ordered Field Logging Patterns . . . . . 133ning Key-Value Pair Logging Patterns . . . . 135ing Field Resolvers . . . . . . . . . . . . . . . . . 136fining a Field Resolver for Multiple lues. . . . . . . . . . . . . . . . . . . . . . . . . . . . 136fining a Field Resolver for Date and e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137ating a Logging Profile . . . . . . . . . . . . . . 137oring the Status of Third-Party Devices . . . 138orting MIBs. . . . . . . . . . . . . . . . . . . . . . . 139ting a Probing Profile . . . . . . . . . . . . . . . 140ting Monitoring of a Third-Party Device . . . 142uring a Third-Party Device for Monitoring . 143ing the Ports for Third-Party Device oring . . . . . . . . . . . . . . . . . . . . . . . . . . . 143ting/Deactivating Third-Party Statusoring Alerts . . . . . . . . . . . . . . . . . . . . . . 143

R 9ng Logged Data . . . . . . . . . . . . . . . . . . . 145

g Started with the Logs View. . . . . . . . . . 146rview . . . . . . . . . . . . . . . . . . . . . . . . . . . 146ning the Logs View . . . . . . . . . . . . . . . . . 146

ult (Records) Arrangement, Panels, and s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 146ils Arrangement . . . . . . . . . . . . . . . . . . . 149istics Arrangement . . . . . . . . . . . . . . . . . 150Analysis Arrangement . . . . . . . . . . . . . . . 152ing Log Data . . . . . . . . . . . . . . . . . . . . . 153ing Log Entry Details in the Side Panel . . 153

Entries . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157Browsing Log Entries on a Timeline . . . . . . . . 158Viewing Temporary Log Entries . . . . . . . . . . . 158Sorting Log Entries . . . . . . . . . . . . . . . . . . . 159Checking Whois Records for IP Addresses in Logs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159

Changing How Data Entries Are Displayed . . . . 160Increasing and Decreasing Text Size in Data Entries . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160Changing the Time Zone for Log Browsing . . . 160Changing Data Columns in the Log Entry Table. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 160Resolving Log Details to DNS Names or System Elements. . . . . . . . . . . . . . . . . . . . . 161Deactivating/Activating Log Entry Highlighting 162

Exporting Data from the Logs View . . . . . . . . . 162Exporting Extracts of Log Data . . . . . . . . . . . 162Exporting IPS Traffic Recordings . . . . . . . . . . 164Attaching Logs to Incident Cases . . . . . . . . . 164

Creating Rules From Logs . . . . . . . . . . . . . . . . 165

CHAPTER 10Reports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 167

Getting Started with Reports. . . . . . . . . . . . . . 168Configuration Overview . . . . . . . . . . . . . . . . . 168

Creating and Modifying Report Designs . . . . . . 169Modifying Report Designs. . . . . . . . . . . . . . . 170Creating New Report Designs . . . . . . . . . . . . 170Creating and Modifying Report Sections . . . . 172

Modifying Report Sections . . . . . . . . . . . . . 172Creating New Report Sections. . . . . . . . . . . 173

Creating and Modifying Report Items . . . . . . . 173Creating Report Items . . . . . . . . . . . . . . . . 174Modifying Report Items . . . . . . . . . . . . . . . 174

Generating and Viewing Reports . . . . . . . . . . . 175Generating a Report. . . . . . . . . . . . . . . . . . . 175

Defining the Report Task . . . . . . . . . . . . . . 176Selecting Data Sources . . . . . . . . . . . . . . . 177

Canceling Ongoing Report Tasks . . . . . . . . . . 178Viewing Reports. . . . . . . . . . . . . . . . . . . . . . 178

6Changing the Properties of Generated Reports 179Exporting Reports . . . . . . . . . . . . . . . . . . . . . . 179

Exporting a Report as a PDF File . . . . . . . . . . 180Exporting a Report as an HTML File . . . . . . . . 180E-Mailing Reports . . . . . . . . . . . . . . . . . . . . . 181

Creating a System Audit Report . . . . . . . . . . . . 181

CHAPTER 11Filtering Data . . . . . . . . . . . . . . . . . . . . . . . . . 183

GettinDefin

BasCreaSaviCrea

EdAddFilteRem

OrganCreaCha

CHAPTEWorkin

GettinCon

CreatDefinAddin

InseCreaAdd

ArranConne

ConCon

CreatSpeCrea

ViewinAdjuCollin DZoom

PrintinExpor

CHAPTER 13Incident Cases. . . . . . . . . . . . . . . . . . . . . . . . . 207

Getting Started with Incident Cases. . . . . . . . . 208Configuration Overview . . . . . . . . . . . . . . . . . 208

Creating a New Incident Case . . . . . . . . . . . . . 209Setting an Incident Context. . . . . . . . . . . . . . . 210Attaching Data to Incident Cases . . . . . . . . . . 210

Attaching Logs and Audit Entries to Incident Table of Contents

g Started with Filtering Data . . . . . . . . . . 184ing Filters . . . . . . . . . . . . . . . . . . . . . . . . 185ics of Constructing Filters . . . . . . . . . . . . 185ting and Editing Local Filters. . . . . . . . . . 187ng Local Filters. . . . . . . . . . . . . . . . . . . . 189ting and Editing Filter Elements. . . . . . . . 190iting Filter Elements . . . . . . . . . . . . . . . . 190ing and Modifying Filtering Criteria in rs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 191oving Filtering Criteria from Filters . . . . . . 193izing Filter Elements . . . . . . . . . . . . . . . . 193ting New Filter Tags . . . . . . . . . . . . . . . . 193

nging the Tag of a Filter . . . . . . . . . . . . . . 194

R 12g With Diagrams . . . . . . . . . . . . . . . . . . 195

g Started with Diagrams . . . . . . . . . . . . . 196figuration Overview . . . . . . . . . . . . . . . . . 196

ing Diagrams . . . . . . . . . . . . . . . . . . . . . 197ing the Diagram Background . . . . . . . . . . 198g Elements to Diagrams . . . . . . . . . . . . . 199rting New Elements Manually . . . . . . . . . 199ting Diagrams from Configured Elements . 199

ing Text Comments to a Diagram . . . . . . . 200ging Elements in Diagrams . . . . . . . . . . . 201cting Elements in Diagrams . . . . . . . . . . 201

necting Elements Automatically . . . . . . . . 201necting Elements Manually . . . . . . . . . . . 202ing Links Between Diagrams . . . . . . . . . . 202cifying a Parent Diagram . . . . . . . . . . . . . 202ting Links from One Diagram to Another. . 203g Diagrams . . . . . . . . . . . . . . . . . . . . . . 203sting the Element Details in Diagrams . . . 203apsing and Expanding Groups of Elements iagrams . . . . . . . . . . . . . . . . . . . . . . . . . 204

ing and Navigating Diagrams . . . . . . . . . 204g Diagrams . . . . . . . . . . . . . . . . . . . . . . 204

ting Diagrams as Images . . . . . . . . . . . . 205

Cases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211Attaching Policy Snapshots to Incident Cases 212Attaching Memos to Incident Cases . . . . . . . 212Attaching Files to Incident Cases . . . . . . . . . 213

Adding Players to Incident Cases. . . . . . . . . . . 213Adding Journal Entries to Incident Cases . . . . . 214Working With Existing Incident Cases. . . . . . . . 214

Opening an Incident Case for Editing . . . . . . . 214Changing the Priority of an Incident Case. . . . 214Changing the State of an Incident Case . . . . . 215Checking Incident History . . . . . . . . . . . . . . . 215

CONTROLLING ENGINES

CHAPTER 14Controlling Engine Operation. . . . . . . . . . . . . . 219

Commanding Engines Remotely . . . . . . . . . . . 220Turning Engines Online . . . . . . . . . . . . . . . . . 220Turning Engines Offline . . . . . . . . . . . . . . . . . 221Setting Nodes to Standby . . . . . . . . . . . . . . . 221Rebooting Nodes . . . . . . . . . . . . . . . . . . . . . 221Refreshing the Currently Installed Policy . . . . 222Backing up and Restoring Dynamic Routing Configurations . . . . . . . . . . . . . . . . . . . . . . . 222

Commanding Engines Locally . . . . . . . . . . . . . 222Setting Engine Options . . . . . . . . . . . . . . . . . . 223

Enabling/Disabling Engine Status Monitoring . 223Enabling/Disabling Firewall/VPN Diagnostics . 223Disabling/Enabling User Database Replication 223Enabling/Disabling Status Surveillance . . . . . 224Enabling/Disabling SSH Access to the Engine 224Changing the Engine Password . . . . . . . . . . . 224

Changing NetLink State Manually . . . . . . . . . . 225Disabling/Enabling Cluster Nodes . . . . . . . . . . 225

Disabling Nodes of a Cluster Temporarily . . . . 225Re-Enabling Disabled Cluster Nodes . . . . . . . 226

Editing Engine Configurations . . . . . . . . . . . . . 226

CHAPTER 15Stopping Traffic Manually . . . . . . . . . . . . . . . . 227

Terminating Connections Manually . . . . . . . . . . 228Blacklisting Connections Manually . . . . . . . . . . 228

CHAPTER 16Working on the Engine Command Line . . . . . . . 231

Getting Started with the Engine Command Line. 232Accessing the Engine Command Line . . . . . . . . 232ReconCreatRestoConfig

MANA

CHAPTEConfig

GettinEnginConfigUpgra

CHAPTEAdmin

GettinCon

DefinLists

DefiDefi

DefinCreaDefiDefiAccoResView

CustoDefinAdmin

EnaDefi

ChangAutheMethoDelet

CHAPTEAlert E

Gettin

Configuration Overview . . . . . . . . . . . . . . . . . 262

Creating Alerts. . . . . . . . . . . . . . . . . . . . . . . . 263Defining Custom Alerts. . . . . . . . . . . . . . . . . 263Defining What Triggers an Alert . . . . . . . . . . . 264

Defining Alert Chains . . . . . . . . . . . . . . . . . . . 264Defining Alert Channels . . . . . . . . . . . . . . . . 265Creating New Alert Chains . . . . . . . . . . . . . . 267Modifying Existing Alert Chains . . . . . . . . . . . 2677Table of Contents

figuring Basic Engine Settings . . . . . . . . 233ing Engine Scripts . . . . . . . . . . . . . . . . . . 234ring a Previous Configuration Manually. . . 235uring Dynamic Routing . . . . . . . . . . . . . . 235

GEMENT CENTER CONFIGURATION

R 17uring Automatic Software Updates . . . . . 239

g Started with Automatic Updates and e Upgrades . . . . . . . . . . . . . . . . . . . . . . 240uring Automatic Updates and Engine des . . . . . . . . . . . . . . . . . . . . . . . . . . . . 240

R 18istrator Accounts . . . . . . . . . . . . . . . . . . 243

g Started with Administrator Accounts . . . 244figuration Overview . . . . . . . . . . . . . . . . . 244

ing Administrator Roles and Access Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244ning Administrator Roles . . . . . . . . . . . . . 245ning Access Control Lists . . . . . . . . . . . . 247ing Administrator Accounts . . . . . . . . . . . 248ting a New Administrator Element . . . . . . 248ning Administrator Permissions . . . . . . . . 250ning Rights for Restricted Administrator unts . . . . . . . . . . . . . . . . . . . . . . . . . . . 251

tricting the Logs an Administrator Can . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 252mizing Log Colors. . . . . . . . . . . . . . . . . . 253ing Password and Login Settings for istrators . . . . . . . . . . . . . . . . . . . . . . . . 254

bling Enforcement of Password Settings . . 254ning Password Policy Settings . . . . . . . . . 255ing Administrator Passwords . . . . . . . . . 257nticating Administrators Using RADIUS ds . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257

ing Administrator Accounts . . . . . . . . . . . 259

R 19scalation . . . . . . . . . . . . . . . . . . . . . . . . 261

g Started with Alert Escalation . . . . . . . . 262

Editing Alert Chains . . . . . . . . . . . . . . . . . . . 268Defining the Final Action of an Alert Chain . . . 269

Defining Alert Policies. . . . . . . . . . . . . . . . . . . 270Creating New Alert Policies . . . . . . . . . . . . . . 270Modifying Existing Alert Policies . . . . . . . . . . 270Editing Alert Policy Rules . . . . . . . . . . . . . . . 271

Installing Alert Policies . . . . . . . . . . . . . . . . . . 272Acknowledging Alerts . . . . . . . . . . . . . . . . . . . 272

Acknowledging Individual Alerts. . . . . . . . . . . 273Acknowledging All Active Alerts . . . . . . . . . . . 273

Using Custom Scripts for Alert Escalation . . . . 274Setting up a Dedicated Alert Server. . . . . . . . . 275Creating SMTP Server Elements . . . . . . . . . . . 276Testing Alerts. . . . . . . . . . . . . . . . . . . . . . . . . 277

CHAPTER 20Domains . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279

Getting Started with Domains . . . . . . . . . . . . . 280Configuration Overview . . . . . . . . . . . . . . . . . 280

Creating Domains . . . . . . . . . . . . . . . . . . . . . 281Defining a Domain Logo . . . . . . . . . . . . . . . . 282

Logging in to a Domain. . . . . . . . . . . . . . . . . . 283Logging out of a Domain. . . . . . . . . . . . . . . . . 284Moving Elements Between Domains . . . . . . . . 284Using the Domain Overview . . . . . . . . . . . . . . 286Deleting Domains . . . . . . . . . . . . . . . . . . . . . 286

CHAPTER 21Setting up the Web Portal . . . . . . . . . . . . . . . . 287

Getting Started with Web Portal Access . . . . . . 288Configuration Overview . . . . . . . . . . . . . . . . . 288

Defining Web Portal Server Settings . . . . . . . . 289Activating HTTPS on the Web Portal Server. . . . 290Allowing Web Portal Connections. . . . . . . . . . . 291Defining Web Portal User Accounts . . . . . . . . . 292

Granting Engines to a Web Portal User . . . . . 293Selecting Policy Permissions for a Web Portal User . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 294

8Selecting Log Browsing Permissions for a Web Portal User . . . . . . . . . . . . . . . . . . . . . . 295Selecting Report Data Permissions for a Web Portal User. . . . . . . . . . . . . . . . . . . . . . . . . . 296

Customizing the Web Portal . . . . . . . . . . . . . . . 297Adding a New Web Portal Language . . . . . . . . 297

Importing a Web Portal Language File through the Management Client. . . . . . . . . . 297

Enabling/Disabling a Web Portal Localization . 298Cus

Writin

CHAPTEDistribStart .

GettinCon

ActivaDistriAcces

CHAPTELog Se

DefinDefiSeleCertCon

ChangExpor

DefiExpoConCreaSysl

CHAPTEConfig

AboutInstal

Con

DefiElemInstServCreaManInstSoft

InstalCon

Creating Additional Log Server Elements . . . . 326Installing Licenses for Additional Log Servers. 327Setting a Log Server as a Backup Log Server. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 327Creating Access Rules for Additional Log Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . 328Installing Additional Log Server Software . . . . 328

Changing the Active Management Server . . . . . 329Table of Contents

tomizing the Look of the Web Portal . . . . . 298g Announcements to Web Portal Users . . 299

R 22uting Management Clients Through Web . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 301

g Started with Web Start Distribution. . . . 302figuration Overview . . . . . . . . . . . . . . . . . 302

ting Web Start on the Management Server 303buting Web Start from External Servers . . 304sing the Web Start Clients . . . . . . . . . . . 305

R 23rver Configuration . . . . . . . . . . . . . . . . . 307

ing a Log Server . . . . . . . . . . . . . . . . . . . 308ning a Log Server Element. . . . . . . . . . . . 308cting Backup Log Servers . . . . . . . . . . . . 309ifying the Log Server . . . . . . . . . . . . . . . . 310figuring an Alert Server . . . . . . . . . . . . . . 310ing Log Server Configuration Parameters . 310ting Log Data to Syslog . . . . . . . . . . . . . . 314ning General Syslog Settings . . . . . . . . . . 314rting Log Filters for Syslog Sending . . . . . 316

figuring Syslog Filter Settings. . . . . . . . . . 317ting a Rule Allowing Traffic to the og Server . . . . . . . . . . . . . . . . . . . . . . . . 318

R 24uring Additional SMC Servers . . . . . . . . . 319

Additional SMC Servers . . . . . . . . . . . . . 320ling Additional Management Servers . . . . 320figuration Overview . . . . . . . . . . . . . . . . . 320

ning an Additional Management Server ent . . . . . . . . . . . . . . . . . . . . . . . . . . . . 321

alling Licenses for Additional Management ers . . . . . . . . . . . . . . . . . . . . . . . . . . . . 322ting Access Rules for Additional agement Servers . . . . . . . . . . . . . . . . . . 323alling Additional Management Server ware . . . . . . . . . . . . . . . . . . . . . . . . . . . 323ling Additional Log Servers . . . . . . . . . . . 325figuration Overview . . . . . . . . . . . . . . . . . 325

Disabling and Enabling Automatic Database Replication . . . . . . . . . . . . . . . . . . . . . . . . . . 330Retrying Automatic Database Replication. . . . . 331Synchronizing Management Databases Manually 332

CHAPTER 25Reconfiguring the Management Center and

Engines. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 335

Modifying a Management Server Element . . . . 336Changing the Management Database Password 337Changing the Management Platform . . . . . . . . 338Changing SMC IP Addressing . . . . . . . . . . . . . 339

Changing the Management Server IP Address 339Changing the Log Server IP Address . . . . . . . 340Changing IP Addresses of Combined Management/Log Servers . . . . . . . . . . . . . . 341

If Configuration Changes Prevent Managing the Engines. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 342Changing the Role of Security Engines. . . . . . . 342

Preparing to Change the Security Engine Role 343Clearing the Existing Security Engine Configuration . . . . . . . . . . . . . . . . . . . . . . . . 343Reconfiguring the Security Engine . . . . . . . . . 344

ENGINE ELEMENT CONFIGURATION

CHAPTER 26Creating and Modifying Engine Elements . . . . . 349

Getting Started with Engine Elements . . . . . . . 350Configuration Overview . . . . . . . . . . . . . . . . . 350

Creating New Engine Elements . . . . . . . . . . . . 351Creating a New Single Firewall Element . . . . . 351Creating Multiple Single Firewall Elements . . . 353

Defining Interfaces for Multiple Single Firewalls . . . . . . . . . . . . . . . . . . . . . . . . . . 355Defining Routing for Multiple Single Firewalls . . . . . . . . . . . . . . . . . . . . . . . . . . 357Selecting Additional Configuration Options for Multiple Single Firewalls . . . . . . . . . . . . 357Defining Tester Settings for Multiple Single Firewalls . . . . . . . . . . . . . . . . . . . . . 358Defining Permissions for Multiple Single

Firewalls . . . . . . . . . . . . . . . . . . . . . . . . . . 358Defining Add-Ons for Multiple Single Firewalls . . . . . . . . . . . . . . . . . . . . . . . . . . 359Defining Advanced Settings for Multiple Single Firewalls . . . . . . . . . . . . . . . . . . . . . 360Defining Internal Security Gateway End-Points for Multiple Single Firewalls. . . . . . . . 360Uploading the Multiple Single Firewall Initial Configuration to the Installation Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . 363SeFir

CreaCrea

DeCluSefor

CreaCreaCreaElemCreaElemCreaDup

ModifModElemModOncConClus

Preto Coa FAcCo

ConClusConClusAddCha

ChtheChDif

EditinEditinEditin

Editing IPS Cluster Properties . . . . . . . . . . . . . 390Editing Single Layer 2 Firewall Properties . . . . . 391Editing Layer 2 Firewall Cluster Properties . . . . 392Adjusting the Global Contact Policy for Single Engines. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 393About Engine Time Synchronization . . . . . . . . . 394

CHAPTER 27Network Interface Configuration . . . . . . . . . . . 3959Table of Contents

lecting a Policy to Install on the ewalls . . . . . . . . . . . . . . . . . . . . . . . . . . 364ting a New Firewall Cluster Element. . . . . 365ting Multiple Firewall Cluster Elements . . 366fining Interfaces for Multiple Firewall sters. . . . . . . . . . . . . . . . . . . . . . . . . . . 368lecting Additional Configuration Options Multiple Firewall Clusters . . . . . . . . . . . . 369ting a New Single IPS Element . . . . . . . . 370ting a New IPS Cluster Element. . . . . . . . 371ting a New Single Layer 2 Firewall ent . . . . . . . . . . . . . . . . . . . . . . . . . . . . 372ting a New Layer 2 Firewall Cluster ent . . . . . . . . . . . . . . . . . . . . . . . . . . . . 373ting a New SSL VPN Gateway Element . . . 374licating an Existing Engine Element . . . . . 375ying Existing Engine Elements . . . . . . . . . 376ifying the Properties of Single Engine ents . . . . . . . . . . . . . . . . . . . . . . . . . . . 376ifying Properties of Several Engines at e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 377verting a Single Firewall to a Firewall ter . . . . . . . . . . . . . . . . . . . . . . . . . . . . 377paring for Converting a Single Firewall a Firewall Cluster . . . . . . . . . . . . . . . . . . 378nverting a Single Firewall Element to irewall Cluster . . . . . . . . . . . . . . . . . . . . 379tivating the Clustered Configuration After nversion. . . . . . . . . . . . . . . . . . . . . . . . . 381verting a Single IPS Engine to an IPS ter . . . . . . . . . . . . . . . . . . . . . . . . . . . . 382verting a Single Layer 2 Firewall to a ter . . . . . . . . . . . . . . . . . . . . . . . . . . . . 383ing a Node to a Cluster . . . . . . . . . . . . . . 384nging Engine Control IP Address. . . . . . . . 385anging Engine Control Address Within Same Network . . . . . . . . . . . . . . . . . . . 385anging Firewall Control Address to a ferent Network . . . . . . . . . . . . . . . . . . . . 386g Single Firewall Properties . . . . . . . . . . . 387g Firewall Cluster Properties . . . . . . . . . . 388g Single IPS Engine Properties. . . . . . . . . 389

Getting Started with Interface Configuration . . . 396Configuration Overview . . . . . . . . . . . . . . . . . 397

Firewall Interface Configuration . . . . . . . . . . . . 397Defining Physical Interfaces for Firewall Engines. . . . . . . . . . . . . . . . . . . . . . . . . . . . 398Adding VLAN Interfaces for Firewall Engines . . 401Adding ADSL Interfaces for Single Firewalls . . 403Adding Wireless Interfaces for Single Firewalls 404Defining Tunnel Interfaces . . . . . . . . . . . . . . 406Configuring Advanced Interface Properties for Firewalls . . . . . . . . . . . . . . . . . . . . . . . . . . . 407Defining SSID Interfaces for Single Firewalls . 410Configuring Security Settings for SSID Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . 412Configuring MAC Filtering for SSID Interfaces . 413Configuring Single Firewall IP Addresses . . . . 414Adding IPv4 Addresses for a Single Firewall . . 415Configuring VRRP Settings for Single Firewalls 416Configuring PPPoE Settings for Single Firewalls 417Adding IPv6 Addresses for a Single Firewall . . 418Configuring Firewall Cluster IP Addresses. . . . 419Adding IPv4 Addresses for a Firewall Cluster . 420Adding IPv6 Addresses for a Firewall Cluster . 422Defining Modem Interfaces for Single Firewalls 423Changing/Removing the PIN Code of a Modem Interface . . . . . . . . . . . . . . . . . . . . . 424Setting Interface Options for Firewalls . . . . . . 425About Using a Dynamic IP Address on a Firewall Interface . . . . . . . . . . . . . . . . . . . . . 427

IPS Engine Interface Configuration. . . . . . . . . . 428Defining System Communication Interfaces for IPS Engines . . . . . . . . . . . . . . . . . . . . . . . . . 428Adding VLAN Interfaces for IPS Engines . . . . . 430Configuring IP Addresses for IPS Engines. . . . 432

Configuring IP Addresses for Single IPS Engines. . . . . . . . . . . . . . . . . . . . . . . . . . . 432Configuring IP Addresses for IPS Clusters . . 433

Defining Traffic Inspection Interfaces for IPS Engines. . . . . . . . . . . . . . . . . . . . . . . . . . . . 434

Defining Logical Interfaces for IPS

10

Engines and Layer 2 Firewalls . . . . . . . . . . . 434Defining Reset Interfaces for IPS Engines. . . 435Defining Capture Interfaces for IPS Engines . . . . . . . . . . . . . . . . . . . . . . . . . . . 436Defining Inline Interfaces for IPS Engines . . . 437

Configuring Advanced Interface Properties for IPS Engines . . . . . . . . . . . . . . . . . . . . . . . . . 440Setting Interface Options for IPS Engines . . . . 442

Layer 2 Firewall Interface Configuration . . . . . . 444DefiLayeConFirewConFirew

Co2 FCoFir

Defi2 Fi

DeFir

ConLayeSettFirew

ConfigActivaInterf

CHAPTEConnec

GettinSMC

Con

SavinEngin

CreaSavi

Conne

CHAPTEConfig

GettinCon

SpeciAddin

ConCoExtCo

File System Space Test . . . . . . . . . . . . . . . 473Configuring Additional Settings for the Free Swap Space Test . . . . . . . . . . . . . . . . 473Configuring Additional Settings for the Link Status Test . . . . . . . . . . . . . . . . . . . . 473Configuring Additional Settings for the Multiping Test . . . . . . . . . . . . . . . . . . . . . . 474

Checking Configured Tests . . . . . . . . . . . . . . . 475Removing Engine Tests. . . . . . . . . . . . . . . . . . 476Table of Contents

ning System Communication Interfaces for r Firewalls . . . . . . . . . . . . . . . . . . . . . . . 444figuring VLAN Interfaces for Layer 2 alls . . . . . . . . . . . . . . . . . . . . . . . . . . . 446

figuring IP Addresses for Layer 2 alls . . . . . . . . . . . . . . . . . . . . . . . . . . . 447

nfiguring IP Addresses for Single Layer irewalls . . . . . . . . . . . . . . . . . . . . . . . . . 448nfiguring IP Addresses for Layer 2 ewall Clusters. . . . . . . . . . . . . . . . . . . . . 449ning Traffic Inspection Interfaces for Layer rewalls . . . . . . . . . . . . . . . . . . . . . . . . . . 450fining Inline Interfaces for Layer 2 ewalls . . . . . . . . . . . . . . . . . . . . . . . . . . 450figuring Advanced Interface Properties for r 2 Firewalls. . . . . . . . . . . . . . . . . . . . . . 452ing Interface Options for Layer 2 alls . . . . . . . . . . . . . . . . . . . . . . . . . . . 454uring Manual ARP Settings . . . . . . . . . . . 456ting the Internal DHCP Server on a Firewall ace . . . . . . . . . . . . . . . . . . . . . . . . . . . . 457

R 28ting Engines to the Management Center 459

g Started with Connecting Engines to the . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 460figuration Overview . . . . . . . . . . . . . . . . . 461

g an Initial Configuration for Security es . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 461ting One-Time Passwords . . . . . . . . . . . . 461ng Initial Configuration Details . . . . . . . . . 463cting SSL VPN Gateways to the SMC. . . . 465

R 29uring the Engine Tester . . . . . . . . . . . . . 467

g Started with the Engine Tester . . . . . . . 468figuration Overview . . . . . . . . . . . . . . . . . 468

fying Global Engine Tester Settings . . . . . 469g Engine Tests . . . . . . . . . . . . . . . . . . . . 470figuring Additional Test-Specific Settings . . 472nfiguring Additional Settings for the ernal Test . . . . . . . . . . . . . . . . . . . . . . . 472nfiguring Additional Settings for the

Disabling/Enabling Configured Engine Tests. . . 476Disabling/Enabling Individual Engine Tests. . . 476Disabling/Enabling All Custom Engine Tests. . 477

CHAPTER 30Engine Permissions . . . . . . . . . . . . . . . . . . . . . 479

Getting Started with Engine Permissions . . . . . 480Configuration Overview . . . . . . . . . . . . . . . . . 480

Defining Administrator Permissions on Engines 480Selecting Permitted Policies for Engines . . . . . 481

CHAPTER 31Alias Translations for Engines . . . . . . . . . . . . . 483

Getting Started with Alias Translations. . . . . . . 484Defining Alias Translation Values . . . . . . . . . . . 484

Adding Alias Translation Values . . . . . . . . . . . 484Removing Alias Translation Values. . . . . . . . . 485

CHAPTER 32Add-on Features . . . . . . . . . . . . . . . . . . . . . . . 487

Getting Started with Add-On Features . . . . . . . 488Editing Add-On Settings . . . . . . . . . . . . . . . . . 488Configuring Anti-Virus Settings . . . . . . . . . . . . 489Configuring Anti-Spam Settings . . . . . . . . . . . . 489

Defining General Anti-Spam Settings . . . . . . . 490Defining Scoring Settings for Anti-Spam. . . . . 492Defining Spam Filtering Rules . . . . . . . . . . . . 493Defining DNSBL Settings . . . . . . . . . . . . . . . 495Modifying Advanced Anti-Spam Settings. . . . . 497Modifying Anti-Spam Settings Elements . . . . . 499

CHAPTER 33Advanced Engine Settings . . . . . . . . . . . . . . . . 501

Getting Started with Advanced Engine Settings. 502Adjusting Firewall System Parameters . . . . . . . 502Adjusting Firewall Traffic Handling Parameters . 504Adjusting Firewall Clustering Options . . . . . . . . 506

Adjusting General Firewall Clustering Options . 506Tuning the Firewall Load Balancing Filter . . . . 508

Manually Tuning the Load Balancing Filter . . 508Adding Load Balancing Filter Entries . . . . . . 509

Adjusting IPS Engine System Parameters . . . . . 510Adjusting IPS Engine Traffic Parameters . . . . . . 511Adjusting IPS Clustering Options . . . . . . . . . . . 512Adjusting Layer 2 Firewall System Parameters. . 514Adjusting Layer 2 Firewall Traffic Parameters. . . 515Adjusting Layer 2 Firewall Clustering Options . . 516Configuring Inspection of Tunneled Traffic . . . . . 518Setting Connection Timeouts. . . . . . . . . . . . . . 519ConfigConfig

CHAPTESetting

GettinConfigConfigConfigActiva

ROUT

CHAPTEConfig

GettinCon

AddinDefiDefi

CreAd

DefiRou

DeEnAc

RouDeDe

DefiAddinFirewaRemoModif

DeaInteActivAdd

Check

CHAPTER 36Outbound Traffic Management . . . . . . . . . . . . . 549

Getting Started with Outbound Traffic Management . . . . . . . . . . . . . . . . . . . . . . . . . 550

Configuration Overview . . . . . . . . . . . . . . . . . 551

Configuring Outbound Multi-Link Settings . . . . . 551Creating an Outbound Multi-Link Element. . . . 552Selecting NetLinks for an Outbound Multi-Link 55311Table of Contents

uring Default SYN Flood Protection . . . . . 520uring Default Log Handling Settings . . . . 521

R 34 up SNMP for Engines . . . . . . . . . . . . . . 523

g Started with SNMP Configuration . . . . . 524uring SNMP Version 1 or 2c . . . . . . . . . . 524uring SNMP Version 3 . . . . . . . . . . . . . . 525uring What Triggers SNMP Traps . . . . . . . 525ting the SNMP Agent on Engines . . . . . . . 526

ING

R 35uring Routing. . . . . . . . . . . . . . . . . . . . . 529

g Started with Routing . . . . . . . . . . . . . . 530figuration Overview . . . . . . . . . . . . . . . . . 530

g Routes for Firewalls . . . . . . . . . . . . . . . 531ning a Single-Link Route for a Firewall . . . 531ning a Multi-Link Route for a Firewall . . . . 532ating NetLinks. . . . . . . . . . . . . . . . . . . . 532

ding a Multi-Link Route . . . . . . . . . . . . . . 534ning Routing for the Route-Based VPN . . . 535ting DHCP Messages . . . . . . . . . . . . . . . 536fining a DHCP Server . . . . . . . . . . . . . . . 536abling DHCP Relay . . . . . . . . . . . . . . . . . 537tivating the DHCP Relay Sub-policy . . . . . . 538ting Multicast Traffic . . . . . . . . . . . . . . . . 538fining Static Multicast . . . . . . . . . . . . . . . 539fining IGMP-Based Multicast Forwarding . . 540ning Policy Routing . . . . . . . . . . . . . . . . . 541g Routes for IPS Engines and Layer 2 lls . . . . . . . . . . . . . . . . . . . . . . . . . . . . 543ving Routes . . . . . . . . . . . . . . . . . . . . . . 544ying Antispoofing for Firewalls . . . . . . . . . 544ctivating Antispoofing for an IP Address/rface Pair . . . . . . . . . . . . . . . . . . . . . . . . 545ating Antispoofing for Routable IP

resses . . . . . . . . . . . . . . . . . . . . . . . . . . 546ing Routes . . . . . . . . . . . . . . . . . . . . . . 546

Defining Destination Cache Settings . . . . . . . 554Creating Outbound Load Balancing NAT Rules . 554Monitoring And Testing Outbound Traffic Management . . . . . . . . . . . . . . . . . . . . . . . . . 556

CHAPTER 37Inbound Traffic Management . . . . . . . . . . . . . . 557

Getting Started with Inbound Traffic Management 558Configuration Overview . . . . . . . . . . . . . . . . . 558

Defining a Server Pool . . . . . . . . . . . . . . . . . . 559Creating a New Server Pool Element . . . . . . . 559Defining External Address(es) of Server Pool . 559Adding Server Pool Members . . . . . . . . . . . . 560

Installing Monitoring Agents . . . . . . . . . . . . . . 561Uninstalling Monitoring Agents . . . . . . . . . . . . 563Configuring Monitoring Agents. . . . . . . . . . . . . 563

Editing sgagent.local.conf . . . . . . . . . . . . . . . 564Editing sgagent.conf. . . . . . . . . . . . . . . . . . . 564

Editing the sgagent.conf Statement Section. 566Options in the sgagent.conf Statement Section . . . . . . . . . . . . . . . . . . . . . . . . . . . 567Monitoring Agent Statement Configuration Examples . . . . . . . . . . . . . . . . . . . . . . . . . 568Editing the sgagent.conf Test Section . . . . . 570Monitoring Agent Test Configuration Examples . . . . . . . . . . . . . . . . . . . . . . . . . 572Editing Internal Tests for Monitoring Agents . . . . . . . . . . . . . . . . . . . . . . . . . . . 573Monitoring Agent Internal Test Examples . . . 575

Enabling Monitoring Agents. . . . . . . . . . . . . . . 578Entering Server Pool IP Addresses on Your DNS Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 578Creating Access Rules for Inbound Load Balancing . . . . . . . . . . . . . . . . . . . . . . . . . . . 579Configuring Dynamic DNS Updates . . . . . . . . . 580

Configuration Overview . . . . . . . . . . . . . . . . . 580

Improving DDNS Security . . . . . . . . . . . . . . . 580Defining an External DNS Server . . . . . . . . . . 581Defining the Dynamic DNS Update Information 582Defining a Dynamic DNS Rule . . . . . . . . . . . . 583

12

Monitoring and Testing Monitoring Agents. . . . . 583

TRAFFIC INSPECTION POLICIES

CHAPTER 38Creating and Managing Policy Elements . . . . . . 587

Getting Started with Policies . . . . . . . . . . . . . . 588Configuration Overview . . . . . . . . . . . . . . . . . 590

CreatCreat

CreaCon

InstalTracki

ChePrevChe

VieCo

CheCha

MovinDelet

CHAPTEEditing

GettinUsing

EditEditDefi

CriAddRea

SeaFindCou

AddinEditin

DefiDefi

EditinDefiMatDefi

Defining Access Rule Action Options . . . . . . . 616Defining Apply Blacklist Action Options . . . . 616Defining Discard Action Options . . . . . . . . . 617Defining Refuse Action Options. . . . . . . . . . 617Defining Jump Action Options . . . . . . . . . . . 618Defining Firewall Allow Action Options . . . . . 618Defining Continue Action Options in Access Rules. . . . . . . . . . . . . . . . . . . . . . . 622Defining Firewall Use VPN Action Options. . . 622Table of Contents

ing a New Template Policy or a Policy . . . . 591ing a New Sub-Policy . . . . . . . . . . . . . . . . 592ting a New Empty Sub-Policy . . . . . . . . . . 592

verting Existing Rules into a Sub-Policy . . . 593ling Policies . . . . . . . . . . . . . . . . . . . . . . 594ng Policy Changes . . . . . . . . . . . . . . . . . 596cking the Currently Installed Policy . . . . . . 596iewing the Currently Installed Policy . . . . . 596cking and Comparing Policy Versions . . . . 596wing Policy Snapshots . . . . . . . . . . . . . . 597mparing Two Policy Snapshots. . . . . . . . . 597cking for Untransferred Configuration nges . . . . . . . . . . . . . . . . . . . . . . . . . . . 598g the Policy Under a Different Template . . 598ing Policies, Templates, and Sub-Policies . 599

R 39 Policies . . . . . . . . . . . . . . . . . . . . . . . . 601

g Started with Editing the Rules in Policies 602 the Policy Editing View . . . . . . . . . . . . . . 603ing Rule Tables . . . . . . . . . . . . . . . . . . . . 604ing Rule Cells . . . . . . . . . . . . . . . . . . . . . 605ning Source, Destination, and Service teria . . . . . . . . . . . . . . . . . . . . . . . . . . . 606ing Comments in Policies. . . . . . . . . . . . . 607ding Rule Identifiers . . . . . . . . . . . . . . . . 607

rching in Rules . . . . . . . . . . . . . . . . . . . . 608ing Unused Rules in Firewall Policies (Hit nters). . . . . . . . . . . . . . . . . . . . . . . . . . . 609g Insert Points in Policy Templates . . . . . . 610g Ethernet Rules. . . . . . . . . . . . . . . . . . . 610ning Logging Options for Ethernet Rules . . 611ning a MAC Address for Ethernet Rules . . 612g Access Rules. . . . . . . . . . . . . . . . . . . . 612ning What Traffic an Access Rule ches . . . . . . . . . . . . . . . . . . . . . . . . . . . 613ning What Action an Access Rule Takes . . 615

Defining IPS and Layer 2 Firewall Allow Action Options . . . . . . . . . . . . . . . . . . . . . . 623

Defining Access Rule Logging Options . . . . . . 624Defining Firewall Access Rule Authentication Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . 626

Editing Firewall NAT Rules . . . . . . . . . . . . . . . . 626Adding a NAT Rule . . . . . . . . . . . . . . . . . . . . 627Defining What Traffic a NAT Rule Matches . . . 628Overwriting the Source Address in Packets. . . 629

Defining Static Source Translation Options . 630Defining Dynamic Source Translation Options. . . . . . . . . . . . . . . . . . . . . . . . . . . 631

Overwriting the Destination Address in Packets 632NAT Rule Examples . . . . . . . . . . . . . . . . . . . 634

Example of a Static Source Translation Rule . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 634Example of a Dynamic Source Translation Rule . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 635Example of a Destination Translation Rule . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 636Example of a Combined Source And Destination Translation Rule. . . . . . . . . . . . 637

Editing Inspection Policies . . . . . . . . . . . . . . . 638Modifying the Inspection Rules Tree . . . . . . . 638

Adding Situations to the Rules Tree. . . . . . . 640Removing Overrides From the Rules Tree. . . 640

Adding Exceptions to the Inspection Policy . . . 640Defining What Traffic an Inspection Exception Rule Matches . . . . . . . . . . . . . . . 641Defining What Action an Exception Rule Takes . . . . . . . . . . . . . . . . . . . . . . . . . . . . 643Defining Continue Action Options in Exception Rules. . . . . . . . . . . . . . . . . . . . . 643Defining Permit Action Options in Exception Rules. . . . . . . . . . . . . . . . . . . . . 644Defining Terminate Action Options in Exception Rules. . . . . . . . . . . . . . . . . . . . . 645

Defining Logging Options for Inspection Rules and Exceptions . . . . . . . . . . . . . . . . . . . . . . 647Importing Snort Rules Libraries. . . . . . . . . . . 648

Limiting the Time when a Rule Is Active . . . . . . 652Validating Rules Automatically. . . . . . . . . . . . . 653

Overriding Default Validation Options for Rules 654Viewing Policy Validation Issues. . . . . . . . . . . 656Disabling a Validation Warning for a Rule . . . . 657Excluding Rules from Policy Validation . . . . . . 657

Changing Default Rules. . . . . . . . . . . . . . . . . . 657

CHAPTER 40Defining IP Addresses . . . . . . . . . . . . . . . . . . . 659

Getting Started with Defining IP Addresses. . . . 660Defin

DefiDefiDefiDefiDefiDefiDefiDefiDefi

Using

CHAPTEDefinin

GettinCon

DefinDefiDefiGrou

UsingDefin

DefiDefiDefiDefiDefiDefiParaDefiParaDefiDefiDefiDefiDefiDefiDefiDefi

Defining TCP Proxy Protocol Parameters. . . . . 691Defining TFTP Protocol Parameters . . . . . . . . 692

CHAPTER 42Defining Situations . . . . . . . . . . . . . . . . . . . . . 695

Getting Started With Situations . . . . . . . . . . . . 696Configuration Overview . . . . . . . . . . . . . . . . . 697

Creating New Situation Elements . . . . . . . . . . 697Defining Context Options for Situations . . . . . . 69913Table of Contents

ing IP Addresses as Elements . . . . . . . . . 661ning Address Range Elements . . . . . . . . . 661ning Alias Elements . . . . . . . . . . . . . . . . 662ning Domain Name Elements. . . . . . . . . . 663ning Expression Elements . . . . . . . . . . . . 664ning Group Elements. . . . . . . . . . . . . . . . 666ning Host Elements . . . . . . . . . . . . . . . . 667ning Network Elements . . . . . . . . . . . . . . 668ning Router Elements . . . . . . . . . . . . . . . 668ning Zone Elements . . . . . . . . . . . . . . . . 670 Feature-Specific Elements in Policies . . . 670

R 41g Network Services . . . . . . . . . . . . . . . . 673

g Started with Services . . . . . . . . . . . . . 674figuration Overview . . . . . . . . . . . . . . . . . 674

ing Services . . . . . . . . . . . . . . . . . . . . . . 675ning a New IP-Based Service . . . . . . . . . . 675ning a New Ethernet Service . . . . . . . . . . 677ping Services . . . . . . . . . . . . . . . . . . . . 678 Protocol Elements . . . . . . . . . . . . . . . . . 678ing Protocol Parameters . . . . . . . . . . . . . 679ning DNS Protocol Parameters . . . . . . . . . 679ning FTP Protocol Parameters . . . . . . . . . 680ning GRE Protocol Parameters . . . . . . . . . 681ning H323 Protocol Parameters . . . . . . . . 682ning HTTP/HTTPS Protocol Parameters. . . 682ning IPv4 Encapsulation Protocol meters . . . . . . . . . . . . . . . . . . . . . . . . . 684ning IPv6 Encapsulation Protocol meters . . . . . . . . . . . . . . . . . . . . . . . . . 684ning MSRPC Protocol Parameters. . . . . . . 685ning NetBIOS Protocol Parameters . . . . . . 686ning Oracle Protocol Parameters . . . . . . . 686ning Shell (RSH) Protocol Parameters. . . . 687ning SIP Protocol Parameters. . . . . . . . . . 688ning SMTP Protocol Parameters . . . . . . . . 689ning SSH Protocol Parameters . . . . . . . . . 689ning SunRPC Protocol Options . . . . . . . . . 690

Defining HTTP URL Filter Options. . . . . . . . . . 700Defining Port/Host Scan Detection Options . . 700

Defining Context Options for Correlation Situations . . . . . . . . . . . . . . . . . . . . . . . . . . . 702

Configuring Compress Contexts . . . . . . . . . . 703Configuring Count Contexts. . . . . . . . . . . . . . 704Configuring Group Contexts . . . . . . . . . . . . . 705Configuring Match Contexts . . . . . . . . . . . . . 706Configuring Sequence Contexts. . . . . . . . . . . 706

Defining Tags for Situations . . . . . . . . . . . . . . 707Creating a New Tag . . . . . . . . . . . . . . . . . . . 707Adding Tags to One Situation at a Time . . . . . 708Adding Tags to Several Situations at Once . . . 708Removing Tags from Situations . . . . . . . . . . . 709

Working With Vulnerabilities . . . . . . . . . . . . . . 709Creating New Vulnerability Elements . . . . . . . 709Associating Vulnerabilities With Situations . . . 710

CHAPTER 43Working With Applications . . . . . . . . . . . . . . . 711

Getting Started With Applications . . . . . . . . . . 712Configuration Overview . . . . . . . . . . . . . . . . . 712

Creating TLS Matches . . . . . . . . . . . . . . . . . . 712Creating Access Rules for Application Detection 714

Overriding Application Properties in Service Definitions. . . . . . . . . . . . . . . . . . . . . . . . . . 714Logging Application Use . . . . . . . . . . . . . . . . 716

CHAPTER 44Defining User Responses . . . . . . . . . . . . . . . . . 717

Getting Started with User Responses . . . . . . . 718Configuration Overview . . . . . . . . . . . . . . . . . 718

Creating User Responses . . . . . . . . . . . . . . . . 718Defining User Response Entries . . . . . . . . . . . 719

CHAPTER 45Quality of Service (QoS) . . . . . . . . . . . . . . . . . 721

Getting Started with QoS . . . . . . . . . . . . . . . . 722Configuration Overview . . . . . . . . . . . . . . . . . 723

Creating QoS Classes . . . . . . . . . . . . . . . . . . 723

14

Defining QoS Policies . . . . . . . . . . . . . . . . . . . 724Creating New QoS Policies . . . . . . . . . . . . . . 724Editing QoS Rules. . . . . . . . . . . . . . . . . . . . . 725

Matching QoS Rules to Network Traffic . . . . . . . 726Defining Speed and QoS Policy for Interfaces . . 727

CHAPTER 46Filtering Web Addresses . . . . . . . . . . . . . . . . . . 729

Getting Started with Web Filtering . . . . . . . . . . 730Con

BlackCreat

CHAPTESetting

GettinCon

ConfigConfig

CreaElemImpoCertGenCertExpoCert

DefinInspe

CreaImpoCertConfor T

ActivaExclud

GlobExclTraff

DefinCreat

CHAPTEExtern

GettinCon

DefinDefin

Crea

Defining Protocol Parameters for CIS Redirection . . . . . . . . . . . . . . . . . . . . . . . . . 753

Defining Access Rules for CIS Redirection . . . . 754Defining NAT Rules for CIS Redirection . . . . . . 755

CHAPTER 49Blacklisting IP Addresses . . . . . . . . . . . . . . . . 757

Getting Started with Blacklisting . . . . . . . . . . . 758Configuration Overview . . . . . . . . . . . . . . . . . 758Table of Contents

figuration Overview . . . . . . . . . . . . . . . . . 730

listing/Whitelisting Web URLs Manually . . 731ing Web Filtering Rules . . . . . . . . . . . . . . 732

R 47 up TLS Inspection . . . . . . . . . . . . . . . . 733

g Started with TLS inspection . . . . . . . . . 734figuration Overview . . . . . . . . . . . . . . . . . 735

uring Server Protection. . . . . . . . . . . . . . 736uring Client Protection . . . . . . . . . . . . . . 737ting Client Protection Certificate Authority ents . . . . . . . . . . . . . . . . . . . . . . . . . . . 737rting a Private Key and Signing

ificate for HTTPS Client Protection . . . . . . 738erating a Private Key and Signing ificate for HTTPS Client Protection . . . . . . 739rting an HTTPS Client Protection ificate . . . . . . . . . . . . . . . . . . . . . . . . . . 740ing Trusted Certificate Authorities for TLS ction . . . . . . . . . . . . . . . . . . . . . . . . . . . 740ting Trusted Certificate Authority Elements 741rting a Trusted Certificate Authority

ificate for TLS inspection . . . . . . . . . . . . 741figuring Certificate Revocation List Checks LS inspection. . . . . . . . . . . . . . . . . . . . . 742ting TLS inspection on the Engine . . . . . . 743ing Connections from TLS inspection . . . 744ally Excluding Domains From Decryption . 744uding Domains from Inspection of HTTPS ic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 745ing a Custom HTTPS Service . . . . . . . . . . 746ing Access Rules for TLS inspection . . . . . 747

R 48al Content Inspection. . . . . . . . . . . . . . . 749

g Started with External Content Inspection 750figuration Overview . . . . . . . . . . . . . . . . . 750

ing a Content Inspection Server Element . 751ing a Service for CIS Redirection . . . . . . . 752ting a Service for CIS Redirection . . . . . . 752

Enabling Blacklist Enforcement . . . . . . . . . . . . 759Configuring Automatic Blacklisting . . . . . . . . . . 760

Defining Which Traffic is Blacklisted Automatically . . . . . . . . . . . . . . . . . . . . . . . . 760

Adding a Rule for Automatic Blacklisting . . . 760Defining Blacklisting Rule Action Options . . . 761

Blacklisting Traffic Manually . . . . . . . . . . . . . . 763

USERS AND AUTHENTICATION

CHAPTER 50Setting up Directory Servers . . . . . . . . . . . . . . 767

Getting Started with Directory Servers . . . . . . . 768Configuration Overview . . . . . . . . . . . . . . . . . 769

Integrating External Directory Servers . . . . . . . 769Configuring Schema Files on External Directory Servers . . . . . . . . . . . . . . . . . . . . . 770Defining Active Directory Server Elements . . . 771Defining LDAP Server Elements. . . . . . . . . . . 771Configuring LDAP Connection Settings . . . . . . 773Adding LDAP Object Classes . . . . . . . . . . . . . 774Configuring LDAP Attribute Mapping. . . . . . . . 775Adding Authentication Methods. . . . . . . . . . . 776Defining LDAP Domains . . . . . . . . . . . . . . . . 778

Enabling Access Control by User . . . . . . . . . . . 779Defining the Active Directory Domain Controllers for Access Control by User. . . . . . 780Creating User Agent Elements. . . . . . . . . . . . 781Selecting User Agents for Firewalls . . . . . . . . 782Generating a Certificate and Saving the Configuration . . . . . . . . . . . . . . . . . . . . . . . . 782Allowing Communication With the User Agent. 783Installing User Agents . . . . . . . . . . . . . . . . . 783

Defining User Accounts . . . . . . . . . . . . . . . . . 784Defining User Groups . . . . . . . . . . . . . . . . . . 785Defining Users. . . . . . . . . . . . . . . . . . . . . . . 786

Linking Authentication Server Users to External Directories . . . . . . . . . . . . . . . . . . . 788

Selecting Domain Nodes for User Linking . . . 788Creating and Linking Authentication Server User Accounts . . . . . . . . . . . . . . . . . . . . . . 790

Managing User Information . . . . . . . . . . . . . . . 792Adding/Removing Users From User Groups . . 792Importing and Exporting User Information. . . . 793

Importing Users from an LDIF File . . . . . . . . 793Ex

ChaCleaUseResSettOn o

CHAPTESetting

GettinCon

IntegrDefiServDefiServ

IntegrDefiDefiMetDefiDefiChaCreaCertEnaAuthEnaAuthEnaServ

DefinEnabl

CreaBrowDefiUseEnaCon

Authe

Customizing the HTML Pages Profile for Browser-Based User Authentication . . . . . . . . . . . . . . . 822

Exporting the Default HTML Pages Profile . . . 822Customizing the Default HTML Pages . . . . . . 823Importing the Custom HTML Pages . . . . . . . . 823

Customizing the Telnet Authentication Prompt . 824Monitoring and Testing User Authentication . . . 82515Table of Contents

porting Users to an LDIF File . . . . . . . . . . 793nging User Passwords . . . . . . . . . . . . . . . 794ring the Authentication Settings of a r . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 794etting Local User Database on Firewalls . . 794ing User Database Replication to Firewalls r Off . . . . . . . . . . . . . . . . . . . . . . . . . . . 795

R 51 up User Authentication. . . . . . . . . . . . . 797

g Started with User Authentication . . . . . 798figuration Overview . . . . . . . . . . . . . . . . . 799

ating External Authentication Services . . . 800ning RADIUS or TACACS+ Authentication ers . . . . . . . . . . . . . . . . . . . . . . . . . . . . 800ning Authentication Methods for External ers . . . . . . . . . . . . . . . . . . . . . . . . . . . . 802ating Authentication Server Services . . . . 803ning Authentication Server Elements . . . . 804ning Authentication Server Authentication hods . . . . . . . . . . . . . . . . . . . . . . . . . . . 805ning Authentication Server RADIUS Clients 809ning Authentication Server Notification nnels . . . . . . . . . . . . . . . . . . . . . . . . . . . 810ting and Signing Authentication Server ificates . . . . . . . . . . . . . . . . . . . . . . . . . 812bling Federated Authentication With the entication Server . . . . . . . . . . . . . . . . . . 814

bling RADIUS Accounting With the entication Server . . . . . . . . . . . . . . . . . . 814

bling Web Services With the Authentication er . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 814

ing IPv4 Access Rules for Authentication. . 815ing Browser-Based User Authentication . . 817ting and Signing HTTPS Certificates for ser-Based User Authentication . . . . . . . . 818

ning IPv4 Access Rules for Browser-Based r Authentication . . . . . . . . . . . . . . . . . . . 819bling Redirection of Unauthenticated HTTP nections. . . . . . . . . . . . . . . . . . . . . . . . . 820nticating to a Stonesoft Firewall . . . . . . . 821

VIRTUAL PRIVATE NETWORKS

CHAPTER 52Basic Policy-Based VPN Configurations . . . . . . 829

Getting Started With Basic Policy-Based VPN Configuration . . . . . . . . . . . . . . . . . . . . . . . . . 830Configuration 1: Basic VPN Between Stonesoft Firewall/VPN Engines . . . . . . . . . . . . . . . . . . . 831

Creating Gateway Elements for Configuration 1 831Creating a VPN Element for Configuration 1 . . 832Creating Rules for VPN Configuration 1 . . . . . 834

Configuration 2: Basic VPN With a Partner Gateway . . . . . . . . . . . . . . . . . . . . . . . . . . . . 835

Creating an Internal Gateway Element for Configuration 2 . . . . . . . . . . . . . . . . . . . . . . 835Creating an External Gateway Element for Configuration 2 . . . . . . . . . . . . . . . . . . . . . . 837Defining a Site for External Gateway in Configuration 2 . . . . . . . . . . . . . . . . . . . . . . 838Creating a VPN Profile for Configuration 2 . . . 838Creating a VPN Element for Configuration 2 . . 841Creating Rules for Configuration 2. . . . . . . . . 843

Configuration 3: Basic VPN for Remote Clients. 844Managing VPN Client Addresses in Configuration 3 . . . . . . . . . . . . . . . . . . . . . . 844Creating Gateway Elements for Configuration 3 845Adding VPN Client Settings for Configuration 3 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 846Creating a VPN Element for Configuration 3 . . 848Creating Users for VPN Configuration 3 . . . . . 849Creating Rules for VPN Configuration 3 . . . . . 850

Configuration 4: Basic VPN Hub . . . . . . . . . . . 852Creating Gateway Elements for VPN Configuration 4 . . . . . . . . . . . . . . . . . . . . . . 852Creating a VPN Element for VPN Configuration 4 . . . . . . . . . . . . . . . . . . . . . . 853Defining Site Properties for VPN Configuration 4 . . . . . . . . . . . . . . . . . . . . . . 854Creating Rules for VPN Configuration 4 . . . . . 855

16

CHAPTER 53Configuring IPsec VPNs. . . . . . . . . . . . . . . . . . 857

Getting Started With IPsec VPNs . . . . . . . . . . . 858Configuration Overview . . . . . . . . . . . . . . . . . 859

Configuring IPsec VPNs . . . . . . . . . . . . . . . . . 860Defining Gateway Profiles . . . . . . . . . . . . . . . . 861

Defining a Custom Gateway Profile. . . . . . . . . 861Defining Security Gateways . . . . . . . . . . . . . . . 863

CreaDefiGateDefiGateDefiDefi

DefinDisaManAdjuAddDefiAdjuDisaRemVPN

DefinCreaModDefiDefiDefiDefi

DefinCreaModDefiDefiVPNEditCreaCreaPolicCreaPolicCreafor PPrevPolic

Creating NAT Rules for Policy-Based VPN Traffic . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 898

Editing the Route-Based VPN . . . . . . . . . . . . . 899Selecting the Default Encryption for the Route-Based VPN. . . . . . . . . . . . . . . . . . . . . 899Defining Route-Based VPN Tunnels . . . . . . . . 900Using the Route-Based VPN in Tunnel Mode. . 902

Monitoring VPNs . . . . . . . . . . . . . . . . . . . . . . 903Table of Contents

ting a New Security Gateway Element . . . 864ning End-Points for Internal Security ways . . . . . . . . . . . . . . . . . . . . . . . . . . . 864

ning End-Points for External Security ways . . . . . . . . . . . . . . . . . . . . . . . . . . . 867

ning Trusted CAs for a Gateway . . . . . . . . 869ning Gateway-Specific VPN Client Settings 870ing Sites for VPN Gateways . . . . . . . . . . . 872bling/Re-Enabling Automatic VPN Site agement . . . . . . . . . . . . . . . . . . . . . . . . 873sting Automatic VPN Site Management . . 873ing a New VPN Site . . . . . . . . . . . . . . . . . 874ning Protected Networks for VPN Sites . . . 874sting VPN-Specific Site Settings. . . . . . . . 875bling a VPN Site Temporarily in All VPNs. . 876oving a VPN Site Permanently from All s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 876ing VPN Profiles . . . . . . . . . . . . . . . . . . . 877ting a New VPN Profile . . . . . . . . . . . . . . 877ifying an Existing VPN Profile . . . . . . . . . . 878ning IKE SA Settings for a VPN. . . . . . . . . 879ning IPsec SA Settings for a VPN . . . . . . . 881ning VPN Client Settings . . . . . . . . . . . . . 883ning Trusted CAs for a VPN . . . . . . . . . . . 885ing Policy-Based VPNs . . . . . . . . . . . . . . . 886ting a New VPN Element . . . . . . . . . . . . . 886ifying an Existing VPN Element . . . . . . . . 887ning VPN Topology for Policy-Based VPNs . 888ning VPN Tunnel Settings for Policy-Based s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 889ing VPN Link Modes in Policy-Based VPNs. 892ting Rules for Policy-Based VPNs. . . . . . . 893ting Rules for Gateway Connections in y-Based VPNs . . . . . . . . . . . . . . . . . . . . 894ting Rules for VPN Client Connections in y-Based VPNs . . . . . . . . . . . . . . . . . . . . 895ting Forwarding Rules on Hub Gateways olicy-Based VPNs . . . . . . . . . . . . . . . . . . 897enting Other Access Rules from Matching y-Based VPN Traffic . . . . . . . . . . . . . . . . 898

CHAPTER 54Managing VPN Certificates . . . . . . . . . . . . . . . 905

Getting Started With VPN Certificates . . . . . . . 906Configuration Overview . . . . . . . . . . . . . . . . . 906

Defining a VPN Certificate Authority . . . . . . . . . 907Creating and Signing VPN Certificates . . . . . . . 909

Creating a VPN Certificate or Certificate Request for an Internal Gateway . . . . . . . . . . 909Signing External Certificate Requests Internally 911

Uploading VPN Certificates Manually . . . . . . . . 912Renewing VPN Certificates . . . . . . . . . . . . . . . 913Exporting the Certificate of VPN Gateway or VPN CA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 914Importing a VPN Gateway Certificate . . . . . . . . 915Checking When Gateway Certificates Expire . . . 915Checking When an Internal VPN CA Expires . . . 916

CHAPTER 55Reconfiguring Existing VPNs . . . . . . . . . . . . . . 917

Adding or Removing Tunnels in a VPN . . . . . . . 918Configuring NAT Settings for an Existing VPN . . 918

Activating NAT Traversal . . . . . . . . . . . . . . . . 918Translating Addresses of VPN Communications Between Gateways. . . . . . . . . . . . . . . . . . . . 919Translating Addresses in Traffic Inside a VPN Tunnel. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 919

Adding New Gateways to an Existing VPN . . . . . 920Changing Gateway IP Addressing in an Existing VPN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 920Giving VPN Access to Additional Hosts. . . . . . . 921Routing Internet Traffic Through Policy-Based VPNs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 922Redirecting Traffic Between VPN Tunnels . . . . . 922Renewing or Generating Pre-Shared Keys . . . . . 923

Generating a New Pre-Shared Key Automatically . . . . . . . . . . . . . . . . . . . . . . . . 923Renewing Pre-Shared Keys Manually . . . . . . . 924

Advanced VPN Tuning . . . . . . . . . . . . . . . . . . . 924

Defining a Custom Gateway Settings Element . 925Adjusting MOBIKE Settings . . . . . . . . . . . . . 925Adjusting Negotiation Retry Settings . . . . . . 926Adjusting Certificate Cache Settings . . . . . . 926

Assigning the Gateway Settings for a Firewall/VPN Engine . . . . . . . . . . . . . . . . . . . 927

CHAPTER 56VPN Client Settings . . . . . . . . . . . . . . . . . . . . . 929

GettinList oClientMana

ConConClieConAddAllow

Expor

MAIN

CHAPTEBackin

GettinCon

CreatStorinResto

ResResRes

Recov

CHAPTEManag

GettinCon

DefinArchiv

CreaSeleSeleData

DeletCreaSeleSele

Pruning Log Data . . . . . . . . . . . . . . . . . . . . . 956Disabling Pruning Filters . . . . . . . . . . . . . . . . 958

Exporting Log Data. . . . . . . . . . . . . . . . . . . . . 958Creating an Export Log Task . . . . . . . . . . . . . 959Selecting Data for Log Export . . . . . . . . . . . . 960Selecting Operation Settings for Log Export . . 961

Viewing a History of Executed Log Tasks . . . . . 962

CHAPTER 5917Table of Contents

g Started With VPN Client Settings . . . . . 930f VPN Client Settings in the Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 931ging VPN Client IP Addresses . . . . . . . . . 934figuring NAT Pool for VPN Clients . . . . . . . 934figuring Virtual IP Addressing for VPN nts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 935figuring the Gateway for Virtual IP ress Clients . . . . . . . . . . . . . . . . . . . . . . 936ing DHCP Relay in the Policy . . . . . . . . . 937

ting VPN Client Configuration to a File . . . 938

TENANCE AND UPGRADES

R 57g up and Restoring System Configurations 941

g Started with Backups . . . . . . . . . . . . . 942figuration Overview . . . . . . . . . . . . . . . . . 942

ing Backups . . . . . . . . . . . . . . . . . . . . . . 943g Backup Files . . . . . . . . . . . . . . . . . . . . 944ring Backups . . . . . . . . . . . . . . . . . . . . . 945toring a Management Server Backup . . . . 945toring a Log Server Backup . . . . . . . . . . . 946toring an Authentication Server Backup . . 947ering from a Hardware Failure . . . . . . . . . 947

R 58ing Log Data . . . . . . . . . . . . . . . . . . . . . 949

g Started with Log Data Management . . . 950figuration Overview . . . . . . . . . . . . . . . . . 950

ing When Logs Are Generated . . . . . . . . . 951ing Log Data . . . . . . . . . . . . . . . . . . . . . 952ting an Archive Log Task . . . . . . . . . . . . . 952cting Log Data for Archiving. . . . . . . . . . . 953cting Operation Settings for Archiving Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 953

ing Log Data . . . . . . . . . . . . . . . . . . . . . . 954ting a Delete Log Task . . . . . . . . . . . . . . 954cting Data for Deleting Logs . . . . . . . . . . 955cting Operation Settings for Deleting Logs 956

Managing and Scheduling Tasks . . . . . . . . . . . . 963

Getting Started with Tasks . . . . . . . . . . . . . . . 964Configuration Overview . . . . . . . . . . . . . . . . . 964

Task Types. . . . . . . . . . . . . . . . . . . . . . . . . . . 965Creating New Task Definitions . . . . . . . . . . . . . 967

Creating Backup Tasks . . . . . . . . . . . . . . . . . 967Creating Policy Refresh Tasks . . . . . . . . . . . . 968Creating Policy Upload Tasks. . . . . . . . . . . . . 968Creating Remote Upgrade Tasks . . . . . . . . . . 969Creating sgInfo Tasks . . . . . . . . . . . . . . . . . . 970

Scheduling Tasks . . . . . . . . . . . . . . . . . . . . . . 970Starting Tasks Manually . . . . . . . . . . . . . . . . . 971Pausing the Scheduled Execution of a Task . . . 971Cancelling a Task Schedule. . . . . . . . . . . . . . . 972Stopping Task Execution . . . . . . . . . . . . . . . . . 972

CHAPTER 60Managing Licenses . . . . . . . . . . . . . . . . . . . . . 973

Getting Started with Licenses . . . . . . . . . . . . . 974Generating New Licenses . . . . . . . . . . . . . . . . 976Upgrading Licenses Manually . . . . . . . . . . . . . 977Changing License Binding Details . . . . . . . . . . 978Installing Licenses . . . . . . . . . . . . . . . . . . . . . 979

Installing a License for an Unlicensed Component . . . . . . . . . . . . . . . . . . . . . . . . . 979Replacing the License of a Previously Licensed Component . . . . . . . . . . . . . . . . . . 980

Checking If All Components Are Licensed. . . . . 981Checking License Validity and State. . . . . . . . . 982

CHAPTER 61Upgrading the Management Center . . . . . . . . . 983

Getting Started with Upgrading the SMC . . . . . 984Configuration Overview . . . . . . . . . . . . . . . . . 985

Obtaining the SMC Installation Files . . . . . . . . 985Upgrading Management Center Servers . . . . . . 986Default Installation Directories for SMC . . . . . . 987

18

CHAPTER 62Upgrading the Engines . . . . . . . . . . . . . . . . . . . 989

Getting Started with Upgrading Engines . . . . . . 990Configuration Overview . . . . . . . . . . . . . . . . . 991

Obtaining Engine Upgrade Files . . . . . . . . . . . . 991Upgrading Engines Remotely . . . . . . . . . . . . . . 992Upgrading Legacy IPS Engines . . . . . . . . . . . . . 994

Upgrading Sensors and Sensor Clusters to IPS UpgSingRem

CHAPTEManua

GettinCon

ImporActiva

TROU

CHAPTEGenera

If YouTools

CHAPTETrouble

ForgoUser Creat

CHAPTETrouble

Alert CertCertLog StatEngiSystTestThro

Log MConConConCon

Incomplete Connection Closed . . . . . . . . . . . 1014NAT Balance: Remote Host Does Not Respond . . . . . . . . . . . . . . . . . . . . . . . . . . . 1014Not a Valid SYN Packet. . . . . . . . . . . . . . . . . 1015Requested NAT Cannot Be Done . . . . . . . . . . 1016Spoofed Packets . . . . . . . . . . . . . . . . . . . . . 1016IPsec VPN Log Messages . . . . . . . . . . . . . . . 1016

Error Messages . . . . . . . . . . . . . . . . . . . . . . . 1017Table of Contents

Engines . . . . . . . . . . . . . . . . . . . . . . . . . 994rading a Legacy Sensor-Analyzer to a le IPS Engine . . . . . . . . . . . . . . . . . . . . . 995oving Unused Analyzers . . . . . . . . . . . . . 996

R 63l Dynamic Updates . . . . . . . . . . . . . . . . . 997

g Started with Manual Dynamic Updates . 998figuration Overview . . . . . . . . . . . . . . . . . 998

ting an Update Package . . . . . . . . . . . . . 999ting an Update Package . . . . . . . . . . . . . 999

BLESHOOTING

R 64l Troubleshooting Tips . . . . . . . . . . . . . . 1003

r Problem Is Not Listed . . . . . . . . . . . . . . 1004For Further Troubleshooting. . . . . . . . . . . 1004

R 65shooting Accounts and Passwords . . . . . 1005

tten Passwords. . . . . . . . . . . . . . . . . . . . 1006Account Changes Have no Effect . . . . . . . 1007ing an Emergency Administrator Account. . 1007

R 66shooting Alert, Log, and Error Messages 1009

Log Messages . . . . . . . . . . . . . . . . . . . . 1010ificate Authority Expired/Expiring Alerts . . 1010ificate Expired/Expiring Alerts . . . . . . . . . 1010Spool Filling . . . . . . . . . . . . . . . . . . . . . . 1010us Surveillance: Inoperative Security nes . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1010em Alert . . . . . . . . . . . . . . . . . . . . . . . . 1011 Failed . . . . . . . . . . . . . . . . . . . . . . . . . . 1011ughput License Exceeded . . . . . . . . . . . . 1011essages . . . . . . . . . . . . . . . . . . . . . . . . 1012

nection Closed/Reset by Client/Server. . . 1012nection Removed During Connection Setup 1012nection State Might Be Too Large. . . . . . . 1012nection Timeout . . . . . . . . . . . . . . . . . . . 1013

Command Failed/Connect Timed out. . . . . . . 1017PKIX Validation Failed . . . . . . . . . . . . . . . . . . 1017Policy Installation Errors . . . . . . . . . . . . . . . . 1017Unexpected Error . . . . . . . . . . . . . . . . . . . . . 1017

CHAPTER 67Troubleshooting Certificates . . . . . . . . . . . . . . 1019

Understanding Certificate-Related Problems. . . 1020Replacing Expired/Missing Certificates . . . . . . 1022

Renewing SMC Server Certificates . . . . . . . . 1022Renewing Engine Certificates . . . . . . . . . . . . 1023

Dealing with Expiring Certificate Authorities . . . 1024

CHAPTER 68Troubleshooting Engine Operation . . . . . . . . . . 1027

Node Does not Go or Stay Online . . . . . . . . . . 1028Error Commanding an Engine . . . . . . . . . . . . . 1028Errors with Heartbeat and Synchronization . . . . 1029Problems Contacting the Management Server . 1029

CHAPTER 69Troubleshooting Licensing . . . . . . . . . . . . . . . . 1031

Troubleshooting Licensing. . . . . . . . . . . . . . . . 1032License Is Shown as Retained . . . . . . . . . . . . 1032License Is Shown as Unassigned . . . . . . . . . . 1033Throughput License Exceeded Alerts . . . . . . . . 1033

CHAPTER 70Troubleshooting Logging . . . . . . . . . . . . . . . . . 1035

Problems With Viewing Logs . . . . . . . . . . . . . . 1036Logs Are Filling up the Storage Space . . . . . . . 1036Log Server Does not Run . . . . . . . . . . . . . . . . 1037

CHAPTER 71Troubleshooting the Management Client. . . . . . 1039

Some Options Are Disabled . . . . . . . . . . . . . . 1040Slow Startup and Use. . . . . . . . . . . . . . . . . . . 1040Problems Logging In with the Management Client . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1041Problems with Layout and Views . . . . . . . . . . . 1041Problems With Viewing Statistics. . . . . . . . . . . 1041Problems with Status Monitoring . . . . . . . . . . . 1042

Problems Installing Web Start on an External Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1042Problems Controlling Management Servers. . . . 1043

CHAPTER 72Troubleshooting NAT . . . . . . . . . . . . . . . . . . . . 1045

Troubleshooting NAT Errors . . . . . . . . . . . . . . . 1046NAT Is Not Applied Correctly . . . . . . . . . . . . . . 1046NAT Is Applied When it Should Not Be . . . . . . . 1047

CHAPTETrouble

TroubThe InstThe TimePolicReaWarIgno

TroubValidRuleAllowInspEnaTraffFirewPackUns

CHAPTETrouble

TroubNo ReEmpty

CHAPTETrouble

UpgraStone1062

CHAPTETrouble

CheckResulReadiVPN CProbleProbleClient

Traffic Does Not Use the Route-Based VPN . . . 1067

REFERENCE

APPENDIX ACommand Line Tools . . . . . . . . . . . . . . . . . . . . 1071

Management Center Commands . . . . . . . . . . . 1072Engine Commands . . . . . . . . . . . . . . . . . . . . . 108219Table of Contents

R 73shooting Policies . . . . . . . . . . . . . . . . . 1049

leshooting Policy Installation . . . . . . . . . . 1050Engine Performs a Roll-Back at Policy allation. . . . . . . . . . . . . . . . . . . . . . . . . . 1050Management Server Contact to Nodes s Out . . . . . . . . . . . . . . . . . . . . . . . . . . 1050y Installation Fails for Some Other

son . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1051ning Automatic Proxy ARP Option Is red . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1051leshooting Rules. . . . . . . . . . . . . . . . . . . 1052ating Rules . . . . . . . . . . . . . . . . . . . . . . 1052 That Allows ANY Service Does Not All Traffic . . . . . . . . . . . . . . . . . . . . . . . 1052

ection Policy Produces False Positives . . . 1052bling Passthrough for PPTP Traffic. . . . . . . 1053ic I Want to Allow Is Stopped by the all . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1053ets Are Dropped as Spoofed. . . . . . . . . . 1054

upported Definitions in IPv6 Access Rules 1055

R 74shooting Reporting . . . . . . . . . . . . . . . . 1057

leshooting Reporting . . . . . . . . . . . . . . . . 1058port is Generated at All . . . . . . . . . . . . . 1058 Report Sections or Incomplete Data. . . . 1059

R 75shooting Upgrades . . . . . . . . . . . . . . . . 1061

de Fails Because of Running Services . . . 1062soft Management Center Installation Failed

R 76shooting IPsec VPNs . . . . . . . . . . . . . . 1063

ing Automatic IPsec VPN Validation ts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1064ng IPsec VPN-Related Logs . . . . . . . . . . . 1064ertificate Issues . . . . . . . . . . . . . . . . . . 1065ms with Internal to External Gateway VPN 1065ms Connecting With a Stonesoft IPsec VPN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1066

Server Pool Monitoring Agent Commands. . . . . 1089

APPENDIX BDefault Communication Ports . . . . . . . . . . . . . 1091

Management Center Ports . . . . . . . . . . . . . . . 1092Security Engine Ports . . . . . . . . . . . . . . . . . . . 1095

APPENDIX CPredefined Aliases . . . . . . . . . . . . . . . . . . . . . . 1099

Pre-Defined User Aliases . . . . . . . . . . . . . . . . 1100System Aliases . . . . . . . . . . . . . . . . . . . . . . . 1100

APPENDIX DRegular Expression Syntax. . . . . . . . . . . . . . . . 1103

Syntax for Stonesoft Regular Expressions . . . . 1104Special Character Sequences . . . . . . . . . . . . . 1106Pattern-Matching Modifiers . . . . . . . . . . . . . . . 1107Bit Variable Extensions . . . . . . . . . . . . . . . . . . 1108Variable Expression Evaluation . . . . . . . . . . . . 1110

Stream Operations. . . . . . . . . . . . . . . . . . . . 1112Other Expressions . . . . . . . . . . . . . . . . . . . . 1113

System Variables . . . . . . . . . . . . . . . . . . . . . . 1114Independent Subexpressions . . . . . . . . . . . . . 1115Para